Edit tour

Windows Analysis Report
PO F1298-24 Fabric Order.exe

Overview

General Information

Sample name:	PO F1298-24 Fabric Order.exe
Analysis ID:	1541083
MD5:	2ce31411b27c3fcdf0bfb5e56a784584
SHA1:	5afa11934390d52249dc138853922e64dcfaa528
SHA256:	473c91688591c4649ea77e07c95d77ecb87fbb22e060a9e1f4540af522d59ff5
Tags:	AgentTeslaexeuser-TeamDreier
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected AgentTesla

Yara detected AntiVM3

Yara detected UAC Bypass using CMSTP

.NET source code references suspicious native API functions

AI detected suspicious sample

Adds a directory exclusion to Windows Defender

Contains functionality to log keystrokes (.Net Source)

Disables UAC (registry)

Initial sample is a PE file and has a suspicious name

Injects a PE file into a foreign processes

Loading BitLocker PowerShell Module

Machine Learning detection for sample

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

PE file does not import any functions

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Powershell Defender Exclusion

Sigma detected: Suspicious Outbound SMTP Connections

Uses SMTP (mail sending)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

PO F1298-24 Fabric Order.exe (PID: 2452 cmdline: "C:\Users\user\Desktop\PO F1298-24 Fabric Order.exe" MD5: 2CE31411B27C3FCDF0BFB5E56A784584)

powershell.exe (PID: 1200 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\PO F1298-24 Fabric Order.exe" -Force MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 6592 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

RegAsm.exe (PID: 4708 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

RegAsm.exe (PID: 5512 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

WerFault.exe (PID: 6164 cmdline: C:\Windows\system32\WerFault.exe -u -p 2452 -s 1604 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://0xmrmagnezi.github.io/malware%20analysis/AgentTesla/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Port": "25", "Host": "mail.iaa-airferight.com", "Username": "admin@iaa-airferight.com", "Password": "manlikeyou88"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000004.00000002.3351887667.0000000002FBE000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.2330596455.000001855C594000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000004.00000002.3345081837.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000004.00000002.3345081837.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.2331410579.000001856CE42000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2331410579.000001856CE42000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000004.00000002.3351887667.0000000002F71000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000004.00000002.3351887667.0000000002F71000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: PO F1298-24 Fabric Order.exe PID: 2452	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: PO F1298-24 Fabric Order.exe PID: 2452	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: PO F1298-24 Fabric Order.exe PID: 2452	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: PO F1298-24 Fabric Order.exe PID: 2452	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
Process Memory Space: RegAsm.exe PID: 4708	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RegAsm.exe PID: 4708	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 9 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
4.2.RegAsm.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
4.2.RegAsm.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
4.2.RegAsm.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x334cb:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3353d:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x335c7:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33659:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x336c3:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33735:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x337cb:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3385b:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.PO F1298-24 Fabric Order.exe.1856ce7d3c0.4.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.PO F1298-24 Fabric Order.exe.1856ce7d3c0.4.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.PO F1298-24 Fabric Order.exe.1856ce7d3c0.4.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x316cb:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3173d:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x317c7:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x31859:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x318c3:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x31935:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x319cb:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x31a5b:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.PO F1298-24 Fabric Order.exe.1856ceb7e08.3.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.PO F1298-24 Fabric Order.exe.1856ceb7e08.3.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.PO F1298-24 Fabric Order.exe.1856ceb7e08.3.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x334cb:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3353d:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x335c7:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33659:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x336c3:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33735:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x337cb:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3385b:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.PO F1298-24 Fabric Order.exe.1856ceb7e08.3.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.PO F1298-24 Fabric Order.exe.1856ceb7e08.3.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.PO F1298-24 Fabric Order.exe.1856ceb7e08.3.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x316cb:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3173d:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x317c7:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x31859:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x318c3:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x31935:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x319cb:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x31a5b:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.PO F1298-24 Fabric Order.exe.1856ce7d3c0.4.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.PO F1298-24 Fabric Order.exe.1856ce7d3c0.4.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.PO F1298-24 Fabric Order.exe.1856ce7d3c0.4.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x334cb:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x6df13:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3353d:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x6df85:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x335c7:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x6e00f:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33659:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x6e0a1:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x336c3:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x6e10b:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33735:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x6e17d:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x337cb:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x6e213:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3385b:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548 0x6e2a3:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
Click to see the 10 entries

Sigma Signatures

System Summary

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\PO F1298-24 Fabric Order.exe" -Force, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\PO F1298-24 Fabric Order.exe" -Force, CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\PO F1298-24 Fabric Order.exe", ParentImage: C:\Users\user\Desktop\PO F1298-24 Fabric Order.exe, ParentProcessId: 2452, ParentProcessName: PO F1298-24 Fabric Order.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\PO F1298-24 Fabric Order.exe" -Force, ProcessId: 1200, ProcessName: powershell.exe

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DestinationIp: 46.175.148.58, DestinationIsIpv6: false, DestinationPort: 25, EventID: 3, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe, Initiated: true, ProcessId: 4708, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49704

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\PO F1298-24 Fabric Order.exe" -Force, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\PO F1298-24 Fabric Order.exe" -Force, CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\PO F1298-24 Fabric Order.exe", ParentImage: C:\Users\user\Desktop\PO F1298-24 Fabric Order.exe, ParentProcessId: 2452, ParentProcessName: PO F1298-24 Fabric Order.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\PO F1298-24 Fabric Order.exe" -Force, ProcessId: 1200, ProcessName: powershell.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 0.2.PO F1298-24 Fabric Order.exe.1856ceb7e08.3.raw.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Port": "25", "Host": "mail.iaa-airferight.com", "Username": "admin@iaa-airferight.com", "Password": "manlikeyou88"}

Multi AV Scanner detection for submitted file

Source: PO F1298-24 Fabric Order.exe

ReversingLabs: Detection: 52%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: PO F1298-24 Fabric Order.exe

Joe Sandbox ML: detected

Exploits

Yara detected UAC Bypass using CMSTP

Source: Yara match	File source: 00000000.00000002.2330596455.000001855C594000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: PO F1298-24 Fabric Order.exe PID: 2452, type: MEMORYSTR

Source: PO F1298-24 Fabric Order.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: Microsoft.VisualBasic.ni.pdb source: WER6BA7.tmp.dmp.8.dr
Source:	Binary string: System.ni.pdbRSDS source: WER6BA7.tmp.dmp.8.dr
Source:	Binary string: System.Windows.Forms.ni.pdb source: WER6BA7.tmp.dmp.8.dr
Source:	Binary string: Microsoft.VisualBasic.pdb0 source: WER6BA7.tmp.dmp.8.dr
Source:	Binary string: System.Drawing.ni.pdb source: WER6BA7.tmp.dmp.8.dr
Source:	Binary string: mscorlib.ni.pdbRSDS7^3l source: WER6BA7.tmp.dmp.8.dr
Source:	Binary string: Microsoft.VisualBasic.ni.pdbRSDS& source: WER6BA7.tmp.dmp.8.dr
Source:	Binary string: System.Drawing.ni.pdbRSDS source: WER6BA7.tmp.dmp.8.dr
Source:	Binary string: System.pdb source: WER6BA7.tmp.dmp.8.dr
Source:	Binary string: System.Core.ni.pdb source: WER6BA7.tmp.dmp.8.dr
Source:	Binary string: Microsoft.VisualBasic.pdb source: WER6BA7.tmp.dmp.8.dr
Source:	Binary string: System.Windows.Forms.pdb source: WER6BA7.tmp.dmp.8.dr
Source:	Binary string: mscorlib.pdb source: WER6BA7.tmp.dmp.8.dr
Source:	Binary string: System.Drawing.pdbq1 source: WER6BA7.tmp.dmp.8.dr
Source:	Binary string: System.Management.ni.pdbRSDSJ< source: WER6BA7.tmp.dmp.8.dr
Source:	Binary string: System.Windows.Forms.ni.pdbRSDS source: WER6BA7.tmp.dmp.8.dr
Source:	Binary string: System.Drawing.pdb source: WER6BA7.tmp.dmp.8.dr
Source:	Binary string: System.Management.pdb source: WER6BA7.tmp.dmp.8.dr
Source:	Binary string: mscorlib.ni.pdb source: WER6BA7.tmp.dmp.8.dr
Source:	Binary string: System.Management.ni.pdb source: WER6BA7.tmp.dmp.8.dr
Source:	Binary string: System.Core.pdb source: WER6BA7.tmp.dmp.8.dr
Source:	Binary string: System.Core.pdb& source: WER6BA7.tmp.dmp.8.dr
Source:	Binary string: System.ni.pdb source: WER6BA7.tmp.dmp.8.dr
Source:	Binary string: System.Core.ni.pdbRSDS source: WER6BA7.tmp.dmp.8.dr

Source: Joe Sandbox View

IP Address: 46.175.148.58 46.175.148.58

Source: Joe Sandbox View

ASN Name: ASLAGIDKOM-NETUA ASLAGIDKOM-NETUA

Source: global traffic

TCP traffic: 192.168.2.5:49704 -> 46.175.148.58:25

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: mail.iaa-airferight.com

Source: RegAsm.exe, 00000004.00000002.3351887667.0000000002FC6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mail.iaa-airferight.com
Source: Amcache.hve.8.dr	String found in binary or memory: http://upx.sf.net
Source: PO F1298-24 Fabric Order.exe, 00000000.00000002.2331410579.000001856CE42000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.3345081837.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: 0.2.PO F1298-24 Fabric Order.exe.1856ceb7e08.3.raw.unpack, SKTzxzsJw.cs	.Net Code: sf6jJs8S
Source: 0.2.PO F1298-24 Fabric Order.exe.1856ce7d3c0.4.raw.unpack, SKTzxzsJw.cs	.Net Code: sf6jJs8S

System Summary

Malicious sample detected (through community Yara rule)

Source: 4.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.PO F1298-24 Fabric Order.exe.1856ce7d3c0.4.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.PO F1298-24 Fabric Order.exe.1856ceb7e08.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.PO F1298-24 Fabric Order.exe.1856ceb7e08.3.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.PO F1298-24 Fabric Order.exe.1856ce7d3c0.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: PO F1298-24 Fabric Order.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_02DF9378	4_2_02DF9378
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_02DF4A98	4_2_02DF4A98
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_02DF9B38	4_2_02DF9B38
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_02DF3E80	4_2_02DF3E80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_02DFCDB0	4_2_02DFCDB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_02DF41C8	4_2_02DF41C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_064656E0	4_2_064656E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_06463F50	4_2_06463F50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_0646BD08	4_2_0646BD08
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_0646DD18	4_2_0646DD18
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_06469AE8	4_2_06469AE8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_06462B00	4_2_06462B00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_06468BA0	4_2_06468BA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_06460040	4_2_06460040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_06463250	4_2_06463250
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_06465000	4_2_06465000

Source: C:\Users\user\Desktop\PO F1298-24 Fabric Order.exe

Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 2452 -s 1604

Source: PO F1298-24 Fabric Order.exe

Static PE information: No import functions for PE file found

Source: PO F1298-24 Fabric Order.exe, 00000000.00000002.2331410579.000001856C267000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameNewStb.exe4 vs PO F1298-24 Fabric Order.exe
Source: PO F1298-24 Fabric Order.exe, 00000000.00000000.2093564112.000001855A406000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameNewStb.exe4 vs PO F1298-24 Fabric Order.exe
Source: PO F1298-24 Fabric Order.exe, 00000000.00000002.2331410579.000001856CE42000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename7e5bb978-3a35-43a5-95fe-dd44d69d6a5a.exe4 vs PO F1298-24 Fabric Order.exe
Source: PO F1298-24 Fabric Order.exe	Binary or memory string: OriginalFilenameNewStb.exe4 vs PO F1298-24 Fabric Order.exe

Source: 4.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.PO F1298-24 Fabric Order.exe.1856ce7d3c0.4.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.PO F1298-24 Fabric Order.exe.1856ceb7e08.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.PO F1298-24 Fabric Order.exe.1856ceb7e08.3.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.PO F1298-24 Fabric Order.exe.1856ce7d3c0.4.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers

Source: PO F1298-24 Fabric Order.exe, .cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 0.2.PO F1298-24 Fabric Order.exe.1856ceb7e08.3.raw.unpack, 4JJG6X.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.PO F1298-24 Fabric Order.exe.1856ceb7e08.3.raw.unpack, 4JJG6X.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.PO F1298-24 Fabric Order.exe.1856ceb7e08.3.raw.unpack, 8C78isHTVco.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.PO F1298-24 Fabric Order.exe.1856ceb7e08.3.raw.unpack, 8C78isHTVco.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.PO F1298-24 Fabric Order.exe.1856ceb7e08.3.raw.unpack, 8C78isHTVco.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.PO F1298-24 Fabric Order.exe.1856ceb7e08.3.raw.unpack, 8C78isHTVco.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.PO F1298-24 Fabric Order.exe.1856ceb7e08.3.raw.unpack, CqSP68Ir.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.PO F1298-24 Fabric Order.exe.1856ceb7e08.3.raw.unpack, CqSP68Ir.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'

Source: classification engine

Classification label: mal100.troj.spyw.expl.evad.winEXE@9/10@1/1

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6592:120:WilError_03
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Mutant created: NULL
Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess2452

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_au4vegts.fju.ps1

Jump to behavior

Source: PO F1298-24 Fabric Order.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\PO F1298-24 Fabric Order.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\PO F1298-24 Fabric Order.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: PO F1298-24 Fabric Order.exe

ReversingLabs: Detection: 52%

Source: C:\Users\user\Desktop\PO F1298-24 Fabric Order.exe

File read: C:\Users\user\Desktop\PO F1298-24 Fabric Order.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\PO F1298-24 Fabric Order.exe "C:\Users\user\Desktop\PO F1298-24 Fabric Order.exe"
Source: C:\Users\user\Desktop\PO F1298-24 Fabric Order.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\PO F1298-24 Fabric Order.exe" -Force
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\PO F1298-24 Fabric Order.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"
Source: C:\Users\user\Desktop\PO F1298-24 Fabric Order.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"
Source: C:\Users\user\Desktop\PO F1298-24 Fabric Order.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 2452 -s 1604
Source: C:\Users\user\Desktop\PO F1298-24 Fabric Order.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\PO F1298-24 Fabric Order.exe" -Force	Jump to behavior
Source: C:\Users\user\Desktop\PO F1298-24 Fabric Order.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"	Jump to behavior
Source: C:\Users\user\Desktop\PO F1298-24 Fabric Order.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"	Jump to behavior

Source: C:\Users\user\Desktop\PO F1298-24 Fabric Order.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO F1298-24 Fabric Order.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO F1298-24 Fabric Order.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO F1298-24 Fabric Order.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO F1298-24 Fabric Order.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO F1298-24 Fabric Order.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO F1298-24 Fabric Order.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO F1298-24 Fabric Order.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO F1298-24 Fabric Order.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO F1298-24 Fabric Order.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO F1298-24 Fabric Order.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO F1298-24 Fabric Order.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO F1298-24 Fabric Order.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO F1298-24 Fabric Order.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO F1298-24 Fabric Order.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO F1298-24 Fabric Order.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO F1298-24 Fabric Order.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO F1298-24 Fabric Order.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO F1298-24 Fabric Order.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO F1298-24 Fabric Order.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO F1298-24 Fabric Order.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO F1298-24 Fabric Order.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO F1298-24 Fabric Order.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO F1298-24 Fabric Order.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO F1298-24 Fabric Order.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO F1298-24 Fabric Order.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO F1298-24 Fabric Order.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO F1298-24 Fabric Order.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO F1298-24 Fabric Order.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO F1298-24 Fabric Order.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO F1298-24 Fabric Order.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO F1298-24 Fabric Order.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: fwpuclnt.dll	Jump to behavior

Source: C:\Users\user\Desktop\PO F1298-24 Fabric Order.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\PO F1298-24 Fabric Order.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles

Jump to behavior

Source: PO F1298-24 Fabric Order.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: PO F1298-24 Fabric Order.exe

Static file information: File size 3415639 > 1048576

Source: PO F1298-24 Fabric Order.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: Microsoft.VisualBasic.ni.pdb source: WER6BA7.tmp.dmp.8.dr
Source:	Binary string: System.ni.pdbRSDS source: WER6BA7.tmp.dmp.8.dr
Source:	Binary string: System.Windows.Forms.ni.pdb source: WER6BA7.tmp.dmp.8.dr
Source:	Binary string: Microsoft.VisualBasic.pdb0 source: WER6BA7.tmp.dmp.8.dr
Source:	Binary string: System.Drawing.ni.pdb source: WER6BA7.tmp.dmp.8.dr
Source:	Binary string: mscorlib.ni.pdbRSDS7^3l source: WER6BA7.tmp.dmp.8.dr
Source:	Binary string: Microsoft.VisualBasic.ni.pdbRSDS& source: WER6BA7.tmp.dmp.8.dr
Source:	Binary string: System.Drawing.ni.pdbRSDS source: WER6BA7.tmp.dmp.8.dr
Source:	Binary string: System.pdb source: WER6BA7.tmp.dmp.8.dr
Source:	Binary string: System.Core.ni.pdb source: WER6BA7.tmp.dmp.8.dr
Source:	Binary string: Microsoft.VisualBasic.pdb source: WER6BA7.tmp.dmp.8.dr
Source:	Binary string: System.Windows.Forms.pdb source: WER6BA7.tmp.dmp.8.dr
Source:	Binary string: mscorlib.pdb source: WER6BA7.tmp.dmp.8.dr
Source:	Binary string: System.Drawing.pdbq1 source: WER6BA7.tmp.dmp.8.dr
Source:	Binary string: System.Management.ni.pdbRSDSJ< source: WER6BA7.tmp.dmp.8.dr
Source:	Binary string: System.Windows.Forms.ni.pdbRSDS source: WER6BA7.tmp.dmp.8.dr
Source:	Binary string: System.Drawing.pdb source: WER6BA7.tmp.dmp.8.dr
Source:	Binary string: System.Management.pdb source: WER6BA7.tmp.dmp.8.dr
Source:	Binary string: mscorlib.ni.pdb source: WER6BA7.tmp.dmp.8.dr
Source:	Binary string: System.Management.ni.pdb source: WER6BA7.tmp.dmp.8.dr
Source:	Binary string: System.Core.pdb source: WER6BA7.tmp.dmp.8.dr
Source:	Binary string: System.Core.pdb& source: WER6BA7.tmp.dmp.8.dr
Source:	Binary string: System.ni.pdb source: WER6BA7.tmp.dmp.8.dr
Source:	Binary string: System.Core.ni.pdbRSDS source: WER6BA7.tmp.dmp.8.dr

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Users\user\Desktop\PO F1298-24 Fabric Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO F1298-24 Fabric Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO F1298-24 Fabric Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO F1298-24 Fabric Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO F1298-24 Fabric Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO F1298-24 Fabric Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO F1298-24 Fabric Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO F1298-24 Fabric Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO F1298-24 Fabric Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO F1298-24 Fabric Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO F1298-24 Fabric Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO F1298-24 Fabric Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO F1298-24 Fabric Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO F1298-24 Fabric Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO F1298-24 Fabric Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO F1298-24 Fabric Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO F1298-24 Fabric Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO F1298-24 Fabric Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO F1298-24 Fabric Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO F1298-24 Fabric Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO F1298-24 Fabric Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO F1298-24 Fabric Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO F1298-24 Fabric Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO F1298-24 Fabric Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO F1298-24 Fabric Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO F1298-24 Fabric Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO F1298-24 Fabric Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO F1298-24 Fabric Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO F1298-24 Fabric Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO F1298-24 Fabric Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO F1298-24 Fabric Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO F1298-24 Fabric Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO F1298-24 Fabric Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO F1298-24 Fabric Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO F1298-24 Fabric Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO F1298-24 Fabric Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO F1298-24 Fabric Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO F1298-24 Fabric Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO F1298-24 Fabric Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: PO F1298-24 Fabric Order.exe PID: 2452, type: MEMORYSTR

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\PO F1298-24 Fabric Order.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\cimv2 : SELECT * FROM Win32_VideoController

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: PO F1298-24 Fabric Order.exe, 00000000.00000002.2330596455.000001855C594000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: WINE_GET_UNIX_FILE_NAME
Source: PO F1298-24 Fabric Order.exe, 00000000.00000002.2330596455.000001855C594000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SBIEDLL.DLL
Source: PO F1298-24 Fabric Order.exe, 00000000.00000002.2330596455.000001855C594000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SBIEDLL.DLL0UEZ
Source: PO F1298-24 Fabric Order.exe, 00000000.00000002.2330596455.000001855C594000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: WINE_GET_UNIX_FILE_NAMEP

Source: C:\Users\user\Desktop\PO F1298-24 Fabric Order.exe	Memory allocated: 1855A770000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\PO F1298-24 Fabric Order.exe	Memory allocated: 18574260000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\PO F1298-24 Fabric Order.exe	Memory allocated: 1857C920000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 13D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 2F70000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 4F70000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\PO F1298-24 Fabric Order.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DEVICEMAP\Scsi\Scsi Port 0\Scsi Bus 0\Target Id 0\Logical Unit Id 0 name: Identifier	Jump to behavior
Source: C:\Users\user\Desktop\PO F1298-24 Fabric Order.exe	File opened / queried: C:\WINDOWS\system32\drivers\vmmouse.sys	Jump to behavior
Source: C:\Users\user\Desktop\PO F1298-24 Fabric Order.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\disk\Enum name: 0	Jump to behavior
Source: C:\Users\user\Desktop\PO F1298-24 Fabric Order.exe	File opened / queried: C:\WINDOWS\system32\drivers\vmhgfs.sys	Jump to behavior
Source: C:\Users\user\Desktop\PO F1298-24 Fabric Order.exe	File opened / queried: C:\WINDOWS\system32\drivers\VBoxMouse.sys	Jump to behavior
Source: C:\Users\user\Desktop\PO F1298-24 Fabric Order.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\PO F1298-24 Fabric Order.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\PO F1298-24 Fabric Order.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7065	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2578	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Window / User API: threadDelayed 2725	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Window / User API: threadDelayed 7111	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7160	Thread sleep time: -7378697629483816s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7116	Thread sleep count: 32 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7116	Thread sleep time: -29514790517935264s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7116	Thread sleep time: -100000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 6408	Thread sleep count: 2725 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7116	Thread sleep time: -99859s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 6408	Thread sleep count: 7111 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7116	Thread sleep time: -99749s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7116	Thread sleep time: -99640s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7116	Thread sleep time: -99531s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7116	Thread sleep time: -99422s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7116	Thread sleep time: -99313s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7116	Thread sleep time: -99203s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7116	Thread sleep time: -99094s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7116	Thread sleep time: -98984s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7116	Thread sleep time: -98803s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7116	Thread sleep time: -98609s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7116	Thread sleep time: -98448s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7116	Thread sleep time: -98297s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7116	Thread sleep time: -98172s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7116	Thread sleep time: -98062s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7116	Thread sleep time: -97953s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7116	Thread sleep time: -97843s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7116	Thread sleep time: -97734s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7116	Thread sleep time: -97622s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7116	Thread sleep time: -97516s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7116	Thread sleep time: -97393s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7116	Thread sleep time: -97281s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7116	Thread sleep time: -97172s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7116	Thread sleep time: -97047s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7116	Thread sleep time: -96938s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7116	Thread sleep time: -96813s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7116	Thread sleep time: -96703s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7116	Thread sleep time: -96594s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7116	Thread sleep time: -96469s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7116	Thread sleep time: -96359s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7116	Thread sleep time: -96250s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7116	Thread sleep time: -96141s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7116	Thread sleep time: -96031s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7116	Thread sleep time: -95922s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7116	Thread sleep time: -95812s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7116	Thread sleep time: -95703s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7116	Thread sleep time: -95594s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7116	Thread sleep time: -95469s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7116	Thread sleep time: -95359s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7116	Thread sleep time: -95250s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7116	Thread sleep time: -95141s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7116	Thread sleep time: -95031s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7116	Thread sleep time: -94922s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7116	Thread sleep time: -94813s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7116	Thread sleep time: -94688s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7116	Thread sleep time: -94563s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7116	Thread sleep time: -94453s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7116	Thread sleep time: -94344s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7116	Thread sleep time: -94219s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7116	Thread sleep time: -94109s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7116	Thread sleep time: -94000s >= -30000s	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 99859	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 99749	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 99640	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 99531	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 99422	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 99313	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 99203	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 99094	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 98984	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 98803	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 98609	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 98448	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 98297	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 98172	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 98062	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 97953	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 97843	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 97734	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 97622	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 97516	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 97393	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 97281	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 97172	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 97047	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 96938	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 96813	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 96703	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 96594	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 96469	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 96359	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 96250	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 96141	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 96031	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 95922	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 95812	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 95703	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 95594	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 95469	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 95359	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 95250	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 95141	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 95031	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 94922	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 94813	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 94688	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 94563	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 94453	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 94344	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 94219	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 94109	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 94000	Jump to behavior

Source: Amcache.hve.8.dr	Binary or memory string: VMware
Source: PO F1298-24 Fabric Order.exe, 00000000.00000002.2330596455.000001855C594000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: QEMUP
Source: PO F1298-24 Fabric Order.exe, 00000000.00000002.2330596455.000001855C594000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: "SOFTWARE\VMware, Inc.\VMware ToolsP
Source: PO F1298-24 Fabric Order.exe, 00000000.00000002.2330596455.000001855C594000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: Amcache.hve.8.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: PO F1298-24 Fabric Order.exe, 00000000.00000002.2330596455.000001855C594000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMWARE
Source: PO F1298-24 Fabric Order.exe, 00000000.00000002.2330596455.000001855C594000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\'C:\WINDOWS\system32\drivers\vmmouse.sys&C:\WINDOWS\system32\drivers\vmhgfs.sys
Source: Amcache.hve.8.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.8.dr	Binary or memory string: vmci.sys
Source: PO F1298-24 Fabric Order.exe, 00000000.00000002.2330596455.000001855C594000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\WINDOWS\system32\drivers\vmmouse.sys
Source: PO F1298-24 Fabric Order.exe, 00000000.00000002.2330596455.000001855C594000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmware
Source: PO F1298-24 Fabric Order.exe, 00000000.00000002.2330596455.000001855C594000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\WINDOWS\system32\drivers\vmhgfs.sys
Source: Amcache.hve.8.dr	Binary or memory string: VMware20,1
Source: PO F1298-24 Fabric Order.exe, 00000000.00000002.2330596455.000001855C594000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: &C:\WINDOWS\system32\drivers\vmhgfs.sysP
Source: Amcache.hve.8.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.8.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.8.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.8.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.8.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.8.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: PO F1298-24 Fabric Order.exe, 00000000.00000002.2330596455.000001855C594000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: noValueButYesKey)C:\WINDOWS\system32\drivers\VBoxMouse.sys
Source: PO F1298-24 Fabric Order.exe, 00000000.00000002.2330596455.000001855C594000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\WINDOWS\system32\drivers\VBoxMouse.sys
Source: Amcache.hve.8.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.8.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.8.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: PO F1298-24 Fabric Order.exe, 00000000.00000002.2330596455.000001855C594000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMWAREP
Source: Amcache.hve.8.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.8.dr	Binary or memory string: VMware Virtual USB Mouse
Source: PO F1298-24 Fabric Order.exe, 00000000.00000002.2330596455.000001855C594000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmwareP
Source: Amcache.hve.8.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.8.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.8.dr	Binary or memory string: VMware20,1hbin@
Source: PO F1298-24 Fabric Order.exe, 00000000.00000002.2330596455.000001855C594000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: )C:\WINDOWS\system32\drivers\VBoxMouse.sysP
Source: Amcache.hve.8.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.8.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.8.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: PO F1298-24 Fabric Order.exe, 00000000.00000002.2330596455.000001855C594000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: %C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\P
Source: PO F1298-24 Fabric Order.exe, 00000000.00000002.2330596455.000001855C594000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
Source: PO F1298-24 Fabric Order.exe, 00000000.00000002.2330596455.000001855C594000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware SVGA II
Source: Amcache.hve.8.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.8.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: PO F1298-24 Fabric Order.exe, 00000000.00000002.2330596455.000001855C594000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware SVGA IIP
Source: RegAsm.exe, 00000004.00000002.3375570384.0000000006260000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: PO F1298-24 Fabric Order.exe, 00000000.00000002.2330596455.000001855C594000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 'C:\WINDOWS\system32\drivers\vmmouse.sysP
Source: Amcache.hve.8.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.8.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.8.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: PO F1298-24 Fabric Order.exe, 00000000.00000002.2330596455.000001855C594000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
Source: Amcache.hve.8.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.8.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: PO F1298-24 Fabric Order.exe, 00000000.00000002.2330596455.000001855C594000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: "SOFTWARE\VMware, Inc.\VMware Tools

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\PO F1298-24 Fabric Order.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\PO F1298-24 Fabric Order.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\PO F1298-24 Fabric Order.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

.NET source code references suspicious native API functions

Source: PO F1298-24 Fabric Order.exe, .cs	Reference to suspicious API methods: GetProcAddress(, )
Source: PO F1298-24 Fabric Order.exe, .cs	Reference to suspicious API methods: VirtualProtect(procAddress, (UIntPtr)(ulong)array.Length, (uint)(int)., out var )
Source: PO F1298-24 Fabric Order.exe, .cs	Reference to suspicious API methods: LoadLibrary([.ToInt32()])
Source: 0.2.PO F1298-24 Fabric Order.exe.1856ceb7e08.3.raw.unpack, zOS.cs	Reference to suspicious API methods: _120HqGy.OpenProcess(_2pIt.DuplicateHandle, bInheritHandle: true, (uint)iVE.ProcessID)

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\Desktop\PO F1298-24 Fabric Order.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\PO F1298-24 Fabric Order.exe" -Force
Source: C:\Users\user\Desktop\PO F1298-24 Fabric Order.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\PO F1298-24 Fabric Order.exe" -Force			Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\PO F1298-24 Fabric Order.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\PO F1298-24 Fabric Order.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\PO F1298-24 Fabric Order.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 402000	Jump to behavior
Source: C:\Users\user\Desktop\PO F1298-24 Fabric Order.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 43C000	Jump to behavior
Source: C:\Users\user\Desktop\PO F1298-24 Fabric Order.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 43E000	Jump to behavior
Source: C:\Users\user\Desktop\PO F1298-24 Fabric Order.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: E99008	Jump to behavior

Source: C:\Users\user\Desktop\PO F1298-24 Fabric Order.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\PO F1298-24 Fabric Order.exe" -Force	Jump to behavior
Source: C:\Users\user\Desktop\PO F1298-24 Fabric Order.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"	Jump to behavior
Source: C:\Users\user\Desktop\PO F1298-24 Fabric Order.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"	Jump to behavior

Source: C:\Users\user\Desktop\PO F1298-24 Fabric Order.exe	Queries volume information: C:\Users\user\Desktop\PO F1298-24 Fabric Order.exe VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\PO F1298-24 Fabric Order.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Disables UAC (registry)

Source: C:\Users\user\Desktop\PO F1298-24 Fabric Order.exe

Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System EnableLUA

Jump to behavior

Source: Amcache.hve.8.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.8.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.8.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.8.dr	Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: 4.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO F1298-24 Fabric Order.exe.1856ce7d3c0.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO F1298-24 Fabric Order.exe.1856ceb7e08.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO F1298-24 Fabric Order.exe.1856ceb7e08.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO F1298-24 Fabric Order.exe.1856ce7d3c0.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.3351887667.0000000002FBE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.3345081837.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2331410579.000001856CE42000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.3351887667.0000000002F71000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: PO F1298-24 Fabric Order.exe PID: 2452, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 4708, type: MEMORYSTR

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File opened: C:\FTP Navigator\Ftplist.txt

Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior

Source: Yara match	File source: 4.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO F1298-24 Fabric Order.exe.1856ce7d3c0.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO F1298-24 Fabric Order.exe.1856ceb7e08.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO F1298-24 Fabric Order.exe.1856ceb7e08.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO F1298-24 Fabric Order.exe.1856ce7d3c0.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.3345081837.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2331410579.000001856CE42000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.3351887667.0000000002F71000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: PO F1298-24 Fabric Order.exe PID: 2452, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 4708, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: 4.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO F1298-24 Fabric Order.exe.1856ce7d3c0.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO F1298-24 Fabric Order.exe.1856ceb7e08.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO F1298-24 Fabric Order.exe.1856ceb7e08.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO F1298-24 Fabric Order.exe.1856ce7d3c0.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.3351887667.0000000002FBE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.3345081837.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2331410579.000001856CE42000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.3351887667.0000000002F71000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: PO F1298-24 Fabric Order.exe PID: 2452, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 4708, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	221 Windows Management Instrumentation	1 DLL Side-Loading	211 Process Injection	21 Disable or Modify Tools	2 OS Credential Dumping	341 Security Software Discovery	Remote Services	1 Email Collection	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	Boot or Logon Initialization Scripts	1 DLL Side-Loading	261 Virtualization/Sandbox Evasion	1 Input Capture	1 Process Discovery	Remote Desktop Protocol	1 Input Capture	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	211 Process Injection	1 Credentials in Registry	261 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	11 Archive Collected Data	11 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	1 Application Window Discovery	Distributed Component Object Model	2 Data from Local System	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	24 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
PO F1298-24 Fabric Order.exe	53%	ReversingLabs	Win64.Trojan.AntiSandbox
PO F1298-24 Fabric Order.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
http://upx.sf.net	0%	URL Reputation	safe
https://account.dyn.com/	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
mail.iaa-airferight.com	46.175.148.58	true	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://upx.sf.net	Amcache.hve.8.dr	false	URL Reputation: safe	unknown
https://account.dyn.com/	PO F1298-24 Fabric Order.exe, 00000000.00000002.2331410579.000001856CE42000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.3345081837.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://mail.iaa-airferight.com	RegAsm.exe, 00000004.00000002.3351887667.0000000002FC6000.00000004.00000800.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
46.175.148.58	mail.iaa-airferight.com	Ukraine		56394	ASLAGIDKOM-NETUA	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1541083
Start date and time:	2024-10-24 11:55:11 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 27s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	12
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	PO F1298-24 Fabric Order.exe
Detection:	MAL
Classification:	mal100.troj.spyw.expl.evad.winEXE@9/10@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 60 Number of non-executed functions: 3
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 52.182.143.212
Excluded domains from analysis (whitelisted): ocsp.digicert.com, onedsblobprdcus15.centralus.cloudapp.azure.com, login.live.com, otelrules.azureedge.net, slscr.update.microsoft.com, blobcollector.events.data.trafficmanager.net, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Report size getting too big, too many NtSetInformationFile calls found.
VT rate limit hit for: PO F1298-24 Fabric Order.exe

Simulations

Behavior and APIs

Time	Type	Description
05:56:13	API Interceptor	186x Sleep call for process: RegAsm.exe modified
05:56:13	API Interceptor	18x Sleep call for process: powershell.exe modified
05:56:30	API Interceptor	1x Sleep call for process: WerFault.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
46.175.148.58	PO F1298-24 Fabric Order.zip	Get hash	malicious	AgentTesla	Browse
	PO 316347 24MIA00660067.exe	Get hash	malicious	AgentTesla	Browse
	Purchase Order For Linear Actuator.exe	Get hash	malicious	AgentTesla	Browse
	PO FOR CONNECTOR WITH TERMINAL.exe	Get hash	malicious	AgentTesla, PureLog Stealer, zgRAT	Browse
	New PO-Auras Demand.exe	Get hash	malicious	AgentTesla	Browse
	SecuriteInfo.com.BackDoor.AgentTeslaNET.37.28277.26776.exe	Get hash	malicious	AgentTesla	Browse
	New Purchase Order 568330.exe	Get hash	malicious	AgentTesla	Browse
	SecuriteInfo.com.Win32.PWSX-gen.20380.30925.exe	Get hash	malicious	AgentTesla	Browse
	rrpC2ZDgUd.exe	Get hash	malicious	AgentTesla	Browse
	92ZZIUHzPQ.exe	Get hash	malicious	AgentTesla	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
mail.iaa-airferight.com	PO F1298-24 Fabric Order.zip	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	PO 316347 24MIA00660067.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	Purchase Order For Linear Actuator.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	PO FOR CONNECTOR WITH TERMINAL.exe	Get hash	malicious	AgentTesla, PureLog Stealer, zgRAT	Browse	46.175.148.58
	New PO-Auras Demand.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	SecuriteInfo.com.BackDoor.AgentTeslaNET.37.28277.26776.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	New Purchase Order 568330.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	SecuriteInfo.com.Win32.PWSX-gen.20380.30925.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	rrpC2ZDgUd.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	92ZZIUHzPQ.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ASLAGIDKOM-NETUA	PO F1298-24 Fabric Order.zip	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	PO 316347 24MIA00660067.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	Purchase Order For Linear Actuator.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	PO FOR CONNECTOR WITH TERMINAL.exe	Get hash	malicious	AgentTesla, PureLog Stealer, zgRAT	Browse	46.175.148.58
	New PO-Auras Demand.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	SecuriteInfo.com.BackDoor.AgentTeslaNET.37.28277.26776.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	New Purchase Order 568330.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	SecuriteInfo.com.Win32.PWSX-gen.20380.30925.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	rrpC2ZDgUd.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	92ZZIUHzPQ.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_PO F1298-24 Fabr_697bf1cfe728f851d8e751bad862896dd0f1c69_57bd0835_fad05113-fe59-4ec5-9ada-2e05d5fb69b6\Report.wer

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.232640067576066
Encrypted:	false
SSDEEP:	192:dY1Vo80UnUFaWh8U3eZYdzuiFGZ24lO8L:uHo3UnUFau8JYzuiFGY4lO8L
MD5:	72AC3099E0956ED809DF1C2DF912CE16
SHA1:	3B1C40ED17FE6738764DBFE383627D8DD3D51EA4
SHA-256:	186268BEEA8EAE094A305D050A1C0AEB40DB57FAB13FBF4AD67585CD5AC620EE
SHA-512:	DB60A95B2E8865C5B657F5C15FDCE0F24446F066904644DA8A4B458EE8E2C01D9479E415E0C69AB74A53793B7CC890CA68BCF5A9321C4D4B1C42C0B2CA4DC2BB
Malicious:	false
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.4.2.3.7.3.7.2.5.0.6.1.5.8.5.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.4.2.3.7.3.7.3.5.0.6.1.4.4.2.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.f.a.d.0.5.1.1.3.-.f.e.5.9.-.4.e.c.5.-.9.a.d.a.-.2.e.0.5.d.5.f.b.6.9.b.6.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.b.2.7.5.c.3.a.8.-.6.5.7.1.-.4.8.e.f.-.b.6.3.9.-.3.1.3.1.6.a.0.8.f.0.9.9.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.P.O. .F.1.2.9.8.-.2.4. .F.a.b.r.i.c. .O.r.d.e.r...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.N.e.w.S.t.b...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.9.9.4.-.0.0.0.1.-.0.0.1.4.-.e.7.5.8.-.2.f.f.2.f.a.2.5.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.c.5.e.f.1.c.7.6.a.a.5.a.a.2.5.3.a.8.4.0.1.c.c.d.b.d.c.0.4.e.b.d.0.0.0.0.0.0.0.0.!.0.0.0.0.5.a.f.a.1.1.9.3.4.3.9.0.d.5.2.2.4.9.d.c.1.3.8.8.5.3.9.2.2.e.6.4.d.c.f.a.a.5.2.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER6BA7.tmp.dmp

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Mini DuMP crash report, 16 streams, Thu Oct 24 09:56:13 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	478385
Entropy (8bit):	3.2903801579008514
Encrypted:	false
SSDEEP:	3072:i5zVZeFG/cJcSxzHUSs4o8Axubo+1CCqBspPlBLFuGx3+vEpwQB4WjO:yQx7u4JqBMv3QEpwUXj
MD5:	352EBF913FD074B662F16E9C70814E10
SHA1:	E9A509850434B098D062D403836B988F042B526C
SHA-256:	633BABDAF7B2879E3A62F8DCCF8AEEC1E7A93F7760FFA0A2A8DA6C98915AF64F
SHA-512:	61073E225875863678CE71FC5D1EEBE189701A9F1B285E3D8C6C8CF58F722B75A7F9AFBD2E63F81698B6189CA3D668E67698B558959699FB1C302F74D59ED971
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... ..........g............t.......................$...d(......$ ...(.......P..*...........l.......8...........T............;...............H...........J..............................................................................eJ......0K......Lw......................T..............g.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER6E48.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8870
Entropy (8bit):	3.710513823924976
Encrypted:	false
SSDEEP:	192:R6l7wVeJj8Az6YEI2vJggmfb4Jprp89bh7zX0fPrm:R6lXJYm6YEpvJggmfb4ShfX0fq
MD5:	9757B83B4F4ACFD78CEDDD241F7E7EB8
SHA1:	16D19F9E9603B089D9471C3CEF141C5104985A44
SHA-256:	D5F7DAD9879BE64CC3390172D3060080E315814798968EE2B52581B98028518E
SHA-512:	8BC17F2DB343A45552E463ACA4484B137E40CA29C3DE7D3244B17423E30D009F17936B7848E724920F946EDCC9AEFBB68FE773268A4731FD1CE2787A3F6AC7E1
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.2.4.5.2.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER6E97.tmp.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4829
Entropy (8bit):	4.526707889878556
Encrypted:	false
SSDEEP:	48:cvIwWl8zsdJg771I93cWpW8VYerYm8M4Jwca+F9xyq85cAezy7Mksd:uIjf3I7sV7VhuJwcxx8ezy7Mksd
MD5:	06D2CA8728E98DA3D2485D9B57CC9B77
SHA1:	BA88062B94021560DF8F7401ACC27217AE371E06
SHA-256:	CA2B0889F3A0CCE7EADB5E1FD992EA0635B1BCDE22BD97C456578EC8E7B73033
SHA-512:	F7286202888319EFBE4812C797870CAFCFD16B27D289A61C67C61E779FEC0DF382E8803D9B85189A92A4BC5187BAD3B2170D0C8DAB84EBC17FDD8D91D0AF2FA8
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="557338" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulxmH/lZ:NllUg
MD5:	D904BDD752B6F23D81E93ECA3BD8E0F3
SHA1:	026D8B0D0F79861746760B0431AD46BAD2A01676
SHA-256:	B393D3CEC8368794972E4ADD978B455A2F5BD37E3A116264DBED14DC8C67D6F2
SHA-512:	5B862B7F0BCCEF48E6A5A270C3F6271D7A5002465EAF347C6A266365F1B2CD3D88144C043D826D3456AA43484124D619BF16F9AEAB1F706463F553EE24CB5740
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	@...e................................. ..............@..........

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_au4vegts.fju.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_tacpqzc0.0qh.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_w3yzu04u.qpr.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xkiufkyt.kek.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.421777161384939
Encrypted:	false
SSDEEP:	6144:mSvfpi6ceLP/9skLmb0OTMWSPHaJG8nAgeMZMMhA2fX4WABlEnNk0uhiTwE:FvloTMW+EZMM6DFyG03wE
MD5:	6E15C90343EF904CA3EBA274ADA982DF
SHA1:	9EF915CA6C82296F0A4EB20F26B44F02A18F7D1E
SHA-256:	1A1669AC8F30748D668E0203753A382889C1E126652264A35DF1735748CCCE1D
SHA-512:	8E78EA065B03AD352D0E36F1DF351592B61DA5527940DEB5264E10BCE8A18B682C0FF53A5FE47B914B273F5157B57A3EA6BC7BE7A7183C9F89A6BF45812F8FF6
Malicious:	false
Preview:	regf>...>....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm.....%..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
Entropy (8bit):	4.647598464738664
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	PO F1298-24 Fabric Order.exe
File size:	3'415'639 bytes
MD5:	2ce31411b27c3fcdf0bfb5e56a784584
SHA1:	5afa11934390d52249dc138853922e64dcfaa528
SHA256:	473c91688591c4649ea77e07c95d77ecb87fbb22e060a9e1f4540af522d59ff5
SHA512:	0155d7cc5c31df53a8d375746fa0a1cc0bebf24e32fd64d42921afa910f4b7a7d2e721312dab06138d739ac8485dff374f9ba93a8b4e98ab8d8265855b336e94
SSDEEP:	12288:hyqgrdm4Vz0RpppppppppppppppppppppppppppppdHq4WJnP4b3rTJzZWoFrKfu:ceVWJnAb7lzZf2P8WhpqLgs0eiPlrXO
TLSH:	7AF5F141B5036D27FE58A630D5E2B9F102FE6D6B79F4902FDFA53C462ABA5BE4010432
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...i..g.........."...0.L"............... ....@...... ..............................?.4...`................................

File Icon


Icon Hash:	c5b492b6b69c85d1

Static PE Info

General

Entrypoint:	0x400000
Entrypoint Section:
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x67190369 [Wed Oct 23 14:08:41 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:

Entrypoint Preview

Instruction
dec ebp
pop edx
nop
add byte ptr [ebx], al
add byte ptr [eax], al
add byte ptr [eax+eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x6000	0x3806a	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2000	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x224c	0x2400	50813b0eef0c35bea61020f17cff13c5	False	0.5576171875	data	5.54257814467223	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x6000	0x3806a	0x38200	c2bbec77d50653a46ed0d85398a90457	False	0.30771941119153673	data	5.194902272133097	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0x6474	0x668	Device independent bitmap graphic, 48 x 96 x 4, image size 1152	0.38353658536585367
RT_ICON	0x6adc	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 512	0.48655913978494625
RT_ICON	0x6dc4	0x1e8	Device independent bitmap graphic, 24 x 48 x 4, image size 288	0.5286885245901639
RT_ICON	0x6fac	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128	0.5878378378378378
RT_ICON	0x70d4	0x6739	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	0.9933017975402081
RT_ICON	0xd810	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	0.5578358208955224
RT_ICON	0xe6b8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	0.6367328519855595
RT_ICON	0xef60	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	0.6497695852534562
RT_ICON	0xf628	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	0.47760115606936415
RT_ICON	0xfb90	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 67584	0.125
RT_ICON	0x203b8	0x94a8	Device independent bitmap graphic, 96 x 192 x 32, image size 38016	0.21113622030691612
RT_ICON	0x29860	0x67e8	Device independent bitmap graphic, 80 x 160 x 32, image size 26560	0.21157894736842106
RT_ICON	0x30048	0x5488	Device independent bitmap graphic, 72 x 144 x 32, image size 21600	0.24269870609981517
RT_ICON	0x354d0	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16896	0.22325224374114314
RT_ICON	0x396f8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	0.3196058091286307
RT_ICON	0x3bca0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	0.3642120075046904
RT_ICON	0x3cd48	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	0.5086065573770492
RT_ICON	0x3d6d0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	0.5735815602836879
RT_GROUP_ICON	0x3db38	0x102	data	0.6007751937984496
RT_VERSION	0x3dc3c	0x244	data	0.46379310344827585
RT_MANIFEST	0x3de80	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	0.5489795918367347

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 24, 2024 11:56:14.894902945 CEST	49704	25	192.168.2.5	46.175.148.58
Oct 24, 2024 11:56:15.880306959 CEST	49704	25	192.168.2.5	46.175.148.58
Oct 24, 2024 11:56:17.974066019 CEST	49704	25	192.168.2.5	46.175.148.58
Oct 24, 2024 11:56:21.989737034 CEST	49704	25	192.168.2.5	46.175.148.58
Oct 24, 2024 11:56:30.005357981 CEST	49704	25	192.168.2.5	46.175.148.58

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 24, 2024 11:56:14.820390940 CEST	50213	53	192.168.2.5	1.1.1.1
Oct 24, 2024 11:56:14.856646061 CEST	53	50213	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 24, 2024 11:56:14.820390940 CEST	192.168.2.5	1.1.1.1	0x8d1f	Standard query (0)	mail.iaa-airferight.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 24, 2024 11:56:14.856646061 CEST	1.1.1.1	192.168.2.5	0x8d1f	No error (0)	mail.iaa-airferight.com		46.175.148.58	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	05:56:07
Start date:	24/10/2024
Path:	C:\Users\user\Desktop\PO F1298-24 Fabric Order.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\PO F1298-24 Fabric Order.exe"
Imagebase:	0x1855a400000
File size:	3'415'639 bytes
MD5 hash:	2CE31411B27C3FCDF0BFB5E56A784584
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000000.00000002.2330596455.000001855C594000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2331410579.000001856CE42000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.2331410579.000001856CE42000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	05:56:11
Start date:	24/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\PO F1298-24 Fabric Order.exe" -Force
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	05:56:11
Start date:	24/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	05:56:11
Start date:	24/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"
Imagebase:	0xc40000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000004.00000002.3351887667.0000000002FBE000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000004.00000002.3345081837.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000004.00000002.3345081837.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000004.00000002.3351887667.0000000002F71000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000004.00000002.3351887667.0000000002F71000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	05:56:11
Start date:	24/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"
Imagebase:	0xcc0000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	05:56:11
Start date:	24/10/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 2452 -s 1604
Imagebase:	0x7ff6e8a40000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	11.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	19
Total number of Limit Nodes:	4

Executed Functions

Function 06460040 Relevance: 8.4, Strings: 6, Instructions: 936COMMON

Download Yara Rule

Strings

$sq, xrefs: 06460CDB
$sq, xrefs: 06460CC3
$sq, xrefs: 06460CB7
$sq, xrefs: 06460C9A
$sq, xrefs: 06460C8E
$sq, xrefs: 06460CE7

Memory Dump Source

Source File: 00000004.00000002.3377147407.0000000006460000.00000040.00000800.00020000.00000000.sdmp, Offset: 06460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6460000_RegAsm.jbxd

Similarity

API ID:
String ID: $sq$$sq$$sq$$sq$$sq$$sq
API String ID: 0-3087168343
Opcode ID: 6b80a767eb66db9f65fb94f05714023c582d82b5d8e9d3c616d4a4e7c746cd32
Instruction ID: 6c0903fb5278e3d4f2c1b6c6bcac25b190376e0f79da0364603eda8e9b8be62e
Opcode Fuzzy Hash: 6b80a767eb66db9f65fb94f05714023c582d82b5d8e9d3c616d4a4e7c746cd32
Instruction Fuzzy Hash: C0827E30E106198FCB55EF69C594A9DB7B2FF85300F50C6AAE409AB354EB70ED85CB81

Function 06468BA0 Relevance: 8.3, Strings: 6, Instructions: 767COMMON

Download Yara Rule

Strings

$sq, xrefs: 0646954F
$sq, xrefs: 064694E7
$sq, xrefs: 06469543
$sq, xrefs: 0646951B
$sq, xrefs: 064694DB
$sq, xrefs: 0646950F

Memory Dump Source

Source File: 00000004.00000002.3377147407.0000000006460000.00000040.00000800.00020000.00000000.sdmp, Offset: 06460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6460000_RegAsm.jbxd

Similarity

API ID:
String ID: $sq$$sq$$sq$$sq$$sq$$sq
API String ID: 0-3087168343
Opcode ID: 505fa544793de69439d64ed1b56c8ebde72a30150fe605e497e03cd70c30f911
Instruction ID: ac07cbf20c7036c3eca77c4c37f0e40298b8b0cd8a05b931ba46617db762b679
Opcode Fuzzy Hash: 505fa544793de69439d64ed1b56c8ebde72a30150fe605e497e03cd70c30f911
Instruction Fuzzy Hash: 1F528E70E1020A8FDF65DBA9D5946AEB7B2FB89310F208827E405DB355CB74DC85CB92

Function 0646BD08 Relevance: 4.3, Strings: 3, Instructions: 573
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

0oVp, xrefs: 0646BDA0
PHsq, xrefs: 0646BF68
DqVp, xrefs: 0646BDAC

Memory Dump Source

Source File: 00000004.00000002.3377147407.0000000006460000.00000040.00000800.00020000.00000000.sdmp, Offset: 06460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6460000_RegAsm.jbxd

Similarity

API ID:
String ID: 0oVp$DqVp$PHsq
API String ID: 0-843718501
Opcode ID: 8d9af6a68713841ceddd4b699b952ac0d828c7d5e66d569547e346bab513ef93
Instruction ID: e509348c1bd26605ca0beb642516c1cf143b2ffedbcf7c668a2982c9cd64070c
Opcode Fuzzy Hash: 8d9af6a68713841ceddd4b699b952ac0d828c7d5e66d569547e346bab513ef93
Instruction Fuzzy Hash: 2A22B170B101058FCB55DB69D894AAEB7F2FF89310F20896AE406DB361DB75EC41CB92

Function 02DF9B38 Relevance: 3.1, Instructions: 3065COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3350336235.0000000002DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2df0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d87fee1d4fba6e0708781e17eecefe124e2e2aeb7abd40b13d42ec5f1833a51
Instruction ID: 1808deca5a616d856f03d5911d53bb60a423f0e19d0400d2c048a5a66ac2f92e
Opcode Fuzzy Hash: 4d87fee1d4fba6e0708781e17eecefe124e2e2aeb7abd40b13d42ec5f1833a51
Instruction Fuzzy Hash: 41630C31D10B198ACB51EF68C8806A9F7B1FF99300F51D79AE45877221EB70AAD5CF81

Function 064656E0 Relevance: 3.0, Strings: 2, Instructions: 471
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$sq, xrefs: 06465A29
$sq, xrefs: 06465A1D

Memory Dump Source

Source File: 00000004.00000002.3377147407.0000000006460000.00000040.00000800.00020000.00000000.sdmp, Offset: 06460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6460000_RegAsm.jbxd

Similarity

API ID:
String ID: $sq$$sq
API String ID: 0-1184984226
Opcode ID: da90a46f1131e401ec2ca74d277a35fb88a1f3ca1745d4b5036e549e1d8ea0d7
Instruction ID: 47864e2fdf8ec58fe5e22df56e3e075ac96ebd3fd4f6be07ad7de4a50490b627
Opcode Fuzzy Hash: da90a46f1131e401ec2ca74d277a35fb88a1f3ca1745d4b5036e549e1d8ea0d7
Instruction Fuzzy Hash: 0202BE70B002058FCF59EB69D594AAEB7B2FF84314F14892AE406DB354DB35EC86CB91

Function 0646DD18 Relevance: 2.8, Strings: 2, Instructions: 332
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$sq, xrefs: 0646DE06
Xwq, xrefs: 0646DE1F

Memory Dump Source

Source File: 00000004.00000002.3377147407.0000000006460000.00000040.00000800.00020000.00000000.sdmp, Offset: 06460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6460000_RegAsm.jbxd

Similarity

API ID:
String ID: Xwq$$sq
API String ID: 0-2558833440
Opcode ID: 801ced2b033aa84b9f6a800e05217767e63d9b290702923f991c57053bc4bd1f
Instruction ID: ab45bbbc82f4f26181bc043ff8f3c6808f9cafd12208280cd540c5fbaa8143a2
Opcode Fuzzy Hash: 801ced2b033aa84b9f6a800e05217767e63d9b290702923f991c57053bc4bd1f
Instruction Fuzzy Hash: DCB1B278B042188FDB58AB79885467EBBE7BFC8300B15842EE506D7388DE359C029792

Function 02DFCDB0 Relevance: 2.3, Instructions: 2309COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3350336235.0000000002DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2df0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d1e6f6cca341178a200eef24e32a2bcb5c5670772ae1525fccd4ece7d4de936
Instruction ID: d01062c121ae21dd4eb9c25f9d20c2f89ad8aee9573102f932c010700536b18f
Opcode Fuzzy Hash: 0d1e6f6cca341178a200eef24e32a2bcb5c5670772ae1525fccd4ece7d4de936
Instruction Fuzzy Hash: 6D331B31D107198ECB11EF68C8846ADF7B1FF99300F15D79AE558A7221EB70AAC5CB81

Function 06462B00 Relevance: 1.8, Strings: 1, Instructions: 589
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$, xrefs: 06462EB9

Memory Dump Source

Source File: 00000004.00000002.3377147407.0000000006460000.00000040.00000800.00020000.00000000.sdmp, Offset: 06460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6460000_RegAsm.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-3993045852
Opcode ID: 6c4ad5660d6e319d4826aa17da58f1382386be5894b7e66bb1202191418a01bc
Instruction ID: c05d9fcd140f734e34729b9af4168090c621a53228f180bdc67f172e73a26f4b
Opcode Fuzzy Hash: 6c4ad5660d6e319d4826aa17da58f1382386be5894b7e66bb1202191418a01bc
Instruction Fuzzy Hash: 9722D071F002159BDF65DFA5C8806AFBBB2FF89310F20846AE406AB344DA75DD46CB91

Function 06463F50 Relevance: .8, Instructions: 811COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3377147407.0000000006460000.00000040.00000800.00020000.00000000.sdmp, Offset: 06460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6460000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b9421307de1ea990916e5a139d1612d93fc3b1127ee970c60a10a2973d7131f
Instruction ID: 3752e6aa623ed6304ab5137d9f8cbac7f39feb5c80829519fbf4b29a23ab7437
Opcode Fuzzy Hash: 1b9421307de1ea990916e5a139d1612d93fc3b1127ee970c60a10a2973d7131f
Instruction Fuzzy Hash: DA627C34B002058FDF55EB69D594AAEB7F2EF88314F14846AE406EB394DB35EC46CB81

Function 06469AE8 Relevance: .6, Instructions: 647COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3377147407.0000000006460000.00000040.00000800.00020000.00000000.sdmp, Offset: 06460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6460000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 974b5ab7722f7c956ed7c7a746a671dedaffaa588269a48afb968cb71064d4fc
Instruction ID: 889efb64a4641d16817df1aedf18ba91a87f8b809b45f3e0c981504820977a06
Opcode Fuzzy Hash: 974b5ab7722f7c956ed7c7a746a671dedaffaa588269a48afb968cb71064d4fc
Instruction Fuzzy Hash: DD329430B011098FDF55EF69D994BAEB7B2FB89310F10852AE406EB355DB30DC468B92

Function 02DF9378 Relevance: .6, Instructions: 617COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3350336235.0000000002DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2df0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad66b7c9fb1f58040b72e65634dad44e6a55cfc39b5661e2884fa84c1f524a7e
Instruction ID: 0c31f8b3d7ce22cc0d8260518e698dec07895d379360e4091743412befbb7724
Opcode Fuzzy Hash: ad66b7c9fb1f58040b72e65634dad44e6a55cfc39b5661e2884fa84c1f524a7e
Instruction Fuzzy Hash: AB329C75E002048FDB54DF68D894BAEBBB2EF88314F258469E909EB394DB30DC45CB94

Function 02DF4A98 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3350336235.0000000002DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2df0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dfec8d6197ee1a55af1e98150e73546ea28ffe9745827c41d6f9757bbbd3d56c
Instruction ID: aa03c307774d9dde92070c6a3f79d62dad780e8e93741db07f274bb31a167bd4
Opcode Fuzzy Hash: dfec8d6197ee1a55af1e98150e73546ea28ffe9745827c41d6f9757bbbd3d56c
Instruction Fuzzy Hash: 0DB18F71E002098FDB50CFA9C98579EBBF2AF88314F158129DA15EB354EB349C85CB85

Function 02DF3E80 Relevance: .2, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3350336235.0000000002DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2df0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b3eea267a3b41a635936a9e75702b1a1a136c809ea2590ff027c4dee9537851
Instruction ID: 737584947cf01d679f2e178f339e4e37162c93e629623a3e9c351e8e4217cd16
Opcode Fuzzy Hash: 3b3eea267a3b41a635936a9e75702b1a1a136c809ea2590ff027c4dee9537851
Instruction Fuzzy Hash: 02918E70E002499FDF50CFA8C98579EBBF2AF88314F168129E615E7394EB749C45CB85

Function 02DF6ED8 Relevance: 2.6, Strings: 2, Instructions: 144
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

LRsq, xrefs: 02DF6FE5
LRsq, xrefs: 02DF6F0E

Memory Dump Source

Source File: 00000004.00000002.3350336235.0000000002DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2df0000_RegAsm.jbxd

Similarity

API ID:
String ID: LRsq$LRsq
API String ID: 0-2113534932
Opcode ID: 3446162b4e1e2e22ae1642d47aafb1b0669952429df565428033295cd2464204
Instruction ID: 25e86bb0326bf107ee6692c1f1f5f1803c79fe3f32bc63b4f3521e0744789d2f
Opcode Fuzzy Hash: 3446162b4e1e2e22ae1642d47aafb1b0669952429df565428033295cd2464204
Instruction Fuzzy Hash: B441F571A002159FDB19DB78C4507EEBBB6EF89300F21842AE911EB781EB75DC46CB94

Function 0646E1B0 Relevance: 1.6, APIs: 1, Instructions: 110
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000004.00000002.3377147407.0000000006460000.00000040.00000800.00020000.00000000.sdmp, Offset: 06460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6460000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb70535a978946779800f7a9af925540448de9bf37db91886f5d1da695ae0492
Instruction ID: f1088249810e3bbba02e4aadc0021779d64411eeb42292208e58124a04c13755
Opcode Fuzzy Hash: cb70535a978946779800f7a9af925540448de9bf37db91886f5d1da695ae0492
Instruction Fuzzy Hash: 45317A72E053924FCB119B7AD8146DEBFF1AF85210F1485ABE404DB241DB789885C7D1

Function 0646E280 Relevance: 1.6, APIs: 1, Instructions: 66
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNEL32(?,?,?,?,?,?,?,?,?,0646E202), ref: 0646E2EF

Memory Dump Source

Source File: 00000004.00000002.3377147407.0000000006460000.00000040.00000800.00020000.00000000.sdmp, Offset: 06460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6460000_RegAsm.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: dfed42ebb578929c0d6e8b68ee6027f7f0888affb473b7cd6deeaa76c5df05bc
Instruction ID: 6eaf40c72aff8fa6d6a366c53aaec3d8ab081dd9e86367c42d440671420deae4
Opcode Fuzzy Hash: dfed42ebb578929c0d6e8b68ee6027f7f0888affb473b7cd6deeaa76c5df05bc
Instruction Fuzzy Hash: A52157B5C0021ADBDB10CFAAC544BDEBBF5AF48320F25855AE818A7740D77899408FA1

Function 0646D5AC Relevance: 1.6, APIs: 1, Instructions: 55
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNEL32(?,?,?,?,?,?,?,?,?,0646E202), ref: 0646E2EF

Memory Dump Source

Source File: 00000004.00000002.3377147407.0000000006460000.00000040.00000800.00020000.00000000.sdmp, Offset: 06460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6460000_RegAsm.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: 65e815f19a053fa2e70b02ee6a06b62941d9cf6bf891c22eeb3794f0f1f79750
Instruction ID: 7c7d0692ae23e90197f53e8de56df0d25e2c1006dfb0902a610867bb2ab3b758
Opcode Fuzzy Hash: 65e815f19a053fa2e70b02ee6a06b62941d9cf6bf891c22eeb3794f0f1f79750
Instruction Fuzzy Hash: 991103B5C0465A9BDB10CF9AC544BEEFBF4AF48320F14816AE918B7240D378A944CFE1

Function 02DFF2ED Relevance: 1.4, Strings: 1, Instructions: 110COMMON

Download Yara Rule

Strings

PHsq, xrefs: 02DFF43B

Memory Dump Source

Source File: 00000004.00000002.3350336235.0000000002DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2df0000_RegAsm.jbxd

Similarity

API ID:
String ID: PHsq
API String ID: 0-3083888473
Opcode ID: 284163cfb91ee9ae396a44836a5cd9e687c54a46533bcc3aadd99580d750141e
Instruction ID: f431061c0895ef348a2b1c938f13f190600b7a9762ec1beefb4acc9658f59867
Opcode Fuzzy Hash: 284163cfb91ee9ae396a44836a5cd9e687c54a46533bcc3aadd99580d750141e
Instruction Fuzzy Hash: 1D310131B002058FCB59AB34D5947AE7BE3EB89200F154869D502DB385EF39DC46C795

Function 02DFF300 Relevance: 1.4, Strings: 1, Instructions: 105COMMON

Download Yara Rule

Strings

PHsq, xrefs: 02DFF43B

Memory Dump Source

Source File: 00000004.00000002.3350336235.0000000002DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2df0000_RegAsm.jbxd

Similarity

API ID:
String ID: PHsq
API String ID: 0-3083888473
Opcode ID: 1a2397ed04bfc320d0e1102e69b0f7ba9acc014ee23a3383cab67ce41220bdf8
Instruction ID: 8e06e9cf6230808b9c8cae419eb562a9f7b866ab8defc55b0e5dc302f0d1a998
Opcode Fuzzy Hash: 1a2397ed04bfc320d0e1102e69b0f7ba9acc014ee23a3383cab67ce41220bdf8
Instruction Fuzzy Hash: 3431D031B002098FCB59AB38D55466E7BE7BF89200F154868D506DB389EF35DC45CB99

Function 02DF6F78 Relevance: 1.3, Strings: 1, Instructions: 95COMMON

Download Yara Rule

Strings

LRsq, xrefs: 02DF6FE5

Memory Dump Source

Source File: 00000004.00000002.3350336235.0000000002DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2df0000_RegAsm.jbxd

Similarity

API ID:
String ID: LRsq
API String ID: 0-3165563352
Opcode ID: ae508d534dc0dac0c37764c8a3aa63b887cb60babcb3b862eb25e29eb569031f
Instruction ID: ca337a9ff51e8c41cb874322622b1b39ba4aee5923e758fff76fd39903c0ad4c
Opcode Fuzzy Hash: ae508d534dc0dac0c37764c8a3aa63b887cb60babcb3b862eb25e29eb569031f
Instruction Fuzzy Hash: 56316B71E002099BEB58CF65D440BDEF7B2EF89310F218526E912EB740EB719D45CB54

Function 02DF6B87 Relevance: 1.3, Strings: 1, Instructions: 60COMMON

Download Yara Rule

Strings

LRsq, xrefs: 02DF6BD7

Memory Dump Source

Source File: 00000004.00000002.3350336235.0000000002DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2df0000_RegAsm.jbxd

Similarity

API ID:
String ID: LRsq
API String ID: 0-3165563352
Opcode ID: c66eee6658197f4b1fa2de8950320e7a48393c969fc52a9df42be592f91a71dc
Instruction ID: d703d5815a5b50f1156ce91bbd9be23babe6d016e8eb341e8d435eef619e9529
Opcode Fuzzy Hash: c66eee6658197f4b1fa2de8950320e7a48393c969fc52a9df42be592f91a71dc
Instruction Fuzzy Hash: 941129B27082514FC705A7B8D4A53AE7FB2EF8A314F14846FC996CB741DE789842C791

Function 02DF7908 Relevance: .6, Instructions: 553COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3350336235.0000000002DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2df0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55492766676b78bff9348c80476b075cc9a4a35603656a99e43ef7d76f5aaece
Instruction ID: 3a629f859b4fd8a48dc367f1c1af603bee26ebe13ccfaca2362114c2ea3e932b
Opcode Fuzzy Hash: 55492766676b78bff9348c80476b075cc9a4a35603656a99e43ef7d76f5aaece
Instruction Fuzzy Hash: F0125D307002029BDB59AB38E494B6CB7A2FB89314F618D39E506CB345CF79DC86DB95

Function 02DF7918 Relevance: .6, Instructions: 550COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3350336235.0000000002DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2df0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b6a8fc2e3ab451a0aa2b33e81676053e0acfe6782054f5227fac28dfe6c57ae
Instruction ID: c0a5d8cbe6626c9b6263938562bbd3cc451a016e0d7a1d65cee1ef9fab6da76e
Opcode Fuzzy Hash: 5b6a8fc2e3ab451a0aa2b33e81676053e0acfe6782054f5227fac28dfe6c57ae
Instruction Fuzzy Hash: 1A126D307002069BDB59AB38E494B6CB7A2FB89314F618D2DE506CB345CF75DC82CB95

Function 02DF4A8E Relevance: .3, Instructions: 259COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3350336235.0000000002DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2df0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c702ebfbf84adf514ab6394ebf6873a84d7b7c112a125b206ab48ffd9f1752d8
Instruction ID: c217d3cf2c3133364c508f1f4f924eb16f0e0877ee44654b23bb5bb896fa0b66
Opcode Fuzzy Hash: c702ebfbf84adf514ab6394ebf6873a84d7b7c112a125b206ab48ffd9f1752d8
Instruction Fuzzy Hash: 5EA17E71E00209CFDB50CFA8D9857DEBBF1AF88314F158129EA18EB354EB749885CB95

Function 02DF9364 Relevance: .2, Instructions: 240COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3350336235.0000000002DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2df0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38001b1c553b2de0148c21b75247cc7b9cead7e91ef44560e2b4e3e3dddbc83e
Instruction ID: 427288ad8e5059cab1d7cf4a8143dd52084403ce3dda53879e215e4e12d054ef
Opcode Fuzzy Hash: 38001b1c553b2de0148c21b75247cc7b9cead7e91ef44560e2b4e3e3dddbc83e
Instruction Fuzzy Hash: 64917D74A002049FCB58DF68D494BADBBF2EF88314F158429E906EB364DB35DC46CB54

Function 02DF3E74 Relevance: .2, Instructions: 234COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3350336235.0000000002DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2df0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10b6b0ea8dcf841ab05f5a045c8b4e515e6577e69b74e2a812a3df2e95b73ba6
Instruction ID: bf345c4a3e8dc4c104a72d2febdc888da175074899c077f42618c0941bdc6395
Opcode Fuzzy Hash: 10b6b0ea8dcf841ab05f5a045c8b4e515e6577e69b74e2a812a3df2e95b73ba6
Instruction Fuzzy Hash: 5A918E70E00249DFDB90CFA8C9857DEBBF2AF48314F168129E615E7394EB349885CB95

Function 02DF4810 Relevance: .2, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3350336235.0000000002DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2df0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ebb534f7cc5407b77e369692bcb9382b594dfb8aa380ffb5f2fb4495510dc69a
Instruction ID: 04f962e0c17547988dd2d7fa18dc6a2a812d0dfc6c038aea915d63803aa5e27a
Opcode Fuzzy Hash: ebb534f7cc5407b77e369692bcb9382b594dfb8aa380ffb5f2fb4495510dc69a
Instruction Fuzzy Hash: 56717AB0E04249CFDB54CFA9C98579EBBF2BF88314F158129EA15A7354EB349841CB98

Function 02DF4804 Relevance: .2, Instructions: 179COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3350336235.0000000002DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2df0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35b02711598c91c83c089afed9c64529dac080a3c74cea966f77fa3a388140fc
Instruction ID: 2ccf1069fc8a99efc0a145f039ca5d86bb308b8e9da8f824f59e99d3618ab825
Opcode Fuzzy Hash: 35b02711598c91c83c089afed9c64529dac080a3c74cea966f77fa3a388140fc
Instruction Fuzzy Hash: 417169B0E00249CFDB50CFA9C98579EBBF2BF48318F158129EA15A7354EB349845CB99

Function 02DF6CDC Relevance: .1, Instructions: 141COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3350336235.0000000002DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2df0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59efaf6585c94028cde4c5b76a2f4bd39714cb8fb5ebb745a6977a91b7c4f330
Instruction ID: 5426d2dea2e0648c4df0e55fa78ad81254e4c941f5778dca04c376bba8b3fa70
Opcode Fuzzy Hash: 59efaf6585c94028cde4c5b76a2f4bd39714cb8fb5ebb745a6977a91b7c4f330
Instruction Fuzzy Hash: 345144B2D002188FDB58CFAAC884BDDBBB5FF48314F158129E825AB754DB74A844CF94

Function 02DF6CE8 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3350336235.0000000002DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2df0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b13905951314da3644b6f71e7460e93fb9e76f01a57e7f06b312f6b9637e5909
Instruction ID: 33723f9e4a97019b66967dcec6870d009da0501435fbcde7c1192d08f9ae2021
Opcode Fuzzy Hash: b13905951314da3644b6f71e7460e93fb9e76f01a57e7f06b312f6b9637e5909
Instruction Fuzzy Hash: F55136B2D002188FDB58CFA9C884BDDBBB5BF48314F158129E825BB755DB74A844CF98

Function 02DF1128 Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3350336235.0000000002DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2df0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5d1b302aac0b445361f183d6d26c700418a4d42559530cda40b07d0abd59920
Instruction ID: f3ec432099c33477de3c153d58523db3b2a6cec550d3d53260115e7c5a413d79
Opcode Fuzzy Hash: d5d1b302aac0b445361f183d6d26c700418a4d42559530cda40b07d0abd59920
Instruction Fuzzy Hash: 6D51207124224EEFD74AFB28F8E19643F75FB52304B049D79D0049B23EDA306949EB85

Function 02DF1138 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3350336235.0000000002DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2df0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4e9ef367cb529c1cec5ed9c0c1b1951a9d282eee27138b2585917137c5e0c47
Instruction ID: 59643b3b4496d30d2473cab17e0fa5971838413471bddf100bf7b4d800094c19
Opcode Fuzzy Hash: d4e9ef367cb529c1cec5ed9c0c1b1951a9d282eee27138b2585917137c5e0c47
Instruction Fuzzy Hash: B951EF7124224EEFC74AFB28F9E19543F66F752304B049D79E0049B23EDA706949EB85

Function 02DFF1B0 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3350336235.0000000002DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2df0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95b82141fffc851d0db1b0ccd68966ce65aec781a50afe2120aa81e6333b6d51
Instruction ID: 75c5b632503062ee060ea21adf935ca1683d4ac546e37e44a404323787dd06d2
Opcode Fuzzy Hash: 95b82141fffc851d0db1b0ccd68966ce65aec781a50afe2120aa81e6333b6d51
Instruction Fuzzy Hash: E9314F35E002099BDB18DFA4D894B9EB7B2FF89310F50C919E906E7790DB71AC46CB94

Function 02DF26DC Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3350336235.0000000002DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2df0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b7f363ee0f1f44ff4010d00aadb2ed3fc7856a6e331789913b4d2842e54dca4
Instruction ID: c01208c37cb9dda6bd77d503d3aa80bb50c55b6d8254eaab5daa0b11707a78e7
Opcode Fuzzy Hash: 4b7f363ee0f1f44ff4010d00aadb2ed3fc7856a6e331789913b4d2842e54dca4
Instruction Fuzzy Hash: 5441FFB0900349DFDB10CFA9C984ADEBFF5AF48314F148429E819AB350DB75A949CB90

Function 02DFF1C0 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3350336235.0000000002DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2df0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 077a2a4576deacc0f0d48daa08b09fd64ebfe754f64ef248000e314af1ccceb7
Instruction ID: e74fe2031f552f343a2056ccdde602077ceff02b5fbffacec5c90db955c106f1
Opcode Fuzzy Hash: 077a2a4576deacc0f0d48daa08b09fd64ebfe754f64ef248000e314af1ccceb7
Instruction Fuzzy Hash: FB314D35E102099FDF19DFA4D494A9EB7B2BF89310F10C929E906E7790DB71AC42CB94

Function 02DF26E8 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3350336235.0000000002DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2df0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e81fec82aed16fbbb22b3de36af54688aeb91500e4a3901f5488c5b764653e31
Instruction ID: 22d1c6cd15ae7499c4fafae8c4ecaa07d3b08b79e52ca4ec2850aa1c57310842
Opcode Fuzzy Hash: e81fec82aed16fbbb22b3de36af54688aeb91500e4a3901f5488c5b764653e31
Instruction Fuzzy Hash: A641EEB0D00349DFDB10CFA9C984ADEBFB5EF48314F248429E809AB354DB75A949CB90

Function 02DF9250 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3350336235.0000000002DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2df0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d029cfdf909b41df1ff79aa18a0573e72421ac053232913b44271df8a76549b4
Instruction ID: cfc4149549790cb8e73adfd72576e089264b31a1fd0c1d7dabd918880492a201
Opcode Fuzzy Hash: d029cfdf909b41df1ff79aa18a0573e72421ac053232913b44271df8a76549b4
Instruction Fuzzy Hash: B3317C31E0020A9BCF09CFA5D8A0BDEB7B2FF89314F548519E905AB340EB709846CB90

Function 02DF9260 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3350336235.0000000002DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2df0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b47beba39160c1ff30fad53ccb321c99958e7efa20baf11c7d85c88abe8741be
Instruction ID: d34770348f1f842185388afe7395418f03a300e6e296c688239fd4c7b909efbd
Opcode Fuzzy Hash: b47beba39160c1ff30fad53ccb321c99958e7efa20baf11c7d85c88abe8741be
Instruction Fuzzy Hash: 04218C31E0020A9BDF09DFA5D4A0B9EB7B2FF89300F50C529E905AB340DB70A846CB90

Function 02DF16A0 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3350336235.0000000002DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2df0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d52a645cb3e4ceee8b6ba6be14d48ad3281ca8eb25d7db794d324d759db0944b
Instruction ID: 3f096e04ca2b1f885791592875f6abffe58628a80d2665fd6b2cad8bb11b19fa
Opcode Fuzzy Hash: d52a645cb3e4ceee8b6ba6be14d48ad3281ca8eb25d7db794d324d759db0944b
Instruction Fuzzy Hash: 45212674200206EBDF5AEB28E8D47993765EB40344F215A26E50ECB359EF30DC81DBD6

Function 02DF9150 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3350336235.0000000002DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2df0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8de7054ba89f95f6e09d3f1df07c39feda030c62fb52a7d8de76dd85ec4054d8
Instruction ID: 82fabf350a33ab23e1074eaacfe953a4d44d7c6a7038c79adb08660432f7e222
Opcode Fuzzy Hash: 8de7054ba89f95f6e09d3f1df07c39feda030c62fb52a7d8de76dd85ec4054d8
Instruction Fuzzy Hash: 5F218E34E0020A8BDB18CFA4D854BDEB7B2EF89300F51862AE916E7341EB709D46CB54

Function 02DF4F88 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3350336235.0000000002DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2df0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8cec410515b30d606858d8f8c866239d54255275b4d13963003f46f21393129a
Instruction ID: 24f28aa17b2bc71512da894a47a94c9ee297fcbc4555b3aec27ca45b320c45b3
Opcode Fuzzy Hash: 8cec410515b30d606858d8f8c866239d54255275b4d13963003f46f21393129a
Instruction Fuzzy Hash: E0214834700209CFCB98DB78D558BAD77F1AF48300F214468E606EB7A4EB329D04CBA4

Function 0133D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3349569656.000000000133D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0133D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_133d000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80e85aa24129dd6564dc37119324fb1e4bc04b1caec0949a0f4808747f815ea7
Instruction ID: 2dc08091e446cca7a1fea404f72e6d366bdf166e0717f03bd68ec9b5a3f4dc36
Opcode Fuzzy Hash: 80e85aa24129dd6564dc37119324fb1e4bc04b1caec0949a0f4808747f815ea7
Instruction Fuzzy Hash: B52142B1604204DFCB15CF68D9C0B26FB65FBC4B18F60C96DE80A4B246C33AC447CA61

Function 02DF1380 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3350336235.0000000002DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2df0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 900f1d6112b01aa167862a848a74b39ed844b440845bb9a814e1001af2e36c88
Instruction ID: 2f1926365d29d17897ec5cd5d3ed95eeb4e791eb3b82079a0c3b020e8f7805f9
Opcode Fuzzy Hash: 900f1d6112b01aa167862a848a74b39ed844b440845bb9a814e1001af2e36c88
Instruction Fuzzy Hash: E221E470A00315DFDF796628D4983AD3AA5E746315F12082AF64BCB381DF29CC81C78A

Function 02DF9160 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3350336235.0000000002DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2df0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87b03b9d9178c2370327546b54dafa60bea580e7af9ad2f6af60a3e42473b1f3
Instruction ID: 7cc033efe10d8b14f59fcebc9f8328f7c5cb741baab4b307788c1c36ca5df109
Opcode Fuzzy Hash: 87b03b9d9178c2370327546b54dafa60bea580e7af9ad2f6af60a3e42473b1f3
Instruction Fuzzy Hash: 12214F34E0020A9BDB18CFA5D854BDEB7B2AF89310F51862AE915F7340EB71AD46CB54

Function 02DF1888 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3350336235.0000000002DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2df0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba3cacbd951d40d1dbda695c3c2571e98c855fd1ec8fede9e43ce23cc6ec2f97
Instruction ID: cc9c64c43fe544d00a701aad55af1917c5b6c27bc578de967c90d984b5e18247
Opcode Fuzzy Hash: ba3cacbd951d40d1dbda695c3c2571e98c855fd1ec8fede9e43ce23cc6ec2f97
Instruction Fuzzy Hash: C5213930B00208CFDB94EB78C5547AE77F2AF49244F210468D61AEB364EB32CD40CBA5

Function 02DF16B0 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3350336235.0000000002DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2df0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 011a3d1ea9d4884d498929d78784f2085cc4c7bd27ad0c71ee1b8c84ff839016
Instruction ID: b41f4628e6111ccba7dfae8a66842e04be382ab8e9d4550f9bd965a9ec565f87
Opcode Fuzzy Hash: 011a3d1ea9d4884d498929d78784f2085cc4c7bd27ad0c71ee1b8c84ff839016
Instruction Fuzzy Hash: 6121DF78210207EBDF69EB28E894B593725EB44344F115A26E10ECB359DF30DC80DBD6

Function 02DF187A Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3350336235.0000000002DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2df0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 186f58e90d75036335c1fc97e27b1e641c469c77896b691a2075d3e5d43688c3
Instruction ID: f59e7cfba520b413574a3734773e08050641505aa3e04e26eb8022b4120df1bb
Opcode Fuzzy Hash: 186f58e90d75036335c1fc97e27b1e641c469c77896b691a2075d3e5d43688c3
Instruction Fuzzy Hash: 2E213930B00204CFDB94EB78C6557AD77F2AF49204F110468CA1AEB364EB32CD00CBA9

Function 02DF4F98 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3350336235.0000000002DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2df0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eec700f7dcee6ef56dfc2cc01723c374f9bcc16a2dd3c49a0d0b5a61eee9900b
Instruction ID: 1e64bd1ade2a4590447a233d5314b6e9f396532a4586a9e8e965ece8c8a3d70e
Opcode Fuzzy Hash: eec700f7dcee6ef56dfc2cc01723c374f9bcc16a2dd3c49a0d0b5a61eee9900b
Instruction Fuzzy Hash: E821E734700209CFDB98EB78D558AAD77F5AF49304F214468E606EB7A4EB329D04CBA5

Function 0133D006 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3349569656.000000000133D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0133D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_133d000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 139f0e0322f11e22d469c3a8d89c068f74197073a8813046a57fb62c0838b3ee
Instruction ID: 0e9f2b1c6f54fc63d9ca3fa6ef99b815a02526b3237edf2ce4323ca9257d0544
Opcode Fuzzy Hash: 139f0e0322f11e22d469c3a8d89c068f74197073a8813046a57fb62c0838b3ee
Instruction Fuzzy Hash: E12180755083809FCB02CF64D994B11BF71EB86618F28C5DAD8498F267C33AD85ACB62

Function 02DF17C2 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3350336235.0000000002DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2df0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57192cd1d07779eefcf39a4966622dbbc34c9c1b4982ad31781f5f4ac92846cf
Instruction ID: bc0f5aea3e197fb495ecdc59c1f5866d11f1140b0e2012708fbcf56d08c730bd
Opcode Fuzzy Hash: 57192cd1d07779eefcf39a4966622dbbc34c9c1b4982ad31781f5f4ac92846cf
Instruction Fuzzy Hash: BA110276B00212EBDF84AB79984879F7BE5FB88650F010425EA09D3341EB30CD01C7D0

Function 02DF0848 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3350336235.0000000002DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2df0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24f490c5e4cf49f27e90f5a3e378acdee513e03968b5d1efbedca02ceb13ef70
Instruction ID: e1f8c5ab7bd0e4f176b44eb86b0f5d91b893592a36c2c6b9f47c6cb60d45e236
Opcode Fuzzy Hash: 24f490c5e4cf49f27e90f5a3e378acdee513e03968b5d1efbedca02ceb13ef70
Instruction Fuzzy Hash: 9311C430B002095BDF947B79C45076D3261EB45222F224979E606CB34BDF60DC81CBD5

Function 02DF0838 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3350336235.0000000002DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2df0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 810d1738af77014fe158bd3741978ff2aab9b710032b729fe7737686a4ef2976
Instruction ID: 56abf22f6a111c0e6704a26976b45a065f3fd790eb444b8991dcc7839603a6d8
Opcode Fuzzy Hash: 810d1738af77014fe158bd3741978ff2aab9b710032b729fe7737686a4ef2976
Instruction Fuzzy Hash: 63110631A002055BEFA4BA74C45036E3251EB45326F264D39E643CB34BDB64DC81CBD9

Function 02DF80F1 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3350336235.0000000002DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2df0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24e4b186ed068eb3b661d2e6424d279ed87163a445f5dea66b3209092809db96
Instruction ID: d5490f04ac843c4a8bd07302f3dc6741ad924544754c9c5789c2bad6fc108f70
Opcode Fuzzy Hash: 24e4b186ed068eb3b661d2e6424d279ed87163a445f5dea66b3209092809db96
Instruction Fuzzy Hash: 7D118E7060020AEFDF05EB68E990B9DBBB1EB44304F109A79E905DB354DF319E45AB92

Function 02DF148E Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3350336235.0000000002DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2df0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c344e707d3461256c1aa333fd378672180c87a8d34515941f1fb7865cc6c8a55
Instruction ID: 9b89720debf22b7d9446ac5bdb9fc26ac4829dd1d3688f361eaa26bf55c2892f
Opcode Fuzzy Hash: c344e707d3461256c1aa333fd378672180c87a8d34515941f1fb7865cc6c8a55
Instruction Fuzzy Hash: 74118235A00215DFCB51EFB888502AE7BF6EF48215F16007AD909E7345E731DD41CBA5

Function 02DF1498 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3350336235.0000000002DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2df0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6dc4be234c977f8f6dbf1e7903bea0ba803b455194cbd80944e425292570d0c
Instruction ID: 75bcf898f7b2f9a02849aeb09949f6b745cbcbd9f6949aaf44daf5cf469449af
Opcode Fuzzy Hash: b6dc4be234c977f8f6dbf1e7903bea0ba803b455194cbd80944e425292570d0c
Instruction Fuzzy Hash: 86015E71A00215DFCB51EFB888502AE76F6EF88211F260479D509E7345E735DD41CBA9

Function 02DF9898 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3350336235.0000000002DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2df0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42d449e006b0581e342e403b50c5ff249c8b6b2b09bdd7ba610c1a45601d9a8a
Instruction ID: 7578d6fa09e82283330e45516c051828e17268a9c9ea28bb83cb74413864795b
Opcode Fuzzy Hash: 42d449e006b0581e342e403b50c5ff249c8b6b2b09bdd7ba610c1a45601d9a8a
Instruction Fuzzy Hash: 6701B530A002048BCB14EF59D98478EBB75FF84311F558568DC0C6B299DB74AD45CBE1

Function 02DF40FF Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3350336235.0000000002DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2df0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3486d65a18d6fa4c0fc7ad6dff733219587cdaca18e03f59496714cc9da32e80
Instruction ID: 8e53708cd8719d533fb0be3fe61d8d0a3b3b83aa5112e78ae987bfb3509d2280
Opcode Fuzzy Hash: 3486d65a18d6fa4c0fc7ad6dff733219587cdaca18e03f59496714cc9da32e80
Instruction Fuzzy Hash: DC111B30D04209DECFB4DB94D9887EEB772AF6131AF162029D211B22A4EB304DC9CF19

Function 02DF1524 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3350336235.0000000002DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2df0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d3090f828c6ca77c0d3f3aabc8d269cedd194e92cc17f95541d2362bff323f0
Instruction ID: 93b50dacd1f06aad63d2cbc6b2647f99f5e5d7317d5254a415315e5a9887482d
Opcode Fuzzy Hash: 1d3090f828c6ca77c0d3f3aabc8d269cedd194e92cc17f95541d2362bff323f0
Instruction Fuzzy Hash: 2DF02B77A08150DFD7628BA488901AC7B71FF94211B1B00D7CA4ADB356D735DC42CB19

Function 02DF7090 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3350336235.0000000002DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2df0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cbcff5d5c9d3ea6543eea3fe6e7ef8c6cc1c61566617dd5a8dac1d1d1eb2f93d
Instruction ID: 77b22170098c1e1d7d101ae458b014f9eab1e6c7ba5d93f70f57eb29b2903b29
Opcode Fuzzy Hash: cbcff5d5c9d3ea6543eea3fe6e7ef8c6cc1c61566617dd5a8dac1d1d1eb2f93d
Instruction Fuzzy Hash: 66F0EC39B00218CFCB08DB64D699BADB7B2EF89715F114068E6069B3A5DF31AD42DB40

Function 02DF8100 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3350336235.0000000002DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2df0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c25ab5c62b1e9bb38dbb8df4240a9acd45774e82a93a5ca770c9e9446e5de7e
Instruction ID: d36366ffed94d5d868ead49f96f7bc819bcbeafb2a0c98d3ef50cf6df437f9c7
Opcode Fuzzy Hash: 5c25ab5c62b1e9bb38dbb8df4240a9acd45774e82a93a5ca770c9e9446e5de7e
Instruction Fuzzy Hash: 67F0317491010EEFCF09FFB8F990A9D77B1EB44304F509A79C905AB254DE312E54AB91

Non-executed Functions

Function 06465000 Relevance: 13.0, Strings: 10, Instructions: 468COMMON

Download Yara Rule

Strings

$sq, xrefs: 0646554C
$sq, xrefs: 0646556E
$sq, xrefs: 064650F0
$sq, xrefs: 0646512D
$sq, xrefs: 064650FC
$sq, xrefs: 06465121
$sq, xrefs: 06465558
$sq, xrefs: 064654B9
$sq, xrefs: 06465562
$sq, xrefs: 064654AD

Memory Dump Source

Source File: 00000004.00000002.3377147407.0000000006460000.00000040.00000800.00020000.00000000.sdmp, Offset: 06460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6460000_RegAsm.jbxd

Similarity

API ID:
String ID: $sq$$sq$$sq$$sq$$sq$$sq$$sq$$sq$$sq$$sq
API String ID: 0-4253766512
Opcode ID: 49298e02a65225b23111f99c62dd89a1356c4bb03fcb1ddcfa765b77017d2541
Instruction ID: e8ad0a1b8b08b6c7665020f21ebc2c4b2cb260a7a944673ba0bd4a9569d7c4ca
Opcode Fuzzy Hash: 49298e02a65225b23111f99c62dd89a1356c4bb03fcb1ddcfa765b77017d2541
Instruction Fuzzy Hash: 6B123070E00219CFDB69DF65D894A9EB7B2FF89300F20856AE409AB355DB309D85CF51

Function 06463250 Relevance: 2.9, Strings: 2, Instructions: 407COMMON

Download Yara Rule

Strings

\Oxq, xrefs: 0646338C
XPxq, xrefs: 06463349

Memory Dump Source

Source File: 00000004.00000002.3377147407.0000000006460000.00000040.00000800.00020000.00000000.sdmp, Offset: 06460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6460000_RegAsm.jbxd

Similarity

API ID:
String ID: XPxq$\Oxq
API String ID: 0-1810105689
Opcode ID: 9ed1cca39419231288ce49320f37465b0155bbd6ca1b6c4ff90cb6c08786dfce
Instruction ID: 8dc2a38b09bd781859d8e23851c05c71ea7184e79431adaba24086444d3acc53
Opcode Fuzzy Hash: 9ed1cca39419231288ce49320f37465b0155bbd6ca1b6c4ff90cb6c08786dfce
Instruction Fuzzy Hash: 21D1E231B101548FDB66DF6AD480AAEBBB2FF89310F25946BE406DB351CA35DC42C792

Function 02DF41C8 Relevance: .3, Instructions: 281COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3350336235.0000000002DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2df0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1372443e6a2cd2a23db93db02c5ab16b95e299e0caab5de3a6c81ba0eb100918
Instruction ID: 58d1fcb67a8396f8a0fdbcb47468ff0ef5dff3730660d9be0a791727d94a0cac
Opcode Fuzzy Hash: 1372443e6a2cd2a23db93db02c5ab16b95e299e0caab5de3a6c81ba0eb100918
Instruction Fuzzy Hash: 41B15B70E00209CFDB50CFA9D9857AEBBF2AF88314F158129EA15A7394EB749C45CF85

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report PO F1298-24 Fabric Order.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Exploits

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_PO F1298-24 Fabr_697bf1cfe728f851d8e751bad862896dd0f1c69_57bd0835_fad05113-fe59-4ec5-9ada-2e05d5fb69b6\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER6BA7.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER6E48.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER6E97.tmp.xml

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_au4vegts.fju.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_tacpqzc0.0qh.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_w3yzu04u.qpr.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xkiufkyt.kek.ps1

C:\Windows\appcompat\Programs\Amcache.hve

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Windows Analysis Report
PO F1298-24 Fabric Order.exe

Function 0646BD08 Relevance: 4.3, Strings: 3, Instructions: 573
COMMON

Function 064656E0 Relevance: 3.0, Strings: 2, Instructions: 471
COMMON

Function 0646DD18 Relevance: 2.8, Strings: 2, Instructions: 332
COMMON

Function 06462B00 Relevance: 1.8, Strings: 1, Instructions: 589
COMMON

Function 02DF6ED8 Relevance: 2.6, Strings: 2, Instructions: 144
COMMON

Function 0646E1B0 Relevance: 1.6, APIs: 1, Instructions: 110
COMMON

Function 0646E280 Relevance: 1.6, APIs: 1, Instructions: 66
COMMON

Function 0646D5AC Relevance: 1.6, APIs: 1, Instructions: 55
COMMON