Edit tour

Windows Analysis Report
StrCmp.7z

Overview

General Information

Sample name:	StrCmp.7z
Analysis ID:	1538458
MD5:	6b66077329b871ffb9acd8d380c32620
SHA1:	97a1fa8230100ab247555f09dafa76146f740163
SHA256:	948b664b1e308d8472f1f0f2b61db8bd9b42eca291db93dced4ed3db1de2c1af
Infos:

Detection

Score:	22
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

Sigma detected: Potential Persistence Via COM Hijacking From Suspicious Locations

Creates a process in suspended mode (likely to inject code)

Creates a window with clipboard capturing capabilities

Drops PE files

Queries the volume information (name, serial number etc) of a device

Classification

Process Tree

System is w10x64_ra

OpenWith.exe (PID: 2860 cmdline: C:\Windows\system32\OpenWith.exe -Embedding MD5: E4A834784FA08C17D47A1E72429C5109)

7z.exe (PID: 6512 cmdline: "C:\Program Files\7-Zip\7z.exe" "C:\Users\user\Desktop\StrCmp.7z" MD5: 9A1DD1D96481D61934DCC2D568971D06)

conhost.exe (PID: 6520 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

rundll32.exe (PID: 2036 cmdline: C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding MD5: EF3179D498793BF4234F708D3BE28633)

7z.exe (PID: 7060 cmdline: "C:\Program Files\7-Zip\7z.exe" "C:\Users\user\Desktop\StrCmp.7z" MD5: 9A1DD1D96481D61934DCC2D568971D06)

conhost.exe (PID: 7072 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

SystemSettingsBroker.exe (PID: 6384 cmdline: C:\Windows\System32\SystemSettingsBroker.exe -Embedding MD5: C0D134B5F3F4541B92342D62F2CA4DC9)

7zFM.exe (PID: 4008 cmdline: "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\user\Desktop\StrCmp.7z" MD5: 30AC0B832D75598FB3EC37B6F2A8C86A)

StrCmp.exe (PID: 3192 cmdline: "C:\Users\user\AppData\Local\Temp\7zO8AFC0119\StrCmp.exe" MD5: 916D7425A559AAA77F640710A65F9182)

StrCmp.exe (PID: 2292 cmdline: "C:\Users\user\Desktop\StrCmp.exe" MD5: 916D7425A559AAA77F640710A65F9182)

StrCmp.exe (PID: 5504 cmdline: "C:\Users\user\Desktop\StrCmp.exe" MD5: 916D7425A559AAA77F640710A65F9182)

StrCmp.exe (PID: 4668 cmdline: "C:\Users\user\Desktop\StrCmp.exe" MD5: 916D7425A559AAA77F640710A65F9182)

cleanup

Sigma Signatures

System Summary

Sigma detected: Potential Persistence Via COM Hijacking From Suspicious Locations

Source: Registry Key set

Author: Nasreddine Bencherchali (Nextron Systems): Data: Details: C:\Users\user\Desktop\StrCmp.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\StrCmp.exe, ProcessId: 4668, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4F7FA487-8CC1-493E-AF0A-E7A294474F25}\LocalServer32\(Default)

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: tse1.mm.bing.net

Source: C:\Program Files\7-Zip\7zFM.exe

Window created: window name: CLIPBRDWNDCLASS

Source: classification engine

Classification label: sus22.win7Z@14/3@1/0

Source: C:\Program Files\7-Zip\7zFM.exe

File created: C:\Users\user\Desktop\StrCmp.exe

Source: C:\Users\user\Desktop\StrCmp.exe	Mutant created: NULL
Source: C:\Windows\System32\OpenWith.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2860:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6520:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7072:120:WilError_03

Source: C:\Program Files\7-Zip\7zFM.exe

File created: C:\Users\user\AppData\Local\Temp\7zE8AF93B19

Source: C:\Windows\System32\OpenWith.exe

File read: C:\Users\desktop.ini

Source: C:\Windows\System32\OpenWith.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: unknown

Process created: C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

Source: unknown	Process created: C:\Windows\System32\OpenWith.exe C:\Windows\system32\OpenWith.exe -Embedding
Source: C:\Windows\System32\OpenWith.exe	Process created: C:\Program Files\7-Zip\7z.exe "C:\Program Files\7-Zip\7z.exe" "C:\Users\user\Desktop\StrCmp.7z"
Source: C:\Program Files\7-Zip\7z.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\OpenWith.exe	Process created: C:\Program Files\7-Zip\7z.exe "C:\Program Files\7-Zip\7z.exe" "C:\Users\user\Desktop\StrCmp.7z"
Source: unknown	Process created: C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
Source: unknown	Process created: C:\Program Files\7-Zip\7z.exe "C:\Program Files\7-Zip\7z.exe" "C:\Users\user\Desktop\StrCmp.7z"
Source: C:\Program Files\7-Zip\7z.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\SystemSettingsBroker.exe C:\Windows\System32\SystemSettingsBroker.exe -Embedding
Source: unknown	Process created: C:\Program Files\7-Zip\7zFM.exe "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\user\Desktop\StrCmp.7z"
Source: C:\Program Files\7-Zip\7zFM.exe	Process created: C:\Users\user\AppData\Local\Temp\7zO8AFC0119\StrCmp.exe "C:\Users\user\AppData\Local\Temp\7zO8AFC0119\StrCmp.exe"
Source: C:\Program Files\7-Zip\7zFM.exe	Process created: C:\Users\user\AppData\Local\Temp\7zO8AFC0119\StrCmp.exe "C:\Users\user\AppData\Local\Temp\7zO8AFC0119\StrCmp.exe"
Source: unknown	Process created: C:\Users\user\Desktop\StrCmp.exe "C:\Users\user\Desktop\StrCmp.exe"
Source: unknown	Process created: C:\Users\user\Desktop\StrCmp.exe "C:\Users\user\Desktop\StrCmp.exe"
Source: unknown	Process created: C:\Users\user\Desktop\StrCmp.exe "C:\Users\user\Desktop\StrCmp.exe"

Source: C:\Windows\System32\OpenWith.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: twinui.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dwmapi.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: pdh.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: actxprxy.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.ui.appdefaults.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.ui.immersive.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: uiautomationcore.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dui70.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: duser.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dwrite.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: bcp47mrm.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: uianimation.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d11.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dxgi.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d10warp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: resourcepolicyclient.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dxcore.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dcomp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: oleacc.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: edputil.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.ui.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windowmanagementapi.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: textinputframework.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: inputhost.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: coreuicomponents.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: coreuicomponents.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windowscodecs.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: thumbcache.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: apphelp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: appresolver.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: bcp47langs.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: slc.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: sppc.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: tiledatarepository.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: staterepository.core.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.staterepository.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: wtsapi32.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.staterepositorycore.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: mrmcorer.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: appxdeploymentclient.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: sxs.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: directmanipulation.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: textshaping.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: ninput.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: explorerframe.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dataexchange.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.ui.fileexplorer.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: structuredquery.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: atlthunk.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.fileexplorer.common.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.storage.search.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: linkinfo.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: twinapi.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: ntshrui.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: cscapi.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: winmm.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: ehstorshell.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: cscui.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: networkexplorer.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: pcacli.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: sfc_os.dll
Source: C:\Windows\System32\SystemSettingsBroker.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\SystemSettingsBroker.exe	Section loaded: systemsettings.datamodel.dll
Source: C:\Windows\System32\SystemSettingsBroker.exe	Section loaded: settingshandlers_sharedexperiences_rome.dll
Source: C:\Windows\System32\SystemSettingsBroker.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\SystemSettingsBroker.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\SystemSettingsBroker.exe	Section loaded: windows.devices.radios.dll
Source: C:\Windows\System32\SystemSettingsBroker.exe	Section loaded: cdp.dll
Source: C:\Windows\System32\SystemSettingsBroker.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\SystemSettingsBroker.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\SystemSettingsBroker.exe	Section loaded: dsreg.dll
Source: C:\Windows\System32\SystemSettingsBroker.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\SystemSettingsBroker.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\SystemSettingsBroker.exe	Section loaded: policymanager.dll
Source: C:\Program Files\7-Zip\7zFM.exe	Section loaded: uxtheme.dll
Source: C:\Program Files\7-Zip\7zFM.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files\7-Zip\7zFM.exe	Section loaded: textshaping.dll
Source: C:\Program Files\7-Zip\7zFM.exe	Section loaded: windows.storage.dll
Source: C:\Program Files\7-Zip\7zFM.exe	Section loaded: wldp.dll
Source: C:\Program Files\7-Zip\7zFM.exe	Section loaded: windowscodecs.dll
Source: C:\Program Files\7-Zip\7zFM.exe	Section loaded: profapi.dll
Source: C:\Program Files\7-Zip\7zFM.exe	Section loaded: propsys.dll
Source: C:\Program Files\7-Zip\7zFM.exe	Section loaded: explorerframe.dll
Source: C:\Program Files\7-Zip\7zFM.exe	Section loaded: cryptbase.dll
Source: C:\Program Files\7-Zip\7zFM.exe	Section loaded: thumbcache.dll
Source: C:\Program Files\7-Zip\7zFM.exe	Section loaded: textinputframework.dll
Source: C:\Program Files\7-Zip\7zFM.exe	Section loaded: coreuicomponents.dll
Source: C:\Program Files\7-Zip\7zFM.exe	Section loaded: coremessaging.dll
Source: C:\Program Files\7-Zip\7zFM.exe	Section loaded: ntmarta.dll
Source: C:\Program Files\7-Zip\7zFM.exe	Section loaded: wintypes.dll
Source: C:\Program Files\7-Zip\7zFM.exe	Section loaded: wintypes.dll
Source: C:\Program Files\7-Zip\7zFM.exe	Section loaded: wintypes.dll
Source: C:\Program Files\7-Zip\7zFM.exe	Section loaded: dataexchange.dll
Source: C:\Program Files\7-Zip\7zFM.exe	Section loaded: d3d11.dll
Source: C:\Program Files\7-Zip\7zFM.exe	Section loaded: dcomp.dll
Source: C:\Program Files\7-Zip\7zFM.exe	Section loaded: dxgi.dll
Source: C:\Program Files\7-Zip\7zFM.exe	Section loaded: twinapi.appcore.dll
Source: C:\Program Files\7-Zip\7zFM.exe	Section loaded: policymanager.dll
Source: C:\Program Files\7-Zip\7zFM.exe	Section loaded: msvcp110_win.dll
Source: C:\Program Files\7-Zip\7zFM.exe	Section loaded: edputil.dll
Source: C:\Program Files\7-Zip\7zFM.exe	Section loaded: urlmon.dll
Source: C:\Program Files\7-Zip\7zFM.exe	Section loaded: iertutil.dll
Source: C:\Program Files\7-Zip\7zFM.exe	Section loaded: srvcli.dll
Source: C:\Program Files\7-Zip\7zFM.exe	Section loaded: netutils.dll
Source: C:\Program Files\7-Zip\7zFM.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Program Files\7-Zip\7zFM.exe	Section loaded: sspicli.dll
Source: C:\Program Files\7-Zip\7zFM.exe	Section loaded: appresolver.dll
Source: C:\Program Files\7-Zip\7zFM.exe	Section loaded: bcp47langs.dll
Source: C:\Program Files\7-Zip\7zFM.exe	Section loaded: slc.dll
Source: C:\Program Files\7-Zip\7zFM.exe	Section loaded: userenv.dll
Source: C:\Program Files\7-Zip\7zFM.exe	Section loaded: sppc.dll
Source: C:\Program Files\7-Zip\7zFM.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Program Files\7-Zip\7zFM.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Program Files\7-Zip\7zFM.exe	Section loaded: apphelp.dll
Source: C:\Program Files\7-Zip\7zFM.exe	Section loaded: pcacli.dll
Source: C:\Program Files\7-Zip\7zFM.exe	Section loaded: mpr.dll
Source: C:\Program Files\7-Zip\7zFM.exe	Section loaded: sfc_os.dll
Source: C:\Users\user\AppData\Local\Temp\7zO8AFC0119\StrCmp.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\7zO8AFC0119\StrCmp.exe	Section loaded: msvbvm60.dll
Source: C:\Users\user\AppData\Local\Temp\7zO8AFC0119\StrCmp.exe	Section loaded: vb6zz.dll
Source: C:\Users\user\AppData\Local\Temp\7zO8AFC0119\StrCmp.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\7zO8AFC0119\StrCmp.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\7zO8AFC0119\StrCmp.exe	Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Local\Temp\7zO8AFC0119\StrCmp.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\AppData\Local\Temp\7zO8AFC0119\StrCmp.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Local\Temp\7zO8AFC0119\StrCmp.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\7zO8AFC0119\StrCmp.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\7zO8AFC0119\StrCmp.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\7zO8AFC0119\StrCmp.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\7zO8AFC0119\StrCmp.exe	Section loaded: wintypes.dll
Source: C:\Users\user\Desktop\StrCmp.exe	Section loaded: apphelp.dll
Source: C:\Users\user\Desktop\StrCmp.exe	Section loaded: msvbvm60.dll
Source: C:\Users\user\Desktop\StrCmp.exe	Section loaded: vb6zz.dll
Source: C:\Users\user\Desktop\StrCmp.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Desktop\StrCmp.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\Desktop\StrCmp.exe	Section loaded: textshaping.dll
Source: C:\Users\user\Desktop\StrCmp.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\Desktop\StrCmp.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\Desktop\StrCmp.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\Desktop\StrCmp.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\Desktop\StrCmp.exe	Section loaded: wintypes.dll
Source: C:\Users\user\Desktop\StrCmp.exe	Section loaded: wintypes.dll
Source: C:\Users\user\Desktop\StrCmp.exe	Section loaded: wintypes.dll
Source: C:\Users\user\Desktop\StrCmp.exe	Section loaded: msvbvm60.dll
Source: C:\Users\user\Desktop\StrCmp.exe	Section loaded: vb6zz.dll
Source: C:\Users\user\Desktop\StrCmp.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Desktop\StrCmp.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\Desktop\StrCmp.exe	Section loaded: textshaping.dll
Source: C:\Users\user\Desktop\StrCmp.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\Desktop\StrCmp.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\Desktop\StrCmp.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\Desktop\StrCmp.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\Desktop\StrCmp.exe	Section loaded: wintypes.dll
Source: C:\Users\user\Desktop\StrCmp.exe	Section loaded: wintypes.dll
Source: C:\Users\user\Desktop\StrCmp.exe	Section loaded: wintypes.dll
Source: C:\Users\user\Desktop\StrCmp.exe	Section loaded: msvbvm60.dll
Source: C:\Users\user\Desktop\StrCmp.exe	Section loaded: vb6zz.dll
Source: C:\Users\user\Desktop\StrCmp.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Desktop\StrCmp.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\Desktop\StrCmp.exe	Section loaded: sxs.dll

Source: C:\Windows\System32\OpenWith.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\InProcServer32

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\OpenWith.exe

Window detected: Number of UI elements: 13

Source: C:\Program Files\7-Zip\7zFM.exe

File created: C:\Users\user\AppData\Local\Temp\7zO8AFC0119\StrCmp.exe

Jump to dropped file

Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\SystemSettingsBroker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\7-Zip\7zFM.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zO8AFC0119\StrCmp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\StrCmp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\StrCmp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\StrCmp.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Program Files\7-Zip\7zFM.exe

Process information queried: ProcessInformation

Source: C:\Windows\System32\OpenWith.exe

Process created: C:\Program Files\7-Zip\7z.exe "C:\Program Files\7-Zip\7z.exe" "C:\Users\user\Desktop\StrCmp.7z"

Source: C:\Windows\System32\OpenWith.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
Source: C:\Windows\System32\OpenWith.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation
Source: C:\Windows\System32\OpenWith.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation
Source: C:\Windows\System32\OpenWith.exe	Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation
Source: C:\Windows\System32\OpenWith.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation
Source: C:\Windows\System32\OpenWith.exe	Queries volume information: C:\Windows\Fonts\segmdl2.ttf VolumeInformation
Source: C:\Windows\System32\OpenWith.exe	Queries volume information: C:\Windows\Fonts\segmdl2.ttf VolumeInformation

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	11 Process Injection	1 Masquerading	OS Credential Dumping	1 Process Discovery	Remote Services	1 Clipboard Data	1 Non-Application Layer Protocol	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Rundll32	LSASS Memory	1 File and Directory Discovery	Remote Desktop Protocol	Data from Removable Media	1 Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	11 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\7zO8AFC0119\StrCmp.exe	0%	ReversingLabs

Name	IP	Active	Malicious	Antivirus Detection	Reputation
ax-0001.ax-msedge.net	150.171.27.10	true	false		unknown
tse1.mm.bing.net	unknown	unknown	false		unknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1538458
Start date and time:	2024-10-21 10:39:01 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	42
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	EGA enabled
Analysis Mode:	stream
Analysis stop reason:	Timeout
Sample name:	StrCmp.7z
Detection:	SUS
Classification:	sus22.win7Z@14/3@1/0

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 2.23.209.136, 2.23.209.186, 2.23.209.182, 2.23.209.192, 2.23.209.183, 2.23.209.188, 2.23.209.189, 2.23.209.133, 2.23.209.131
Excluded domains from analysis (whitelisted): ctldl.windowsupdate.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: StrCmp.7z

Created / dropped Files

C:\Users\user\AppData\Local\Temp\7zO8AFC0119\StrCmp.exe

Download File

Process:	C:\Program Files\7-Zip\7zFM.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	48896
Entropy (8bit):	5.121181282636362
Encrypted:	false
SSDEEP:
MD5:	916D7425A559AAA77F640710A65F9182
SHA1:	23D25052AEF9BA71DDEEF7CFA86EE43D5BA1EA13
SHA-256:	118DE01FB498E81EAB4ADE980A621AF43B52265A9FCBAE5DEDC492CDF8889F35
SHA-512:	D0C260A0347441B4E263DA52FEB43412DF217C207EBA594D59C10EE36E47E1A098B82CE633851C16096B22F4A4A6F8282BDD23D149E337439FE63A77EC7343BC
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........K...........6......5.....t5.....Rich.*..................PE..L......U.................P...0...............`....@.........................................................................4L..(....p..\................/..................................................0... ....... ............................text....A.......P.................. ..`.data...,....`.......`..............@....rsrc...\....p... ...p..............@..@l.[J............MSVBVM60.DLL............................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\7zO8AFC0119\StrCmp.exe:Zone.Identifier

Download File

Process:	C:\Program Files\7-Zip\7zFM.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Reputation:	unknown
Preview:	[ZoneTransfer]....ZoneId=0

\Device\ConDrv

Download File

Process:	C:\Program Files\7-Zip\7z.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	154
Entropy (8bit):	5.18254149019846
Encrypted:	false
SSDEEP:
MD5:	2E06763521536B1A3CEE8CA8397DBAA2
SHA1:	0E02238149380F1DC4262185AEB4284502ED92E5
SHA-256:	CFBCF1CDAA25F009048EE658244A567FB43E7B8CF5C8A81238C388D810DA57D1
SHA-512:	9DF2FE0C12E1F7B8261087E2854C07A4C070FFDED57E91ECF6E9076D868B7B37378FFFF75BD7D233CD1241CD21B1B37975F1153A5FE21F97201283A9E806D549
Malicious:	false
Reputation:	unknown
Preview:	..7-Zip 23.01 (x64) : Copyright (c) 1999-2023 Igor Pavlov : 2023-06-20........Command Line Error:..Unsupported command:..C:\Users\user\Desktop\StrCmp.7z..

Static File Info

General

File type:	7-zip archive data, version 0.4
Entropy (8bit):	7.987160183715531
TrID:	7-Zip compressed archive (6006/1) 100.00%
File name:	StrCmp.7z
File size:	16'494 bytes
MD5:	6b66077329b871ffb9acd8d380c32620
SHA1:	97a1fa8230100ab247555f09dafa76146f740163
SHA256:	948b664b1e308d8472f1f0f2b61db8bd9b42eca291db93dced4ed3db1de2c1af
SHA512:	49dd8d4c12de77708dd17c3b756f05f0a640a76e59af1484e3c73ec89bec4d9b363b20fd73f80fe3b05006e65d3279d6784c7b85978b3cf65a17dc7f10fb8d85
SSDEEP:	384:JG8PGy+sPjy/Tg9HG7dVJKMGYeW/IhVdD8qjsshtKaXDL369XesN8qPCJNp+:NeLs7KTg96BoWgV933KYL36VesxPCJN0
TLSH:	9972D0E0B7E45069E79B38E6B14F94C17F325D852BCE70A16CAC174666CE47D803B82B
File Content Preview:	7z..'........?......r........!.....?.].&..p.........../D.N.....r,.`......\|.M.\.....5.......p...X.vU5.V.&\...5i.F..........o}lU`.= ....S.NVM.}.9u9...\.^..@..s..1]\..........#...S.."...Z<P.jDK.q.!....c.t...... .^.._..,.._....Kg.V.....>f.....U,..J......\|..

File Icon


Icon Hash:	72e2a2a292a2a2b2

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: `rundll32.exe {DLLname, DLLfunction}` ).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report StrCmp.7z

Overview

General Information

Detection

Signatures

Classification

Process Tree

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

General Information

Warnings

Created / dropped Files

C:\Users\user\AppData\Local\Temp\7zO8AFC0119\StrCmp.exe

C:\Users\user\AppData\Local\Temp\7zO8AFC0119\StrCmp.exe:Zone.Identifier

\Device\ConDrv

Static File Info

General

File Icon

Windows Analysis Report
StrCmp.7z