Windows Analysis Report
MDE_File_Sample_39fcbadcdb2708c0aef13776eca6ccd7370cf644.zip

Overview

General Information

Sample name: MDE_File_Sample_39fcbadcdb2708c0aef13776eca6ccd7370cf644.zip
Analysis ID: 1541184
MD5: b1114059d5b05be6d2d72e36c5faf24b
SHA1: 154bd0e4d01ba93d98d0dfc816c975155ba74461
SHA256: a2b371673dc9bf2d5b28909c3f953a3a9a7ebc7f0a04bef99590dab294310dd8

Detection

Score: 1
Range: 0 - 100
Whitelisted: false
Confidence: 80%

Signatures

Creates a process in suspended mode (likely to inject code)
May sleep (evasive loops) to hinder dynamic analysis
Queries the volume information (name, serial number etc) of a device

Classification

Source: classification engine Classification label: clean1.winZIP@9/19@0/0
Source: C:\Program Files\7-Zip\7zG.exe File created: C:\Users\user\Desktop\.text
Source: C:\Windows\System32\OpenWith.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5564:120:WilError_03
Source: C:\Windows\System32\mspaint.exe File read: C:\Users\desktop.ini
Source: C:\Windows\System32\rundll32.exe Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers
Source: unknown Process created: C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
Source: unknown Process created: C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
Source: unknown Process created: C:\Program Files\7-Zip\7zG.exe "C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\user\Desktop\39fcbadcdb2708c0aef13776eca6ccd7370cf644~\" -ad -an -ai#7zMap30539:132:7zEvent18843
Source: unknown Process created: C:\Program Files\7-Zip\7zG.exe "C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\user\Desktop\" -an -ai#7zMap14814:132:7zEvent15960
Source: unknown Process created: C:\Windows\System32\mspaint.exe "C:\Windows\system32\mspaint.exe" "C:\Users\user\Desktop\.rsrc\0\ICON\50.ico"
Source: unknown Process created: C:\Windows\System32\notepad.exe "C:\Windows\system32\NOTEPAD.EXE" C:\Users\user\Desktop\.rsrc\1033\version.txt
Source: unknown Process created: C:\Windows\System32\OpenWith.exe C:\Windows\system32\OpenWith.exe -Embedding
Source: C:\Windows\System32\OpenWith.exe Process created: C:\Windows\System32\notepad.exe "C:\Windows\system32\NOTEPAD.EXE" C:\Users\user\Desktop\.text
Source: C:\Windows\System32\OpenWith.exe Process created: C:\Windows\System32\notepad.exe "C:\Windows\system32\NOTEPAD.EXE" C:\Users\user\Desktop\.text
Source: unknown Process created: C:\Windows\System32\notepad.exe "C:\Windows\system32\NOTEPAD.EXE" C:\Users\user\Desktop\.text
Source: C:\Program Files\7-Zip\7zG.exe Section loaded: kernel.appcore.dll
Source: C:\Program Files\7-Zip\7zG.exe Section loaded: uxtheme.dll
Source: C:\Program Files\7-Zip\7zG.exe Section loaded: cryptbase.dll
Source: C:\Program Files\7-Zip\7zG.exe Section loaded: explorerframe.dll
Source: C:\Program Files\7-Zip\7zG.exe Section loaded: textshaping.dll
Source: C:\Program Files\7-Zip\7zG.exe Section loaded: textinputframework.dll
Source: C:\Program Files\7-Zip\7zG.exe Section loaded: coreuicomponents.dll
Source: C:\Program Files\7-Zip\7zG.exe Section loaded: coremessaging.dll
Source: C:\Program Files\7-Zip\7zG.exe Section loaded: ntmarta.dll
Source: C:\Program Files\7-Zip\7zG.exe Section loaded: coremessaging.dll
Source: C:\Program Files\7-Zip\7zG.exe Section loaded: wintypes.dll
Source: C:\Program Files\7-Zip\7zG.exe Section loaded: wintypes.dll
Source: C:\Program Files\7-Zip\7zG.exe Section loaded: wintypes.dll
Source: C:\Program Files\7-Zip\7zG.exe Section loaded: kernel.appcore.dll
Source: C:\Program Files\7-Zip\7zG.exe Section loaded: uxtheme.dll
Source: C:\Program Files\7-Zip\7zG.exe Section loaded: cryptbase.dll
Source: C:\Program Files\7-Zip\7zG.exe Section loaded: explorerframe.dll
Source: C:\Program Files\7-Zip\7zG.exe Section loaded: textshaping.dll
Source: C:\Program Files\7-Zip\7zG.exe Section loaded: textinputframework.dll
Source: C:\Program Files\7-Zip\7zG.exe Section loaded: coreuicomponents.dll
Source: C:\Program Files\7-Zip\7zG.exe Section loaded: coremessaging.dll
Source: C:\Program Files\7-Zip\7zG.exe Section loaded: ntmarta.dll
Source: C:\Program Files\7-Zip\7zG.exe Section loaded: wintypes.dll
Source: C:\Program Files\7-Zip\7zG.exe Section loaded: wintypes.dll
Source: C:\Program Files\7-Zip\7zG.exe Section loaded: wintypes.dll
Source: C:\Windows\System32\mspaint.exe Section loaded: apphelp.dll
Source: C:\Windows\System32\mspaint.exe Section loaded: acgenral.dll
Source: C:\Windows\System32\mspaint.exe Section loaded: userenv.dll
Source: C:\Windows\System32\mspaint.exe Section loaded: mpr.dll
Source: C:\Windows\System32\mspaint.exe Section loaded: sspicli.dll
Source: C:\Windows\System32\mspaint.exe Section loaded: mfc42u.dll
Source: C:\Windows\System32\mspaint.exe Section loaded: propsys.dll
Source: C:\Windows\System32\mspaint.exe Section loaded: winmm.dll
Source: C:\Windows\System32\mspaint.exe Section loaded: ninput.dll
Source: C:\Windows\System32\mspaint.exe Section loaded: uxtheme.dll
Source: C:\Windows\System32\mspaint.exe Section loaded: msftedit.dll
Source: C:\Windows\System32\mspaint.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\mspaint.exe Section loaded: uiribbon.dll
Source: C:\Windows\System32\mspaint.exe Section loaded: xmllite.dll
Source: C:\Windows\System32\mspaint.exe Section loaded: windows.storage.dll
Source: C:\Windows\System32\mspaint.exe Section loaded: wldp.dll
Source: C:\Windows\System32\mspaint.exe Section loaded: efswrt.dll
Source: C:\Windows\System32\mspaint.exe Section loaded: wintypes.dll
Source: C:\Windows\System32\mspaint.exe Section loaded: twinapi.appcore.dll
Source: C:\Windows\System32\mspaint.exe Section loaded: sti.dll
Source: C:\Windows\System32\mspaint.exe Section loaded: wiatrace.dll
Source: C:\Windows\System32\mspaint.exe Section loaded: atlthunk.dll
Source: C:\Windows\System32\mspaint.exe Section loaded: dwmapi.dll
Source: C:\Windows\System32\mspaint.exe Section loaded: windowscodecs.dll
Source: C:\Windows\System32\mspaint.exe Section loaded: textshaping.dll
Source: C:\Windows\System32\mspaint.exe Section loaded: oleacc.dll
Source: C:\Windows\System32\mspaint.exe Section loaded: windows.staterepositoryps.dll
Source: C:\Windows\System32\mspaint.exe Section loaded: photometadatahandler.dll
Source: C:\Windows\System32\mspaint.exe Section loaded: textinputframework.dll
Source: C:\Windows\System32\mspaint.exe Section loaded: coreuicomponents.dll
Source: C:\Windows\System32\mspaint.exe Section loaded: coremessaging.dll
Source: C:\Windows\System32\mspaint.exe Section loaded: ntmarta.dll
Source: C:\Windows\System32\mspaint.exe Section loaded: msxml6.dll
Source: C:\Windows\System32\notepad.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\notepad.exe Section loaded: uxtheme.dll
Source: C:\Windows\System32\notepad.exe Section loaded: mrmcorer.dll
Source: C:\Windows\System32\notepad.exe Section loaded: windows.storage.dll
Source: C:\Windows\System32\notepad.exe Section loaded: wldp.dll
Source: C:\Windows\System32\notepad.exe Section loaded: textshaping.dll
Source: C:\Windows\System32\notepad.exe Section loaded: efswrt.dll
Source: C:\Windows\System32\notepad.exe Section loaded: mpr.dll
Source: C:\Windows\System32\notepad.exe Section loaded: wintypes.dll
Source: C:\Windows\System32\notepad.exe Section loaded: twinapi.appcore.dll
Source: C:\Windows\System32\notepad.exe Section loaded: oleacc.dll
Source: C:\Windows\System32\notepad.exe Section loaded: textinputframework.dll
Source: C:\Windows\System32\notepad.exe Section loaded: coreuicomponents.dll
Source: C:\Windows\System32\notepad.exe Section loaded: coremessaging.dll
Source: C:\Windows\System32\notepad.exe Section loaded: ntmarta.dll
Source: C:\Windows\System32\notepad.exe Section loaded: urlmon.dll
Source: C:\Windows\System32\notepad.exe Section loaded: iertutil.dll
Source: C:\Windows\System32\notepad.exe Section loaded: srvcli.dll
Source: C:\Windows\System32\notepad.exe Section loaded: netutils.dll
Source: C:\Windows\System32\notepad.exe Section loaded: propsys.dll
Source: C:\Windows\System32\notepad.exe Section loaded: policymanager.dll
Source: C:\Windows\System32\notepad.exe Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\OpenWith.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\OpenWith.exe Section loaded: uxtheme.dll
Source: C:\Windows\System32\OpenWith.exe Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\System32\OpenWith.exe Section loaded: windows.storage.dll
Source: C:\Windows\System32\OpenWith.exe Section loaded: wldp.dll
Source: C:\Windows\System32\OpenWith.exe Section loaded: twinui.dll
Source: C:\Windows\System32\OpenWith.exe Section loaded: wintypes.dll
Source: C:\Windows\System32\OpenWith.exe Section loaded: powrprof.dll
Source: C:\Windows\System32\OpenWith.exe Section loaded: dwmapi.dll
Source: C:\Windows\System32\OpenWith.exe Section loaded: pdh.dll
Source: C:\Windows\System32\OpenWith.exe Section loaded: umpdc.dll
Source: C:\Windows\System32\OpenWith.exe Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\OpenWith.exe Section loaded: actxprxy.dll
Source: C:\Windows\System32\OpenWith.exe Section loaded: propsys.dll
Source: C:\Windows\System32\OpenWith.exe Section loaded: windows.staterepositoryps.dll
Source: C:\Windows\System32\OpenWith.exe Section loaded: windows.ui.appdefaults.dll
Source: C:\Windows\System32\OpenWith.exe Section loaded: windows.ui.immersive.dll
Source: C:\Windows\System32\OpenWith.exe Section loaded: profapi.dll
Source: C:\Windows\System32\OpenWith.exe Section loaded: ntmarta.dll
Source: C:\Windows\System32\OpenWith.exe Section loaded: uiautomationcore.dll
Source: C:\Windows\System32\OpenWith.exe Section loaded: dui70.dll
Source: C:\Windows\System32\OpenWith.exe Section loaded: duser.dll
Source: C:\Windows\System32\OpenWith.exe Section loaded: dwrite.dll
Source: C:\Windows\System32\OpenWith.exe Section loaded: bcp47mrm.dll
Source: C:\Windows\System32\OpenWith.exe Section loaded: uianimation.dll
Source: C:\Windows\System32\OpenWith.exe Section loaded: d3d11.dll
Source: C:\Windows\System32\OpenWith.exe Section loaded: dxgi.dll
Source: C:\Windows\System32\OpenWith.exe Section loaded: d3d10warp.dll
Source: C:\Windows\System32\OpenWith.exe Section loaded: resourcepolicyclient.dll
Source: C:\Windows\System32\OpenWith.exe Section loaded: dxcore.dll
Source: C:\Windows\System32\OpenWith.exe Section loaded: dcomp.dll
Source: C:\Windows\System32\OpenWith.exe Section loaded: oleacc.dll
Source: C:\Windows\System32\OpenWith.exe Section loaded: edputil.dll
Source: C:\Windows\System32\OpenWith.exe Section loaded: windows.ui.dll
Source: C:\Windows\System32\OpenWith.exe Section loaded: windowmanagementapi.dll
Source: C:\Windows\System32\OpenWith.exe Section loaded: textinputframework.dll
Source: C:\Windows\System32\OpenWith.exe Section loaded: inputhost.dll
Source: C:\Windows\System32\OpenWith.exe Section loaded: twinapi.appcore.dll
Source: C:\Windows\System32\OpenWith.exe Section loaded: coremessaging.dll
Source: C:\Windows\System32\OpenWith.exe Section loaded: coremessaging.dll
Source: C:\Windows\System32\OpenWith.exe Section loaded: twinapi.appcore.dll
Source: C:\Windows\System32\OpenWith.exe Section loaded: coreuicomponents.dll
Source: C:\Windows\System32\OpenWith.exe Section loaded: coreuicomponents.dll
Source: C:\Windows\System32\OpenWith.exe Section loaded: coremessaging.dll
Source: C:\Windows\System32\OpenWith.exe Section loaded: windowscodecs.dll
Source: C:\Windows\System32\OpenWith.exe Section loaded: thumbcache.dll
Source: C:\Windows\System32\OpenWith.exe Section loaded: policymanager.dll
Source: C:\Windows\System32\OpenWith.exe Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\OpenWith.exe Section loaded: apphelp.dll
Source: C:\Windows\System32\OpenWith.exe Section loaded: appresolver.dll
Source: C:\Windows\System32\OpenWith.exe Section loaded: bcp47langs.dll
Source: C:\Windows\System32\OpenWith.exe Section loaded: slc.dll
Source: C:\Windows\System32\OpenWith.exe Section loaded: userenv.dll
Source: C:\Windows\System32\OpenWith.exe Section loaded: sppc.dll
Source: C:\Windows\System32\OpenWith.exe Section loaded: tiledatarepository.dll
Source: C:\Windows\System32\OpenWith.exe Section loaded: staterepository.core.dll
Source: C:\Windows\System32\OpenWith.exe Section loaded: windows.staterepository.dll
Source: C:\Windows\System32\OpenWith.exe Section loaded: wtsapi32.dll
Source: C:\Windows\System32\OpenWith.exe Section loaded: windows.staterepositorycore.dll
Source: C:\Windows\System32\OpenWith.exe Section loaded: mrmcorer.dll
Source: C:\Windows\System32\OpenWith.exe Section loaded: sxs.dll
Source: C:\Windows\System32\OpenWith.exe Section loaded: directmanipulation.dll
Source: C:\Windows\System32\OpenWith.exe Section loaded: textshaping.dll
Source: C:\Windows\System32\OpenWith.exe Section loaded: urlmon.dll
Source: C:\Windows\System32\OpenWith.exe Section loaded: iertutil.dll
Source: C:\Windows\System32\OpenWith.exe Section loaded: srvcli.dll
Source: C:\Windows\System32\OpenWith.exe Section loaded: netutils.dll
Source: C:\Windows\System32\OpenWith.exe Section loaded: sspicli.dll
Source: C:\Windows\System32\OpenWith.exe Section loaded: pcacli.dll
Source: C:\Windows\System32\OpenWith.exe Section loaded: mpr.dll
Source: C:\Windows\System32\OpenWith.exe Section loaded: sfc_os.dll
Source: C:\Windows\System32\notepad.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\notepad.exe Section loaded: uxtheme.dll
Source: C:\Windows\System32\notepad.exe Section loaded: mrmcorer.dll
Source: C:\Windows\System32\notepad.exe Section loaded: windows.storage.dll
Source: C:\Windows\System32\notepad.exe Section loaded: wldp.dll
Source: C:\Windows\System32\notepad.exe Section loaded: textshaping.dll
Source: C:\Windows\System32\notepad.exe Section loaded: efswrt.dll
Source: C:\Windows\System32\notepad.exe Section loaded: mpr.dll
Source: C:\Windows\System32\notepad.exe Section loaded: wintypes.dll
Source: C:\Windows\System32\notepad.exe Section loaded: twinapi.appcore.dll
Source: C:\Windows\System32\notepad.exe Section loaded: oleacc.dll
Source: C:\Windows\System32\notepad.exe Section loaded: textinputframework.dll
Source: C:\Windows\System32\notepad.exe Section loaded: coreuicomponents.dll
Source: C:\Windows\System32\notepad.exe Section loaded: coremessaging.dll
Source: C:\Windows\System32\notepad.exe Section loaded: ntmarta.dll
Source: C:\Windows\System32\notepad.exe Section loaded: urlmon.dll
Source: C:\Windows\System32\notepad.exe Section loaded: iertutil.dll
Source: C:\Windows\System32\notepad.exe Section loaded: srvcli.dll
Source: C:\Windows\System32\notepad.exe Section loaded: netutils.dll
Source: C:\Windows\System32\notepad.exe Section loaded: propsys.dll
Source: C:\Windows\System32\notepad.exe Section loaded: policymanager.dll
Source: C:\Windows\System32\notepad.exe Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\notepad.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\notepad.exe Section loaded: uxtheme.dll
Source: C:\Windows\System32\notepad.exe Section loaded: mrmcorer.dll
Source: C:\Windows\System32\notepad.exe Section loaded: windows.storage.dll
Source: C:\Windows\System32\notepad.exe Section loaded: wldp.dll
Source: C:\Windows\System32\notepad.exe Section loaded: textshaping.dll
Source: C:\Windows\System32\notepad.exe Section loaded: efswrt.dll
Source: C:\Windows\System32\notepad.exe Section loaded: mpr.dll
Source: C:\Windows\System32\notepad.exe Section loaded: wintypes.dll
Source: C:\Windows\System32\notepad.exe Section loaded: twinapi.appcore.dll
Source: C:\Windows\System32\notepad.exe Section loaded: oleacc.dll
Source: C:\Windows\System32\notepad.exe Section loaded: textinputframework.dll
Source: C:\Windows\System32\notepad.exe Section loaded: coreuicomponents.dll
Source: C:\Windows\System32\notepad.exe Section loaded: coremessaging.dll
Source: C:\Windows\System32\notepad.exe Section loaded: ntmarta.dll
Source: C:\Windows\System32\notepad.exe Section loaded: urlmon.dll
Source: C:\Windows\System32\notepad.exe Section loaded: iertutil.dll
Source: C:\Windows\System32\notepad.exe Section loaded: srvcli.dll
Source: C:\Windows\System32\notepad.exe Section loaded: netutils.dll
Source: C:\Windows\System32\notepad.exe Section loaded: propsys.dll
Source: C:\Windows\System32\notepad.exe Section loaded: policymanager.dll
Source: C:\Windows\System32\notepad.exe Section loaded: msvcp110_win.dll
Source: C:\Program Files\7-Zip\7zG.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{56FDF344-FD6D-11d0-958A-006097C9A090}\InProcServer32
Source: C:\Windows\System32\mspaint.exe File opened: C:\Windows\system32\MSFTEDIT.DLL
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Program Files\7-Zip\7zG.exe Window detected: Number of UI elements: 15
Source: C:\Windows\System32\rundll32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\mspaint.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\mspaint.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\mspaint.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\mspaint.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Windows\System32\mspaint.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\mspaint.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe Process information set: NOOPENFILEERRORBOX
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Windows\System32\OpenWith.exe TID: 1240 Thread sleep count: 32 > 30
Source: C:\Windows\System32\mspaint.exe Process information queried: ProcessInformation
Creates a process in suspended mode (likely to inject code)
Source: C:\Windows\System32\OpenWith.exe Process created: C:\Windows\System32\notepad.exe "C:\Windows\system32\NOTEPAD.EXE" C:\Users\user\Desktop\.text
Queries the volume information (name, serial number etc) of a device
Source: C:\Windows\System32\notepad.exe Queries volume information: C:\Users\user\Desktop\.rsrc\1033\version.txt VolumeInformation
Source: C:\Windows\System32\OpenWith.exe Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
Source: C:\Windows\System32\OpenWith.exe Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation
Source: C:\Windows\System32\OpenWith.exe Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation
Source: C:\Windows\System32\OpenWith.exe Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation
Source: C:\Windows\System32\OpenWith.exe Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation
Source: C:\Windows\System32\OpenWith.exe Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation
Source: C:\Windows\System32\OpenWith.exe Queries volume information: C:\Windows\Fonts\segmdl2.ttf VolumeInformation
Source: C:\Windows\System32\OpenWith.exe Queries volume information: C:\Windows\Fonts\segmdl2.ttf VolumeInformation
Source: C:\Windows\System32\notepad.exe Queries volume information: C:\Users\user\Desktop\.text VolumeInformation
Source: C:\Windows\System32\notepad.exe Queries volume information: C:\Users\user\Desktop\.text VolumeInformation
windows-stand
⊘No contacted IP infos