Edit tour

Windows Analysis Report
SecuriteInfo.com.FileRepMalware.16359.15944.exe

Overview

General Information

Sample name:	SecuriteInfo.com.FileRepMalware.16359.15944.exe
Analysis ID:	1542662
MD5:	1ef81575c0f526800283239b2469818d
SHA1:	16509b0ae23980c3d49afe176d61e770affd8112
SHA256:	bf5ae3f1cfe10e6772e1ca445a9a49280141746d9a5a72bccfe3eb5786a6c9a0
Tags:	exe
Infos:

Detection

Score:	45
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Compliance

Score:	47
Range:	0 - 100

Signatures

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Contains functionality to log keystrokes (.Net Source)

Adds / modifies Windows certificates

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Contains functionality for read data from the clipboard

Contains functionality to shutdown / reboot the system

Contains long sleeps (>= 3 min)

Detected potential crypto function

Drops PE files

Enables debug privileges

Found dropped PE file which has not been started or loaded

Found inlined nop instructions (likely shell or obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

SecuriteInfo.com.FileRepMalware.16359.15944.exe (PID: 6660 cmdline: "C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.16359.15944.exe" MD5: 1EF81575C0F526800283239B2469818D)

KillProcPCTT.exe (PID: 6332 cmdline: "C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\KillProcPCTT.exe MD5: 58AB737BC9B7870455589C683CBBE7D9)

conhost.exe (PID: 1848 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

mssched.exe (PID: 1248 cmdline: "C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe" -f SecuriteInfo.com.FileRepMalware.16359.15944.exe MD5: DDD7094ECD63758C260126E8A8D7880F)

mssched.exe (PID: 7108 cmdline: "C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe" MD5: DDD7094ECD63758C260126E8A8D7880F)

cleanup

Sigma Signatures

Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.16359.15944.exe, ProcessId: 6660, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\scheduler

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for dropped file

Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\jusched32.exe	ReversingLabs: Detection: 25%
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe	ReversingLabs: Detection: 62%

Multi AV Scanner detection for submitted file

Source: SecuriteInfo.com.FileRepMalware.16359.15944.exe	ReversingLabs: Detection: 60%
Source: SecuriteInfo.com.FileRepMalware.16359.15944.exe	Virustotal: Detection: 67%			Perma Link

Compliance

Uses 32bit PE files

Source: SecuriteInfo.com.FileRepMalware.16359.15944.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

PE / OLE file has a valid certificate

Source: SecuriteInfo.com.FileRepMalware.16359.15944.exe

Static PE information: certificate valid

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: SecuriteInfo.com.FileRepMalware.16359.15944.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Binary contains paths to debug symbols

Source:	Binary string: D:\JenkinsWorkspaces\trebuchet-stage-release\AWSDotNetPublic\sdk\src\Core\obj\AWSSDK.Core.Net35\Release\net35\AWSSDK.Core.pdbSHA256 source: SecuriteInfo.com.FileRepMalware.16359.15944.exe, 00000000.00000002.2092551285.000000000040A000.00000004.00000001.01000000.00000003.sdmp, AWSSDK.Core.dll.0.dr
Source:	Binary string: /_/Src/Newtonsoft.Json/obj/Release/net35/Newtonsoft.Json.pdbSHA256 source: mssched.exe, 00000004.00000002.3325444659.000001FC2FAB2000.00000002.00000001.01000000.0000000E.sdmp, Newtonsoft.Json.dll.0.dr
Source:	Binary string: C:\Users\bryan\source\repos\pctattletalewindowsjusched\jusched32\obj\Debug\jusched32.pdb source: jusched32.exe.0.dr
Source:	Binary string: C:\Users\bryan\source\repos\pctattletalewindows\PCTTRecorder\obj\Debug\mssched.pdb,g source: mssched.exe, 00000004.00000000.2091397832.000001FC13C72000.00000002.00000001.01000000.00000008.sdmp, mssched.exe.0.dr
Source:	Binary string: 35\Release\net35\AWSSDK.Core.pdb source: SecuriteInfo.com.FileRepMalware.16359.15944.exe, 00000000.00000002.2092551285.000000000040A000.00000004.00000001.01000000.00000003.sdmp
Source:	Binary string: D:\JenkinsWorkspaces\trebuchet-stage-release\AWSDotNetPublic\sdk\src\Services\S3\obj\AWSSDK.S3.Net35\Release\net35\AWSSDK.S3.pdbSHA256t source: AWSSDK.S3.dll.0.dr
Source:	Binary string: C:\Users\bryan\source\repos\KillProcPCTT\KillProcPCTT\obj\Debug\KillProcPCTT.pdba{ m*_CorExeMainmscoree.dll source: KillProcPCTT.exe, 00000002.00000000.2071056452.00000000003C2000.00000002.00000001.01000000.00000004.sdmp, KillProcPCTT.exe.0.dr
Source:	Binary string: C:\Users\bryan\source\repos\pctattletalewindows\PCTTRecorder\obj\Debug\mssched.pdb source: mssched.exe, 00000004.00000000.2091397832.000001FC13C72000.00000002.00000001.01000000.00000008.sdmp, mssched.exe.0.dr
Source:	Binary string: D:\JenkinsWorkspaces\trebuchet-stage-release\AWSDotNetPublic\sdk\src\Core\obj\AWSSDK.Core.Net35\Release\net35\AWSSDK.Core.pdb source: SecuriteInfo.com.FileRepMalware.16359.15944.exe, 00000000.00000002.2092551285.000000000040A000.00000004.00000001.01000000.00000003.sdmp, AWSSDK.Core.dll.0.dr
Source:	Binary string: /_/Src/Newtonsoft.Json/obj/Release/net35/Newtonsoft.Json.pdb source: mssched.exe, 00000004.00000002.3325444659.000001FC2FAB2000.00000002.00000001.01000000.0000000E.sdmp, Newtonsoft.Json.dll.0.dr
Source:	Binary string: 35\Release\net35\AWSSDK.Core.pdbSHA256 source: SecuriteInfo.com.FileRepMalware.16359.15944.exe, 00000000.00000002.2092551285.000000000040A000.00000004.00000001.01000000.00000003.sdmp
Source:	Binary string: C:\Users\bryan\source\repos\KillProcPCTT\KillProcPCTT\obj\Debug\KillProcPCTT.pdb source: KillProcPCTT.exe, 00000002.00000000.2071056452.00000000003C2000.00000002.00000001.01000000.00000004.sdmp, KillProcPCTT.exe.0.dr
Source:	Binary string: .pdb source: AWSSDK.S3.dll.0.dr
Source:	Binary string: D:\JenkinsWorkspaces\trebuchet-stage-release\AWSDotNetPublic\sdk\src\Services\S3\obj\AWSSDK.S3.Net35\Release\net35\AWSSDK.S3.pdb source: AWSSDK.S3.dll.0.dr
Source:	Binary string: C:\Users\norritb\Documents\git\NsisDotNetChecker\plugin\Release\DotNetChecker.pdb source: DotNetChecker.dll.0.dr

Spreading

Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.16359.15944.exe	Code function: 0_2_00405C49 GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	0_2_00405C49
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.16359.15944.exe	Code function: 0_2_00406873 FindFirstFileW,FindClose,	0_2_00406873
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.16359.15944.exe	Code function: 0_2_0040290B FindFirstFileW,	0_2_0040290B

Software Vulnerabilities

Found inlined nop instructions (likely shell or obfuscated code)

Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe	Code function: 4x nop then jmp 00007FF848E72B09h	4_2_00007FF848E70A7A
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe	Code function: 4x nop then jmp 00007FF848E72B09h	4_2_00007FF848E72A75
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe	Code function: 4x nop then jmp 00007FF848E71806h	4_2_00007FF848E7165F
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe	Code function: 4x nop then jmp 00007FF848E91806h	6_2_00007FF848E91606

Networking

Source: AWSSDK.Core.dll.0.dr	String found in binary or memory: http://169.254.169.254
Source: AWSSDK.Core.dll.0.dr	String found in binary or memory: http://169.254.170.2
Source: AWSSDK.Core.dll.0.dr	String found in binary or memory: http://169.254.170.2aUnable
Source: Newtonsoft.Json.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: Newtonsoft.Json.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: Newtonsoft.Json.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/NETFoundationProjectsCodeSigningCA.crt0
Source: mssched.exe, 00000006.00000002.2191523893.00000125CA7FA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.FileRepMalware.16359.15944.exe, jusched32.exe.0.dr, KillProcPCTT.exe.0.dr, mssched.exe.0.dr	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: mssched.exe, 00000004.00000002.3324489153.000001FC2E3B0000.00000004.00000020.00020000.00000000.sdmp, mssched.exe, 00000006.00000002.2196206672.00000125E4BD0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: mssched.exe, 00000004.00000002.3321706794.000001FC14059000.00000004.00000020.00020000.00000000.sdmp, mssched.exe, 00000006.00000002.2191893132.00000125CA9F5000.00000004.00000020.00020000.00000000.sdmp, mssched.exe, 00000006.00000002.2191523893.00000125CA7FA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.FileRepMalware.16359.15944.exe, jusched32.exe.0.dr, KillProcPCTT.exe.0.dr, mssched.exe.0.dr	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y
Source: mssched.exe, 00000006.00000002.2191893132.00000125CA9F5000.00000004.00000020.00020000.00000000.sdmp, mssched.exe, 00000006.00000002.2191523893.00000125CA7FA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.FileRepMalware.16359.15944.exe, jusched32.exe.0.dr, KillProcPCTT.exe.0.dr, mssched.exe.0.dr	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0
Source: Newtonsoft.Json.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: Newtonsoft.Json.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0=
Source: Newtonsoft.Json.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/NETFoundationProjectsCodeSigningCA.crl0E
Source: Newtonsoft.Json.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: Newtonsoft.Json.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: Newtonsoft.Json.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/NETFoundationProjectsCodeSigningCA.crl0L
Source: Newtonsoft.Json.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: mssched.exe, 00000004.00000002.3321706794.000001FC14059000.00000004.00000020.00020000.00000000.sdmp, mssched.exe, 00000006.00000002.2191893132.00000125CA9F5000.00000004.00000020.00020000.00000000.sdmp, mssched.exe, 00000006.00000002.2191523893.00000125CA7FA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.FileRepMalware.16359.15944.exe, jusched32.exe.0.dr, KillProcPCTT.exe.0.dr, mssched.exe.0.dr	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#
Source: mssched.exe, 00000006.00000002.2191893132.00000125CA9F5000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.FileRepMalware.16359.15944.exe, jusched32.exe.0.dr, KillProcPCTT.exe.0.dr, mssched.exe.0.dr	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#
Source: AWSSDK.S3.dll.0.dr	String found in binary or memory: http://docs.aws.amazon.com/AmazonS3/latest/dev/BucketRestrictions.html)
Source: AWSSDK.Core.dll.0.dr	String found in binary or memory: http://docs.aws.amazon.com/sdk-for-net/v3/developer-guide/net-dg-config-creds.html
Source: Newtonsoft.Json.dll.0.dr	String found in binary or memory: http://james.newtonking.com/projects/json
Source: SecuriteInfo.com.FileRepMalware.16359.15944.exe	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: SecuriteInfo.com.FileRepMalware.16359.15944.exe, jusched32.exe.0.dr, KillProcPCTT.exe.0.dr, mssched.exe.0.dr	String found in binary or memory: http://ocsp.comodoca.com0
Source: Newtonsoft.Json.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: Newtonsoft.Json.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0K
Source: Newtonsoft.Json.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: Newtonsoft.Json.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0O
Source: mssched.exe, 00000004.00000002.3321706794.000001FC14059000.00000004.00000020.00020000.00000000.sdmp, mssched.exe, 00000006.00000002.2191893132.00000125CA9F5000.00000004.00000020.00020000.00000000.sdmp, mssched.exe, 00000006.00000002.2191523893.00000125CA7FA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.FileRepMalware.16359.15944.exe, jusched32.exe.0.dr, KillProcPCTT.exe.0.dr, mssched.exe.0.dr	String found in binary or memory: http://ocsp.sectigo.com0
Source: mssched.exe, 00000004.00000000.2091397832.000001FC13C72000.00000002.00000001.01000000.00000008.sdmp, mssched.exe.0.dr	String found in binary or memory: http://pctattletale.com/amazonfix.php
Source: AWSSDK.S3.dll.0.dr	String found in binary or memory: http://s3.amazonaws.com/doc/2006-03-01/
Source: mssched.exe, 00000004.00000002.3322345709.000001FC15A14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: mssched.exe, 00000004.00000000.2091397832.000001FC13C72000.00000002.00000001.01000000.00000008.sdmp, mssched.exe.0.dr	String found in binary or memory: http://www.pctattletale.com/members/autologinfirstrun.php?AuthKey=
Source: mssched.exe, 00000004.00000000.2091397832.000001FC13C72000.00000002.00000001.01000000.00000008.sdmp, mssched.exe.0.dr	String found in binary or memory: http://www.pctattletale.com/members/forgotpassword.php
Source: mssched.exe, 00000004.00000000.2091397832.000001FC13C72000.00000002.00000001.01000000.00000008.sdmp, mssched.exe, 00000004.00000002.3322345709.000001FC15AA7000.00000004.00000800.00020000.00000000.sdmp, mssched.exe.0.dr	String found in binary or memory: http://www.pctattletale.com/removal.php
Source: AWSSDK.Core.dll.0.dr	String found in binary or memory: https://ip-ranges.amazonaws.com/ip-ranges.json
Source: mssched.exe, 00000004.00000000.2091397832.000001FC13C72000.00000002.00000001.01000000.00000008.sdmp, mssched.exe.0.dr	String found in binary or memory: https://pctattletale.com/app/Authenticationv14.php/AddComputer
Source: mssched.exe, 00000004.00000000.2091397832.000001FC13C72000.00000002.00000001.01000000.00000008.sdmp, mssched.exe.0.dr	String found in binary or memory: https://pctattletale.com/app/Authenticationv14.php/AddExclusionAccount
Source: mssched.exe, 00000004.00000000.2091397832.000001FC13C72000.00000002.00000001.01000000.00000008.sdmp, mssched.exe.0.dr	String found in binary or memory: https://pctattletale.com/app/Authenticationv14.php/CreateAccount
Source: mssched.exe, 00000004.00000000.2091397832.000001FC13C72000.00000002.00000001.01000000.00000008.sdmp, mssched.exe.0.dr	String found in binary or memory: https://pctattletale.com/app/Authenticationv14.php/DeleteComputer
Source: mssched.exe, 00000004.00000000.2091397832.000001FC13C72000.00000002.00000001.01000000.00000008.sdmp, mssched.exe.0.dr	String found in binary or memory: https://pctattletale.com/app/Authenticationv14.php/GetComputerStatus
Source: mssched.exe, 00000004.00000000.2091397832.000001FC13C72000.00000002.00000001.01000000.00000008.sdmp, mssched.exe.0.dr	String found in binary or memory: https://pctattletale.com/app/Authenticationv14.php/SendKeyStrokes
Source: mssched.exe, 00000004.00000000.2091397832.000001FC13C72000.00000002.00000001.01000000.00000008.sdmp, mssched.exe.0.dr	String found in binary or memory: https://pctattletale.com/members/signup.php?source=PCTTSiteWinDownloadqhttp://www.pctattletale.com/m
Source: mssched.exe, 00000004.00000000.2091397832.000001FC13C72000.00000002.00000001.01000000.00000008.sdmp, mssched.exe, 00000004.00000002.3322345709.000001FC15941000.00000004.00000800.00020000.00000000.sdmp, mssched.exe, 00000006.00000002.2192544443.00000125CC3A1000.00000004.00000800.00020000.00000000.sdmp, mssched.exe.0.dr	String found in binary or memory: https://pctattletale.com:443/app/Authenticationv14.php
Source: mssched.exe, 00000004.00000002.3321706794.000001FC14059000.00000004.00000020.00020000.00000000.sdmp, mssched.exe, 00000006.00000002.2191893132.00000125CA9F5000.00000004.00000020.00020000.00000000.sdmp, mssched.exe, 00000006.00000002.2191523893.00000125CA7FA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.FileRepMalware.16359.15944.exe, jusched32.exe.0.dr, KillProcPCTT.exe.0.dr, mssched.exe.0.dr	String found in binary or memory: https://sectigo.com/CPS0
Source: Newtonsoft.Json.dll.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: Newtonsoft.Json.dll.0.dr	String found in binary or memory: https://www.newtonsoft.com/json
Source: Newtonsoft.Json.dll.0.dr	String found in binary or memory: https://www.newtonsoft.com/jsonschema
Source: Newtonsoft.Json.dll.0.dr	String found in binary or memory: https://www.nuget.org/packages/Newtonsoft.Json.Bson

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: mssched.exe.0.dr, UserActivityHook.cs

.Net Code: Start

Contains functionality for read data from the clipboard

Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.16359.15944.exe

Code function: 0_2_004056DE GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_004056DE

System Summary

Contains functionality to shutdown / reboot the system

Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.16359.15944.exe

Code function: 0_2_0040352D EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,ExitProcess,CoUninitialize,ExitProcess,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,

0_2_0040352D

Detected potential crypto function

Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.16359.15944.exe	Code function: 0_2_0040755C	0_2_0040755C
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.16359.15944.exe	Code function: 0_2_00406D85	0_2_00406D85
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe	Code function: 4_2_00007FF848E75D5F	4_2_00007FF848E75D5F
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe	Code function: 4_2_00007FF848E754DC	4_2_00007FF848E754DC

Sample file is different than original file name gathered from version info

Source: SecuriteInfo.com.FileRepMalware.16359.15944.exe, 00000000.00000002.2092551285.000000000040A000.00000004.00000001.01000000.00000003.sdmp

Binary or memory string: OriginalFilenameAWSSDK.Core.dllb! vs SecuriteInfo.com.FileRepMalware.16359.15944.exe

Uses 32bit PE files

Source: SecuriteInfo.com.FileRepMalware.16359.15944.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: mssched.exe.0.dr

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: AWSSDK.Core.dll.0.dr

Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5

Source: classification engine

Classification label: mal45.spyw.winEXE@7/13@0/0

Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.16359.15944.exe

0_2_0040352D

Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.16359.15944.exe

Code function: 0_2_0040498A GetDlgItem,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,

0_2_0040498A

Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.16359.15944.exe

Code function: 0_2_004021AA CoCreateInstance,

0_2_004021AA

Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.16359.15944.exe

File created: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler

Jump to behavior

Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\KillProcPCTT.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\KillProcPCTT.exe.log

Jump to behavior

Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1848:120:WilError_03

Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.16359.15944.exe

File created: C:\Users\user\AppData\Local\Temp\nsq505C.tmp

Jump to behavior

Source: SecuriteInfo.com.FileRepMalware.16359.15944.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.16359.15944.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.16359.15944.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: SecuriteInfo.com.FileRepMalware.16359.15944.exe	ReversingLabs: Detection: 60%
Source: SecuriteInfo.com.FileRepMalware.16359.15944.exe	Virustotal: Detection: 67%

Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.16359.15944.exe

File read: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.16359.15944.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.16359.15944.exe "C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.16359.15944.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.16359.15944.exe	Process created: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\KillProcPCTT.exe "C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\KillProcPCTT.exe
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\KillProcPCTT.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.16359.15944.exe	Process created: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe "C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe" -f SecuriteInfo.com.FileRepMalware.16359.15944.exe
Source: unknown	Process created: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe "C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.16359.15944.exe	Process created: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\KillProcPCTT.exe "C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\KillProcPCTT.exe	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.16359.15944.exe	Process created: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe "C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe" -f SecuriteInfo.com.FileRepMalware.16359.15944.exe	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.16359.15944.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.16359.15944.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.16359.15944.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.16359.15944.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.16359.15944.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.16359.15944.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.16359.15944.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.16359.15944.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.16359.15944.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.16359.15944.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.16359.15944.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.16359.15944.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.16359.15944.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.16359.15944.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.16359.15944.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.16359.15944.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.16359.15944.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.16359.15944.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.16359.15944.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.16359.15944.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.16359.15944.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.16359.15944.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.16359.15944.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.16359.15944.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\KillProcPCTT.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\KillProcPCTT.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\KillProcPCTT.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\KillProcPCTT.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\KillProcPCTT.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\KillProcPCTT.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\KillProcPCTT.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\KillProcPCTT.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\KillProcPCTT.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe	Section loaded: dataexchange.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe	Section loaded: dcomp.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe	Section loaded: profapi.dll	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.16359.15944.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Reads internet explorer settings

Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Settings

Jump to behavior

Found graphical window changes (likely an installer)

Source: Window Recorder

Window detected: More than 3 window changes detected

Uses Microsoft Silverlight

Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

PE / OLE file has a valid certificate

Source: SecuriteInfo.com.FileRepMalware.16359.15944.exe

Static PE information: certificate valid

Submission file is bigger than most known malware samples

Source: SecuriteInfo.com.FileRepMalware.16359.15944.exe

Static file information: File size 1585816 > 1048576

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: SecuriteInfo.com.FileRepMalware.16359.15944.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Binary contains paths to debug symbols

Source:	Binary string: D:\JenkinsWorkspaces\trebuchet-stage-release\AWSDotNetPublic\sdk\src\Core\obj\AWSSDK.Core.Net35\Release\net35\AWSSDK.Core.pdbSHA256 source: SecuriteInfo.com.FileRepMalware.16359.15944.exe, 00000000.00000002.2092551285.000000000040A000.00000004.00000001.01000000.00000003.sdmp, AWSSDK.Core.dll.0.dr
Source:	Binary string: /_/Src/Newtonsoft.Json/obj/Release/net35/Newtonsoft.Json.pdbSHA256 source: mssched.exe, 00000004.00000002.3325444659.000001FC2FAB2000.00000002.00000001.01000000.0000000E.sdmp, Newtonsoft.Json.dll.0.dr
Source:	Binary string: C:\Users\bryan\source\repos\pctattletalewindowsjusched\jusched32\obj\Debug\jusched32.pdb source: jusched32.exe.0.dr
Source:	Binary string: C:\Users\bryan\source\repos\pctattletalewindows\PCTTRecorder\obj\Debug\mssched.pdb,g source: mssched.exe, 00000004.00000000.2091397832.000001FC13C72000.00000002.00000001.01000000.00000008.sdmp, mssched.exe.0.dr
Source:	Binary string: 35\Release\net35\AWSSDK.Core.pdb source: SecuriteInfo.com.FileRepMalware.16359.15944.exe, 00000000.00000002.2092551285.000000000040A000.00000004.00000001.01000000.00000003.sdmp
Source:	Binary string: D:\JenkinsWorkspaces\trebuchet-stage-release\AWSDotNetPublic\sdk\src\Services\S3\obj\AWSSDK.S3.Net35\Release\net35\AWSSDK.S3.pdbSHA256t source: AWSSDK.S3.dll.0.dr
Source:	Binary string: C:\Users\bryan\source\repos\KillProcPCTT\KillProcPCTT\obj\Debug\KillProcPCTT.pdba{ m*_CorExeMainmscoree.dll source: KillProcPCTT.exe, 00000002.00000000.2071056452.00000000003C2000.00000002.00000001.01000000.00000004.sdmp, KillProcPCTT.exe.0.dr
Source:	Binary string: C:\Users\bryan\source\repos\pctattletalewindows\PCTTRecorder\obj\Debug\mssched.pdb source: mssched.exe, 00000004.00000000.2091397832.000001FC13C72000.00000002.00000001.01000000.00000008.sdmp, mssched.exe.0.dr
Source:	Binary string: D:\JenkinsWorkspaces\trebuchet-stage-release\AWSDotNetPublic\sdk\src\Core\obj\AWSSDK.Core.Net35\Release\net35\AWSSDK.Core.pdb source: SecuriteInfo.com.FileRepMalware.16359.15944.exe, 00000000.00000002.2092551285.000000000040A000.00000004.00000001.01000000.00000003.sdmp, AWSSDK.Core.dll.0.dr
Source:	Binary string: /_/Src/Newtonsoft.Json/obj/Release/net35/Newtonsoft.Json.pdb source: mssched.exe, 00000004.00000002.3325444659.000001FC2FAB2000.00000002.00000001.01000000.0000000E.sdmp, Newtonsoft.Json.dll.0.dr
Source:	Binary string: 35\Release\net35\AWSSDK.Core.pdbSHA256 source: SecuriteInfo.com.FileRepMalware.16359.15944.exe, 00000000.00000002.2092551285.000000000040A000.00000004.00000001.01000000.00000003.sdmp
Source:	Binary string: C:\Users\bryan\source\repos\KillProcPCTT\KillProcPCTT\obj\Debug\KillProcPCTT.pdb source: KillProcPCTT.exe, 00000002.00000000.2071056452.00000000003C2000.00000002.00000001.01000000.00000004.sdmp, KillProcPCTT.exe.0.dr
Source:	Binary string: .pdb source: AWSSDK.S3.dll.0.dr
Source:	Binary string: D:\JenkinsWorkspaces\trebuchet-stage-release\AWSDotNetPublic\sdk\src\Services\S3\obj\AWSSDK.S3.Net35\Release\net35\AWSSDK.S3.pdb source: AWSSDK.S3.dll.0.dr
Source:	Binary string: C:\Users\norritb\Documents\git\NsisDotNetChecker\plugin\Release\DotNetChecker.pdb source: DotNetChecker.dll.0.dr

Data Obfuscation

Binary contains a suspicious time stamp

Source: KillProcPCTT.exe.0.dr

Static PE information: 0x8FC92EDE [Mon Jun 11 10:43:42 2046 UTC]

Uses code obfuscation techniques (call, push, ret)

Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe	Code function: 4_2_00007FF848E75976 push edi; retf	4_2_00007FF848E759D6
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe	Code function: 4_2_00007FF848E700BD pushad ; iretd	4_2_00007FF848E700C1
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe	Code function: 4_2_00007FF848E72021 push ebx; iretd	4_2_00007FF848E7203A

Source: mssched.exe.0.dr

Static PE information: section name: .text entropy: 7.467575341224463

Persistence and Installation Behavior

Drops PE files

Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.16359.15944.exe	File created: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\KillProcPCTT.exe	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.16359.15944.exe	File created: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\AWSSDK.S3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.16359.15944.exe	File created: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\Newtonsoft.Json.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.16359.15944.exe	File created: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\jusched32.exe	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.16359.15944.exe	File created: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\AWSSDK.Core.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.16359.15944.exe	File created: C:\Users\user\AppData\Local\Temp\nsl5176.tmp\DotNetChecker.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.16359.15944.exe	File created: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe	Jump to dropped file

Boot Survival

Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.16359.15944.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run scheduler			Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.16359.15944.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run scheduler			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe

Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.16359.15944.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\KillProcPCTT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\KillProcPCTT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\KillProcPCTT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\KillProcPCTT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\KillProcPCTT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\KillProcPCTT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\KillProcPCTT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\KillProcPCTT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\KillProcPCTT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\KillProcPCTT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\KillProcPCTT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\KillProcPCTT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\KillProcPCTT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\KillProcPCTT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\KillProcPCTT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\KillProcPCTT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\KillProcPCTT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Allocates memory with a write watch (potentially for evading sandboxes)

Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\KillProcPCTT.exe	Memory allocated: 2500000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\KillProcPCTT.exe	Memory allocated: 26E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\KillProcPCTT.exe	Memory allocated: 2520000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe	Memory allocated: 1FC13FB0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe	Memory allocated: 1FC2D940000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe	Memory allocated: 125CA9E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe	Memory allocated: 125E43A0000 memory reserve \| memory write watch	Jump to behavior

Contains long sleeps (>= 3 min)

Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\KillProcPCTT.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Found dropped PE file which has not been started or loaded

Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.16359.15944.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\AWSSDK.S3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.16359.15944.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\Newtonsoft.Json.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.16359.15944.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\jusched32.exe	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.16359.15944.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\AWSSDK.Core.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.16359.15944.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsl5176.tmp\DotNetChecker.dll	Jump to dropped file

May sleep (evasive loops) to hinder dynamic analysis

Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\KillProcPCTT.exe TID: 7104	Thread sleep time: -922337203685477s >= -30000s			Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe TID: 6980	Thread sleep time: -922337203685477s >= -30000s			Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.16359.15944.exe	Code function: 0_2_00405C49 GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	0_2_00405C49
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.16359.15944.exe	Code function: 0_2_00406873 FindFirstFileW,FindClose,	0_2_00406873
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.16359.15944.exe	Code function: 0_2_0040290B FindFirstFileW,	0_2_0040290B

Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\KillProcPCTT.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: SecuriteInfo.com.FileRepMalware.16359.15944.exe, 00000000.00000002.2092806026.000000000060F000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: _VMware_

Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.16359.15944.exe

API call chain: ExitProcess graph end node

graph_0-3420

Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\KillProcPCTT.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Enables debug privileges

Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\KillProcPCTT.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\KillProcPCTT.exe

Memory allocated: page read and write | page guard

Jump to behavior

Language, Device and Operating System Detection

Queries the volume information (name, serial number etc) of a device

Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\KillProcPCTT.exe	Queries volume information: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\KillProcPCTT.exe VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe	Queries volume information: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe	Queries volume information: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\Newtonsoft.Json.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe	Queries volume information: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.16359.15944.exe

0_2_0040352D

Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Adds / modifies Windows certificates

Source: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe

Registry key created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 Blob

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	1 Access Token Manipulation	2 Masquerading	1 Input Capture	1 Query Registry	Remote Services	1 Input Capture	1 Encrypted Channel	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	1 Process Injection	11 Disable or Modify Tools	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	1 Archive Collected Data	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Registry Run Keys / Startup Folder	31 Virtualization/Sandbox Evasion	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	1 Clipboard Data	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 DLL Side-Loading	1 Access Token Manipulation	NTDS	31 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Process Injection	LSA Secrets	2 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	4 Obfuscated Files or Information	Cached Domain Credentials	15 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	2 Software Packing	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Timestomp	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 DLL Side-Loading	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
SecuriteInfo.com.FileRepMalware.16359.15944.exe	61%	ReversingLabs	Win32.Trojan.Malgent
SecuriteInfo.com.FileRepMalware.16359.15944.exe	67%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner	Label
C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\AWSSDK.Core.dll	0%	ReversingLabs
C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\AWSSDK.S3.dll	0%	ReversingLabs
C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\KillProcPCTT.exe	0%	ReversingLabs
C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\Newtonsoft.Json.dll	0%	ReversingLabs
C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\jusched32.exe	25%	ReversingLabs	Win32.Trojan.Generic
C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe	62%	ReversingLabs	Win32.Spyware.PcTattletale
C:\Users\user\AppData\Local\Temp\nsl5176.tmp\DotNetChecker.dll	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
https://sectigo.com/CPS0	0%	URL Reputation	safe
https://sectigo.com/CPS0	0%	URL Reputation	safe
http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0	0%	URL Reputation	safe
http://ocsp.sectigo.com0	0%	URL Reputation	safe
http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#	0%	URL Reputation	safe
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#	0%	URL Reputation	safe
http://nsis.sf.net/NSIS_ErrorError	0%	URL Reputation	safe
http://james.newtonking.com/projects/json	0%	URL Reputation	safe
http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y	0%	URL Reputation	safe
https://www.newtonsoft.com/jsonschema	0%	URL Reputation	safe
https://www.nuget.org/packages/Newtonsoft.Json.Bson	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
http://169.254.170.2	0%	Virustotal		Browse
http://docs.aws.amazon.com/sdk-for-net/v3/developer-guide/net-dg-config-creds.html	0%	Virustotal		Browse
https://pctattletale.com/app/Authenticationv14.php/AddComputer	0%	Virustotal		Browse
https://www.newtonsoft.com/json	0%	Virustotal		Browse

Name	Source	Malicious	Antivirus Detection	Reputation
http://docs.aws.amazon.com/sdk-for-net/v3/developer-guide/net-dg-config-creds.html	AWSSDK.Core.dll.0.dr	false	0%, Virustotal, Browse	unknown
https://sectigo.com/CPS0	mssched.exe, 00000004.00000002.3321706794.000001FC14059000.00000004.00000020.00020000.00000000.sdmp, mssched.exe, 00000006.00000002.2191893132.00000125CA9F5000.00000004.00000020.00020000.00000000.sdmp, mssched.exe, 00000006.00000002.2191523893.00000125CA7FA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.FileRepMalware.16359.15944.exe, jusched32.exe.0.dr, KillProcPCTT.exe.0.dr, mssched.exe.0.dr	false	URL Reputation: safe URL Reputation: safe	unknown
http://169.254.170.2	AWSSDK.Core.dll.0.dr	false	0%, Virustotal, Browse	unknown
http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0	mssched.exe, 00000006.00000002.2191893132.00000125CA9F5000.00000004.00000020.00020000.00000000.sdmp, mssched.exe, 00000006.00000002.2191523893.00000125CA7FA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.FileRepMalware.16359.15944.exe, jusched32.exe.0.dr, KillProcPCTT.exe.0.dr, mssched.exe.0.dr	false	URL Reputation: safe	unknown
http://ocsp.sectigo.com0	mssched.exe, 00000004.00000002.3321706794.000001FC14059000.00000004.00000020.00020000.00000000.sdmp, mssched.exe, 00000006.00000002.2191893132.00000125CA9F5000.00000004.00000020.00020000.00000000.sdmp, mssched.exe, 00000006.00000002.2191523893.00000125CA7FA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.FileRepMalware.16359.15944.exe, jusched32.exe.0.dr, KillProcPCTT.exe.0.dr, mssched.exe.0.dr	false	URL Reputation: safe	unknown
https://pctattletale.com/app/Authenticationv14.php/AddComputer	mssched.exe, 00000004.00000000.2091397832.000001FC13C72000.00000002.00000001.01000000.00000008.sdmp, mssched.exe.0.dr	false	0%, Virustotal, Browse	unknown
http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#	mssched.exe, 00000004.00000002.3321706794.000001FC14059000.00000004.00000020.00020000.00000000.sdmp, mssched.exe, 00000006.00000002.2191893132.00000125CA9F5000.00000004.00000020.00020000.00000000.sdmp, mssched.exe, 00000006.00000002.2191523893.00000125CA7FA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.FileRepMalware.16359.15944.exe, jusched32.exe.0.dr, KillProcPCTT.exe.0.dr, mssched.exe.0.dr	false	URL Reputation: safe	unknown
https://www.newtonsoft.com/json	Newtonsoft.Json.dll.0.dr	false	0%, Virustotal, Browse	unknown
http://s3.amazonaws.com/doc/2006-03-01/	AWSSDK.S3.dll.0.dr	false		unknown
http://169.254.170.2aUnable	AWSSDK.Core.dll.0.dr	false		unknown
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#	mssched.exe, 00000006.00000002.2191893132.00000125CA9F5000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.FileRepMalware.16359.15944.exe, jusched32.exe.0.dr, KillProcPCTT.exe.0.dr, mssched.exe.0.dr	false	URL Reputation: safe	unknown
http://nsis.sf.net/NSIS_ErrorError	SecuriteInfo.com.FileRepMalware.16359.15944.exe	false	URL Reputation: safe	unknown
http://www.pctattletale.com/members/autologinfirstrun.php?AuthKey=	mssched.exe, 00000004.00000000.2091397832.000001FC13C72000.00000002.00000001.01000000.00000008.sdmp, mssched.exe.0.dr	false		unknown
https://pctattletale.com/app/Authenticationv14.php/SendKeyStrokes	mssched.exe, 00000004.00000000.2091397832.000001FC13C72000.00000002.00000001.01000000.00000008.sdmp, mssched.exe.0.dr	false		unknown
https://pctattletale.com/app/Authenticationv14.php/CreateAccount	mssched.exe, 00000004.00000000.2091397832.000001FC13C72000.00000002.00000001.01000000.00000008.sdmp, mssched.exe.0.dr	false		unknown
http://james.newtonking.com/projects/json	Newtonsoft.Json.dll.0.dr	false	URL Reputation: safe	unknown
https://pctattletale.com/app/Authenticationv14.php/AddExclusionAccount	mssched.exe, 00000004.00000000.2091397832.000001FC13C72000.00000002.00000001.01000000.00000008.sdmp, mssched.exe.0.dr	false		unknown
http://pctattletale.com/amazonfix.php	mssched.exe, 00000004.00000000.2091397832.000001FC13C72000.00000002.00000001.01000000.00000008.sdmp, mssched.exe.0.dr	false		unknown
https://pctattletale.com/app/Authenticationv14.php/DeleteComputer	mssched.exe, 00000004.00000000.2091397832.000001FC13C72000.00000002.00000001.01000000.00000008.sdmp, mssched.exe.0.dr	false		unknown
https://pctattletale.com:443/app/Authenticationv14.php	mssched.exe, 00000004.00000000.2091397832.000001FC13C72000.00000002.00000001.01000000.00000008.sdmp, mssched.exe, 00000004.00000002.3322345709.000001FC15941000.00000004.00000800.00020000.00000000.sdmp, mssched.exe, 00000006.00000002.2192544443.00000125CC3A1000.00000004.00000800.00020000.00000000.sdmp, mssched.exe.0.dr	false		unknown
http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y	mssched.exe, 00000004.00000002.3321706794.000001FC14059000.00000004.00000020.00020000.00000000.sdmp, mssched.exe, 00000006.00000002.2191893132.00000125CA9F5000.00000004.00000020.00020000.00000000.sdmp, mssched.exe, 00000006.00000002.2191523893.00000125CA7FA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.FileRepMalware.16359.15944.exe, jusched32.exe.0.dr, KillProcPCTT.exe.0.dr, mssched.exe.0.dr	false	URL Reputation: safe	unknown
http://docs.aws.amazon.com/AmazonS3/latest/dev/BucketRestrictions.html)	AWSSDK.S3.dll.0.dr	false		unknown
http://www.pctattletale.com/members/forgotpassword.php	mssched.exe, 00000004.00000000.2091397832.000001FC13C72000.00000002.00000001.01000000.00000008.sdmp, mssched.exe.0.dr	false		unknown
https://www.newtonsoft.com/jsonschema	Newtonsoft.Json.dll.0.dr	false	URL Reputation: safe	unknown
https://ip-ranges.amazonaws.com/ip-ranges.json	AWSSDK.Core.dll.0.dr	false		unknown
https://www.nuget.org/packages/Newtonsoft.Json.Bson	Newtonsoft.Json.dll.0.dr	false	URL Reputation: safe	unknown
http://www.pctattletale.com/removal.php	mssched.exe, 00000004.00000000.2091397832.000001FC13C72000.00000002.00000001.01000000.00000008.sdmp, mssched.exe, 00000004.00000002.3322345709.000001FC15AA7000.00000004.00000800.00020000.00000000.sdmp, mssched.exe.0.dr	false		unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	mssched.exe, 00000004.00000002.3322345709.000001FC15A14000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://169.254.169.254	AWSSDK.Core.dll.0.dr	false		unknown
https://pctattletale.com/members/signup.php?source=PCTTSiteWinDownloadqhttp://www.pctattletale.com/m	mssched.exe, 00000004.00000000.2091397832.000001FC13C72000.00000002.00000001.01000000.00000008.sdmp, mssched.exe.0.dr	false		unknown
https://pctattletale.com/app/Authenticationv14.php/GetComputerStatus	mssched.exe, 00000004.00000000.2091397832.000001FC13C72000.00000002.00000001.01000000.00000008.sdmp, mssched.exe.0.dr	false		unknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1542662
Start date and time:	2024-10-26 05:27:10 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 49s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	9
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	SecuriteInfo.com.FileRepMalware.16359.15944.exe
Detection:	MAL
Classification:	mal45.spyw.winEXE@7/13@0/0
EGA Information:	Successful, ratio: 25%
HCA Information:	Successful, ratio: 84% Number of executed functions: 75 Number of non-executed functions: 28
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, dns.msftncsi.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target KillProcPCTT.exe, PID 6332 because it is empty
Execution Graph export aborted for target mssched.exe, PID 1248 because it is empty
Execution Graph export aborted for target mssched.exe, PID 7108 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.

Simulations

Behavior and APIs

Time	Type	Description
05:28:09	Autostart	Run: HKLM\Software\Microsoft\Windows\CurrentVersion\Run scheduler C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\Newtonsoft.Json.dll	BlueJeans.2.28.61m.msi	Get hash	malicious	Unknown	Browse
	BlueJeansLauncher.exe	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\AWSSDK.Core.dll

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.16359.15944.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	894464
Entropy (8bit):	5.713479259906917
Encrypted:	false
SSDEEP:	12288:6WrEpyvAlP4fs12DsSb6BGA6Aw80TK7nOhiQI+mFvJe:4yvUr12DsFJ6AwmOEQI+D
MD5:	EDFA1BC995251D29FA3E6F99898DECF5
SHA1:	85AA9E5ED37F836CE48E5F6B5239BC4E2E3875D6
SHA-256:	9B2A1FF6CC50A6D8B7B769CC33B59FDE3A6012E883DDCC687760342A0F9CB4BD
SHA-512:	51247719BFAF97DA4EB9361827D6AD750AB5346799EDB4FF894B503B313CE0090F7F4EEC170570A030F32A301D3D32CEFAAC24F5A9825AAA3DCFC0EDEA454FB0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...-.t..........." ..0.................. ........... ....................................@.................................9...O...................................(...T............................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B................m.......H............g..............3.........................................."..(9.......0..]........(;.....o3.....o3...oL...r...p(L...YoM...oN...&.o5...(T...t......o^.......r...psO...z..(........0..0.................o[...t....oe...o.......(.........(....}P.......o[...t....oe...o....}Q.......o[...t....oe...o.....(....}R.......o[...t....oe...o......[(....}S.......o[...t....oe...o......[(....}T.......o[...t....oe...o......[(....}U.......o[...t....oe...o......[(....}V.......o[...t.

C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\AWSSDK.S3.dll

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.16359.15944.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	578048
Entropy (8bit):	5.894096286070584
Encrypted:	false
SSDEEP:	6144:Vr/byUy5V+S1hjy4Sonw7MNEe3rE4KAgWpuJ8e0v3cH9FNsm8p5A8w7632Sviyp:1/byD1hYMy7Spe0xBt
MD5:	1065840AF40D9BB580368D58F314667E
SHA1:	D36372E8CA9C2C7C72B6633CB56A28AA3BCA7634
SHA-256:	6E2C1B665A258B1C2AF50ADEBCBE4C4D2344D6B1BDBFCE2F01B9A6A1D005AEF8
SHA-512:	D94CA71ADEB0DA7B4A3730786A3D1ECFB4CCAF48BEA0EAF3AC8C508B5BEA282EB58E48F3F34C0FF1B77B44356B9624248908EAA1A3CA564AFDA61918CA2E4869
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....k..........." ..0.............J.... ........... .......................@......+.....@.....................................O............................ ..........T............................................ ............... ..H............text...P.... ...................... ..`.rsrc...............................@..@.reloc....... ......................@..B................,.......H...........\...................d........................................0.................(....r...p(5.....(6...-..(7...(....s8...r9..po9.....-..s......o....,9.o......o:...o;...,%.o........(<...,..o........(=...(.....~....6.(...........~.............0..........(>...., .o?...s@...sA...%.oB.......oC...F.r9..p(D...t....6.r9..p.(E.....(>...^.(>....,...oF....oC...F.r?..p(D........J.r?..p......(E.....0...........(G...u(.....,...oH....(I...*....0..N........(J...-.ri..

C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\KillProcPCTT.exe

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.16359.15944.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	10896
Entropy (8bit):	6.283358337533618
Encrypted:	false
SSDEEP:	96:8MkHgCmLN5waVRaEZ6VAxzNtf0Cvh3PIKfhigYpHp7isNeV9gfMfOJ6lHDs8gZ5h:HkA/fDTR5pPIKfhigk7ip9gfDQC52U
MD5:	58AB737BC9B7870455589C683CBBE7D9
SHA1:	6D29DB3CC4B5930F1790FAD0F02A4A2F71625A2C
SHA-256:	E998892C3C44BC036FD728A0FEAB970C9B57ECE2B2F1B3B60570B944775F73F8
SHA-512:	85376F9B36FEF6D45DC6C3CCC17EA8D202017F26A2675271BE1C74DB3125A1049157CFB44EF24139EF9D8EBA1232C75A25B14CE5A18722816063544F9FA4A81E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................"...0................. ...@....@.. ...............................V....`.................................9..O....@.......................`.......)..8............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................m......H.......\|!...............................................................0..-.........(........&....r...p(.....(.....rC..p(.........................0.._..........(......rU..p(....s.......o.......+0........o....rm..po...........,.....o.........X....i2.+...0..^........r...p(..........+.......o........X....i2.r...p(............+...........o.........X.......i2.".(.....*.BSJB............v4.0.30319......l...\...#~......,...#Strings............#US.........#GUID.......l...#Blob...

C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\Newtonsoft.Json.dll

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.16359.15944.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	487848
Entropy (8bit):	6.0690443951540844
Encrypted:	false
SSDEEP:	6144:gPcKvY/K2XApxA4Q6cVP1c81CQhGwMJVKGfZoUalqBu87egsAuiAP3:AS/KFnA96cw81nMBEMBsAsP3
MD5:	80F862778817F5E76D80172D4500D99A
SHA1:	920800ADD4D4F137096B64544D91809653DD9DE2
SHA-256:	F4FD69C5758CDF429B029186BD4763F1E0A61D55B5A86C4802702B6F89D9CF5E
SHA-512:	8217C269B3355CD1E43A906446F403440F23FB53304200A7C1BC2CA53675342BA5B12A540C74DF15BEB4D608D41D113F3F2AD45285CB076DCECE242FB3EF9CD6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: BlueJeans.2.28.61m.msi, Detection: malicious, Browse Filename: BlueJeansLauncher.exe, Detection: malicious, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................" ..0..H...........e... ........... ....................................@.................................\|e..O....................R...............d..T............................................ ............... ..H............text....F... ...H.................. ..`.rsrc................J..............@..@.reloc...............P..............@..B.................e......H........'.. =..................,d........................................(......(.....(.............}.....(......{.....X.....}......0...........-.~.....~....X....b...aX...X...X.+....b...aX...X...2.....cY.....cY....cY...{...._..{........+,..{.....3...{.......(....,...{......{........-.....0...........-.r...ps....z.o......-.~.....~....X...+....b..o....aX...X...o....2.....cY.....cY....cY..{......{...._..+%.{.....3..{.....o....,..{.....{......-....(.....0..H.........{.

C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\jusched32.exe

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.16359.15944.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16528
Entropy (8bit):	6.223701720184252
Encrypted:	false
SSDEEP:	384:RLmDicgGVIzP0K0w5RaA5mIufiLWu0+pwKI7igDQs6De:/t8KchD9L
MD5:	4363EC070B653180D86FE34205897676
SHA1:	DB0E10DF7F066CD49C4150655611A474D0B57B1E
SHA-256:	64199356C5DA71302881FC02E93F136D1C3BE0E7239AAE7758F598A09158A47F
SHA-512:	DC6D9F12E356130D307CECD5A864B39C797924B68D15AE5D5D9970A11286943CDD2D6CD509BE3A0618FD056593B0210788E5D9FF58205EDA5FE1C2A1BD00F2F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 25%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....Z.a.........."...0.."...........A... ...`....@.. ...................................`..................................A..O....`...............,..............H@............................................... ............... ..H............text....!... ...".................. ..`.rsrc........`.......$..............@..@.reloc.............................@..B.................A......H.......<'...............>..p..............................................}.....(.......(.......(.......(......0..!.........(......%o.... ....`o.......+......0...........r...p(............,...(........0..#..........o....(....&...&.....&.......+................................0...........(....o....(.......r...p( ...(!...&r+..p("......(#...( ...(.......i..r[..p.o$...o%...ry..p.(&...('......)...%.r}..p.%..o$...o%....%.ry..p.%...%.("......(#....((...(...................2C.i

C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.16359.15944.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1061520
Entropy (8bit):	7.4329456015921265
Encrypted:	false
SSDEEP:	24576:11Z1VCCWzZ3jawO1Z1FCCWzZ3jawj2CCWzZ30awc8:j/VAW5/FAWW2AdO
MD5:	DDD7094ECD63758C260126E8A8D7880F
SHA1:	6EA21F815AD5F4280972F94FA06F7169A9823F5F
SHA-256:	74730DAB8EF4EDD2B1351EABD9D7CF049167B648F79590FDAA99DD6C6F98F60D
SHA-512:	54D37F6F886CCB99D53E4281A3A87158680E3824B6220A11C4FC995F78A3B4F2D70668725871E027C9D7B919A9557AD30DA3C38D81F93E650268690F380E52C6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 62%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...\|.bc.........."...0..H..........Vg... ........@.. ...............................{....`..................................g..O.......0....................`.......e............................................... ............... ..H............text...\G... ...H.................. ..`.rsrc...0............J..............@..@.reloc.......`......................@..B................8g......H.....................................................................z..}......}.....("......(........}......}.....("........(......0................(........(........................0..)........{.........(#...t......\|......(...+...3.....0..)........{.........(%...t......\|......(...+...3.....0..)........{.........(#...t......\|......(...+...3.....0..)........{.........(%...t......\|......(...+...3.....0..)........{.........(#...t......\|......(...+...3.....0..).......

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\mssched.exe.log

Download File

Process:	C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	1281
Entropy (8bit):	5.370111951859942
Encrypted:	false
SSDEEP:	24:ML9E4KQ71qE4GIs0E4KCKDE4KGKZI6KhPKIE4TKBGKoZAE4KKUNb:MxHKQ71qHGIs0HKCYHKGSI6oPtHTHhA2
MD5:	12C61586CD59AA6F2A21DF30501F71BD
SHA1:	E6B279DC134544867C868E3FF3C267A06CE340C7
SHA-256:	EC20A856DBBCF320F7F24C823D6E9D2FD10E9335F5DE2F56AB9A7DF1ED358543
SHA-512:	B0731F59C74C9D25A4C82E166B3DC300BBCF89F6969918EC748B867C641ED0D8E0DE81AAC68209EF140219861B4939F1B07D0885ACA112D494D23AAF9A9C03FE
Malicious:	false
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\567ff6b0de7f9dcd8111001e94ab7cf6\System.Drawing.ni.dll",0..3,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\2a7fffeef3976b2a6f273db66b1f0107\System.Windows.Forms.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\S

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\KillProcPCTT.exe.log

Download File

Process:	C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\KillProcPCTT.exe
File Type:	CSV text
Category:	modified
Size (bytes):	226
Entropy (8bit):	5.360398796477698
Encrypted:	false
SSDEEP:	6:Q3La/xw5DLIP12MUAvvR+uTL2ql2ABgTv:Q3La/KDLI4MWuPTAv
MD5:	3A8957C6382192B71471BD14359D0B12
SHA1:	71B96C965B65A051E7E7D10F61BEBD8CCBB88587
SHA-256:	282FBEFDDCFAA0A9DBDEE6E123791FC4B8CB870AE9D450E6394D2ACDA3D8F56D
SHA-512:	76C108641F682F785A97017728ED51565C4F74B61B24E190468E3A2843FCC43615C6C8ABE298750AF238D7A44E97C001E3BE427B49900432F905A7CE114AA9AD
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\mssched.exe_Url_4gcyhmu3ku50ql3oveaqzgvl21ncnjvy\1.0.0.71\user.config (copy)

Download File

Process:	C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1445
Entropy (8bit):	4.672900179777062
Encrypted:	false
SSDEEP:	24:2dqIK07E449sQK6E4Ev+XPmNMnvDXGnvMLSvODvbDvRRPEKpnv5/:crr7HKsQ7Hq4mNMnzGnWSWDTDpRPEAnN
MD5:	CA7323204F02466FBF74973C035EAC3D
SHA1:	7DAA3B01A3F7C3B3B836AC430A7D47DA08840064
SHA-256:	BF53CA0E0DE0CD30F39F780E4240F2A5A491DC51AC69323ACD56922C5066E61D
SHA-512:	8CD24D0FA96725463A44CA65409FC2F024B95906E46AD36FF7C7BFCD047A93F0C330B324B7C62BD45B7E7BFD80701EE0804D41A5A136407E9E3FA4B7E0853514
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <configSections>.. <sectionGroup name="userSettings" type="System.Configuration.UserSettingsGroup, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" >.. <section name="PCTTRecorder.Properties.Settings" type="System.Configuration.ClientSettingsSection, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" allowExeDefinition="MachineToLocalUser" requirePermission="false" />.. </sectionGroup>.. </configSections>.. <userSettings>.. <PCTTRecorder.Properties.Settings>.. <setting name="TimeCardAppDate" serializeAs="String">.. <value>2024-10-25</value>.. </setting>.. <setting name="LogKeyStrokes" serializeAs="String">.. <value>True</value>.. </setting>.. <setting name="TimeCardAppSecondsLogged" serializeAs="String">.. <value>0</value>.. </set

C:\Users\user\AppData\Local\Microsoft\mssched.exe_Url_4gcyhmu3ku50ql3oveaqzgvl21ncnjvy\1.0.0.71\xonhjdd2.newcfg

Download File

Process:	C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1445
Entropy (8bit):	4.672900179777062
Encrypted:	false
SSDEEP:	24:2dqIK07E449sQK6E4Ev+XPmNMnvDXGnvMLSvODvbDvRRPEKpnv5/:crr7HKsQ7Hq4mNMnzGnWSWDTDpRPEAnN
MD5:	CA7323204F02466FBF74973C035EAC3D
SHA1:	7DAA3B01A3F7C3B3B836AC430A7D47DA08840064
SHA-256:	BF53CA0E0DE0CD30F39F780E4240F2A5A491DC51AC69323ACD56922C5066E61D
SHA-512:	8CD24D0FA96725463A44CA65409FC2F024B95906E46AD36FF7C7BFCD047A93F0C330B324B7C62BD45B7E7BFD80701EE0804D41A5A136407E9E3FA4B7E0853514
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <configSections>.. <sectionGroup name="userSettings" type="System.Configuration.UserSettingsGroup, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" >.. <section name="PCTTRecorder.Properties.Settings" type="System.Configuration.ClientSettingsSection, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" allowExeDefinition="MachineToLocalUser" requirePermission="false" />.. </sectionGroup>.. </configSections>.. <userSettings>.. <PCTTRecorder.Properties.Settings>.. <setting name="TimeCardAppDate" serializeAs="String">.. <value>2024-10-25</value>.. </setting>.. <setting name="LogKeyStrokes" serializeAs="String">.. <value>True</value>.. </setting>.. <setting name="TimeCardAppSecondsLogged" serializeAs="String">.. <value>0</value>.. </set

C:\Users\user\AppData\Local\Temp\nsl5176.tmp\DotNetChecker.dll

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.16359.15944.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	87040
Entropy (8bit):	6.321191870855878
Encrypted:	false
SSDEEP:	1536:X/Zjm/1nZ12+XrMX7uf9RX22LurfSECjSeeWSKQUDs0OsWPIcdA2kUlTeJ:XyQ7I22Lur67jKKQA2kmTeJ
MD5:	7BA49F3F086DC16A2863B0F9E704916C
SHA1:	A3045477D3AF46E31D12479F02A1B64666BA8BE2
SHA-256:	263FE61F2F50CFFA5356AF07B027A691C6640A04245E88EA9734DD84BD735289
SHA-512:	3EA076B68126A7D451703DBB58F616BF272788FCBCEB02C6B12855FCD4F204C0A94A4486B73F4DAAC6002A74F4F0F51F941654AD11AF56EC38E5EB6CDD3FCB2D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........n.............D.O.....D.M....D.L.....]Q......]Q......]Q.............-.u............EQ......EQ......EQA.....EQ......Rich....................PE..L...x..\...........!.................5....................................................@..........................9......l>..P...............................(...@2..p............................2..@...............4............................text............................... ..`.rdata..Te.......f..................@..@.data........P.......6..............@....gfids.......p.......>..............@..@.rsrc................@..............@..@.reloc..(............B..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\376483\user_ebteme\1729898892.jpg

Download File

Process:	C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	44444
Entropy (8bit):	7.252705879208812
Encrypted:	false
SSDEEP:	768:KuovvoqQ+Joy2GJDCvwuLmrbGpOnzGIH3I25bapgD9ta:KDf2GVCvrSMOZHhap4ta
MD5:	B8A1D2CBFE36452EC963AB5F89C66223
SHA1:	9BCD8624F77B2E653D65629AE697C50477741E7F
SHA-256:	A535A88891A4552C092FF367070AE2684D3B7E3378835DF2126D78E72AB467A5
SHA-512:	7D93ED70D8A6AB28CB45FCFC4D94B9CF27696C2B6B6F0C11A15065D17ADB07368D274450259457E51DA62E59F4C8F0893894E545FEE0C5C935F007B971DD8A23
Malicious:	false
Preview:	......JFIF.....`.`.....C. ..... ...$" &0P40,,0bFJ:Ptfzxrfpn........np........\|............C."$$00^44^.p.............................................................."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.m.Q^......n....u$...I.....dF.>.>.....X.c..hn...Ndd..E6....(...(..... ..}.~.....}.>..b..s...z....v\...P....L.....E.V...Q@..U..h.......O.L..\!..P..>.m..<....G.m...<k/n..}].1...E2 .n .L.*.k..+.....E-%Q.E.P.E.P0..(...(...(.(...(...(...(...(...(....QE.%....QE..QE..QE..RR.P.E.P0..(...(...(...(.(...(...(..c.JZJ.(..@.QE..QE..QE.%....(...(...J)i(...(.QE..RR.@.E.P.E.P.E.P1(

\Device\ConDrv

Download File

Process:	C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\KillProcPCTT.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	44
Entropy (8bit):	4.172404562203418
Encrypted:	false
SSDEEP:	3:rJ7K4Fh3vY+9n:rAIhwqn
MD5:	2B1E83201F0924931C63EAA9D6CB0F3B
SHA1:	0C42B092CEA0C05DC05E4015F7EC001038A6E6AF
SHA-256:	6E9563CBA1ABD6D6F1B90B9611285E0B2EAE05792B299EA95655565B3B51A6AE
SHA-512:	B4018F81F090F68CCC846321E7252D270C480F681B48A8FF9096023153530A7DF757055DC02EFD2721733E1F8963E4FBCDC128D143039323E941B2F0DFC4AAB9
Malicious:	false
Preview:	Shutting down older pcTattletale..Complete..

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Entropy (8bit):	7.992219926892812
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	SecuriteInfo.com.FileRepMalware.16359.15944.exe
File size:	1'585'816 bytes
MD5:	1ef81575c0f526800283239b2469818d
SHA1:	16509b0ae23980c3d49afe176d61e770affd8112
SHA256:	bf5ae3f1cfe10e6772e1ca445a9a49280141746d9a5a72bccfe3eb5786a6c9a0
SHA512:	41e615a67ae73e16da9a21039bc26be5986b83f124594da9905df8f8045e3dfc5497092764abd848a182b81daf31d2f92d49876cbd2cb77f2c1c839920202330
SSDEEP:	49152:pkKkIKb+dIUxkNTGVv8M6lR4vDfD0Hu2qlv76:pvBdIU8Gt8M6lWDfQHuFlm
TLSH:	26753385F20C8726EC9246769E7180ACC2B3793AA96A7C4D43CC5D497EC35143EFE5B2
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...Pf..Pf..Pf._9..Pf..Pg.LPf._;..Pf..sV..Pf..V`..Pf.Rich.Pf.........................PE..L...Z.Oa.................j.........

File Icon


Icon Hash:	3d2e0f95332b3399

Static PE Info

General

Entrypoint:	0x40352d
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x614F9B5A [Sat Sep 25 21:57:46 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	56a78d55f3f7af51443e58e0ce2fb5f6

Authenticode Signature

Signature Valid:	true
Signature Issuer:	CN=Sectigo Public Code Signing CA R36, O=Sectigo Limited, C=GB
Signature Validation Error:	The operation completed successfully
Error Number:	0
Not Before, Not After	22/03/2023 01:00:00 22/03/2024 00:59:59
Subject Chain	CN="Fleming Technologies, LLC", O="Fleming Technologies, LLC", S=Michigan, C=US
Version:	3
Thumbprint MD5:	78BD57CDF30F9AC05DECB3F534AC68A7
Thumbprint SHA-1:	80F9E3506228F28AC7B95B85B43FAF1CF6E1FC4C
Thumbprint SHA-256:	ABBEC2D9C41B98096825FDD0117879549A1E59C311DF7CE17D6959926DC99CE1
Serial:	551D55E73720C480501627F8068DF8CB

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
sub esp, 000003F4h
push ebx
push esi
push edi
push 00000020h
pop edi
xor ebx, ebx
push 00008001h
mov dword ptr [ebp-14h], ebx
mov dword ptr [ebp-04h], 0040A2E0h
mov dword ptr [ebp-10h], ebx
call dword ptr [004080CCh]
mov esi, dword ptr [004080D0h]
lea eax, dword ptr [ebp-00000140h]
push eax
mov dword ptr [ebp-0000012Ch], ebx
mov dword ptr [ebp-2Ch], ebx
mov dword ptr [ebp-28h], ebx
mov dword ptr [ebp-00000140h], 0000011Ch
call esi
test eax, eax
jne 00007F24795A545Ah
lea eax, dword ptr [ebp-00000140h]
mov dword ptr [ebp-00000140h], 00000114h
push eax
call esi
mov ax, word ptr [ebp-0000012Ch]
mov ecx, dword ptr [ebp-00000112h]
sub ax, 00000053h
add ecx, FFFFFFD0h
neg ax
sbb eax, eax
mov byte ptr [ebp-26h], 00000004h
not eax
and eax, ecx
mov word ptr [ebp-2Ch], ax
cmp dword ptr [ebp-0000013Ch], 0Ah
jnc 00007F24795A542Ah
and word ptr [ebp-00000132h], 0000h
mov eax, dword ptr [ebp-00000134h]
movzx ecx, byte ptr [ebp-00000138h]
mov dword ptr [00434FB8h], eax
xor eax, eax
mov ah, byte ptr [ebp-0000013Ch]
movzx eax, ax
or eax, ecx
xor ecx, ecx
mov ch, byte ptr [ebp-2Ch]
movzx ecx, cx
shl eax, 10h
or eax, ecx

Rich Headers

Programming Language:

[EXP] VC++ 6.0 SP5 build 8804

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x8610	0xa0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x49000	0xa60	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x181e08	0x1490
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8000	0x2b0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x6897	0x6a00	ce9df19df15aa7bfbc0a8d0af0b841d0	False	0.6661261792452831	data	6.458398214928006	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8000	0x14a6	0x1600	a118375c929d970903c1204233b7583d	False	0.4392755681818182	data	5.024109281264143	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xa000	0x2b018	0x600	82a10c59a8679bb952fc8316070b8a6c	False	0.521484375	data	4.15458210408643	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x36000	0x13000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x49000	0xa60	0xc00	0e42cd951eda0fea5d6d51c0ee3c76d3	False	0.4033203125	data	4.201606800234224	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x49190	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 640	English	United States	0.42473118279569894
RT_DIALOG	0x49478	0x100	data	English	United States	0.5234375
RT_DIALOG	0x49578	0x11c	data	English	United States	0.6056338028169014
RT_DIALOG	0x49698	0x60	data	English	United States	0.7291666666666666
RT_GROUP_ICON	0x496f8	0x14	data	English	United States	1.2
RT_MANIFEST	0x49710	0x349	XML 1.0 document, ASCII text, with very long lines (841), with no line terminators	English	United States	0.5517241379310345

Imports

DLL	Import
ADVAPI32.dll	RegCreateKeyExW, RegEnumKeyW, RegQueryValueExW, RegSetValueExW, RegCloseKey, RegDeleteValueW, RegDeleteKeyW, AdjustTokenPrivileges, LookupPrivilegeValueW, OpenProcessToken, SetFileSecurityW, RegOpenKeyExW, RegEnumValueW
SHELL32.dll	SHGetSpecialFolderLocation, SHFileOperationW, SHBrowseForFolderW, SHGetPathFromIDListW, ShellExecuteExW, SHGetFileInfoW
ole32.dll	OleInitialize, OleUninitialize, CoCreateInstance, IIDFromString, CoTaskMemFree
COMCTL32.dll	ImageList_Create, ImageList_Destroy, ImageList_AddMasked
USER32.dll	GetClientRect, EndPaint, DrawTextW, IsWindowEnabled, DispatchMessageW, wsprintfA, CharNextA, CharPrevW, MessageBoxIndirectW, GetDlgItemTextW, SetDlgItemTextW, GetSystemMetrics, FillRect, AppendMenuW, TrackPopupMenu, OpenClipboard, SetClipboardData, CloseClipboard, IsWindowVisible, CallWindowProcW, GetMessagePos, CheckDlgButton, LoadCursorW, SetCursor, GetSysColor, SetWindowPos, GetWindowLongW, PeekMessageW, SetClassLongW, GetSystemMenu, EnableMenuItem, GetWindowRect, ScreenToClient, EndDialog, RegisterClassW, SystemParametersInfoW, CreateWindowExW, GetClassInfoW, DialogBoxParamW, CharNextW, ExitWindowsEx, DestroyWindow, CreateDialogParamW, SetTimer, SetWindowTextW, PostQuitMessage, SetForegroundWindow, ShowWindow, wsprintfW, SendMessageTimeoutW, FindWindowExW, IsWindow, GetDlgItem, SetWindowLongW, LoadImageW, GetDC, ReleaseDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, EmptyClipboard, CreatePopupMenu
GDI32.dll	SetBkMode, SetBkColor, GetDeviceCaps, CreateFontIndirectW, CreateBrushIndirect, DeleteObject, SetTextColor, SelectObject
KERNEL32.dll	GetExitCodeProcess, WaitForSingleObject, GetModuleHandleA, GetProcAddress, GetSystemDirectoryW, lstrcatW, Sleep, lstrcpyA, WriteFile, GetTempFileNameW, CreateFileW, lstrcmpiA, RemoveDirectoryW, CreateProcessW, CreateDirectoryW, GetLastError, CreateThread, GlobalLock, GlobalUnlock, GetDiskFreeSpaceW, WideCharToMultiByte, lstrcpynW, lstrlenW, SetErrorMode, GetVersionExW, GetCommandLineW, GetTempPathW, GetWindowsDirectoryW, SetEnvironmentVariableW, CopyFileW, ExitProcess, GetCurrentProcess, GetModuleFileNameW, GetFileSize, GetTickCount, MulDiv, SetFileAttributesW, GetFileAttributesW, SetCurrentDirectoryW, MoveFileW, GetFullPathNameW, GetShortPathNameW, SearchPathW, CompareFileTime, SetFileTime, CloseHandle, lstrcmpiW, lstrcmpW, ExpandEnvironmentStringsW, GlobalFree, GlobalAlloc, GetModuleHandleW, LoadLibraryExW, MoveFileExW, FreeLibrary, WritePrivateProfileStringW, GetPrivateProfileStringW, lstrlenA, MultiByteToWideChar, ReadFile, SetFilePointer, FindClose, FindNextFileW, FindFirstFileW, DeleteFileW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 26, 2024 05:28:27.033814907 CEST	53	59534	1.1.1.1	192.168.2.5

Target ID:	0
Start time:	23:28:05
Start date:	25/10/2024
Path:	C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.16359.15944.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.16359.15944.exe"
Imagebase:	0x400000
File size:	1'585'816 bytes
MD5 hash:	1EF81575C0F526800283239B2469818D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	23:28:05
Start date:	25/10/2024
Path:	C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\KillProcPCTT.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\KillProcPCTT.exe
Imagebase:	0x3c0000
File size:	10'896 bytes
MD5 hash:	58AB737BC9B7870455589C683CBBE7D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	23:28:06
Start date:	25/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	23:28:07
Start date:	25/10/2024
Path:	C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe" -f SecuriteInfo.com.FileRepMalware.16359.15944.exe
Imagebase:	0x1fc13c70000
File size:	1'061'520 bytes
MD5 hash:	DDD7094ECD63758C260126E8A8D7880F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 62%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	23:28:17
Start date:	25/10/2024
Path:	C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe"
Imagebase:	0x125ca5b0000
File size:	1'061'520 bytes
MD5 hash:	DDD7094ECD63758C260126E8A8D7880F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	25.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	16.7%
Total number of Nodes:	1345
Total number of Limit Nodes:	23

Executed Functions

Function 0040352D Relevance: 89.7, APIs: 34, Strings: 17, Instructions: 450
stringfilecomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00008001), ref: 00403550
GetVersionExW.KERNEL32(?), ref: 00403579
GetVersionExW.KERNEL32(0000011C), ref: 00403590
lstrlenA.KERNEL32(UXTHEME,UXTHEME), ref: 00403627
#17.COMCTL32(00000007,00000009,0000000B), ref: 00403663
OleInitialize.OLE32(00000000), ref: 0040366A
SHGetFileInfoW.SHELL32(0042B228,00000000,?,000002B4,00000000), ref: 00403688
GetCommandLineW.KERNEL32(00433F00,NSIS Error), ref: 0040369D
CharNextW.USER32(00000000,"C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.16359.15944.exe",00000020,"C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.16359.15944.exe",00000000), ref: 004036D6
GetTempPathW.KERNEL32(00000400,C:\Users\user\AppData\Local\Temp\,00000000,?), ref: 00403809
GetWindowsDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,000003FB), ref: 0040381A
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,\Temp), ref: 00403826
GetTempPathW.KERNEL32(000003FC,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,\Temp), ref: 0040383A
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,Low), ref: 00403842
SetEnvironmentVariableW.KERNEL32(TEMP,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,Low), ref: 00403853
SetEnvironmentVariableW.KERNEL32(TMP,C:\Users\user\AppData\Local\Temp\), ref: 0040385B
DeleteFileW.KERNELBASE(1033), ref: 0040386F
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.16359.15944.exe",00000000,?), ref: 00403956
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,0040A26C,C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.16359.15944.exe",00000000,?), ref: 00403965

Part of subcall function 00405AEB: CreateDirectoryW.KERNELBASE(?,00000000,00403520,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403810), ref: 00405AF1

lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,.tmp,C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.16359.15944.exe",00000000,?), ref: 00403970
lstrcmpiW.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\Desktop,C:\Users\user\AppData\Local\Temp\,.tmp,C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.16359.15944.exe",00000000,?), ref: 0040397C
SetCurrentDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\), ref: 0040399C
DeleteFileW.KERNEL32(0042AA28,0042AA28,?,00436000,?), ref: 004039FB
CopyFileW.KERNEL32(C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.16359.15944.exe,0042AA28,00000001), ref: 00403A0E
CloseHandle.KERNEL32(00000000,0042AA28,0042AA28,?,0042AA28,00000000), ref: 00403A3B
ExitProcess.KERNEL32(?), ref: 00403A59
CoUninitialize.COMBASE(?), ref: 00403A5E
ExitProcess.KERNEL32 ref: 00403A78
GetCurrentProcess.KERNEL32(00000028,?), ref: 00403A8C
OpenProcessToken.ADVAPI32(00000000), ref: 00403A93
LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00403AA7
AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000), ref: 00403AC6
ExitWindowsEx.USER32(00000002,80040002), ref: 00403AEB
ExitProcess.KERNEL32 ref: 00403B0C

Strings

.tmp, xrefs: 0040396A
TEMP, xrefs: 0040384E
UXTHEME, xrefs: 0040361B, 00403620, 00403626
C:\Users\user\AppData\Local\Temp\, xrefs: 004037FE, 00403803, 00403819, 00403825, 00403834, 00403841, 0040384D, 00403855, 00403953, 00403964, 0040396F, 0040397B, 0040398C, 0040399B, 00403A51
SeShutdownPrivilege, xrefs: 00403AA1
NSIS Error, xrefs: 0040368E
C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.16359.15944.exe, xrefs: 00403A09
TMP, xrefs: 00403856
1033, xrefs: 0040386A
C:\Users\user\Desktop, xrefs: 00403975, 0040397A, 004039AD
~nsu, xrefs: 0040394E
C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler, xrefs: 00403928
\Temp, xrefs: 00403820
C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\, xrefs: 004037EE, 0040391D, 004039A4, 004039AE
Low, xrefs: 0040383C
Error launching installer, xrefs: 004038FF
"C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.16359.15944.exe", xrefs: 004036A3, 004036A9, 004036BE, 00403895, 004038A1, 004038EF, 004038F9

Memory Dump Source

Source File: 00000000.00000002.2092512933.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2092495447.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092531995.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092652651.0000000000449000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: Processlstrcat$ExitFile$Directory$CurrentDeleteEnvironmentPathTempTokenVariableVersionWindows$AdjustCharCloseCommandCopyCreateErrorHandleInfoInitializeLineLookupModeNextOpenPrivilegePrivilegesUninitializeValuelstrcmpilstrlen
String ID: "C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.16359.15944.exe"$.tmp$1033$C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler$C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\$C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.16359.15944.exe$Error launching installer$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$UXTHEME$\Temp$~nsu
API String ID: 2292928366-2531529280
Opcode ID: 7a788a85b9786d5a7ebd132106c546d121407ab0fc20c65c93ef4011eb75cbdd
Instruction ID: 4d4dc0a58e4858e72561def8a0259f0227da8af974c10a5ea2b310ef4b80d7a5
Opcode Fuzzy Hash: 7a788a85b9786d5a7ebd132106c546d121407ab0fc20c65c93ef4011eb75cbdd
Instruction Fuzzy Hash: 66E10670A00214AADB10AFB59D45BAF3AB8EF4470AF14847FF545B22D1DB7C8A41CB6D

Function 004056DE Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 284
windowclipboardmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDlgItem.USER32(?,00000403), ref: 0040573C
GetDlgItem.USER32(?,000003EE), ref: 0040574B
GetClientRect.USER32(?,?), ref: 00405788
GetSystemMetrics.USER32(00000002), ref: 0040578F
SendMessageW.USER32(?,00001061,00000000,?), ref: 004057B0
SendMessageW.USER32(?,00001036,00004000,00004000), ref: 004057C1
SendMessageW.USER32(?,00001001,00000000,00000110), ref: 004057D4
SendMessageW.USER32(?,00001026,00000000,00000110), ref: 004057E2
SendMessageW.USER32(?,00001024,00000000,?), ref: 004057F5
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 00405817
ShowWindow.USER32(?,00000008), ref: 0040582B
GetDlgItem.USER32(?,000003EC), ref: 0040584C
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 0040585C
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 00405875
SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 00405881
GetDlgItem.USER32(?,000003F8), ref: 0040575A

Part of subcall function 004044CE: SendMessageW.USER32(00000028,?,00000001,004042F9), ref: 004044DC

GetDlgItem.USER32(?,000003EC), ref: 0040589E
CreateThread.KERNELBASE(00000000,00000000,Function_00005672,00000000), ref: 004058AC
CloseHandle.KERNELBASE(00000000), ref: 004058B3
ShowWindow.USER32(00000000), ref: 004058D7
ShowWindow.USER32(?,00000008), ref: 004058DC
ShowWindow.USER32(00000008), ref: 00405926
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040595A
CreatePopupMenu.USER32 ref: 0040596B
AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 0040597F
GetWindowRect.USER32(?,?), ref: 0040599F
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 004059B8
SendMessageW.USER32(?,00001073,00000000,?), ref: 004059F0
OpenClipboard.USER32(00000000), ref: 00405A00
EmptyClipboard.USER32 ref: 00405A06
GlobalAlloc.KERNEL32(00000042,00000000), ref: 00405A12
GlobalLock.KERNEL32(00000000), ref: 00405A1C
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405A30
GlobalUnlock.KERNEL32(00000000), ref: 00405A50
SetClipboardData.USER32(0000000D,00000000), ref: 00405A5B
CloseClipboard.USER32 ref: 00405A61

Strings

{, xrefs: 00405944

Memory Dump Source

Source File: 00000000.00000002.2092512933.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2092495447.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092531995.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092652651.0000000000449000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: {
API String ID: 590372296-366298937
Opcode ID: efbbf4d88f7660e4c87201c03f03245d3270aa31951a4a241d93bb0c475bbbe6
Instruction ID: 6b97441d6f4cfe62a880681573964a63c423f2dd70b2063085686802d9cc5617
Opcode Fuzzy Hash: efbbf4d88f7660e4c87201c03f03245d3270aa31951a4a241d93bb0c475bbbe6
Instruction Fuzzy Hash: C8B169B1900608FFDB119FA0DD85AAE7B79FB44355F00803AFA41BA1A0C7755E51DF58

Function 00405C49 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 148
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNELBASE(?,?,75923420,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405C72
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\nsl5176.tmp\*.*,\*.*,C:\Users\user\AppData\Local\Temp\nsl5176.tmp\*.*,?,?,75923420,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405CBA
lstrcatW.KERNEL32(?,0040A014,?,C:\Users\user\AppData\Local\Temp\nsl5176.tmp\*.*,?,?,75923420,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405CDD
lstrlenW.KERNEL32(?,?,0040A014,?,C:\Users\user\AppData\Local\Temp\nsl5176.tmp\*.*,?,?,75923420,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405CE3
FindFirstFileW.KERNELBASE(C:\Users\user\AppData\Local\Temp\nsl5176.tmp\*.*,?,?,?,0040A014,?,C:\Users\user\AppData\Local\Temp\nsl5176.tmp\*.*,?,?,75923420,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405CF3
FindNextFileW.KERNELBASE(00000000,00000010,000000F2,?,?,?,?,0000002E), ref: 00405D93
FindClose.KERNEL32(00000000), ref: 00405DA2

Strings

C:\Users\user\AppData\Local\Temp\nsl5176.tmp\*.*, xrefs: 00405CA2, 00405CA8, 00405CB9, 00405CF2
C:\Users\user\AppData\Local\Temp\, xrefs: 00405C56
., xrefs: 00405D04
\*.*, xrefs: 00405CB4
., xrefs: 00405D18

Memory Dump Source

Source File: 00000000.00000002.2092512933.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2092495447.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092531995.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092652651.0000000000449000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: .$.$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\nsl5176.tmp\*.*$\*.*
API String ID: 2035342205-1558109550
Opcode ID: 91e5555b9508150fcf6e55f7c9d4dc2ae8152fc7335161658e002f7252bbf59f
Instruction ID: 8b2ee76931e9ba666d6dc67a471f1b560bbb00ea1adf29c264b32972d7114dcf
Opcode Fuzzy Hash: 91e5555b9508150fcf6e55f7c9d4dc2ae8152fc7335161658e002f7252bbf59f
Instruction Fuzzy Hash: 3D41A130900A14BADB216B65CC8DABF7678DF81714F14817FF841B21D1D77C4A819EAE

Function 00406873 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNELBASE(75923420,004302B8,C:\,00405F5D,C:\,C:\,00000000,C:\,C:\,75923420,?,C:\Users\user\AppData\Local\Temp\,00405C69,?,75923420,C:\Users\user\AppData\Local\Temp\), ref: 0040687E
FindClose.KERNEL32(00000000), ref: 0040688A

Strings

C:\, xrefs: 00406873

Memory Dump Source

Source File: 00000000.00000002.2092512933.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2092495447.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092531995.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092652651.0000000000449000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID: C:\
API String ID: 2295610775-3404278061
Opcode ID: 86d0f84efe5cb21a5e65899ed37e92679b9de560e532c409a12d624e9ae3e839
Instruction ID: 67599a3b69382adcf67454a25bfea179debcebd0a6e2e92eb77ede12202c023a
Opcode Fuzzy Hash: 86d0f84efe5cb21a5e65899ed37e92679b9de560e532c409a12d624e9ae3e839
Instruction Fuzzy Hash: C3D012325192205FC3402B386E0C84B7A989F16331726CB76B4AAF51E0D7388C7387BD

Function 00403F9A Relevance: 51.4, APIs: 34, Instructions: 357
windowstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403FD6
ShowWindow.USER32(?), ref: 00403FF6
GetWindowLongW.USER32(?,000000F0), ref: 00404008
ShowWindow.USER32(?,00000004), ref: 00404021
DestroyWindow.USER32 ref: 00404035
SetWindowLongW.USER32(?,00000000,00000000), ref: 0040404E
GetDlgItem.USER32(?,?), ref: 0040406D
SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 00404081
IsWindowEnabled.USER32(00000000), ref: 00404088
GetDlgItem.USER32(?,00000001), ref: 00404133
GetDlgItem.USER32(?,00000002), ref: 0040413D
SetClassLongW.USER32(?,000000F2,?), ref: 00404157
SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 004041A8
GetDlgItem.USER32(?,00000003), ref: 0040424E
ShowWindow.USER32(00000000,?), ref: 0040426F
KiUserCallbackDispatcher.NTDLL(?,?), ref: 00404281
EnableWindow.USER32(?,?), ref: 0040429C
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 004042B2
EnableMenuItem.USER32(00000000), ref: 004042B9
SendMessageW.USER32(?,000000F4,00000000,00000001), ref: 004042D1
SendMessageW.USER32(?,00000401,00000002,00000000), ref: 004042E4
lstrlenW.KERNEL32(0042D268,?,0042D268,00000000), ref: 0040430E
SetWindowTextW.USER32(?,0042D268), ref: 00404322
ShowWindow.USER32(?,0000000A), ref: 00404456

Memory Dump Source

Source File: 00000000.00000002.2092512933.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2092495447.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092531995.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092652651.0000000000449000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: Window$Item$MessageSendShow$Long$EnableMenu$CallbackClassDestroyDispatcherEnabledSystemTextUserlstrlen
String ID:
API String ID: 121052019-0
Opcode ID: 655396db076bddd1a804ad939a9de1a35d1e50ec2b89a3d41d0d0026322ce3ca
Instruction ID: 19e8ffe36521fda3862950d2389d84f1ef0c133ac5ff71005f69e3a94542e2f3
Opcode Fuzzy Hash: 655396db076bddd1a804ad939a9de1a35d1e50ec2b89a3d41d0d0026322ce3ca
Instruction Fuzzy Hash: DDC1A1B1A00704ABDB206F61EE49E2B3A68FB84746F15053EF741B61F1CB799841DB2D

Function 00403BEC Relevance: 45.7, APIs: 14, Strings: 12, Instructions: 215
stringregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0040690A: GetModuleHandleA.KERNEL32(?,00000020,?,0040363D,0000000B), ref: 0040691C
Part of subcall function 0040690A: GetProcAddress.KERNEL32(00000000,?), ref: 00406937

GetUserDefaultUILanguage.KERNELBASE(00000002,75923420,C:\Users\user\AppData\Local\Temp\,?,00000000,?), ref: 00403C06

Part of subcall function 00406484: wsprintfW.USER32 ref: 00406491

lstrcatW.KERNEL32(1033,0042D268,80000001,Control Panel\Desktop\ResourceLocale,00000000,0042D268,00000000,00000002,75923420,C:\Users\user\AppData\Local\Temp\,?,00000000,?), ref: 00403C6D
lstrlenW.KERNEL32(00432EA0,?,?,?,00432EA0,00000000,C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\,1033,0042D268,80000001,Control Panel\Desktop\ResourceLocale,00000000,0042D268,00000000,00000002,75923420), ref: 00403CED
lstrcmpiW.KERNEL32(00432E98,.exe,00432EA0,?,?,?,00432EA0,00000000,C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\,1033,0042D268,80000001,Control Panel\Desktop\ResourceLocale,00000000,0042D268,00000000), ref: 00403D00
GetFileAttributesW.KERNEL32(00432EA0,?,00000000,?), ref: 00403D0B
LoadImageW.USER32(00000067,00000001,00000000,00000000,00008040,C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\), ref: 00403D54
RegisterClassW.USER32(00433EA0), ref: 00403D91
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00403DA9
CreateWindowExW.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403DDE
ShowWindow.USER32(00000005,00000000,?,00000000,?), ref: 00403E14
GetClassInfoW.USER32(00000000,RichEdit20W,00433EA0), ref: 00403E40
GetClassInfoW.USER32(00000000,RichEdit,00433EA0), ref: 00403E4D
RegisterClassW.USER32(00433EA0), ref: 00403E56
DialogBoxParamW.USER32(?,00000000,00403F9A,00000000), ref: 00403E75

Strings

1033, xrefs: 00403C0C, 00403C68
RichEdit, xrefs: 00403E47
RichEd32, xrefs: 00403E28
RichEd20, xrefs: 00403E1A
C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\, xrefs: 00403C7C, 00403C84, 00403D27, 00403D2D, 00403D3D
_Nb, xrefs: 00403D70, 00403DD8
RichEdit20W, xrefs: 00403E38, 00403E3E
C:\Users\user\AppData\Local\Temp\, xrefs: 00403BF1
.exe, xrefs: 00403CFA
.DEFAULT\Control Panel\International, xrefs: 00403C58
elete file: , xrefs: 00403CDC, 00403CE3, 00403CEC, 00403D0A
Control Panel\Desktop\ResourceLocale, xrefs: 00403C20

Memory Dump Source

Source File: 00000000.00000002.2092512933.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2092495447.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092531995.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092652651.0000000000449000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: Class$Info$RegisterWindow$AddressAttributesCreateDefaultDialogFileHandleImageLanguageLoadModuleParamParametersProcShowSystemUserlstrcatlstrcmpilstrlenwsprintf
String ID: .DEFAULT\Control Panel\International$.exe$1033$C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\$C:\Users\user\AppData\Local\Temp\$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20W$_Nb$elete file:
API String ID: 606308-3923983357
Opcode ID: 4d5bc0c8b1d06963261e86736c564a0ba68078006fcf7539d23d4665df175b37
Instruction ID: 6cc527b2f10929733706d009ff8c1d9b21e511251dd9cb17fe62514cef47010a
Opcode Fuzzy Hash: 4d5bc0c8b1d06963261e86736c564a0ba68078006fcf7539d23d4665df175b37
Instruction Fuzzy Hash: F561A670140300BED721AF66ED46F2B3A6CEB84B5AF40453FF945B62E2CB7D59018A6D

Function 0040307D Relevance: 24.7, APIs: 5, Strings: 9, Instructions: 181
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 0040308E
GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.16359.15944.exe,00000400,?,?,?,?,?,0040387D,?), ref: 004030AA

Part of subcall function 0040602D: GetFileAttributesW.KERNELBASE(00000003,004030BD,C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.16359.15944.exe,80000000,00000003,?,?,?,?,?,0040387D,?), ref: 00406031
Part of subcall function 0040602D: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,?,?,?,0040387D,?), ref: 00406053

GetFileSize.KERNEL32(00000000,00000000,00444000,00000000,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.16359.15944.exe,C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.16359.15944.exe,80000000,00000003,?,?,?,?,?,0040387D), ref: 004030F6
GlobalAlloc.KERNELBASE(00000040,}8@,?,?,?,?,?,0040387D,?), ref: 0040322C

Strings

Null, xrefs: 00403174
Inst, xrefs: 00403162
C:\Users\user\Desktop, xrefs: 004030D8, 004030DD, 004030E3
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 00403253
soft, xrefs: 0040316B
C:\Users\user\AppData\Local\Temp\, xrefs: 00403084
}8@, xrefs: 00403227, 00403242
Error launching installer, xrefs: 004030CD
C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.16359.15944.exe, xrefs: 00403094, 004030A3, 004030B7, 004030D7

Memory Dump Source

Source File: 00000000.00000002.2092512933.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2092495447.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092531995.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092652651.0000000000449000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: File$AllocAttributesCountCreateGlobalModuleNameSizeTick
String ID: C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.16359.15944.exe$Error launching installer$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft$}8@
API String ID: 2803837635-163011212
Opcode ID: b2925046ebf4ee23c20be954f21b6b8de3b8febbf6f0f410cc7df6a070a5bb34
Instruction ID: 750c061bb954c4555836cecba7cc54c639b148d890841a972b43b12454d44aa7
Opcode Fuzzy Hash: b2925046ebf4ee23c20be954f21b6b8de3b8febbf6f0f410cc7df6a070a5bb34
Instruction Fuzzy Hash: 7951B571904204AFDB10AF65ED42B9E7EACAB48756F14807BF904B62D1C77C9F408B9D

Function 004032B4 Relevance: 19.4, APIs: 4, Strings: 7, Instructions: 166
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 0040331E
GetTickCount.KERNEL32 ref: 004033C5
MulDiv.KERNEL32(7FFFFFFF,00000064,?), ref: 004033EE
wsprintfW.USER32 ref: 00403401

Strings

... %d%%, xrefs: 004033FB
*B, xrefs: 004032DF
A, xrefs: 0040347E
}8@, xrefs: 004032B4
} } }, "s3" : { "defaults" : { "signatureVersions" : [ "s3v4" ] }, "endpoints" : { "us-iso-east-1" : { "protocols" : [ "http", "https" ], "signatureVersions" : [ "s3v4" ] , xrefs: 00403338
/4B, xrefs: 004033A2, 004033BD, 0040343A
A, xrefs: 00403374

Memory Dump Source

Source File: 00000000.00000002.2092512933.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2092495447.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092531995.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092652651.0000000000449000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: CountTick$wsprintf
String ID: *B$ A$ A$... %d%%$/4B$} } }, "s3" : { "defaults" : { "signatureVersions" : [ "s3v4" ] }, "endpoints" : { "us-iso-east-1" : { "protocols" : [ "http", "https" ], "signatureVersions" : [ "s3v4" ] $}8@
API String ID: 551687249-328096470
Opcode ID: d1cfd4714e4687a3a26bd4ac3846c46955ae89f51795138bd42b88bfc39313c7
Instruction ID: 54ab186c05730647c672001b6e56d135182c7b51176e178f40f708a1e84a381e
Opcode Fuzzy Hash: d1cfd4714e4687a3a26bd4ac3846c46955ae89f51795138bd42b88bfc39313c7
Instruction Fuzzy Hash: E251BD31810219EBCF11DF65DA44B9E7BB8AF05756F10827BE804BB2C1D7789E44CBA9

Function 0040657A Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 196
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryW.KERNEL32(00432EA0,00000400), ref: 00406695
GetWindowsDirectoryW.KERNEL32(00432EA0,00000400,00000000,C:\Users\user\AppData\Local\Temp\nsl5176.tmp\,?,004055D6,C:\Users\user\AppData\Local\Temp\nsl5176.tmp\,00000000,00000000,0042342F,759223A0), ref: 004066A8
lstrcatW.KERNEL32(00432EA0,\Microsoft\Internet Explorer\Quick Launch), ref: 0040671F
lstrlenW.KERNEL32(00432EA0,00000000,C:\Users\user\AppData\Local\Temp\nsl5176.tmp\,?,004055D6,C:\Users\user\AppData\Local\Temp\nsl5176.tmp\,00000000), ref: 00406779

Strings

\Microsoft\Internet Explorer\Quick Launch, xrefs: 00406719
C:\Users\user\AppData\Local\Temp\nsl5176.tmp\, xrefs: 0040659F
Software\Microsoft\Windows\CurrentVersion, xrefs: 00406663

Memory Dump Source

Source File: 00000000.00000002.2092512933.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2092495447.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092531995.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092652651.0000000000449000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: Directory$SystemWindowslstrcatlstrlen
String ID: C:\Users\user\AppData\Local\Temp\nsl5176.tmp\$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 4260037668-1140045403
Opcode ID: 0b784a7e5946d1979f34278c46bba3f41134a9dae7c042527df4b3408295a3c8
Instruction ID: 685928b229c5d1fd60d609eb920d771e11fa4d776b5b66b0bad6c944a0f90ddf
Opcode Fuzzy Hash: 0b784a7e5946d1979f34278c46bba3f41134a9dae7c042527df4b3408295a3c8
Instruction Fuzzy Hash: 1D61D131900205EADB209F64DD80BAE77A5EF54318F22813BE907B72D0D77D99A1CB5D

Function 0040176F Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 145
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcatW.KERNEL32(00000000,00000000,"C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe" -f SecuriteInfo.com.FileRepMalware.16359.15944.exe,C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler,?,?,00000031), ref: 004017B0
CompareFileTime.KERNEL32(-00000014,?,"C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe" -f SecuriteInfo.com.FileRepMalware.16359.15944.exe,"C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe" -f SecuriteInfo.com.FileRepMalware.16359.15944.exe,00000000,00000000,"C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe" -f SecuriteInfo.com.FileRepMalware.16359.15944.exe,C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler,?,?,00000031), ref: 004017D5

Part of subcall function 0040653D: lstrcpynW.KERNEL32(?,?,00000400,0040369D,00433F00,NSIS Error), ref: 0040654A

Part of subcall function 0040559F: lstrlenW.KERNEL32(C:\Users\user\AppData\Local\Temp\nsl5176.tmp\,00000000,0042342F,759223A0,?,?,?,?,?,?,?,?,?,00403418,00000000,?), ref: 004055D7
Part of subcall function 0040559F: lstrlenW.KERNEL32(00403418,C:\Users\user\AppData\Local\Temp\nsl5176.tmp\,00000000,0042342F,759223A0,?,?,?,?,?,?,?,?,?,00403418,00000000), ref: 004055E7
Part of subcall function 0040559F: lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\nsl5176.tmp\,00403418,00403418,C:\Users\user\AppData\Local\Temp\nsl5176.tmp\,00000000,0042342F,759223A0), ref: 004055FA
Part of subcall function 0040559F: SetWindowTextW.USER32(C:\Users\user\AppData\Local\Temp\nsl5176.tmp\,C:\Users\user\AppData\Local\Temp\nsl5176.tmp\), ref: 0040560C
Part of subcall function 0040559F: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405632
Part of subcall function 0040559F: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040564C
Part of subcall function 0040559F: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040565A

Strings

C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler, xrefs: 0040179E
SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System, xrefs: 00401835, 00401851
"C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe" -f SecuriteInfo.com.FileRepMalware.16359.15944.exe, xrefs: 0040178D, 00401796, 004017A3, 004017B5, 004017C1, 004017F7, 0040180D, 0040182B, 00401867, 004018E8, 004018F1, 004018FB, 00401906

Memory Dump Source

Source File: 00000000.00000002.2092512933.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2092495447.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092531995.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092652651.0000000000449000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID: "C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe" -f SecuriteInfo.com.FileRepMalware.16359.15944.exe$C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler$SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
API String ID: 1941528284-3651343164
Opcode ID: e76ef7c14b194b1d558144f9db04474b742f47f92f43e4e9c0b682ed5946015e
Instruction ID: 1e3f5e060805a06bac003644be00ba5f3fef1f2c353f2d3d357c0a6c5ca497fd
Opcode Fuzzy Hash: e76ef7c14b194b1d558144f9db04474b742f47f92f43e4e9c0b682ed5946015e
Instruction Fuzzy Hash: F4419371900108BACF11BFB5DD85DAE7A79EF45768B20423FF422B10E2D63C8A91966D

Function 0040559F Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 72
stringwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenW.KERNEL32(C:\Users\user\AppData\Local\Temp\nsl5176.tmp\,00000000,0042342F,759223A0,?,?,?,?,?,?,?,?,?,00403418,00000000,?), ref: 004055D7
lstrlenW.KERNEL32(00403418,C:\Users\user\AppData\Local\Temp\nsl5176.tmp\,00000000,0042342F,759223A0,?,?,?,?,?,?,?,?,?,00403418,00000000), ref: 004055E7
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\nsl5176.tmp\,00403418,00403418,C:\Users\user\AppData\Local\Temp\nsl5176.tmp\,00000000,0042342F,759223A0), ref: 004055FA
SetWindowTextW.USER32(C:\Users\user\AppData\Local\Temp\nsl5176.tmp\,C:\Users\user\AppData\Local\Temp\nsl5176.tmp\), ref: 0040560C
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405632
SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040564C
SendMessageW.USER32(?,00001013,?,00000000), ref: 0040565A

Part of subcall function 0040657A: lstrcatW.KERNEL32(00432EA0,\Microsoft\Internet Explorer\Quick Launch), ref: 0040671F
Part of subcall function 0040657A: lstrlenW.KERNEL32(00432EA0,00000000,C:\Users\user\AppData\Local\Temp\nsl5176.tmp\,?,004055D6,C:\Users\user\AppData\Local\Temp\nsl5176.tmp\,00000000), ref: 00406779

Strings

C:\Users\user\AppData\Local\Temp\nsl5176.tmp\, xrefs: 004055C0, 004055D0, 004055D6, 004055F9, 00405605

Memory Dump Source

Source File: 00000000.00000002.2092512933.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2092495447.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092531995.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092652651.0000000000449000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: MessageSendlstrlen$lstrcat$TextWindow
String ID: C:\Users\user\AppData\Local\Temp\nsl5176.tmp\
API String ID: 1495540970-3611396640
Opcode ID: 738a72538bd68e99fc25cc5aeb13fda9b39fd06f1dca7185dcaff0c953f7535c
Instruction ID: 138a2a903332092674924c4fce2a37a83712bc812e9b86ab44911e1df8857bb6
Opcode Fuzzy Hash: 738a72538bd68e99fc25cc5aeb13fda9b39fd06f1dca7185dcaff0c953f7535c
Instruction Fuzzy Hash: C1219071900558BACF11AFA9DD84DDFBF75EF45354F14803AF904B22A0C7794A419F68

Function 0040689A Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryW.KERNEL32(?,00000104), ref: 004068B1
wsprintfW.USER32 ref: 004068EC
LoadLibraryExW.KERNEL32(?,00000000,00000008), ref: 00406900

Strings

\, xrefs: 004068C2
UXTHEME, xrefs: 004068A3
%s%S.dll, xrefs: 004068E6

Memory Dump Source

Source File: 00000000.00000002.2092512933.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2092495447.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092531995.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092652651.0000000000449000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: DirectoryLibraryLoadSystemwsprintf
String ID: %s%S.dll$UXTHEME$\
API String ID: 2200240437-1946221925
Opcode ID: 70474fd7a4f9c0ba06a591290262a653731ba096fd3a0e6ffa6d52d828e9795f
Instruction ID: 21628a1c63ce2f140fdd4d546058f3b0ba52bdb51e88dcb335987c0e659eada7
Opcode Fuzzy Hash: 70474fd7a4f9c0ba06a591290262a653731ba096fd3a0e6ffa6d52d828e9795f
Instruction Fuzzy Hash: D0F0F671511119ABDB10BB64DD0DF9B376CBF00305F10847AA646F10D0EB7CDA68CBA8

Function 00405A6E Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 39
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryW.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\), ref: 00405AB1
GetLastError.KERNEL32 ref: 00405AC5
SetFileSecurityW.ADVAPI32(?,80000007,00000001), ref: 00405ADA
GetLastError.KERNEL32 ref: 00405AE4

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405A94

Memory Dump Source

Source File: 00000000.00000002.2092512933.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2092495447.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092531995.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092652651.0000000000449000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: ErrorLast$CreateDirectoryFileSecurity
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 3449924974-823278215
Opcode ID: 79915fdb32ce531948ad707932686e2b3240d3ac97543659e1c0f9af800e449c
Instruction ID: 637b0a295f6611997b04f2fb2f8121e2d74ae93851c1d74b8ff7b710bfe1865b
Opcode Fuzzy Hash: 79915fdb32ce531948ad707932686e2b3240d3ac97543659e1c0f9af800e449c
Instruction Fuzzy Hash: 1A010871D04219EAEF019BA0DD84BEFBBB4EB14314F00813AD545B6281E7789648CFE9

Function 00405F14 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 47
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0040653D: lstrcpynW.KERNEL32(?,?,00000400,0040369D,00433F00,NSIS Error), ref: 0040654A

Part of subcall function 00405EB7: CharNextW.USER32(?,?,C:\,?,00405F2B,C:\,C:\,75923420,?,C:\Users\user\AppData\Local\Temp\,00405C69,?,75923420,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405EC5
Part of subcall function 00405EB7: CharNextW.USER32(00000000), ref: 00405ECA
Part of subcall function 00405EB7: CharNextW.USER32(00000000), ref: 00405EE2

lstrlenW.KERNEL32(C:\,00000000,C:\,C:\,75923420,?,C:\Users\user\AppData\Local\Temp\,00405C69,?,75923420,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405F6D
GetFileAttributesW.KERNELBASE(C:\,C:\,C:\,C:\,C:\,C:\,00000000,C:\,C:\,75923420,?,C:\Users\user\AppData\Local\Temp\,00405C69,?,75923420,C:\Users\user\AppData\Local\Temp\), ref: 00405F7D

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405F14
C:\, xrefs: 00405F1A, 00405F1F, 00405F25, 00405F66, 00405F6C, 00405F74, 00405F7C

Memory Dump Source

Source File: 00000000.00000002.2092512933.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2092495447.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092531995.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092652651.0000000000449000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: CharNext$AttributesFilelstrcpynlstrlen
String ID: C:\$C:\Users\user\AppData\Local\Temp\
API String ID: 3248276644-1964270705
Opcode ID: 442e1b1d96b1c23b6c0207761c3788c7dd97485575ed4e88a223653099446a7a
Instruction ID: e20fb510edeaf32ba19235dad054e15b0ffac27cf679254cac4fdbc394554759
Opcode Fuzzy Hash: 442e1b1d96b1c23b6c0207761c3788c7dd97485575ed4e88a223653099446a7a
Instruction Fuzzy Hash: E3F0F426119D6226DB22333A5C05EAF0554CE9276475A023BF895B12C5DB3C8A43D8AE

Function 0040605C Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 37
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 0040607A
GetTempFileNameW.KERNELBASE(?,?,00000000,?,?,?,?,0040352B,1033,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403810), ref: 00406095

Strings

nsa, xrefs: 00406069
C:\Users\user\AppData\Local\Temp\, xrefs: 00406061

Memory Dump Source

Source File: 00000000.00000002.2092512933.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2092495447.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092531995.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092652651.0000000000449000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: C:\Users\user\AppData\Local\Temp\$nsa
API String ID: 1716503409-44229769
Opcode ID: 418a87fb760587bef7583f4f3acae06d17b3011fc99645d3e11ea5bfcaa5fca8
Instruction ID: cc98cbd97bba9fac9576f26979179aa346a2ab2dc3c85b14509754d74f2b81c3
Opcode Fuzzy Hash: 418a87fb760587bef7583f4f3acae06d17b3011fc99645d3e11ea5bfcaa5fca8
Instruction Fuzzy Hash: CEF09076B40204FBEB00CF69ED05E9EB7BCEB95750F11803AFA05F7140E6B499648768

Function 004015C1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00405EB7: CharNextW.USER32(?,?,C:\,?,00405F2B,C:\,C:\,75923420,?,C:\Users\user\AppData\Local\Temp\,00405C69,?,75923420,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405EC5
Part of subcall function 00405EB7: CharNextW.USER32(00000000), ref: 00405ECA
Part of subcall function 00405EB7: CharNextW.USER32(00000000), ref: 00405EE2

GetFileAttributesW.KERNELBASE(?,?,00000000,0000005C,00000000,000000F0), ref: 0040161A

Part of subcall function 00405A6E: CreateDirectoryW.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\), ref: 00405AB1

SetCurrentDirectoryW.KERNELBASE(?,C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler,?,00000000,000000F0), ref: 0040164D

Strings

C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler, xrefs: 00401640

Memory Dump Source

Source File: 00000000.00000002.2092512933.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2092495447.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092531995.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092652651.0000000000449000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: CharNext$Directory$AttributesCreateCurrentFile
String ID: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler
API String ID: 1892508949-372905971
Opcode ID: e89a9e6a3f09ade376d0d4b3fd71c203f5cd3ef8be9bd613e1140dffb9deb40c
Instruction ID: 910f9ca0e916fbda017ea5bccd1daba2d9720f9cae8b5c5670dceb894c5ef12e
Opcode Fuzzy Hash: e89a9e6a3f09ade376d0d4b3fd71c203f5cd3ef8be9bd613e1140dffb9deb40c
Instruction Fuzzy Hash: 3E11D031504110EBCF216FA5CD4099F36A0EF25369B28493BE945B52F1DA3E4A829A8E

Function 004020D8 Relevance: 4.6, APIs: 3, Instructions: 73libraryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000,00000001,000000F0), ref: 00402103

Part of subcall function 0040559F: lstrlenW.KERNEL32(C:\Users\user\AppData\Local\Temp\nsl5176.tmp\,00000000,0042342F,759223A0,?,?,?,?,?,?,?,?,?,00403418,00000000,?), ref: 004055D7
Part of subcall function 0040559F: lstrlenW.KERNEL32(00403418,C:\Users\user\AppData\Local\Temp\nsl5176.tmp\,00000000,0042342F,759223A0,?,?,?,?,?,?,?,?,?,00403418,00000000), ref: 004055E7
Part of subcall function 0040559F: lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\nsl5176.tmp\,00403418,00403418,C:\Users\user\AppData\Local\Temp\nsl5176.tmp\,00000000,0042342F,759223A0), ref: 004055FA
Part of subcall function 0040559F: SetWindowTextW.USER32(C:\Users\user\AppData\Local\Temp\nsl5176.tmp\,C:\Users\user\AppData\Local\Temp\nsl5176.tmp\), ref: 0040560C
Part of subcall function 0040559F: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405632
Part of subcall function 0040559F: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040564C
Part of subcall function 0040559F: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040565A

LoadLibraryExW.KERNEL32(00000000,?,00000008,00000001,000000F0), ref: 00402114
FreeLibrary.KERNELBASE(?,?,000000F7,?,?,00000008,00000001,000000F0), ref: 00402191

Memory Dump Source

Source File: 00000000.00000002.2092512933.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2092495447.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092531995.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092652651.0000000000449000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: MessageSend$Librarylstrlen$FreeHandleLoadModuleTextWindowlstrcat
String ID:
API String ID: 334405425-0
Opcode ID: 0812a69665cf11e377adb3684f8a171474585e26745252b9346dd4e1bc3f05c7
Instruction ID: d1cf9917c249e547a3b1759614bc69e8b445b1996c4dbd71fd6f6dd46acd7470
Opcode Fuzzy Hash: 0812a69665cf11e377adb3684f8a171474585e26745252b9346dd4e1bc3f05c7
Instruction Fuzzy Hash: 2A21C231904104FACF11AFA5CE48A9D7A71BF48358F20413BF605B91E1DBBD8A82965D

Function 0040248A Relevance: 4.6, APIs: 3, Instructions: 64registrystringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(0040B5F0,00000023,00000011,00000002), ref: 004024D5
RegSetValueExW.KERNELBASE(?,?,?,?,0040B5F0,00000000,00000011,00000002), ref: 00402515
RegCloseKey.ADVAPI32(?,?,?,0040B5F0,00000000,00000011,00000002), ref: 004025FD

Memory Dump Source

Source File: 00000000.00000002.2092512933.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2092495447.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092531995.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092652651.0000000000449000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: CloseValuelstrlen
String ID:
API String ID: 2655323295-0
Opcode ID: 3f2741e17913f4b3ae47e715a678bc9f1b76d5c80f35dbb4c6e867a5b8f0e772
Instruction ID: a32c4fc66ba480c3aafb49ec1434dbeb720bd0d2787204a1d049ba7b64bbfaa1
Opcode Fuzzy Hash: 3f2741e17913f4b3ae47e715a678bc9f1b76d5c80f35dbb4c6e867a5b8f0e772
Instruction Fuzzy Hash: 8B118E71E00119BEEF10AFA5DE49EAEBAB8FF44358F15443AF504F61C1D7B88D40AA58

Function 00405C01 Relevance: 4.5, APIs: 3, Instructions: 28fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00406008: GetFileAttributesW.KERNELBASE(?,?,00405C0D,?,?,00000000,00405DE3,?,?,?,?), ref: 0040600D
Part of subcall function 00406008: SetFileAttributesW.KERNELBASE(?,00000000), ref: 00406021

RemoveDirectoryW.KERNELBASE(?,?,?,00000000,00405DE3), ref: 00405C1C
DeleteFileW.KERNELBASE(?,?,?,00000000,00405DE3), ref: 00405C24
SetFileAttributesW.KERNEL32(?,00000000), ref: 00405C3C

Memory Dump Source

Source File: 00000000.00000002.2092512933.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2092495447.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092531995.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092652651.0000000000449000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: File$Attributes$DeleteDirectoryRemove
String ID:
API String ID: 1655745494-0
Opcode ID: 8eed124eda4cbc8430ddba83c09443e031bc029d4ce3365f7fb32bc961faff32
Instruction ID: 0274c5225d47ddc366315f3a2fda4b694ad97aa72442a0e2fcdbaf00fd257d87
Opcode Fuzzy Hash: 8eed124eda4cbc8430ddba83c09443e031bc029d4ce3365f7fb32bc961faff32
Instruction Fuzzy Hash: F4E0E53110CF9156E61457309E08F5F2AD8EF86715F05493EF892B10C0CBB848068E6A

Function 0040640B Relevance: 3.0, APIs: 2, Instructions: 44registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNELBASE(00650000,00650000,00000000,00000000,00432EA0,00000800,00000000,?,00000000,00650000,00650000,00432EA0,?,?,00406672,80000002), ref: 00406451
RegCloseKey.ADVAPI32(00650000,?,00406672,80000002,Software\Microsoft\Windows\CurrentVersion,00650000,00432EA0,00650000,00000000,C:\Users\user\AppData\Local\Temp\nsl5176.tmp\), ref: 0040645C

Memory Dump Source

Source File: 00000000.00000002.2092512933.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2092495447.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092531995.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092652651.0000000000449000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: CloseQueryValue
String ID:
API String ID: 3356406503-0
Opcode ID: 5e421e957683aa7155fe1e1f393967b6404614e05e15b89e99e168e2dc4a01c3
Instruction ID: a8d415a3dc4e4479eaaa65942f717852bb8bd3539c12dad3b2e52d491ce509ba
Opcode Fuzzy Hash: 5e421e957683aa7155fe1e1f393967b6404614e05e15b89e99e168e2dc4a01c3
Instruction Fuzzy Hash: FB017C72510209AADF21CF51CC09EDB3BB8FB54364F01803AFD5AA6190D738D968DBA8

Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43windowCOMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
SendMessageW.USER32(?,00000402,00000000), ref: 004013F4

Memory Dump Source

Source File: 00000000.00000002.2092512933.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2092495447.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092531995.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092652651.0000000000449000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: d8feea9b0bd879c8f8267a4ec85e9a32d700cac98845316580bbb569ce856791
Instruction ID: f98c5e72cab4da6dd47fcf147c12dc0649e5852bd482257a86ca63d172a8b8d6
Opcode Fuzzy Hash: d8feea9b0bd879c8f8267a4ec85e9a32d700cac98845316580bbb569ce856791
Instruction Fuzzy Hash: 0B01F4316202209FE7094B389D05B6A3698E710319F14823FF851F65F1EA78DC029B4C

Function 00405672 Relevance: 3.0, APIs: 2, Instructions: 32comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 00405682

Part of subcall function 004044E5: SendMessageW.USER32(?,00000000,00000000,00000000), ref: 004044F7

CoUninitialize.COMBASE(00000404,00000000,?,00000000,?), ref: 004056CE

Memory Dump Source

Source File: 00000000.00000002.2092512933.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2092495447.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092531995.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092652651.0000000000449000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: InitializeMessageSendUninitialize
String ID:
API String ID: 2896919175-0
Opcode ID: 373f90d4a1babe4f1a04baa381ba9309e44634cfc63d647d34b32aa976a59a0d
Instruction ID: 6be4ff692d487ef8b3e25caebddd25c5d55207980f196ef2193ccf2f8785d180
Opcode Fuzzy Hash: 373f90d4a1babe4f1a04baa381ba9309e44634cfc63d647d34b32aa976a59a0d
Instruction Fuzzy Hash: B3F0F0765006009AE6115B95A901BA677A8EBD4316F49883AEF88632E0CB365C418A1C

Function 00405B20 Relevance: 3.0, APIs: 2, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00430270,00000000,00000000), ref: 00405B49
CloseHandle.KERNEL32(?), ref: 00405B56

Memory Dump Source

Source File: 00000000.00000002.2092512933.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2092495447.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092531995.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092652651.0000000000449000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID:
API String ID: 3712363035-0
Opcode ID: 4cad7792158b69fc064c933527736888f22fedd2346a68a48c9e5725d4d2403f
Instruction ID: 0547baa0b497a95b6ed0e8f273b1969b1ac2c9598ef2001c301bcde660c6e2d6
Opcode Fuzzy Hash: 4cad7792158b69fc064c933527736888f22fedd2346a68a48c9e5725d4d2403f
Instruction Fuzzy Hash: 3EE092B4600209BFEB10AB64AE49F7B7AACEB04704F004565BA51E61A1DB78E8158A78

Function 00401573 Relevance: 3.0, APIs: 2, Instructions: 23COMMON

Download Yara Rule

APIs

ShowWindow.USER32(?,?), ref: 00401587
ShowWindow.USER32(?), ref: 0040159C

Memory Dump Source

Source File: 00000000.00000002.2092512933.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2092495447.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092531995.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092652651.0000000000449000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: ShowWindow
String ID:
API String ID: 1268545403-0
Opcode ID: 9830f19a5ada20b5c39db0360587226410169cce59dca2e5f379f63bd844bbb1
Instruction ID: a156d7c756385a3c588793d51facb92f34767ed8181f20582b2048d309791e4b
Opcode Fuzzy Hash: 9830f19a5ada20b5c39db0360587226410169cce59dca2e5f379f63bd844bbb1
Instruction Fuzzy Hash: 25E04F76B101149BCB05DFA8ED908AEB3A6EB84311314483BE502B3290D675AD048B18

Function 0040690A Relevance: 3.0, APIs: 2, Instructions: 22libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,00000020,?,0040363D,0000000B), ref: 0040691C
GetProcAddress.KERNEL32(00000000,?), ref: 00406937

Part of subcall function 0040689A: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 004068B1
Part of subcall function 0040689A: wsprintfW.USER32 ref: 004068EC
Part of subcall function 0040689A: LoadLibraryExW.KERNEL32(?,00000000,00000008), ref: 00406900

Memory Dump Source

Source File: 00000000.00000002.2092512933.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2092495447.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092531995.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092652651.0000000000449000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: AddressDirectoryHandleLibraryLoadModuleProcSystemwsprintf
String ID:
API String ID: 2547128583-0
Opcode ID: c7c26614299f557633109f7ac2ccf4e744cd73af09153470ea8035ac80f12020
Instruction ID: 98bdf7d71c6046f852b78b75196177710d0a141037308efd39b2ac7baa162fea
Opcode Fuzzy Hash: c7c26614299f557633109f7ac2ccf4e744cd73af09153470ea8035ac80f12020
Instruction Fuzzy Hash: 9FE0867390422066D21196745D44D7773A89B99750306443EF946F2090DB38DC31A76E

Function 0040602D Relevance: 3.0, APIs: 2, Instructions: 16fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(00000003,004030BD,C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.16359.15944.exe,80000000,00000003,?,?,?,?,?,0040387D,?), ref: 00406031
CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,?,?,?,0040387D,?), ref: 00406053

Memory Dump Source

Source File: 00000000.00000002.2092512933.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2092495447.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092531995.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092652651.0000000000449000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: 080dfadfdaad2818d5b04c51cfada36c475993ea7ffea5996e238fb5a0e3a6c4
Instruction ID: 1030bc0f2bf25390ef9c6131bda9d6cfedcac9e68b753c15eded60bf4a570351
Opcode Fuzzy Hash: 080dfadfdaad2818d5b04c51cfada36c475993ea7ffea5996e238fb5a0e3a6c4
Instruction Fuzzy Hash: 5ED09E31254201AFEF098F20DE16F2E7BA2EB94B04F11552CB786941E0DAB15C199B15

Function 00406008 Relevance: 3.0, APIs: 2, Instructions: 13COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,?,00405C0D,?,?,00000000,00405DE3,?,?,?,?), ref: 0040600D
SetFileAttributesW.KERNELBASE(?,00000000), ref: 00406021

Memory Dump Source

Source File: 00000000.00000002.2092512933.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2092495447.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092531995.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092652651.0000000000449000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: a764032cc0ce64e7f87df91ab84dfb27e8fca44cfd77f22972d2dc2d25b91850
Instruction ID: c979a2e86073268fb5c10017c0603d576bb262e7e1663e1e1b2ee048d1a5e24b
Opcode Fuzzy Hash: a764032cc0ce64e7f87df91ab84dfb27e8fca44cfd77f22972d2dc2d25b91850
Instruction Fuzzy Hash: 34D012725041316FC2102728EF0C89BBF55EF643717014B35F9A5A22F0CB304C638A98

Function 00403B12 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 11COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(FFFFFFFF,00403A5E,?), ref: 00403B1D

Strings

C:\Users\user\AppData\Local\Temp\nsl5176.tmp\, xrefs: 00403B31

Memory Dump Source

Source File: 00000000.00000002.2092512933.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2092495447.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092531995.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092652651.0000000000449000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: CloseHandle
String ID: C:\Users\user\AppData\Local\Temp\nsl5176.tmp\
API String ID: 2962429428-3611396640
Opcode ID: e86ec88962d2cddd060eb64ec5e150871475ae72b9f2b14f7d4b77a190cc5563
Instruction ID: 74b342ff74dc5917d60848dc34610585f5de2c5243f802b65b47dd8438b48b4d
Opcode Fuzzy Hash: e86ec88962d2cddd060eb64ec5e150871475ae72b9f2b14f7d4b77a190cc5563
Instruction Fuzzy Hash: 5EC0123050470056D1646F749E4FE153B64AB4073EB600325B0F9B10F1CB3C5759895D

Function 00405AEB Relevance: 3.0, APIs: 2, Instructions: 9COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,00000000,00403520,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403810), ref: 00405AF1
GetLastError.KERNEL32 ref: 00405AFF

Memory Dump Source

Source File: 00000000.00000002.2092512933.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2092495447.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092531995.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092652651.0000000000449000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID:
API String ID: 1375471231-0
Opcode ID: a5afa482e644e9a10fedfab033ae5dbb8931bf23a9e1c5533d9f8c1a63861871
Instruction ID: 33feed20cbbf131019f18849f7ccc9358209a8d33535326e0157453b6049084a
Opcode Fuzzy Hash: a5afa482e644e9a10fedfab033ae5dbb8931bf23a9e1c5533d9f8c1a63861871
Instruction Fuzzy Hash: 1BC04C30204501AED6105B609E48B177AA4DB50741F16843D6146E41E0DA789455EE2D

Function 004063D8 Relevance: 1.5, APIs: 1, Instructions: 24registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.KERNELBASE(00000000,?,00000000,00000000,00000000,?,00000000,?,00000000,?,?,?,00402E57,00000000,?,?), ref: 00406401

Memory Dump Source

Source File: 00000000.00000002.2092512933.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2092495447.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092531995.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092652651.0000000000449000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: f0170b29b94a961cdf0cc122a920c286c7e5b726b195fdee8f598fb45efbb6e4
Instruction ID: ccab944935cfefb85f0e849ce69279fb55db75a3b7fb0960311cd9d36817041a
Opcode Fuzzy Hash: f0170b29b94a961cdf0cc122a920c286c7e5b726b195fdee8f598fb45efbb6e4
Instruction Fuzzy Hash: 04E0E6B2010109BFEF095F90DC0AD7B3B1DE704300F01892EFD06D4091E6B5AD306675

Function 004060DF Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(00000000,00000000,00000004,00000004,00000000,000000FF,?,00403498,00000000,0041EA20,000000FF,0041EA20,000000FF,000000FF,00000004,00000000), ref: 004060F3

Memory Dump Source

Source File: 00000000.00000002.2092512933.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2092495447.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092531995.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092652651.0000000000449000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 3dec9289c2e50997f5b7f42c7d661c3d3292bfbb80aff78175bf8fde073ef60e
Instruction ID: d8d859634201a592f38c73999a999f352708a9e59580de02994c407fa40ca669
Opcode Fuzzy Hash: 3dec9289c2e50997f5b7f42c7d661c3d3292bfbb80aff78175bf8fde073ef60e
Instruction Fuzzy Hash: FAE08C3220026AABEF109E60DC04AEB3B6CFB00360F014837FA16E7081E270E93087A4

Function 004060B0 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(00000000,00000000,00000004,00000004,00000000,000000FF,?,004034E2,00000000,00000000,00403306,000000FF,00000004,00000000,00000000,00000000), ref: 004060C4

Memory Dump Source

Source File: 00000000.00000002.2092512933.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2092495447.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092531995.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092652651.0000000000449000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 0024165f2f5d2011be9120f41fe866c54f7b8e58de784a1218c53157080e4b8c
Instruction ID: 1583d2e05e1cff28e3594e7db3f0db2d88eef65457287744bb544c492d9958e5
Opcode Fuzzy Hash: 0024165f2f5d2011be9120f41fe866c54f7b8e58de784a1218c53157080e4b8c
Instruction Fuzzy Hash: AEE0EC322502AAABDF10AE65DC04AEB7B6CEB05361F018936FD16E6150E631E92197A4

Function 004063AA Relevance: 1.5, APIs: 1, Instructions: 19registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,00650000,00432EA0,?,00650000,?,00406438,?,00000000,00650000,00650000,00432EA0,?), ref: 004063CE

Memory Dump Source

Source File: 00000000.00000002.2092512933.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2092495447.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092531995.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092652651.0000000000449000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 759d75b29ffd137612e455953a298f0698f5beae901813cd77d6ec234b014f3e
Instruction ID: 4361357c0318622cec318f667d88df30c4c29b75262f7bca7234b06b46464da2
Opcode Fuzzy Hash: 759d75b29ffd137612e455953a298f0698f5beae901813cd77d6ec234b014f3e
Instruction Fuzzy Hash: 83D0123210020EBBDF115F91AD01FAB3B5DAB08310F014426FE06E40A1D775D530A764

Function 004044E5 Relevance: 1.5, APIs: 1, Instructions: 9windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000000,00000000,00000000), ref: 004044F7

Memory Dump Source

Source File: 00000000.00000002.2092512933.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2092495447.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092531995.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092652651.0000000000449000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: b985a0028b3d47d2300e38cb49a9103195f452c5c5dca8052d978926f7780193
Instruction ID: 729772cd993a62bf3dcd5a53f5ba0c6067f9c4589e443fe2cdcdd0dddf41cb53
Opcode Fuzzy Hash: b985a0028b3d47d2300e38cb49a9103195f452c5c5dca8052d978926f7780193
Instruction Fuzzy Hash: 74C04CB1740605BADA108B509D45F0677546750701F188429B641A50E0CA74E410D62C

Function 004044CE Relevance: 1.5, APIs: 1, Instructions: 6windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000028,?,00000001,004042F9), ref: 004044DC

Memory Dump Source

Source File: 00000000.00000002.2092512933.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2092495447.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092531995.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092652651.0000000000449000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: ea04ea026f55595d688d74c1d87789f1c1942be7a89ca5b988cfd0b6025de892
Instruction ID: f9270ce27bc2d5d500308faa7c43699bdd9cec228278350af1c7ef3a72e6c056
Opcode Fuzzy Hash: ea04ea026f55595d688d74c1d87789f1c1942be7a89ca5b988cfd0b6025de892
Instruction Fuzzy Hash: 4FB01235181A00FBDE514B00DE09F857E62F7E4701F058038F341240F0CBB200A4DB08

Function 004034E5 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,00000000,00000000,00403242,?,?,?,?,?,?,0040387D,?), ref: 004034F3

Memory Dump Source

Source File: 00000000.00000002.2092512933.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2092495447.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092531995.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092652651.0000000000449000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: e1e4f0b9cbde4cef3e4374ef9de0ac4f9a9ec0cef6a377cf2568efe91b529ef4
Instruction ID: 036c8468b6dd2e012b37e6e875261c5f60c7cf4634656b07e897873a541603b6
Opcode Fuzzy Hash: e1e4f0b9cbde4cef3e4374ef9de0ac4f9a9ec0cef6a377cf2568efe91b529ef4
Instruction Fuzzy Hash: 1FB01231140304BFDA214F10DF09F067B21BB94700F20C034B384380F086711435EB0D

Function 004044BB Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,00404292), ref: 004044C5

Memory Dump Source

Source File: 00000000.00000002.2092512933.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2092495447.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092531995.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092652651.0000000000449000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 88c3b14432b04161d4e03979afc52f71aef4d1a500ec292a4d39f98dda9e77ac
Instruction ID: 0db23a64e3c973129ccb7351ad80e5cfa0365495cc8a336c35755b545d17f2be
Opcode Fuzzy Hash: 88c3b14432b04161d4e03979afc52f71aef4d1a500ec292a4d39f98dda9e77ac
Instruction Fuzzy Hash: 74A00275508601DBDE115B51DF09D057B71A7547017414579A18551034C6314461EB5D

Function 00401FA4 Relevance: 1.3, APIs: 1, Instructions: 37COMMON

Download Yara Rule

APIs

Part of subcall function 0040559F: lstrlenW.KERNEL32(C:\Users\user\AppData\Local\Temp\nsl5176.tmp\,00000000,0042342F,759223A0,?,?,?,?,?,?,?,?,?,00403418,00000000,?), ref: 004055D7
Part of subcall function 0040559F: lstrlenW.KERNEL32(00403418,C:\Users\user\AppData\Local\Temp\nsl5176.tmp\,00000000,0042342F,759223A0,?,?,?,?,?,?,?,?,?,00403418,00000000), ref: 004055E7
Part of subcall function 0040559F: lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\nsl5176.tmp\,00403418,00403418,C:\Users\user\AppData\Local\Temp\nsl5176.tmp\,00000000,0042342F,759223A0), ref: 004055FA
Part of subcall function 0040559F: SetWindowTextW.USER32(C:\Users\user\AppData\Local\Temp\nsl5176.tmp\,C:\Users\user\AppData\Local\Temp\nsl5176.tmp\), ref: 0040560C
Part of subcall function 0040559F: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405632
Part of subcall function 0040559F: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040564C
Part of subcall function 0040559F: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040565A

Part of subcall function 00405B20: CreateProcessW.KERNELBASE(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00430270,00000000,00000000), ref: 00405B49
Part of subcall function 00405B20: CloseHandle.KERNEL32(?), ref: 00405B56

CloseHandle.KERNEL32(?,?,?,?,?,?), ref: 00401FEB

Part of subcall function 004069B5: WaitForSingleObject.KERNEL32(?,00000064), ref: 004069C6
Part of subcall function 004069B5: GetExitCodeProcess.KERNEL32(?,?), ref: 004069E8

Part of subcall function 00406484: wsprintfW.USER32 ref: 00406491

Memory Dump Source

Source File: 00000000.00000002.2092512933.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2092495447.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092531995.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092652651.0000000000449000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: MessageSend$CloseHandleProcesslstrlen$CodeCreateExitObjectSingleTextWaitWindowlstrcatwsprintf
String ID:
API String ID: 2972824698-0
Opcode ID: fa18f46a8673bca6434a5c9373a6cbc3dc8609fa07edefac18420a2ce970209b
Instruction ID: a015d294fcb9cc4e365613bb9e09bf6e78b00889af70ee47f703a6c6056ea9c8
Opcode Fuzzy Hash: fa18f46a8673bca6434a5c9373a6cbc3dc8609fa07edefac18420a2ce970209b
Instruction Fuzzy Hash: 2DF09072904112EBCB21BBA59A84EDE76E8DF01318F25403BE102B21D1D77C4E429A6E

Function 004014D7 Relevance: 1.3, APIs: 1, Instructions: 19sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00000000), ref: 004014EA

Memory Dump Source

Source File: 00000000.00000002.2092512933.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2092495447.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092531995.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092652651.0000000000449000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 0247c60e4c81cd0d93bf07655b107266fb29897d22759340ec027b86c090604d
Instruction ID: 7e4bd3fa72896d3e54e8b4d9ea8ddceac118c8145159a7c2ee745a60f6c60e84
Opcode Fuzzy Hash: 0247c60e4c81cd0d93bf07655b107266fb29897d22759340ec027b86c090604d
Instruction Fuzzy Hash: 8DD0A773B141018BD704EBFCFE8545E73E8EB503293208C37D402E10D1E678C846461C

Non-executed Functions

Function 0040498A Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 275stringCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003FB), ref: 004049D9
SetWindowTextW.USER32(00000000,?), ref: 00404A03
SHBrowseForFolderW.SHELL32(?), ref: 00404AB4
CoTaskMemFree.OLE32(00000000), ref: 00404ABF
lstrcmpiW.KERNEL32(00432EA0,0042D268,00000000,?,?), ref: 00404AF1
lstrcatW.KERNEL32(?,00432EA0), ref: 00404AFD
SetDlgItemTextW.USER32(?,000003FB,?), ref: 00404B0F

Part of subcall function 00405B81: GetDlgItemTextW.USER32(?,?,00000400,00404B46), ref: 00405B94

Part of subcall function 004067C4: CharNextW.USER32(?,*?|<>/":,00000000,00000000,75923420,C:\Users\user\AppData\Local\Temp\,?,00403508,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403810), ref: 00406827
Part of subcall function 004067C4: CharNextW.USER32(?,?,?,00000000,?,00403508,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403810), ref: 00406836
Part of subcall function 004067C4: CharNextW.USER32(?,00000000,75923420,C:\Users\user\AppData\Local\Temp\,?,00403508,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403810), ref: 0040683B
Part of subcall function 004067C4: CharPrevW.USER32(?,?,75923420,C:\Users\user\AppData\Local\Temp\,?,00403508,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403810), ref: 0040684E

GetDiskFreeSpaceW.KERNEL32(0042B238,?,?,0000040F,?,0042B238,0042B238,?,00000001,0042B238,?,?,000003FB,?), ref: 00404BD2
MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404BED

Part of subcall function 00404D46: lstrlenW.KERNEL32(0042D268,0042D268,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404DE7
Part of subcall function 00404D46: wsprintfW.USER32 ref: 00404DF0
Part of subcall function 00404D46: SetDlgItemTextW.USER32(?,0042D268), ref: 00404E03

Strings

A, xrefs: 00404AAD
C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\, xrefs: 00404ADA

Memory Dump Source

Source File: 00000000.00000002.2092512933.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2092495447.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092531995.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092652651.0000000000449000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
String ID: A$C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\
API String ID: 2624150263-34098319
Opcode ID: 259166ff03eae0857acd79a20f7b98923a8009c2c5ceed70d4eafac61dfc2b3f
Instruction ID: a81e8b8b6ddc8ea4f7a7a45a10ce21cc850824e22f7b82fba9ad49fead82d7d1
Opcode Fuzzy Hash: 259166ff03eae0857acd79a20f7b98923a8009c2c5ceed70d4eafac61dfc2b3f
Instruction Fuzzy Hash: CBA191B1900208ABDB119FA6DD45AAFB7B8EF84314F10803BF601B62D1D77C9A41CB6D

Function 004021AA Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 129comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(004085F0,?,00000001,004085E0,?,?,00000045,000000CD,00000002,000000DF,000000F0), ref: 00402229

Strings

C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler, xrefs: 00402269

Memory Dump Source

Source File: 00000000.00000002.2092512933.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2092495447.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092531995.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092652651.0000000000449000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: CreateInstance
String ID: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler
API String ID: 542301482-372905971
Opcode ID: f0c7f0c58da5b2556a219b4126ec8a5e6c03aa9de5f34d462473648d541e39b0
Instruction ID: 5977cb51530078b600b156af0050786de557c4b464dd586e6a5beaa7a0440451
Opcode Fuzzy Hash: f0c7f0c58da5b2556a219b4126ec8a5e6c03aa9de5f34d462473648d541e39b0
Instruction Fuzzy Hash: A7411571A00208EFCF40DFE4C989E9D7BB5BF49348B20456AF905EB2D1DB799981CB94

Function 0040290B Relevance: 1.5, APIs: 1, Instructions: 30fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,?,00000002), ref: 0040291A

Memory Dump Source

Source File: 00000000.00000002.2092512933.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2092495447.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092531995.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092652651.0000000000449000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: 23bc45f7dafbc09bf3d58dfb9668e04a20f74da7ffae18e0ad0b6f577034eb1d
Instruction ID: 3f6fbcf0fd4d311cdd608d5f72697756ed96b8559223cd5d9f1c4d92bc61f1b3
Opcode Fuzzy Hash: 23bc45f7dafbc09bf3d58dfb9668e04a20f74da7ffae18e0ad0b6f577034eb1d
Instruction Fuzzy Hash: 3CF08271A04105EFD701DBA4ED49AAEB378FF14314F60417BE116F21D0E7B88E159B29

Function 00406D85 Relevance: .3, Instructions: 334COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2092512933.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2092495447.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092531995.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092652651.0000000000449000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbe53aaae7eeab696340878b5eee03eb0fd33fb80e94407ce6853ed186f7d00c
Instruction ID: 3db1d01f4341fbbb805040525b4c18df43ce82c239752998d09602440244d977
Opcode Fuzzy Hash: fbe53aaae7eeab696340878b5eee03eb0fd33fb80e94407ce6853ed186f7d00c
Instruction Fuzzy Hash: FEE18A71A0070ADFCB24CF59D880BAABBF5FB44305F15852EE496A72D1D338AA91CF45

Function 0040755C Relevance: .3, Instructions: 300COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2092512933.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2092495447.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092531995.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092652651.0000000000449000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad3a06017d63110f505e6ee1591874ec5e375aadb040ddd80f083a0c788ff2d1
Instruction ID: 4d3fc1c80ea15bf86cc2801d6424e98614acddb7a54358772128df9d71e60e61
Opcode Fuzzy Hash: ad3a06017d63110f505e6ee1591874ec5e375aadb040ddd80f083a0c788ff2d1
Instruction Fuzzy Hash: C6C14871E042599BCF18CF68C8905EEBBB2BF88314F25866AD85677380D7347941CF95

Function 00404F06 Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 489windowmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F9), ref: 00404F1E
GetDlgItem.USER32(?,00000408), ref: 00404F29
GlobalAlloc.KERNEL32(00000040,?), ref: 00404F73
LoadImageW.USER32(0000006E,00000000,00000000,00000000,00000000), ref: 00404F8A
SetWindowLongW.USER32(?,000000FC,00405513), ref: 00404FA3
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404FB7
ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 00404FC9
SendMessageW.USER32(?,00001109,00000002), ref: 00404FDF
SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00404FEB
SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 00404FFD
DeleteObject.GDI32(00000000), ref: 00405000
SendMessageW.USER32(?,00000143,00000000,00000000), ref: 0040502B
SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00405037
SendMessageW.USER32(?,00001132,00000000,?), ref: 004050D2
SendMessageW.USER32(?,0000110A,00000003,00000110), ref: 00405102

Part of subcall function 004044CE: SendMessageW.USER32(00000028,?,00000001,004042F9), ref: 004044DC

SendMessageW.USER32(?,00001132,00000000,?), ref: 00405116
GetWindowLongW.USER32(?,000000F0), ref: 00405144
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00405152
ShowWindow.USER32(?,00000005), ref: 00405162
SendMessageW.USER32(?,00000419,00000000,?), ref: 0040525D
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 004052C2
SendMessageW.USER32(?,00000150,00000000,00000000), ref: 004052D7
SendMessageW.USER32(?,00000420,00000000,00000020), ref: 004052FB
SendMessageW.USER32(?,00000200,00000000,00000000), ref: 0040531B
ImageList_Destroy.COMCTL32(?), ref: 00405330
GlobalFree.KERNEL32(?), ref: 00405340
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 004053B9
SendMessageW.USER32(?,00001102,?,?), ref: 00405462
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 00405471
InvalidateRect.USER32(?,00000000,00000001), ref: 0040549C
ShowWindow.USER32(?,00000000), ref: 004054EA
GetDlgItem.USER32(?,000003FE), ref: 004054F5
ShowWindow.USER32(00000000), ref: 004054FC

Strings

N, xrefs: 0040519B
, xrefs: 004054D4
M, xrefs: 004050BA

Memory Dump Source

Source File: 00000000.00000002.2092512933.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2092495447.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092531995.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092652651.0000000000449000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: MessageSend$Window$Image$ItemList_LongShow$Global$AllocCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 2564846305-813528018
Opcode ID: 749bdf8e43bd841ecb3e5c95033ce80d775c45143b483fe0b3b59f6494973967
Instruction ID: 669472b6e39b4296dbb294a81ed98d86f32f22d8abeb4cff7518c6a892085abf
Opcode Fuzzy Hash: 749bdf8e43bd841ecb3e5c95033ce80d775c45143b483fe0b3b59f6494973967
Instruction Fuzzy Hash: EF028A70900608EFDB20DFA9DD45AAF7BB5FB84314F10817AE610BA2E0D7799942DF58

Function 00404658 Relevance: 35.2, APIs: 19, Strings: 1, Instructions: 204windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(?,-0000040A,00000001), ref: 004046F6
GetDlgItem.USER32(?,000003E8), ref: 0040470A
SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 00404727
GetSysColor.USER32(?), ref: 00404738
SendMessageW.USER32(00000000,00000443,00000000,?), ref: 00404746
SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 00404754
lstrlenW.KERNEL32(?), ref: 00404759
SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 00404766
SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 0040477B
GetDlgItem.USER32(?,0000040A), ref: 004047D4
SendMessageW.USER32(00000000), ref: 004047DB
GetDlgItem.USER32(?,000003E8), ref: 00404806
SendMessageW.USER32(00000000,0000044B,00000000,00000201), ref: 00404849
LoadCursorW.USER32(00000000,00007F02), ref: 00404857
SetCursor.USER32(00000000), ref: 0040485A
LoadCursorW.USER32(00000000,00007F00), ref: 00404873
SetCursor.USER32(00000000), ref: 00404876
SendMessageW.USER32(00000111,00000001,00000000), ref: 004048A5
SendMessageW.USER32(00000010,00000000,00000000), ref: 004048B7

Strings

N, xrefs: 004047F4

Memory Dump Source

Source File: 00000000.00000002.2092512933.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2092495447.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092531995.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092652651.0000000000449000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorlstrlen
String ID: N
API String ID: 3103080414-1130791706
Opcode ID: ce357ac6e0fd4f2b4f67e04795876aef6a46bd5fea1783cb4cf669a44dc9f0f8
Instruction ID: e0aa441e67ff77812dea5cfa76c138b5706349c0d06c8e95e02877fce1cb63d1
Opcode Fuzzy Hash: ce357ac6e0fd4f2b4f67e04795876aef6a46bd5fea1783cb4cf669a44dc9f0f8
Instruction Fuzzy Hash: 1A61A3B5900209BFDB10AF60DD85E6A7BA9FB44314F00843AFB05B62D0D778A951DF98

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32(00000000,?,00000000), ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectW.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextW.USER32(00000000,00433F00,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000000.00000002.2092512933.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2092495447.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092531995.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092652651.0000000000449000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: 15a6b7738402934ac822911e252168026e8f0364f08849f6e110b85e8bc9718e
Instruction ID: e457e53e67a16f607b198c8be77aa7e47a8fd9e6aa67a1a07366d16d1d2d9a76
Opcode Fuzzy Hash: 15a6b7738402934ac822911e252168026e8f0364f08849f6e110b85e8bc9718e
Instruction Fuzzy Hash: 0E418B71800209AFCF058FA5DE459AF7FB9FF44315F04802AF991AA1A0C738AA55DFA4

Function 00406183 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 130memorystringCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(00000000,?,00000000,00000001,?,00000000,?,?,0040631E,?,?), ref: 004061BE
GetShortPathNameW.KERNEL32(?,00430908,00000400), ref: 004061C7

Part of subcall function 00405F92: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00406277,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405FA2
Part of subcall function 00405F92: lstrlenA.KERNEL32(00000000,?,00000000,00406277,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405FD4

GetShortPathNameW.KERNEL32(?,00431108,00000400), ref: 004061E4
wsprintfA.USER32 ref: 00406202
GetFileSize.KERNEL32(00000000,00000000,00431108,C0000000,00000004,00431108,?,?,?,?,?), ref: 0040623D
GlobalAlloc.KERNEL32(00000040,0000000A,?,?,?,?), ref: 0040624C
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00406284
SetFilePointer.KERNEL32(0040A580,00000000,00000000,00000000,00000000,00430508,00000000,-0000000A,0040A580,00000000,[Rename],00000000,00000000,00000000), ref: 004062DA
GlobalFree.KERNEL32(00000000), ref: 004062EB
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 004062F2

Part of subcall function 0040602D: GetFileAttributesW.KERNELBASE(00000003,004030BD,C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.16359.15944.exe,80000000,00000003,?,?,?,?,?,0040387D,?), ref: 00406031
Part of subcall function 0040602D: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,?,?,?,0040387D,?), ref: 00406053

Strings

%ls=%ls, xrefs: 004061F8
[Rename], xrefs: 0040626C, 0040627E

Memory Dump Source

Source File: 00000000.00000002.2092512933.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2092495447.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092531995.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092652651.0000000000449000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrlen$AllocAttributesCreateFreePointerSizelstrcpywsprintf
String ID: %ls=%ls$[Rename]
API String ID: 2171350718-461813615
Opcode ID: 6203cc16da91056e546519e3ab518561ff1c14b2742299aa71b9d8e7299f7fea
Instruction ID: 71978d88b6039f89b25a0dfa2ffa892efa56fbf884cfe692307f7793e751c739
Opcode Fuzzy Hash: 6203cc16da91056e546519e3ab518561ff1c14b2742299aa71b9d8e7299f7fea
Instruction Fuzzy Hash: 6A314670200716BBD2207B659D48F6B3A6CEF45754F15017EFA42F62C2EA3CA821867D

Function 00404500 Relevance: 12.1, APIs: 8, Instructions: 68COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 0040451D
GetSysColor.USER32(00000000), ref: 0040455B
SetTextColor.GDI32(?,00000000), ref: 00404567
SetBkMode.GDI32(?,?), ref: 00404573
GetSysColor.USER32(?), ref: 00404586
SetBkColor.GDI32(?,?), ref: 00404596
DeleteObject.GDI32(?), ref: 004045B0
CreateBrushIndirect.GDI32(?), ref: 004045BA

Memory Dump Source

Source File: 00000000.00000002.2092512933.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2092495447.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092531995.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092652651.0000000000449000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: f4fe220c79686689299554ac50abea47664d32920eac269e7a43003585d3568b
Instruction ID: 19446832cb8519ea1938040ed984131457e28e93d0b00b9b4dc42373f0e33a15
Opcode Fuzzy Hash: f4fe220c79686689299554ac50abea47664d32920eac269e7a43003585d3568b
Instruction Fuzzy Hash: 382177B1500705AFCB31DF68DD08B5BBBF8AF41714B058A2EEA96B22E1C734E944CB54

Function 004026EC Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 153fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(?,?,?,?), ref: 00402758
MultiByteToWideChar.KERNEL32(?,00000008,?,?,?,00000001), ref: 00402793
SetFilePointer.KERNEL32(?,?,?,00000001,?,00000008,?,?,?,00000001), ref: 004027B6
MultiByteToWideChar.KERNEL32(?,00000008,?,00000000,?,00000001,?,00000001,?,00000008,?,?,?,00000001), ref: 004027CC

Part of subcall function 0040610E: SetFilePointer.KERNEL32(?,00000000,00000000,00000001), ref: 00406124

SetFilePointer.KERNEL32(?,?,?,00000001,?,?,00000002), ref: 00402878

Strings

9, xrefs: 0040273B

Memory Dump Source

Source File: 00000000.00000002.2092512933.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2092495447.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092531995.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092652651.0000000000449000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: File$Pointer$ByteCharMultiWide$Read
String ID: 9
API String ID: 163830602-2366072709
Opcode ID: 05ec9e9945247294569ed32eb70c3e484d87f4f0290394ce4997a83a7f1e58dd
Instruction ID: 36eba916602f65c1f8b814f2f26102ddc75cc08ed25eda7b441ea0696c55e726
Opcode Fuzzy Hash: 05ec9e9945247294569ed32eb70c3e484d87f4f0290394ce4997a83a7f1e58dd
Instruction Fuzzy Hash: C551E975D00219AADF20EF95CA89AAEBB79FF04304F10817BE541B62D4D7B49D82CB58

Function 004067C4 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,*?|<>/":,00000000,00000000,75923420,C:\Users\user\AppData\Local\Temp\,?,00403508,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403810), ref: 00406827
CharNextW.USER32(?,?,?,00000000,?,00403508,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403810), ref: 00406836
CharNextW.USER32(?,00000000,75923420,C:\Users\user\AppData\Local\Temp\,?,00403508,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403810), ref: 0040683B
CharPrevW.USER32(?,?,75923420,C:\Users\user\AppData\Local\Temp\,?,00403508,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403810), ref: 0040684E

Strings

*?|<>/":, xrefs: 00406816
C:\Users\user\AppData\Local\Temp\, xrefs: 004067C5

Memory Dump Source

Source File: 00000000.00000002.2092512933.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2092495447.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092531995.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092652651.0000000000449000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: Char$Next$Prev
String ID: *?|<>/":$C:\Users\user\AppData\Local\Temp\
API String ID: 589700163-1201062745
Opcode ID: 7f8a10c6574f84f045d99a2f2ba91d71661da1c9dbe2055a6f375f6d39957bd5
Instruction ID: 8e05d213a2b26a47bd0c986db1e6a85e10b5e067f284fb5e9645f7af11a9ce3c
Opcode Fuzzy Hash: 7f8a10c6574f84f045d99a2f2ba91d71661da1c9dbe2055a6f375f6d39957bd5
Instruction Fuzzy Hash: 7311862780161295DB313B158C44A77A2A8AF58798F56843FED86B32C1E77C8C9282AD

Function 00404E54 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404E6F
GetMessagePos.USER32 ref: 00404E77
ScreenToClient.USER32(?,?), ref: 00404E91
SendMessageW.USER32(?,00001111,00000000,?), ref: 00404EA3
SendMessageW.USER32(?,0000113E,00000000,?), ref: 00404EC9

Strings

f, xrefs: 00404EA5

Memory Dump Source

Source File: 00000000.00000002.2092512933.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2092495447.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092531995.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092652651.0000000000449000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: b2affdf3b53bee8738e3b61904ea6c87bda347b462d3853a737802ef9deed65a
Instruction ID: 177f1d0b32132a6560496663958852c5fe6f1b23f9da62007dee57caca3d7f28
Opcode Fuzzy Hash: b2affdf3b53bee8738e3b61904ea6c87bda347b462d3853a737802ef9deed65a
Instruction Fuzzy Hash: 34014C71900219BADB00DBA4DD85BFFBBB8AB54711F10012BBA50B61C0D7B49A058BA5

Function 00402F93 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402FB1
MulDiv.KERNEL32(00181E00,00000064,00183298), ref: 00402FDC
wsprintfW.USER32 ref: 00402FEC
SetWindowTextW.USER32(?,?), ref: 00402FFC
SetDlgItemTextW.USER32(?,00000406,?), ref: 0040300E

Strings

verifying installer: %d%%, xrefs: 00402FE6

Memory Dump Source

Source File: 00000000.00000002.2092512933.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2092495447.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092531995.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092652651.0000000000449000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: verifying installer: %d%%
API String ID: 1451636040-82062127
Opcode ID: ea3fb41b8b9d1af7e43715991a6ce4dd060937d78b5a266238e4f5c2501e20f6
Instruction ID: eb17ebabde20c32bd565f0ca98bf5c3c7f8a04474e671541d9d17dad0456e96b
Opcode Fuzzy Hash: ea3fb41b8b9d1af7e43715991a6ce4dd060937d78b5a266238e4f5c2501e20f6
Instruction Fuzzy Hash: 20014B7064020DABEF209F60DE4AFEA3B79FB04345F008039FA06B51D0DBB999559F69

Function 00402950 Relevance: 9.1, APIs: 6, Instructions: 91memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000,000000F0), ref: 004029B1
GlobalAlloc.KERNEL32(00000040,?,00000000,?), ref: 004029CD
GlobalFree.KERNEL32(?), ref: 00402A06
GlobalFree.KERNEL32(00000000), ref: 00402A19
CloseHandle.KERNEL32(?,?,?,?,?,00000000,40000000,00000002,00000000,00000000,000000F0), ref: 00402A35
DeleteFileW.KERNEL32(?,00000000,40000000,00000002,00000000,00000000,000000F0), ref: 00402A48

Memory Dump Source

Source File: 00000000.00000002.2092512933.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2092495447.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092531995.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092652651.0000000000449000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: Global$AllocFree$CloseDeleteFileHandle
String ID:
API String ID: 2667972263-0
Opcode ID: 18333e3c7c5edca9258600c879c391e4e8cb8a080c4e0dd56f257e0fabcb70bb
Instruction ID: 8fc1a79e9ee36ebd610a2d663d7387b5f1fea8f48d7bc9e01940cd119f3fb53c
Opcode Fuzzy Hash: 18333e3c7c5edca9258600c879c391e4e8cb8a080c4e0dd56f257e0fabcb70bb
Instruction Fuzzy Hash: 5831C271D00124BBCF216FA9CE49DDEBE79AF49364F14023AF450762E0CB794C429BA8

Function 00402EA9 Relevance: 7.6, APIs: 5, Instructions: 84registryCOMMON

Download Yara Rule

APIs

RegEnumValueW.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000,?,?,00100020,?,?,?), ref: 00402EFD
RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 00402F49
RegCloseKey.ADVAPI32(?,?,?), ref: 00402F52
RegDeleteKeyW.ADVAPI32(?,?), ref: 00402F69
RegCloseKey.ADVAPI32(?,?,?), ref: 00402F74

Memory Dump Source

Source File: 00000000.00000002.2092512933.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2092495447.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092531995.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092652651.0000000000449000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: CloseEnum$DeleteValue
String ID:
API String ID: 1354259210-0
Opcode ID: 78d35a7524f1d2205fa0e87ab22fa6bfb41dfe8b1a27fd9ec563711b6eb4cb1f
Instruction ID: ca6229ec891c5908b4c2d3bab14ae3db7b9396451d72a40731f1c02386a45f13
Opcode Fuzzy Hash: 78d35a7524f1d2205fa0e87ab22fa6bfb41dfe8b1a27fd9ec563711b6eb4cb1f
Instruction Fuzzy Hash: DA215A7150010ABBEF119F90CE89EEF7B7DEB50384F100076F909B21A0D7B49E54AA68

Function 00401D81 Relevance: 7.6, APIs: 5, Instructions: 75windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 00401D9A
GetClientRect.USER32(?,?), ref: 00401DE5
LoadImageW.USER32(?,?,?,?,?,?), ref: 00401E15
SendMessageW.USER32(?,00000172,?,00000000), ref: 00401E29
DeleteObject.GDI32(00000000), ref: 00401E39

Memory Dump Source

Source File: 00000000.00000002.2092512933.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2092495447.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092531995.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092652651.0000000000449000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: 0d14a93a4aa2f7ddc0f91d11ffebc05af74b5a93feb44974f4da7284e64bbe2b
Instruction ID: b69f8f45c5cbb28dd5603d9b1d667d2ce3d3910c133b75fee4ecc707c572ca23
Opcode Fuzzy Hash: 0d14a93a4aa2f7ddc0f91d11ffebc05af74b5a93feb44974f4da7284e64bbe2b
Instruction Fuzzy Hash: 3321F672904119AFCB05DBA4DE45AEEBBB5EF08314F14003AFA45F62A0DB389951DB98

Function 00401E4E Relevance: 7.5, APIs: 5, Instructions: 43COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00401E51
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401E6B
MulDiv.KERNEL32(00000000,00000000), ref: 00401E73
ReleaseDC.USER32(?,00000000), ref: 00401E84

Part of subcall function 0040657A: lstrcatW.KERNEL32(00432EA0,\Microsoft\Internet Explorer\Quick Launch), ref: 0040671F
Part of subcall function 0040657A: lstrlenW.KERNEL32(00432EA0,00000000,C:\Users\user\AppData\Local\Temp\nsl5176.tmp\,?,004055D6,C:\Users\user\AppData\Local\Temp\nsl5176.tmp\,00000000), ref: 00406779

CreateFontIndirectW.GDI32(0040CDF0), ref: 00401ED3

Memory Dump Source

Source File: 00000000.00000002.2092512933.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2092495447.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092531995.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092652651.0000000000449000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectReleaselstrcatlstrlen
String ID:
API String ID: 2584051700-0
Opcode ID: 687ed4edf854cbed3824faf0125c127d44ccdaa2da2dd8af5b0190bd77e460f4
Instruction ID: 78b13ae86a0973dc2b43aa2eb6c1af0beb3c1ef463c522f55250376beecb9f8a
Opcode Fuzzy Hash: 687ed4edf854cbed3824faf0125c127d44ccdaa2da2dd8af5b0190bd77e460f4
Instruction Fuzzy Hash: 7001B571904241EFEB005BB0EE49B9A3FB4BB15301F108A39F541B71D2C7B904458BED

Function 00401C43 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401CB3
SendMessageW.USER32(00000000,00000000,?,?), ref: 00401CCB

Strings

!, xrefs: 00401C7F

Memory Dump Source

Source File: 00000000.00000002.2092512933.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2092495447.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092531995.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092652651.0000000000449000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: 56378305e9cef062e59ac21505f1e4874eb63478d5e018d68d94a8de4df44513
Instruction ID: 549e056fbb7746b1afa8e7352ee9f1cbf83a3633853e14f9ff1f16dc1dd81c22
Opcode Fuzzy Hash: 56378305e9cef062e59ac21505f1e4874eb63478d5e018d68d94a8de4df44513
Instruction Fuzzy Hash: 46219C7190420AAFEF05AFA4D94AAAE7BB4FF84304F14453EF601B61D0D7B88941CB98

Function 00404D46 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(0042D268,0042D268,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404DE7
wsprintfW.USER32 ref: 00404DF0
SetDlgItemTextW.USER32(?,0042D268), ref: 00404E03

Strings

%u.%u%s%s, xrefs: 00404DD1

Memory Dump Source

Source File: 00000000.00000002.2092512933.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2092495447.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092531995.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092652651.0000000000449000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s
API String ID: 3540041739-3551169577
Opcode ID: 5273c8e1ef6d25911cf1b9a0066a557bca8c43180978e8caf7984b32bac85cc4
Instruction ID: d7f2b51e3f2153b105aad6c1cbcae815e44f670c765de83d30fbb221df5484fa
Opcode Fuzzy Hash: 5273c8e1ef6d25911cf1b9a0066a557bca8c43180978e8caf7984b32bac85cc4
Instruction Fuzzy Hash: AC11D573A041283BDB10656DAC45E9E369CAF81334F254237FA66F21D1EA78D91182E8

Function 00405EB7 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,?,C:\,?,00405F2B,C:\,C:\,75923420,?,C:\Users\user\AppData\Local\Temp\,00405C69,?,75923420,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405EC5
CharNextW.USER32(00000000), ref: 00405ECA
CharNextW.USER32(00000000), ref: 00405EE2

Strings

C:\, xrefs: 00405EB8

Memory Dump Source

Source File: 00000000.00000002.2092512933.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2092495447.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092531995.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092652651.0000000000449000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: CharNext
String ID: C:\
API String ID: 3213498283-3404278061
Opcode ID: 389604e099afbb0f1c733809242fd9884b65eb47018f1a61235cb76474637dc7
Instruction ID: b7f7aa27055ddc775a1b47344aef2f77b81fec2ea34db2f3ccdabfa21b6bce3d
Opcode Fuzzy Hash: 389604e099afbb0f1c733809242fd9884b65eb47018f1a61235cb76474637dc7
Instruction Fuzzy Hash: 7BF0F631810E1296DB317B548C44E7B97BCEB64354B04843BD741B71C0D3BC8D808BDA

Function 00405E0C Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,0040351A,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403810), ref: 00405E12
CharPrevW.USER32(?,00000000,?,C:\Users\user\AppData\Local\Temp\,0040351A,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403810), ref: 00405E1C
lstrcatW.KERNEL32(?,0040A014), ref: 00405E2E

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405E0C

Memory Dump Source

Source File: 00000000.00000002.2092512933.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2092495447.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092531995.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092652651.0000000000449000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: CharPrevlstrcatlstrlen
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 2659869361-823278215
Opcode ID: 7317fb0b60a0da6156192e69c80d181f5022b3d5f83b8f009beaa75eacd33bdb
Instruction ID: 1a595bf39a0a3392b99637bd72bd9cca8666c17676e511d5d4bf90e80f698eee
Opcode Fuzzy Hash: 7317fb0b60a0da6156192e69c80d181f5022b3d5f83b8f009beaa75eacd33bdb
Instruction Fuzzy Hash: A8D0A731101930BAC2127B49EC08DDF62ACAE89340341443BF145B30A4CB7C5E5187FD

Function 00403019 Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,00000000,004031F7,00000001,?,?,?,?,?,0040387D,?), ref: 0040302C
GetTickCount.KERNEL32 ref: 0040304A
CreateDialogParamW.USER32(0000006F,00000000,00402F93,00000000), ref: 00403067
ShowWindow.USER32(00000000,00000005,?,?,?,?,?,0040387D,?), ref: 00403075

Memory Dump Source

Source File: 00000000.00000002.2092512933.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2092495447.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092531995.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092652651.0000000000449000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: Window$CountCreateDestroyDialogParamShowTick
String ID:
API String ID: 2102729457-0
Opcode ID: a982ea5e0a4ecb993fc2e9b794e4afe077943b4b771bcbca33e5c7758572dd30
Instruction ID: 3364d2369d767f53e7c05e99e54cbc9c067443d5da9c9f227d7c3a258cba7bb7
Opcode Fuzzy Hash: a982ea5e0a4ecb993fc2e9b794e4afe077943b4b771bcbca33e5c7758572dd30
Instruction Fuzzy Hash: A9F08270702A20AFC2316F50FE4998B7F68FB44B56741447AF446B15ACCB380DA2CB9D

Function 00405513 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00405542
CallWindowProcW.USER32(?,?,?,?), ref: 00405593

Part of subcall function 004044E5: SendMessageW.USER32(?,00000000,00000000,00000000), ref: 004044F7

Strings

, xrefs: 00405523

Memory Dump Source

Source File: 00000000.00000002.2092512933.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2092495447.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092531995.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092652651.0000000000449000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: 0dea828d0dd479423763887dac230e90f27d8b8ae518018479b0ad82d517bb95
Instruction ID: 904a7c61355239921aaa7855b64c86422fca6e8886f64d9e6fcbc6a993ea73ec
Opcode Fuzzy Hash: 0dea828d0dd479423763887dac230e90f27d8b8ae518018479b0ad82d517bb95
Instruction Fuzzy Hash: F3017CB1100608BFDF209F11DD80AAB3B27EB84754F50453AFA01762D5D77A8E92DA69

Function 00403B57 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,75923420,00000000,C:\Users\user\AppData\Local\Temp\,00403B2F,00403A5E,?), ref: 00403B71
GlobalFree.KERNEL32(?), ref: 00403B78

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00403B57

Memory Dump Source

Source File: 00000000.00000002.2092512933.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2092495447.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092531995.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092652651.0000000000449000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: Free$GlobalLibrary
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 1100898210-823278215
Opcode ID: 14d9b0f9b7ecca22f0083886da8930ddd6c03ed0d6fdc94ff3a28603f1b7b4ab
Instruction ID: 19c5699a9bb8b3376c06320bd1355d3f7d45777e2bc9a3354ca833756e7661a4
Opcode Fuzzy Hash: 14d9b0f9b7ecca22f0083886da8930ddd6c03ed0d6fdc94ff3a28603f1b7b4ab
Instruction Fuzzy Hash: 40E0EC3290212097C7615F55FE08B6E7B78AF49B26F05056AE884BB2628B746D428BDC

Function 00405E58 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(80000000,C:\Users\user\Desktop,004030E9,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.16359.15944.exe,C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.16359.15944.exe,80000000,00000003,?,?,?,?,?,0040387D,?), ref: 00405E5E
CharPrevW.USER32(80000000,00000000,80000000,C:\Users\user\Desktop,004030E9,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.16359.15944.exe,C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.16359.15944.exe,80000000,00000003), ref: 00405E6E

Strings

C:\Users\user\Desktop, xrefs: 00405E58

Memory Dump Source

Source File: 00000000.00000002.2092512933.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2092495447.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092531995.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092652651.0000000000449000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: CharPrevlstrlen
String ID: C:\Users\user\Desktop
API String ID: 2709904686-1246513382
Opcode ID: 176def5b2db9ef34a9f22db2929791273b03e08e07d7b66f37effa829582f156
Instruction ID: d2786f61c86b799b8b6ecf14661ff9643eaf9d362a95097130d0805b1e4d2bc4
Opcode Fuzzy Hash: 176def5b2db9ef34a9f22db2929791273b03e08e07d7b66f37effa829582f156
Instruction Fuzzy Hash: 36D0A7B3410D20DAC3126718DC04DAF73ECFF6134074A442AF481A71A4D7785E8186ED

Function 00405F92 Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00406277,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405FA2
lstrcmpiA.KERNEL32(00000000,00000000), ref: 00405FBA
CharNextA.USER32(00000000,?,00000000,00406277,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405FCB
lstrlenA.KERNEL32(00000000,?,00000000,00406277,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405FD4

Memory Dump Source

Source File: 00000000.00000002.2092512933.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2092495447.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092531995.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092551285.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092652651.0000000000449000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: 21d608d80335ac136f0ceeda94a64e737efc7ffd0529c55eb96d3cb5f29812e9
Instruction ID: bd09551308ad338638525116890fdadd4ab1f465f5503068af61de479685a4e4
Opcode Fuzzy Hash: 21d608d80335ac136f0ceeda94a64e737efc7ffd0529c55eb96d3cb5f29812e9
Instruction Fuzzy Hash: 34F0C231604418FFC7029BA5CD0099EBBA8EF06250B2140AAF840FB210D678DE019BA9

Analysis Process: KillProcPCTT.exePID: 6332, Parent PID: 6660COMMON

Executed Functions

Function 025004E8 Relevance: .5, Instructions: 469COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2074279860.0000000002500000.00000040.00000800.00020000.00000000.sdmp, Offset: 02500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2500000_KillProcPCTT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2361c4c3e3699fcbc0b8fae69837703c9d70d3f45182e35f69db2d561248af20
Instruction ID: 552d56d99ef1b442d3471e9d14b693b5e43f01f3f85c1b7496ca6aa1907e872a
Opcode Fuzzy Hash: 2361c4c3e3699fcbc0b8fae69837703c9d70d3f45182e35f69db2d561248af20
Instruction Fuzzy Hash: D001F9309441408FC719AF68DC7D6FABB75FF87311F0418AAC485A76A1CB219815CB95

Function 025008B8 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2074279860.0000000002500000.00000040.00000800.00020000.00000000.sdmp, Offset: 02500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2500000_KillProcPCTT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44215844aa9e11d763f02198ed195b260d590fb4dcd54e3f71d47e353077136c
Instruction ID: baab73e3e9b8bac619d4c3f43c3988426445bd159a23650c4ea469a7cd65cf5b
Opcode Fuzzy Hash: 44215844aa9e11d763f02198ed195b260d590fb4dcd54e3f71d47e353077136c
Instruction Fuzzy Hash: E541F274E012099FDB04DFA9C880AEEBBF2BF89300F249569D405B7394DB349A46CF54

Function 02500848 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2074279860.0000000002500000.00000040.00000800.00020000.00000000.sdmp, Offset: 02500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2500000_KillProcPCTT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab9c2e129ab8c231e109166a03667f84729d8bedb33b87605d81f99a981db5cc
Instruction ID: a7b22f7945c6c4139985b093190a43c1dabd5751f6ddbe605422160e5e041379
Opcode Fuzzy Hash: ab9c2e129ab8c231e109166a03667f84729d8bedb33b87605d81f99a981db5cc
Instruction Fuzzy Hash: CFF0A730D4110487D7087B64E82C5F9B77AFBC6711F006869D50567294CB719828CAD9

Analysis Process: mssched.exePID: 1248, Parent PID: 6660COMMON

Executed Functions

Function 00007FF848E75D5F Relevance: 1.9, Strings: 1, Instructions: 649COMMON

Download Yara Rule

Strings

H, xrefs: 00007FF848E763D7

Memory Dump Source

Source File: 00000004.00000002.3328165433.00007FF848E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff848e70000_mssched.jbxd

Similarity

API ID:
String ID: H
API String ID: 0-2852464175
Opcode ID: b4463eccdea9effbaf045f7002d2d408b4e5d8a38bca2e7abccf8975fb20cf36
Instruction ID: 93d27dce908dd8ffdb6cff7f86e3b24218e283db3b8ea3258d7e9250bb0d10cd
Opcode Fuzzy Hash: b4463eccdea9effbaf045f7002d2d408b4e5d8a38bca2e7abccf8975fb20cf36
Instruction Fuzzy Hash: 7D321C3090964E8FDB99EF28C895AE977B1FF59344F5001F9D00ED76A6CB35A982CB40

Function 00007FF848E754DC Relevance: .4, Instructions: 351COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3328165433.00007FF848E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff848e70000_mssched.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25049fac087c7d3c4d97d0208befa5a6ed5f12453cd981fdeaae1f9d3a8ed585
Instruction ID: 27232c530ad8e3223c9ec597697b60ce67a13c7777c40b3d57cbfdd64dfbb6d5
Opcode Fuzzy Hash: 25049fac087c7d3c4d97d0208befa5a6ed5f12453cd981fdeaae1f9d3a8ed585
Instruction Fuzzy Hash: 44D12B70909A4D8FDB99EF28C895AE977F1FF59300F1441EDD04ED76A2CA359A86CB00

Function 00007FF848E72A75 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3328165433.00007FF848E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff848e70000_mssched.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98c1bfc9f761a0af8e0d274aed329731bb1e1ed965a9c1cf0c298d8f601e83cb
Instruction ID: 62573d355d9f6e4f6f626770032b228f2ee05a3a9f26d9f86e6e777b9b6b02c8
Opcode Fuzzy Hash: 98c1bfc9f761a0af8e0d274aed329731bb1e1ed965a9c1cf0c298d8f601e83cb
Instruction Fuzzy Hash: 4C118571C0A60ECFEB55AFA0D4442FDBBB1FF4A341F4414BAD10AA7282DB38A548CB44

Function 00007FF848E70A7A Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3328165433.00007FF848E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff848e70000_mssched.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 510a998fdcc86076a6a080a4bb7abdd5becba1b856031aef25bb1bc552461066
Instruction ID: fbd2f465a53c82f6102174423df7120db11651802b401f0b2ba90aedf3a8de5d
Opcode Fuzzy Hash: 510a998fdcc86076a6a080a4bb7abdd5becba1b856031aef25bb1bc552461066
Instruction Fuzzy Hash: AE113531C0961EDEEB25AFA4D4042FEB6B1FF4A341F401579D00AB2282DF39A584CB98

Function 00007FF848E7065D Relevance: 2.8, Strings: 2, Instructions: 292COMMON

Download Yara Rule

Strings

<N_^, xrefs: 00007FF848E70801
N_^Q, xrefs: 00007FF848E706C9

Memory Dump Source

Source File: 00000004.00000002.3328165433.00007FF848E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff848e70000_mssched.jbxd

Similarity

API ID:
String ID: <N_^$N_^Q
API String ID: 0-3778861457
Opcode ID: cac1eaadd1f9f13163509ee426ef8e836194e3b614bdeb79e9991da1e96bb3e2
Instruction ID: bca628199678b1972781e152a56be2e665faed0d21092189a195ba408a87996e
Opcode Fuzzy Hash: cac1eaadd1f9f13163509ee426ef8e836194e3b614bdeb79e9991da1e96bb3e2
Instruction Fuzzy Hash: 3081FBA758E5A53ED30977BCB8510F93B50EF423B9F0C51B7D1CC8A053DA18608A8BA9

Function 00007FF848E706D3 Relevance: 2.8, Strings: 2, Instructions: 258COMMON

Download Yara Rule

Strings

N_^c, xrefs: 00007FF848E70712
<N_^, xrefs: 00007FF848E70801

Memory Dump Source

Source File: 00000004.00000002.3328165433.00007FF848E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff848e70000_mssched.jbxd

Similarity

API ID:
String ID: <N_^$N_^c
API String ID: 0-703301649
Opcode ID: 99cc61ab0a997e2448ba9b08abef5dfa5fbd5c8abfdbd84a94c03ea7092ddedb
Instruction ID: ae21a3f9b5afc814d336b89773bf6d2ba89d18d6e61e0e29cb720b25cf3ed626
Opcode Fuzzy Hash: 99cc61ab0a997e2448ba9b08abef5dfa5fbd5c8abfdbd84a94c03ea7092ddedb
Instruction Fuzzy Hash: B071ABA658F5953EE30A77BCB8660F93F50EF422B9F0C51B7D18C8A053DD18504A8BA9

Function 00007FF848E73AB4 Relevance: .5, Instructions: 549COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3328165433.00007FF848E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff848e70000_mssched.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9003e390f96e5863ef1af0585e8b57bbdefa81b3bc4010cec093ed0455406a8
Instruction ID: 42c95cb3acc44c14a272b08a7a4e3b3f8af82452bf30d42631f6bae0489c2e41
Opcode Fuzzy Hash: d9003e390f96e5863ef1af0585e8b57bbdefa81b3bc4010cec093ed0455406a8
Instruction Fuzzy Hash: 8D12E630A0894D8FDB99EF18C895AE973A2FF59345F5405B8E40EC7296CB35ED82CB40

Function 00007FF848E70CE5 Relevance: .3, Instructions: 260COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3328165433.00007FF848E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff848e70000_mssched.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 711c05f68e235640af6eef9900cc9ba3d64f88a45b30a32373c80281f11e3626
Instruction ID: 4682b1d229558830e41dac57f70dcf0d159e30c95914a5ebe8db5e32205d4648
Opcode Fuzzy Hash: 711c05f68e235640af6eef9900cc9ba3d64f88a45b30a32373c80281f11e3626
Instruction Fuzzy Hash: B9A1793091A61A8FDB99EB64C4997E9B7F1FF05300F5004EDC04A9B296CB39AD86CF04

Function 00007FF848E7552E Relevance: .2, Instructions: 192COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3328165433.00007FF848E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff848e70000_mssched.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec6787843f5be575e23a51431f1b73ef2f3995368ac95af3be52b81ee779775f
Instruction ID: 281a4570296c9ef8ef022535108b2901b2cd1dfd7d3f09cba023f49c8b18c93b
Opcode Fuzzy Hash: ec6787843f5be575e23a51431f1b73ef2f3995368ac95af3be52b81ee779775f
Instruction Fuzzy Hash: 6C714C70908A498FDB99EB28C895AE977F1FF59300F1401EDD40ED76A1CB35AE82CB04

Function 00007FF848E70658 Relevance: .2, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3328165433.00007FF848E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff848e70000_mssched.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c6312527719d700ebfe515594a02f8e45d3348ac9e761e0ab2b42344ac679e1
Instruction ID: 7ff948462ac5241c9e760a5352d1c6ad27beca3eee4b0d43cbb2d7cee579a47e
Opcode Fuzzy Hash: 1c6312527719d700ebfe515594a02f8e45d3348ac9e761e0ab2b42344ac679e1
Instruction Fuzzy Hash: E151FE70909A4D9FDB51EFB8C449AEDBBF1FF19301F1400A9D449D7265DB34A881CB50

Function 00007FF848E7315A Relevance: .2, Instructions: 165COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3328165433.00007FF848E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff848e70000_mssched.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc0fed7587e339946fc6223e02e3c658f6f5621a5cd3991c31a710cc42d3e295
Instruction ID: 2f03673380713009ae60340bf82d96eb6ad442fd326cc14fc0774f2cbc7d9dcf
Opcode Fuzzy Hash: fc0fed7587e339946fc6223e02e3c658f6f5621a5cd3991c31a710cc42d3e295
Instruction Fuzzy Hash: CF512071D2894E9FEBE8EA18D855AF9B3A1FF94340F4042B6D00DD358ACF346D828B54

Function 00007FF848E72B3D Relevance: .1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3328165433.00007FF848E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff848e70000_mssched.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 014c9152f5c8395510e959b7eb47c5142fbb99cd33835f2cf8ebefbcbdb1b30e
Instruction ID: 765758f1724d5d0a1a23e5b2f530a3f43f8d55750145b11008df6b249d3a498c
Opcode Fuzzy Hash: 014c9152f5c8395510e959b7eb47c5142fbb99cd33835f2cf8ebefbcbdb1b30e
Instruction Fuzzy Hash: 5F416B3090C64C8FDB59DFA8D885BEDBBF0FB5A310F1441AED049E7252DA34A886CB51

Function 00007FF848E70A6A Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3328165433.00007FF848E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff848e70000_mssched.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d70216a43816e68f29341376afe066af639909f09f972d0b9283f2f49d0683e
Instruction ID: c1a48a2f28ff485bfcf0c16e6518e9c60b2b24d9908dcdcc4670d4920e108bdd
Opcode Fuzzy Hash: 8d70216a43816e68f29341376afe066af639909f09f972d0b9283f2f49d0683e
Instruction Fuzzy Hash: C541F870908A0C9FDB58EF98D885AEDBBF0FB59310F10416ED44AE7252DA70A886CB45

Function 00007FF848E705A5 Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3328165433.00007FF848E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff848e70000_mssched.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a59d78577f425ccd97c97c6e0f3d6a9c44c2b8da2a2cc4be98466a7b2aa56c6d
Instruction ID: c8dde79ed086826d8c72ffbfeb2887e3626e538e8050b95e7791cd3d8b4bd50e
Opcode Fuzzy Hash: a59d78577f425ccd97c97c6e0f3d6a9c44c2b8da2a2cc4be98466a7b2aa56c6d
Instruction Fuzzy Hash: 64310772E0D99A4FE755EBACE8542FDBBA0FF443A0F04007BE088D3182DA349844C795

Function 00007FF848E72870 Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3328165433.00007FF848E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff848e70000_mssched.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b372c316804fc3c6c0c24fde14ac03ac6ec5c10ace49367779d0826cb8e58045
Instruction ID: fcba39c0bbb570b7ea7b6adf806caf910c798f6a6822e9eafb9c9827cc39edb7
Opcode Fuzzy Hash: b372c316804fc3c6c0c24fde14ac03ac6ec5c10ace49367779d0826cb8e58045
Instruction Fuzzy Hash: E5315D71D0894E8FEB98EF58D841AE9B7B1FF58340F1001BAD00ED7296DF34A8818B80

Function 00007FF848E74649 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3328165433.00007FF848E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff848e70000_mssched.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a25d57ec4faf6f90cc491f0d9b6d96a286eae6cc4eef405d9686436a75db5acd
Instruction ID: ae7fda9b5a3382b7c462a89a97459aea73cff37788b8d88b6b523e8e9ea5b196
Opcode Fuzzy Hash: a25d57ec4faf6f90cc491f0d9b6d96a286eae6cc4eef405d9686436a75db5acd
Instruction Fuzzy Hash: E531B27090968D8FDB95EB68C855AE977E1FF56340F0401F9D40DCB2A2CB39AD86CB04

Function 00007FF848E74677 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3328165433.00007FF848E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff848e70000_mssched.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1b9769de2e90d666fcc4ce16b8b8175ef174424d3fb179057879900507fe4b7
Instruction ID: d79ed8a56ff417e5f6adbdfe8ec13673e2f0e3deb2864fe463779873ddf993ff
Opcode Fuzzy Hash: f1b9769de2e90d666fcc4ce16b8b8175ef174424d3fb179057879900507fe4b7
Instruction Fuzzy Hash: 94314A31A09A8D8FDB95EF28D855BE973E1FF55300F5405B9D40EDB296CA39A982CB00

Function 00007FF848E70FD7 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3328165433.00007FF848E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff848e70000_mssched.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bca19587e3fb24ff51b9ef334d3ef6ccdfc03bd27af20e59f7bc48dbff8ef1b0
Instruction ID: f91b3f7555a66ee36cc95bcb798e095fee7a23be827fe1ea5c2e3682e05b1bf3
Opcode Fuzzy Hash: bca19587e3fb24ff51b9ef334d3ef6ccdfc03bd27af20e59f7bc48dbff8ef1b0
Instruction Fuzzy Hash: 32318C3091E65A9FE751EB34C85ABA9B7F1FF06340F5040E9C04D9B2A6DB38A981CF01

Function 00007FF848E7114C Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3328165433.00007FF848E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff848e70000_mssched.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec7e189f48396e7d17384d9dc7f99d4fd6e662150853b6317e55b4f2ba27c868
Instruction ID: b89b3bef4633a24102d51c17b314aa73c4d1d338273ddb62b85c017f71ecc50f
Opcode Fuzzy Hash: ec7e189f48396e7d17384d9dc7f99d4fd6e662150853b6317e55b4f2ba27c868
Instruction Fuzzy Hash: 4031A43091961A8FEB95FB68C499AE977B1FF59341F5004E9D00CD7292CB35A981CF00

Function 00007FF848E728D0 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3328165433.00007FF848E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff848e70000_mssched.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d91517e3a6b4f2ec81e171d011e6eef65228ee9b9c3b468088f12cc7121e2eeb
Instruction ID: 274951c8aba43169d47b7bf33d7a4e86e42754c9390d54c61acd14dcb55ea35b
Opcode Fuzzy Hash: d91517e3a6b4f2ec81e171d011e6eef65228ee9b9c3b468088f12cc7121e2eeb
Instruction Fuzzy Hash: E721083090894E8FDB98EF68C851BE9B7B2FF58340F5041B9D00ED7296DE34A882CB40

Function 00007FF848E7463C Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3328165433.00007FF848E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff848e70000_mssched.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf083282d25466820d661c31878384dfce06aa2f2fb5f5f5724827d5a5750b2b
Instruction ID: cf8e772f7568e8c898a5e7f2fde434cd102485e3727dab6ebda0f307831b76bb
Opcode Fuzzy Hash: bf083282d25466820d661c31878384dfce06aa2f2fb5f5f5724827d5a5750b2b
Instruction Fuzzy Hash: 4A213D30909A8D8FDB95EF28D455AA973E1FF56300F5100F9D40DCB2A2DB39AD82CB00

Function 00007FF848E72541 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3328165433.00007FF848E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff848e70000_mssched.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 420be6e624824294f71f0dab164d6536941bd5a321b95bd4292d079b87d12ebc
Instruction ID: b4fb40e895e0d87fda6782362918805cd9b069d6b2253aa1d4b0a7f8644c73f2
Opcode Fuzzy Hash: 420be6e624824294f71f0dab164d6536941bd5a321b95bd4292d079b87d12ebc
Instruction Fuzzy Hash: A0113A70D18A8E8FEB85FF68C8686E97BA0FF55340F4501BAD809C7192DF34A9918741

Function 00007FF848E7102D Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3328165433.00007FF848E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff848e70000_mssched.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 071db885332b8a7fd0a3c47048317ce3b4ab15b0617586ce4d4bcc83164219d5
Instruction ID: e75437d35df13a8a425298f13f16b169b8e35e4fc3797486527d5fb9e35b9a6c
Opcode Fuzzy Hash: 071db885332b8a7fd0a3c47048317ce3b4ab15b0617586ce4d4bcc83164219d5
Instruction Fuzzy Hash: 9E21C27085E74A5FD751EB74C45AAA9BBF0FF06300F5040E9C04E9B1A2DB38A986CB04

Function 00007FF848E70898 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3328165433.00007FF848E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff848e70000_mssched.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f34e512ac8005a14a086f391f848f623e47f93ce8b104cbb829842596d0c4b7f
Instruction ID: 8f2ee8aaa028f37804ff70ef728af582a97b46ead933a86a5b9438f1d37cacc0
Opcode Fuzzy Hash: f34e512ac8005a14a086f391f848f623e47f93ce8b104cbb829842596d0c4b7f
Instruction Fuzzy Hash: 5C112BB584F6993ED705BBB8A4061FA7F50EF422A5F0C41BAD0CD4B053DA186049C799

Function 00007FF848E713AC Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3328165433.00007FF848E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff848e70000_mssched.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: adf0a0ac23fe7c14a65d8e32ad00bdc83aad9db7306e5f6f5590e60d107b13cd
Instruction ID: 44b59f8bf81373cf4f44567029b92ba461b42d50073df480065a03996a974a4a
Opcode Fuzzy Hash: adf0a0ac23fe7c14a65d8e32ad00bdc83aad9db7306e5f6f5590e60d107b13cd
Instruction Fuzzy Hash: B2210830D19A5A8FE7A8FA6888557B8B7B1FF54345F4004FAC00DE3292DF356D818B04

Function 00007FF848E75CDD Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3328165433.00007FF848E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff848e70000_mssched.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc4b4b0b757628dd2622118da50844d31ac863d6128751dfb413c586540be445
Instruction ID: 2bbf4ae44602b5607bded9108f2e4a46be246757ef69527a46948c753e076088
Opcode Fuzzy Hash: cc4b4b0b757628dd2622118da50844d31ac863d6128751dfb413c586540be445
Instruction Fuzzy Hash: CB01E970A0995E8FDB94EF18C894AD9B7F1FF59340F1542E4D009D7A56C734ED828B40

Function 00007FF848E71A31 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3328165433.00007FF848E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff848e70000_mssched.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ce02fed580d6308539a2eda77e8bb6568025c970770ceca44a081ca7498e75e
Instruction ID: c098e922bce87143e36ceaf8c89c322bed1f8976776803ffa573a24a3c82b98a
Opcode Fuzzy Hash: 1ce02fed580d6308539a2eda77e8bb6568025c970770ceca44a081ca7498e75e
Instruction Fuzzy Hash: FA01D17080E7C95FD742FF74491A5A97FA0EF17251F0902EED48A8B063D7698459C381

Function 00007FF848E708E0 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3328165433.00007FF848E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff848e70000_mssched.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6f3d797af6bee9f586ce7c12459275f6736171025c7c6342df5254fbd205a5f
Instruction ID: a30a17a32e440f258d6a638323cc4eb9e0ddfcb5f2d1664d26a914843f526ca9
Opcode Fuzzy Hash: c6f3d797af6bee9f586ce7c12459275f6736171025c7c6342df5254fbd205a5f
Instruction Fuzzy Hash: 6AF0907080E7896FD741EFB0490A6AABBA0EF06251F0406EDD49A87056D7289559C740

Function 00007FF848E740AF Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3328165433.00007FF848E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff848e70000_mssched.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9aa9cad59faf3c16633e1e8cc8e1af65d576e09e78dcf953def3e8eaf84048d
Instruction ID: dcd4f8c2207e7f9521281124d7283f58972213f60d3dafa5a1d21aae15f1a765
Opcode Fuzzy Hash: a9aa9cad59faf3c16633e1e8cc8e1af65d576e09e78dcf953def3e8eaf84048d
Instruction Fuzzy Hash: B1F07F70A189598FDB99EF18C895EA9B3B2FF59300F5140A8E01ED7266CA71ED81CF00

Non-executed Functions

Function 00007FF848E7165F Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3328165433.00007FF848E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff848e70000_mssched.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10e9338dfa0aa0fc5050fc523cd7bdf03d661315219d39c757e527e89f8a9ee4
Instruction ID: 1860e30552c03477f22371691481777731d839f8a07f502755ef9b2bb1ce7f6d
Opcode Fuzzy Hash: 10e9338dfa0aa0fc5050fc523cd7bdf03d661315219d39c757e527e89f8a9ee4
Instruction Fuzzy Hash: 2031C730D19A1D8FEB90EB68C859AE9B7B0FF5A341F5014E5D40DE72A2CB35A981CF04

Analysis Process: mssched.exePID: 7108, Parent PID: 1028COMMON

Executed Functions

Function 00007FF848E91FB0 Relevance: .5, Instructions: 515COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2196845703.00007FF848E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff848e90000_mssched.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c88f65a082529f14c337acd07a3e2de7c5a0b9a039ee0cee023921b174965b7
Instruction ID: 74c9ba182703c423e2428ac872837fbe2cbeaa9a534f1b78ba3f247febe39211
Opcode Fuzzy Hash: 5c88f65a082529f14c337acd07a3e2de7c5a0b9a039ee0cee023921b174965b7
Instruction Fuzzy Hash: 71418071D0CA498FEB49EBA8D8557E8BBB1FF56345F0400BAD009E7292CB799884CB14

Function 00007FF848E9240E Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2196845703.00007FF848E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff848e90000_mssched.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d27d62ad88a03d11df21f0d74ceccf26e1321b06fcb26d6e79996ddb7d0e6d9
Instruction ID: dbfcc9c31add3e69a2c1d5283ee657c408a2f536a86e732d0fa2a5653a72c3d0
Opcode Fuzzy Hash: 2d27d62ad88a03d11df21f0d74ceccf26e1321b06fcb26d6e79996ddb7d0e6d9
Instruction Fuzzy Hash: CF319C35D0D6499FDB49EBA4D850AECBBF1FF4A304F1400B9D01AD7292CB7AA841CB14

Function 00007FF848E91A31 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2196845703.00007FF848E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff848e90000_mssched.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0958e0dc9dd4a91f6a1986182b28a3a2f6584da034f31d0479a2be9fa6b2bdec
Instruction ID: f000ce50d74cbf577f79b430d3dc1dc0d46722603121ce1799ee26073d982d1d
Opcode Fuzzy Hash: 0958e0dc9dd4a91f6a1986182b28a3a2f6584da034f31d0479a2be9fa6b2bdec
Instruction Fuzzy Hash: 18115EB5E0D68D9FDB80EF68C8496A97BF0FF69350F0401A6D518CB251DBB9D9018B40

Function 00007FF848E91989 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2196845703.00007FF848E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff848e90000_mssched.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d72b2687bbd4d1a6c708aedfa163e6248a45249b323f26e6caf6a32daabc5e2b
Instruction ID: aa7938b2c0c9893ebf90f4d04d99865ecb185c9cf906a5e799b8ea842ba6bf61
Opcode Fuzzy Hash: d72b2687bbd4d1a6c708aedfa163e6248a45249b323f26e6caf6a32daabc5e2b
Instruction Fuzzy Hash: 5AF08C3184D6884FD716AE2488512E57F60FF46240F0502A6D448C60D3DB6D9558C742

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SecuriteInfo.com.FileRepMalware.16359.15944.exe

Overview

General Information

Detection

Compliance

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\AWSSDK.Core.dll

C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\AWSSDK.S3.dll

C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\KillProcPCTT.exe

C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\Newtonsoft.Json.dll

C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\jusched32.exe

C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\mssched.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\KillProcPCTT.exe.log

C:\Users\user\AppData\Local\Microsoft\mssched.exe_Url_4gcyhmu3ku50ql3oveaqzgvl21ncnjvy\1.0.0.71\user.config (copy)

C:\Users\user\AppData\Local\Microsoft\mssched.exe_Url_4gcyhmu3ku50ql3oveaqzgvl21ncnjvy\1.0.0.71\xonhjdd2.newcfg

C:\Users\user\AppData\Local\Temp\nsl5176.tmp\DotNetChecker.dll

C:\Users\user\AppData\Roaming\376483\user_ebteme\1729898892.jpg

\Device\ConDrv

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Windows Analysis Report
SecuriteInfo.com.FileRepMalware.16359.15944.exe

Function 0040352D Relevance: 89.7, APIs: 34, Strings: 17, Instructions: 450
stringfilecomCOMMON

Function 004056DE Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 284
windowclipboardmemoryCOMMON

Function 00405C49 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 148
filestringCOMMON

Function 00403F9A Relevance: 51.4, APIs: 34, Instructions: 357
windowstringCOMMON

Function 00403BEC Relevance: 45.7, APIs: 14, Strings: 12, Instructions: 215
stringregistryCOMMON

Function 0040307D Relevance: 24.7, APIs: 5, Strings: 9, Instructions: 181
memoryCOMMON

Function 004032B4 Relevance: 19.4, APIs: 4, Strings: 7, Instructions: 166
COMMON

Function 0040657A Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 196
stringCOMMON

Function 0040176F Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 145
stringtimeCOMMON

Function 0040559F Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 72
stringwindowCOMMON

Function 0040689A Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36
libraryCOMMON

Function 00405A6E Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 39
COMMON

Function 00405F14 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 47
stringCOMMON

Function 0040605C Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 37
COMMON

Function 004015C1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65
COMMON