Windows Analysis Report
Po110-11#U3000Order_System Electro %100% S51105P-E01 #Uff08#U6700#U65b0#Uff09jpg .exe

Overview

General Information

Sample name:	Po110-11#U3000Order_System Electro %100% S51105P-E01 #Uff08#U6700#U65b0#Uff09jpg .exe renamed because original name is a hash value
Original sample name:	Po110-11Order_System Electro %100% S51105P-E01 jpg .exe
Analysis ID:	1538399
MD5:	af04642d86b2e7e785a034d8fd4510bd
SHA1:	82b4b45acdec6c64853c5d2c0df36c23026c2e73
SHA256:	cb46f693cb4263f0c8832e56fe42d8dd0e1a5e8c70b102e20322a65b428df9ce
Infos:

Detection

Score:	60
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

AI detected suspicious sample

Initial sample is a PE file and has a suspicious name

Machine Learning detection for sample

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if the current process is being debugged

Creates processes with suspicious names

One or more processes crash

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Classification

Signatures

AV Detection

Multi AV Scanner detection for submitted file

Source: Po110-11#U3000Order_System Electro %100% S51105P-E01 #Uff08#U6700#U65b0#Uff09jpg .exe	ReversingLabs: Detection: 26%
Source: Po110-11#U3000Order_System Electro %100% S51105P-E01 #Uff08#U6700#U65b0#Uff09jpg .exe	Virustotal: Detection: 30%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 82.7% probability

Machine Learning detection for sample

Source: Po110-11#U3000Order_System Electro %100% S51105P-E01 #Uff08#U6700#U65b0#Uff09jpg .exe

Joe Sandbox ML: detected

Uses 32bit PE files

Source: Po110-11#U3000Order_System Electro %100% S51105P-E01 #Uff08#U6700#U65b0#Uff09jpg .exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: Po110-11#U3000Order_System Electro %100% S51105P-E01 #Uff08#U6700#U65b0#Uff09jpg .exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: mscorlib.pdb source: WERC72A.tmp.dmp.3.dr
Source:	Binary string: mscorlib.ni.pdb source: WERC72A.tmp.dmp.3.dr
Source:	Binary string: uLBJ.pdb source: Po110-11#U3000Order_System Electro %100% S51105P-E01 #Uff08#U6700#U65b0#Uff09jpg .exe
Source:	Binary string: mscorlib.ni.pdbRSDS source: WERC72A.tmp.dmp.3.dr
Source:	Binary string: mscorlib.pdbP source: WERC72A.tmp.dmp.3.dr
Source:	Binary string: uLBJ.pdbSHA256 source: Po110-11#U3000Order_System Electro %100% S51105P-E01 #Uff08#U6700#U65b0#Uff09jpg .exe

Source: Amcache.hve.3.dr

String found in binary or memory: http://upx.sf.net

System Summary

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: Po110-11#U3000Order_System Electro %100% S51105P-E01 #Uff08#U6700#U65b0#Uff09jpg .exe

One or more processes crash

Source: C:\Users\user\Desktop\Po110-11#U3000Order_System Electro %100% S51105P-E01 #Uff08#U6700#U65b0#Uff09jpg .exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7312 -s 780

Sample file is different than original file name gathered from version info

Source: Po110-11#U3000Order_System Electro %100% S51105P-E01 #Uff08#U6700#U65b0#Uff09jpg .exe, 00000000.00000002.2185630326.000000000103E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs Po110-11#U3000Order_System Electro %100% S51105P-E01 #Uff08#U6700#U65b0#Uff09jpg .exe
Source: Po110-11#U3000Order_System Electro %100% S51105P-E01 #Uff08#U6700#U65b0#Uff09jpg .exe, 00000000.00000000.1665319160.0000000000A2E000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameuLBJ.exe" vs Po110-11#U3000Order_System Electro %100% S51105P-E01 #Uff08#U6700#U65b0#Uff09jpg .exe
Source: Po110-11#U3000Order_System Electro %100% S51105P-E01 #Uff08#U6700#U65b0#Uff09jpg .exe	Binary or memory string: OriginalFilenameuLBJ.exe" vs Po110-11#U3000Order_System Electro %100% S51105P-E01 #Uff08#U6700#U65b0#Uff09jpg .exe

Uses 32bit PE files

Source: Po110-11#U3000Order_System Electro %100% S51105P-E01 #Uff08#U6700#U65b0#Uff09jpg .exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: Po110-11#U3000Order_System Electro %100% S51105P-E01 #Uff08#U6700#U65b0#Uff09jpg .exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: mal60.winEXE@2/5@0/0

Source: C:\Users\user\Desktop\Po110-11#U3000Order_System Electro %100% S51105P-E01 #Uff08#U6700#U65b0#Uff09jpg .exe	Mutant created: NULL
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7312

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\964211f6-b64c-47db-bbc7-177066a7ffb3

Jump to behavior

Source: Po110-11#U3000Order_System Electro %100% S51105P-E01 #Uff08#U6700#U65b0#Uff09jpg .exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: Po110-11#U3000Order_System Electro %100% S51105P-E01 #Uff08#U6700#U65b0#Uff09jpg .exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.79%

Source: C:\Users\user\Desktop\Po110-11#U3000Order_System Electro %100% S51105P-E01 #Uff08#U6700#U65b0#Uff09jpg .exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Po110-11#U3000Order_System Electro %100% S51105P-E01 #Uff08#U6700#U65b0#Uff09jpg .exe	ReversingLabs: Detection: 26%
Source: Po110-11#U3000Order_System Electro %100% S51105P-E01 #Uff08#U6700#U65b0#Uff09jpg .exe	Virustotal: Detection: 30%

Source: unknown	Process created: C:\Users\user\Desktop\Po110-11#U3000Order_System Electro %100% S51105P-E01 #Uff08#U6700#U65b0#Uff09jpg .exe "C:\Users\user\Desktop\Po110-11#U3000Order_System Electro %100% S51105P-E01 #Uff08#U6700#U65b0#Uff09jpg .exe"
Source: C:\Users\user\Desktop\Po110-11#U3000Order_System Electro %100% S51105P-E01 #Uff08#U6700#U65b0#Uff09jpg .exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7312 -s 780

Source: C:\Users\user\Desktop\Po110-11#U3000Order_System Electro %100% S51105P-E01 #Uff08#U6700#U65b0#Uff09jpg .exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\Po110-11#U3000Order_System Electro %100% S51105P-E01 #Uff08#U6700#U65b0#Uff09jpg .exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Po110-11#U3000Order_System Electro %100% S51105P-E01 #Uff08#U6700#U65b0#Uff09jpg .exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Po110-11#U3000Order_System Electro %100% S51105P-E01 #Uff08#U6700#U65b0#Uff09jpg .exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Po110-11#U3000Order_System Electro %100% S51105P-E01 #Uff08#U6700#U65b0#Uff09jpg .exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Po110-11#U3000Order_System Electro %100% S51105P-E01 #Uff08#U6700#U65b0#Uff09jpg .exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Po110-11#U3000Order_System Electro %100% S51105P-E01 #Uff08#U6700#U65b0#Uff09jpg .exe	Section loaded: uxtheme.dll	Jump to behavior

Source: C:\Users\user\Desktop\Po110-11#U3000Order_System Electro %100% S51105P-E01 #Uff08#U6700#U65b0#Uff09jpg .exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: Po110-11#U3000Order_System Electro %100% S51105P-E01 #Uff08#U6700#U65b0#Uff09jpg .exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: Po110-11#U3000Order_System Electro %100% S51105P-E01 #Uff08#U6700#U65b0#Uff09jpg .exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: Po110-11#U3000Order_System Electro %100% S51105P-E01 #Uff08#U6700#U65b0#Uff09jpg .exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: mscorlib.pdb source: WERC72A.tmp.dmp.3.dr
Source:	Binary string: mscorlib.ni.pdb source: WERC72A.tmp.dmp.3.dr
Source:	Binary string: uLBJ.pdb source: Po110-11#U3000Order_System Electro %100% S51105P-E01 #Uff08#U6700#U65b0#Uff09jpg .exe
Source:	Binary string: mscorlib.ni.pdbRSDS source: WERC72A.tmp.dmp.3.dr
Source:	Binary string: mscorlib.pdbP source: WERC72A.tmp.dmp.3.dr
Source:	Binary string: uLBJ.pdbSHA256 source: Po110-11#U3000Order_System Electro %100% S51105P-E01 #Uff08#U6700#U65b0#Uff09jpg .exe

Source: Po110-11#U3000Order_System Electro %100% S51105P-E01 #Uff08#U6700#U65b0#Uff09jpg .exe

Static PE information: section name: .text entropy: 7.968596594085418

Creates processes with suspicious names

Source: C:\Users\user\Desktop\Po110-11#U3000Order_System Electro %100% S51105P-E01 #Uff08#U6700#U65b0#Uff09jpg .exe

File created: \po110-11#u3000order_system electro %100% s51105p-e01 #uff08#u6700#u65b0#uff09jpg .exe

Source: C:\Users\user\Desktop\Po110-11#U3000Order_System Electro %100% S51105P-E01 #Uff08#U6700#U65b0#Uff09jpg .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Po110-11#U3000Order_System Electro %100% S51105P-E01 #Uff08#U6700#U65b0#Uff09jpg .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Po110-11#U3000Order_System Electro %100% S51105P-E01 #Uff08#U6700#U65b0#Uff09jpg .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Po110-11#U3000Order_System Electro %100% S51105P-E01 #Uff08#U6700#U65b0#Uff09jpg .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Po110-11#U3000Order_System Electro %100% S51105P-E01 #Uff08#U6700#U65b0#Uff09jpg .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Po110-11#U3000Order_System Electro %100% S51105P-E01 #Uff08#U6700#U65b0#Uff09jpg .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Po110-11#U3000Order_System Electro %100% S51105P-E01 #Uff08#U6700#U65b0#Uff09jpg .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Po110-11#U3000Order_System Electro %100% S51105P-E01 #Uff08#U6700#U65b0#Uff09jpg .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Po110-11#U3000Order_System Electro %100% S51105P-E01 #Uff08#U6700#U65b0#Uff09jpg .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Allocates memory with a write watch (potentially for evading sandboxes)

Source: C:\Users\user\Desktop\Po110-11#U3000Order_System Electro %100% S51105P-E01 #Uff08#U6700#U65b0#Uff09jpg .exe	Memory allocated: 1280000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Po110-11#U3000Order_System Electro %100% S51105P-E01 #Uff08#U6700#U65b0#Uff09jpg .exe	Memory allocated: 2E20000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Po110-11#U3000Order_System Electro %100% S51105P-E01 #Uff08#U6700#U65b0#Uff09jpg .exe	Memory allocated: 13F0000 memory reserve \| memory write watch	Jump to behavior

Source: Amcache.hve.3.dr	Binary or memory string: VMware
Source: Amcache.hve.3.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.3.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.3.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.3.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.3.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.3.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.3.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.3.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.3.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.3.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.3.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.3.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.3.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.3.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.3.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.3.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.3.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.3.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.3.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.3.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.3.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.3.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.3.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.3.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.3.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.3.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.3.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.3.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Checks if the current process is being debugged

Source: C:\Users\user\Desktop\Po110-11#U3000Order_System Electro %100% S51105P-E01 #Uff08#U6700#U65b0#Uff09jpg .exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\Po110-11#U3000Order_System Electro %100% S51105P-E01 #Uff08#U6700#U65b0#Uff09jpg .exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\Po110-11#U3000Order_System Electro %100% S51105P-E01 #Uff08#U6700#U65b0#Uff09jpg .exe

Memory allocated: page read and write | page guard

Jump to behavior

Queries the volume information (name, serial number etc) of a device

Source: C:\Users\user\Desktop\Po110-11#U3000Order_System Electro %100% S51105P-E01 #Uff08#U6700#U65b0#Uff09jpg .exe

Queries volume information: C:\Users\user\Desktop\Po110-11#U3000Order_System Electro %100% S51105P-E01 #Uff08#U6700#U65b0#Uff09jpg .exe VolumeInformation

Jump to behavior

AV process strings found (often used to terminate AV products)

Source: Amcache.hve.3.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.3.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.3.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.3.dr	Binary or memory string: MsMpEng.exe

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

⊘No contacted IP infos

ID:	1538399
Product:	CloudBasic
Start time:	07:35:00
Start date:	21.10.2024
Sample:	Po110-11#U3000Order_System Electro %100% S51105P-E01 #Uff08#U6700#U65b0#Uff09jpg .exe
Cookbook:	default.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	af04642d86b2e7e785a034d8fd4510bd
SHA1:	82b4b45acdec6c64853c5d2c0df36c23026c2e73
SHA256:	cb46f693cb4263f0c8832e56fe42d8dd0e1a5e8c70b102e20322a65b428df9ce
Filetype:	Win32 Executable (generic) Net Framework (10011505/4) 49.79%

Name	Type	MD5	SHA1	SHA256
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Po110-11#U3000Or_74ab44bf1d935e2ca69145489c2f99ce846e82_fcc1023b_eb5b3316-d1e5-429a-abff-e47306e8f50f\Report.wer	Unicode text, UTF-16, little-endian text, with CRLF line terminators	5AA0C5E2803759C83B0E1DB3E149104A	5A7E199A5F28E74BB1D24CF34C5209CA5D89A8EE	EB59E1CFC64C653F3FBCB57DE9BDBA26AFC41F10FDDAAB8D7ECA839E751C8152
C:\ProgramData\Microsoft\Windows\WER\Temp\WERC72A.tmp.dmp	Mini DuMP crash report, 15 streams, Mon Oct 21 05:35:51 2024, 0x1205a4 type	7CDDFA8CB0202B2F07AF51E2B457162F	22B487DB7E823A72FE22D858E48D0D70707B3A5C	FEB1692A3BF981E8FD32FEB4CE736558C349E4AF0A43977047CED13797870275
C:\ProgramData\Microsoft\Windows\WER\Temp\WERC825.tmp.WERInternalMetadata.xml	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators	9DFB7CF9D344633A71FFEAB5B5A98546	8505C32E9CE8EC39018125AB12BF7BC0A4ADB7F0	FB3437228A8CF8A87ECED4EC6F4A5755D80E2247773C842FAB2CEC657581D52D
C:\ProgramData\Microsoft\Windows\WER\Temp\WERC855.tmp.xml	XML 1.0 document, ASCII text, with CRLF line terminators	11B72A80EC1B0149FF5F68BE729A384A	36810A7065DBC41054AF985594FE89938BB925C6	083B6E71CAFD3897613C9D5F52D5C8DFC6E9260C7E2E4B523E7B8905FB75E1F7
C:\Windows\appcompat\Programs\Amcache.hve	MS Windows registry file, NT/2000 or above	66B3917BC47B6BE5C5594322CF72DBDF	75078DA47856269382802EFE54D1CA3F67123A45	C4778E377B8762BD2D6AC63F115A557E2486D27A7113222251C87DB311F92B24

Windows Analysis Report
Po110-11#U3000Order_System Electro %100% S51105P-E01 #Uff08#U6700#U65b0#Uff09jpg .exe

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Screenshots

Behavior Graph

Network Map

Windows Analysis Report Po110-11#U3000Order_System Electro %100% S51105P-E01 #Uff08#U6700#U65b0#Uff09jpg .exe

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Screenshots

Behavior Graph

Network Map

Windows Analysis Report
Po110-11#U3000Order_System Electro %100% S51105P-E01 #Uff08#U6700#U65b0#Uff09jpg .exe