Edit tour

Windows Analysis Report
prog.exe

Overview

General Information

Sample name:	prog.exe
Analysis ID:	1542826
MD5:	5f10f34b3ef012f1db5f21755cad4ab1
SHA1:	439ab3bd92cd515b092607291ac054f3fad1359f
SHA256:	f161b56490087b75b15207598c6e0526afd184e3f8e76ab6eff8eaa6f573b660
Tags:	exeuser-aachum
Infos:

Detection

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Disable power options

Sigma detected: Stop EventLog

AI detected suspicious sample

Adds a directory exclusion to Windows Defender

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Loading BitLocker PowerShell Module

Machine Learning detection for sample

Modifies power options to not sleep / hibernate

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Uses powercfg.exe to modify the power settings

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Contains functionality to dynamically determine API calls

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Powershell Defender Exclusion

Sigma detected: Startup Folder File Write

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

prog.exe (PID: 1720 cmdline: "C:\Users\user\Desktop\prog.exe" MD5: 5F10F34B3EF012F1DB5F21755CAD4AB1)

prog.exe (PID: 5344 cmdline: "C:\Users\user\AppData\Local\Temp\prog.exe" MD5: D3ADC3EC7B76556B7FAC591C33F31EA9)

powershell.exe (PID: 5780 cmdline: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 1400 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WmiPrvSE.exe (PID: 652 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)

cmd.exe (PID: 5908 cmdline: C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6128 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

wusa.exe (PID: 4324 cmdline: wusa /uninstall /kb:890830 /quiet /norestart MD5: FBDA2B8987895780375FE0E6254F6198)

sc.exe (PID: 4592 cmdline: C:\Windows\system32\sc.exe stop UsoSvc MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 528 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 1196 cmdline: C:\Windows\system32\sc.exe stop WaaSMedicSvc MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 7100 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 4996 cmdline: C:\Windows\system32\sc.exe stop wuauserv MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 5260 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 1532 cmdline: C:\Windows\system32\sc.exe stop bits MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 5032 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 6948 cmdline: C:\Windows\system32\sc.exe stop dosvc MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 7160 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powercfg.exe (PID: 3872 cmdline: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

conhost.exe (PID: 7064 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powercfg.exe (PID: 5232 cmdline: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

conhost.exe (PID: 1576 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powercfg.exe (PID: 7056 cmdline: C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

conhost.exe (PID: 2072 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powercfg.exe (PID: 1292 cmdline: C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

conhost.exe (PID: 5612 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 7092 cmdline: C:\Windows\system32\sc.exe delete "appdata" MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 6460 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 5828 cmdline: C:\Windows\system32\sc.exe create "appdata" binpath= "C:\ProgramData\win32\svhost.exe" start= "auto" MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 4072 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 5776 cmdline: C:\Windows\system32\sc.exe stop eventlog MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 320 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 5272 cmdline: C:\Windows\system32\sc.exe start "appdata" MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 4416 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

svhost.exe (PID: 5560 cmdline: C:\ProgramData\win32\svhost.exe MD5: D3ADC3EC7B76556B7FAC591C33F31EA9)

cleanup

Sigma Signatures

Change of critical system settings

Sigma detected: Disable power options

Source: Process started

Author: Joe Security: Data: Command: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0, CommandLine: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0, CommandLine|base64offset|contains: , Image: C:\Windows\System32\powercfg.exe, NewProcessName: C:\Windows\System32\powercfg.exe, OriginalFileName: C:\Windows\System32\powercfg.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\prog.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\prog.exe, ParentProcessId: 5344, ParentProcessName: prog.exe, ProcessCommandLine: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0, ProcessId: 3872, ProcessName: powercfg.exe

System Summary

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, CommandLine: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\prog.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\prog.exe, ParentProcessId: 5344, ParentProcessName: prog.exe, ProcessCommandLine: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, ProcessId: 5780, ProcessName: powershell.exe

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Startup Folder File Write

Source: File created

Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research): Data: EventID: 11, Image: C:\Users\user\Desktop\prog.exe, ProcessId: 1720, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup

Sigma detected: New Service Creation Using Sc.EXE

Source: Process started

Author: Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community: Data: Command: C:\Windows\system32\sc.exe create "appdata" binpath= "C:\ProgramData\win32\svhost.exe" start= "auto", CommandLine: C:\Windows\system32\sc.exe create "appdata" binpath= "C:\ProgramData\win32\svhost.exe" start= "auto", CommandLine|base64offset|contains: r, Image: C:\Windows\System32\sc.exe, NewProcessName: C:\Windows\System32\sc.exe, OriginalFileName: C:\Windows\System32\sc.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\prog.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\prog.exe, ParentProcessId: 5344, ParentProcessName: prog.exe, ProcessCommandLine: C:\Windows\system32\sc.exe create "appdata" binpath= "C:\ProgramData\win32\svhost.exe" start= "auto", ProcessId: 5828, ProcessName: sc.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, CommandLine: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\prog.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\prog.exe, ParentProcessId: 5344, ParentProcessName: prog.exe, ProcessCommandLine: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, ProcessId: 5780, ProcessName: powershell.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Stop EventLog

Source: Process started

Author: Joe Security: Data: Command: C:\Windows\system32\sc.exe stop eventlog, CommandLine: C:\Windows\system32\sc.exe stop eventlog, CommandLine|base64offset|contains: ), Image: C:\Windows\System32\sc.exe, NewProcessName: C:\Windows\System32\sc.exe, OriginalFileName: C:\Windows\System32\sc.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\prog.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\prog.exe, ParentProcessId: 5344, ParentProcessName: prog.exe, ProcessCommandLine: C:\Windows\system32\sc.exe stop eventlog, ProcessId: 5776, ProcessName: sc.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: prog.exe

Avira: detected

Multi AV Scanner detection for dropped file

Source: C:\ProgramData\win32\svhost.exe	ReversingLabs: Detection: 73%
Source: C:\Users\user\AppData\Local\Temp\prog.exe	ReversingLabs: Detection: 73%

Multi AV Scanner detection for submitted file

Source: prog.exe

ReversingLabs: Detection: 97%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: prog.exe

Joe Sandbox ML: detected

Source: prog.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: prog.exe, 00000000.00000002.2126289883.00000000006DA000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: https://discord.com/2
Source: prog.exe, 00000000.00000002.2126289883.00000000006DA000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: https://discord.com/6

System Summary

Uses powercfg.exe to modify the power settings

Source: C:\Users\user\AppData\Local\Temp\prog.exe

Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0

Source: C:\Users\user\AppData\Local\Temp\prog.exe	Code function: 2_2_00007FF7B7AF1394 NtContinue,		2_2_00007FF7B7AF1394
Source: C:\ProgramData\win32\svhost.exe	Code function: 35_2_00007FF664861394 NtSetIoCompletion,		35_2_00007FF664861394

Source: C:\Users\user\AppData\Local\Temp\prog.exe	Code function: 2_2_00007FF7B7AF6628	2_2_00007FF7B7AF6628
Source: C:\Users\user\AppData\Local\Temp\prog.exe	Code function: 2_2_00007FF7B7AF6628	2_2_00007FF7B7AF6628
Source: C:\ProgramData\win32\svhost.exe	Code function: 35_2_00007FF664866628	35_2_00007FF664866628
Source: C:\ProgramData\win32\svhost.exe	Code function: 35_2_00007FF664866628	35_2_00007FF664866628

Source: Joe Sandbox View	Dropped File: C:\ProgramData\win32\svhost.exe 25231BA6616C0C1BBC4DDA82BDD46AD067577E16971BAE412B1192B250B456DC
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Temp\prog.exe 25231BA6616C0C1BBC4DDA82BDD46AD067577E16971BAE412B1192B250B456DC

Source: C:\ProgramData\win32\svhost.exe	Code function: String function: 00007FF664861394 appears 33 times
Source: C:\Users\user\AppData\Local\Temp\prog.exe	Code function: String function: 00007FF7B7AF1394 appears 33 times

Source: prog.exe, 00000000.00000002.2126289883.00000000006DA000.00000004.00000001.01000000.00000003.sdmp

Binary or memory string: OriginalFilenameSetup.exe^ vs prog.exe

Source: prog.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.spyw.evad.winEXE@52/7@0/0

Source: C:\Users\user\Desktop\prog.exe

Code function: 0_2_0040135A GetSystemDirectoryA,PathAddBackslashA,GetWindowsDirectoryA,GetTempPathA,GetModuleFileNameA,GetEnvironmentVariableA,FindResourceA,SizeofResource,LoadResource,LockResource,GlobalAlloc,RtlMoveMemory,GlobalAlloc,RtlMoveMemory,GlobalFree,lstrcpynA,lstrcpyA,lstrlenA,lstrcpyA,lstrlenA,lstrcpyA,lstrcatA,lstrcpyA,CreateFileA,WriteFile,HeapAlloc,WriteFile,HeapFree,CreateFileA,GetFileSize,CloseHandle,HeapAlloc,WriteFile,HeapFree,CloseHandle,GlobalFree,SetFileAttributesA,lstrcpyA,PathFindFileNameA,ShellExecuteA,FreeResource,ExitProcess,ExitProcess,

0_2_0040135A

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2072:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7100:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4416:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5260:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:528:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1576:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5612:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:320:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6128:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6460:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7160:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7064:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5032:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4072:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1400:120:WilError_03

Source: C:\Users\user\Desktop\prog.exe

File created: C:\Users\user\AppData\Local\Temp\prog.exe

Jump to behavior

Source: prog.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\prog.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\prog.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: prog.exe

ReversingLabs: Detection: 97%

Source: C:\Users\user\AppData\Local\Temp\prog.exe

File read: C:\Users\user\AppData\Local\Temp\prog.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\prog.exe "C:\Users\user\Desktop\prog.exe"
Source: C:\Users\user\Desktop\prog.exe	Process created: C:\Users\user\AppData\Local\Temp\prog.exe "C:\Users\user\AppData\Local\Temp\prog.exe"
Source: C:\Users\user\AppData\Local\Temp\prog.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Users\user\AppData\Local\Temp\prog.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
Source: C:\Users\user\AppData\Local\Temp\prog.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop UsoSvc
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart
Source: C:\Users\user\AppData\Local\Temp\prog.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop WaaSMedicSvc
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\prog.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop wuauserv
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\prog.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop bits
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\prog.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop dosvc
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\prog.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
Source: C:\Users\user\AppData\Local\Temp\prog.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
Source: C:\Windows\System32\powercfg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\prog.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
Source: C:\Windows\System32\powercfg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\prog.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
Source: C:\Windows\System32\powercfg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\prog.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe delete "appdata"
Source: C:\Windows\System32\powercfg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\prog.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe create "appdata" binpath= "C:\ProgramData\win32\svhost.exe" start= "auto"
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\prog.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop eventlog
Source: C:\Users\user\AppData\Local\Temp\prog.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe start "appdata"
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\ProgramData\win32\svhost.exe C:\ProgramData\win32\svhost.exe
Source: C:\Users\user\Desktop\prog.exe	Process created: C:\Users\user\AppData\Local\Temp\prog.exe "C:\Users\user\AppData\Local\Temp\prog.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\prog.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\prog.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\prog.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop UsoSvc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\prog.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop WaaSMedicSvc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\prog.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop wuauserv	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\prog.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop bits	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\prog.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop dosvc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\prog.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\prog.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\prog.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\prog.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\prog.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe delete "appdata"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\prog.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe create "appdata" binpath= "C:\ProgramData\win32\svhost.exe" start= "auto"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\prog.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop eventlog	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\prog.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe start "appdata"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart	Jump to behavior

Source: C:\Users\user\Desktop\prog.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\prog.exe	Section loaded: acgenral.dll	Jump to behavior
Source: C:\Users\user\Desktop\prog.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\prog.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\prog.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\prog.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Users\user\Desktop\prog.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\prog.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\prog.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\prog.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\prog.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\prog.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\prog.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\prog.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\prog.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\prog.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\prog.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\prog.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Users\user\Desktop\prog.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\Desktop\prog.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\Desktop\prog.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\prog.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\prog.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\prog.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\prog.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\prog.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\prog.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\prog.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\prog.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\prog.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\prog.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\prog.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\prog.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\prog.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\prog.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\prog.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\prog.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\prog.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\prog.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\prog.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\prog.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\prog.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mpclient.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wmitomi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\wusa.exe	Section loaded: dpx.dll	Jump to behavior
Source: C:\Windows\System32\wusa.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\System32\wusa.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wusa.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wusa.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\ProgramData\win32\svhost.exe	Section loaded: apphelp.dll	Jump to behavior

Source: C:\Users\user\Desktop\prog.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: prog.exe

Static file information: File size 3030176 > 1048576

Source: prog.exe

Static PE information: Raw size of .rsrc is bigger than: 0x100000 < 0x2c9800

Source: C:\Users\user\Desktop\prog.exe

Code function: 0_2_004011CF LoadLibraryA,GetProcAddress,GetProcAddress,LoadLibraryA,GetProcAddress,GetProcAddress,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleFileNameA,GetEnvironmentVariableA,

0_2_004011CF

Source: prog.exe.0.dr	Static PE information: section name: .00cfg
Source: svhost.exe.2.dr	Static PE information: section name: .00cfg

Source: C:\Users\user\AppData\Local\Temp\prog.exe	Code function: 2_2_00007FF7B7AF1394 push qword ptr [00007FF7B7AFE004h]; ret		2_2_00007FF7B7AF1403
Source: C:\ProgramData\win32\svhost.exe	Code function: 35_2_00007FF664861394 push qword ptr [00007FF66486E004h]; ret		35_2_00007FF664861403

Source: C:\Users\user\AppData\Local\Temp\prog.exe	File created: C:\ProgramData\win32\svhost.exe			Jump to dropped file
Source: C:\Users\user\Desktop\prog.exe	File created: C:\Users\user\AppData\Local\Temp\prog.exe			Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\prog.exe

File created: C:\ProgramData\win32\svhost.exe

Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\prog.exe

Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop UsoSvc

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Users\user\Desktop\prog.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\prog.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Source: C:\Users\user\Desktop\prog.exe

Evasive API call chain: GetPEB, DecisionNodes, ExitProcess

graph_0-249

Source: C:\Users\user\Desktop\prog.exe

Code function: 0_2_004012D9 rdtsc

0_2_004012D9

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4857			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4921			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\prog.exe	API coverage: 6.8 %
Source: C:\ProgramData\win32\svhost.exe	API coverage: 6.8 %

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2364	Thread sleep count: 4857 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2364	Thread sleep count: 4921 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6524	Thread sleep time: -7378697629483816s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: prog.exe, 00000000.00000002.2126359103.000000000086C000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\yfhs

Source: C:\Users\user\Desktop\prog.exe	API call chain: ExitProcess graph end node	graph_0-199
Source: C:\Users\user\Desktop\prog.exe	API call chain: ExitProcess graph end node	graph_0-226
Source: C:\Users\user\Desktop\prog.exe	API call chain: ExitProcess graph end node	graph_0-251
Source: C:\Users\user\Desktop\prog.exe	API call chain: ExitProcess graph end node	graph_0-254
Source: C:\Users\user\Desktop\prog.exe	API call chain: ExitProcess graph end node	graph_0-167

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\prog.exe

Code function: 0_2_004012D9 rdtsc

0_2_004012D9

Source: C:\Users\user\Desktop\prog.exe

0_2_004011CF

Source: C:\Users\user\Desktop\prog.exe	Code function: 0_2_0040119D mov eax, dword ptr fs:[00000030h]		0_2_0040119D
Source: C:\Users\user\Desktop\prog.exe	Code function: 0_2_004011AF mov eax, dword ptr fs:[00000030h]		0_2_004011AF

Source: C:\Users\user\Desktop\prog.exe

Code function: 0_2_00401AE1 GetCommandLineA,GetModuleHandleA,GetProcessHeap,ExitProcess,

0_2_00401AE1

Source: C:\Users\user\AppData\Local\Temp\prog.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\prog.exe	Code function: 2_2_00007FF7B7AF118B Sleep,Sleep,_amsg_exit,_initterm,SetUnhandledExceptionFilter,malloc,strlen,malloc,memcpy,_cexit,	2_2_00007FF7B7AF118B
Source: C:\Users\user\AppData\Local\Temp\prog.exe	Code function: 2_2_00007FF7B7AF11D8 _initterm,SetUnhandledExceptionFilter,malloc,strlen,malloc,memcpy,_cexit,	2_2_00007FF7B7AF11D8
Source: C:\ProgramData\win32\svhost.exe	Code function: 35_2_00007FF66486118B Sleep,Sleep,_amsg_exit,_initterm,SetUnhandledExceptionFilter,malloc,strlen,malloc,memcpy,_cexit,	35_2_00007FF66486118B
Source: C:\ProgramData\win32\svhost.exe	Code function: 35_2_00007FF6648611D8 _initterm,SetUnhandledExceptionFilter,malloc,strlen,malloc,memcpy,_cexit,	35_2_00007FF6648611D8

HIPS / PFW / Operating System Protection Evasion

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\AppData\Local\Temp\prog.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Source: C:\Users\user\AppData\Local\Temp\prog.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force			Jump to behavior

Source: C:\Users\user\Desktop\prog.exe	Process created: C:\Users\user\AppData\Local\Temp\prog.exe "C:\Users\user\AppData\Local\Temp\prog.exe"			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Modifies power options to not sleep / hibernate

Source: C:\Users\user\AppData\Local\Temp\prog.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
Source: C:\Users\user\AppData\Local\Temp\prog.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
Source: C:\Users\user\AppData\Local\Temp\prog.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\prog.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Service Execution	1 Windows Service	1 Windows Service	1 Disable or Modify Tools	OS Credential Dumping	121 Security Software Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	11 Native API	1 DLL Side-Loading	11 Process Injection	21 Virtualization/Sandbox Evasion	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	11 Process Injection	Security Account Manager	21 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Obfuscated Files or Information	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	11 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
prog.exe	97%	ReversingLabs	Win32.Hacktool.Vbinder
prog.exe	100%	Avira	HEUR/AGEN.1349575
prog.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\ProgramData\win32\svhost.exe	74%	ReversingLabs	Win64.Trojan.MintZard
C:\Users\user\AppData\Local\Temp\prog.exe	74%	ReversingLabs	Win64.Trojan.MintZard

Name	Source	Malicious	Antivirus Detection	Reputation
https://discord.com/2	prog.exe, 00000000.00000002.2126289883.00000000006DA000.00000004.00000001.01000000.00000003.sdmp	false		unknown
https://discord.com/6	prog.exe, 00000000.00000002.2126289883.00000000006DA000.00000004.00000001.01000000.00000003.sdmp	false		unknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1542826
Start date and time:	2024-10-26 16:28:09 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 46s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	38
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	prog.exe
Detection:	MAL
Classification:	mal100.spyw.evad.winEXE@52/7@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 93% Number of executed functions: 13 Number of non-executed functions: 24
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: prog.exe

Simulations

Behavior and APIs

Time	Type	Description
10:29:17	API Interceptor	17x Sleep call for process: powershell.exe modified

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
C:\Users\user\AppData\Local\Temp\prog.exe	prog.exe	Get hash	malicious	Unknown	Browse
C:\ProgramData\win32\svhost.exe	prog.exe	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\ProgramData\win32\svhost.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\prog.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2663424
Entropy (8bit):	6.53722623620131
Encrypted:	false
SSDEEP:	49152:BMnw0O8lulPUtBbXmsGHePO2/cqKQBxLEHq86RM+uFVwYm6fYfOuFa1Y+PJq++W5:CnfxYW/b8em2/ctQBxGql2+Szm6fYfOo
MD5:	D3ADC3EC7B76556B7FAC591C33F31EA9
SHA1:	B7295FAE70F550AA2963DA196B08636094E26E93
SHA-256:	25231BA6616C0C1BBC4DDA82BDD46AD067577E16971BAE412B1192B250B456DC
SHA-512:	0EDD9263191B82E525DA655F76597BBD755174E8436E1E3A783A6A7F7064077E651A7D4DD36B3FD1B353BC435FF9D3ADE466D43327BA086DEE89B712CAB73985
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 74%
Joe Sandbox View:	Filename: prog.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......f.........."...........(.....@..........@............................. )...........`.................................................0...<.....).P.....(...............).x...............................(.......8...............p............................text...v........................... ..`.rdata...+.......,..................@..@.data...`.'.......'.................@....pdata........(.......(.............@..@.00cfg........(.......(.............@..@.tls..........(.......(.............@....rsrc...P.....).......(.............@..@.reloc..x.....).......(.............@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllul3nqth:NllUa
MD5:	851531B4FD612B0BC7891B3F401A478F
SHA1:	483F0D1E71FB0F6EFF159AA96CC82422CF605FB3
SHA-256:	383511F73A5CE9C50CD95B6321EFA51A8C6F18192BEEBBD532D4934E3BC1071F
SHA-512:	A22D105E9F63872406FD271EF0A545BD76974C2674AEFF1B3256BCAC3C2128B9B8AA86B993A53BF87DBAC12ED8F00DCCAFD76E8BA431315B7953656A4CB4E931
Malicious:	false
Preview:	@...e.................................&..............@..........

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_c14qiz0m.w44.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_l2k44ady.woi.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pya4eufh.ber.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xqt1u0o5.fl2.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\prog.exe

Download File

Process:	C:\Users\user\Desktop\prog.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2663424
Entropy (8bit):	6.53722623620131
Encrypted:	false
SSDEEP:	49152:BMnw0O8lulPUtBbXmsGHePO2/cqKQBxLEHq86RM+uFVwYm6fYfOuFa1Y+PJq++W5:CnfxYW/b8em2/ctQBxGql2+Szm6fYfOo
MD5:	D3ADC3EC7B76556B7FAC591C33F31EA9
SHA1:	B7295FAE70F550AA2963DA196B08636094E26E93
SHA-256:	25231BA6616C0C1BBC4DDA82BDD46AD067577E16971BAE412B1192B250B456DC
SHA-512:	0EDD9263191B82E525DA655F76597BBD755174E8436E1E3A783A6A7F7064077E651A7D4DD36B3FD1B353BC435FF9D3ADE466D43327BA086DEE89B712CAB73985
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 74%
Joe Sandbox View:	Filename: prog.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......f.........."...........(.....@..........@............................. )...........`.................................................0...<.....).P.....(...............).x...............................(.......8...............p............................text...v........................... ..`.rdata...+.......,..................@..@.data...`.'.......'.................@....pdata........(.......(.............@..@.00cfg........(.......(.............@..@.tls..........(.......(.............@....rsrc...P.....).......(.............@..@.reloc..x.....).......(.............@..B........................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.70466082348244
TrID:	Win32 Executable (generic) a (10002005/4) 99.94% Win16/32 Executable Delphi generic (2074/23) 0.02% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% VXD Driver (31/22) 0.00%
File name:	prog.exe
File size:	3'030'176 bytes
MD5:	5f10f34b3ef012f1db5f21755cad4ab1
SHA1:	439ab3bd92cd515b092607291ac054f3fad1359f
SHA256:	f161b56490087b75b15207598c6e0526afd184e3f8e76ab6eff8eaa6f573b660
SHA512:	7f6473adb10d878b8c9cb9360c04ed843401d6eb69ca1df546e956e18032598cbdd1fffbdc45c0fe7d3927a6fa54ef77b9d2e10175e3ca15c6421cfa678d59ce
SSDEEP:	49152:ZtH86NYYGclfMk3iDPS6wcXLuankPBUJCBuB+zVma85E4xTz:ZtH8SHGc5MWiDdj7uakPBUJ1oV0EkTz
TLSH:	66E533E92109BF13DE29CFBC8FB281565E359E6251434162A7117FDA8473ECB50B2CE8
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Q......................,.............. ....@...........................-............................................

File Icon


Icon Hash:	0f2b69d4d44d330f

Static PE Info

General

Entrypoint:	0x401ae1
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:
Time Stamp:	0x51BC99EC [Sat Jun 15 16:44:28 2013 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	d5d9d937853db8b666bd4b525813d7bd

Entrypoint Preview

Instruction
call 00007F04A88378D1h
mov dword ptr [0040300Bh], eax
push 00000000h
call 00007F04A88378DDh
mov dword ptr [00403013h], eax
call 00007F04A88378DFh
mov dword ptr [00403C70h], eax
push 0000000Ah
push dword ptr [0040300Bh]
push 00000000h
push dword ptr [00403013h]
call 00007F04A8836D5Fh
push 00000000h
call 00007F04A8837888h
int3
jmp dword ptr [0040207Ch]
jmp dword ptr [00402008h]
jmp dword ptr [0040200Ch]
jmp dword ptr [00402010h]
jmp dword ptr [00402014h]
jmp dword ptr [00402018h]
jmp dword ptr [0040201Ch]
jmp dword ptr [00402020h]
jmp dword ptr [00402024h]
jmp dword ptr [00402028h]
jmp dword ptr [0040202Ch]
jmp dword ptr [00402030h]
jmp dword ptr [00402034h]
jmp dword ptr [00402038h]
jmp dword ptr [0040203Ch]
jmp dword ptr [00402040h]
jmp dword ptr [00402044h]
jmp dword ptr [00402048h]
jmp dword ptr [0040204Ch]
jmp dword ptr [00402050h]
jmp dword ptr [00402054h]
jmp dword ptr [00402058h]
jmp dword ptr [00402000h]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x20bc	0x50	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x11000	0x2c9800	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0xbc	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xc26	0xe00	a941ede160cf12509be8dd37ae2b6a57	False	0.47935267857142855	data	5.1463325678068115	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x2000	0x4c0	0x600	930587e8eece4537e4be6a4476dc03fa	False	0.4055989583333333	data	4.212357479426224	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x3000	0xd6f0	0x600	7f95694b637a8e9d84e496462c4af938	False	0.16927083333333334	data	1.7255508052001818	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x11000	0x2c9800	0x2c9800	6abea6dfb676b8546f495dafed3678ee	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0x11220	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	0.32180851063829785
RT_ICON	0x11688	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	0.18785178236397748
RT_ICON	0x12730	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	0.17074688796680498
RT_ICON	0x14cd8	0x42028	Device independent bitmap graphic, 256 x 512 x 32, image size 0	0.020719294611947808
RT_RCDATA	0x56d00	0x283675	data	0.9986152648925781
RT_RCDATA	0x2da378	0x96	data	0.9533333333333334
RT_GROUP_ICON	0x2da410	0x3e	data	0.7903225806451613
RT_GROUP_ICON	0x2da450	0x22	data	1.088235294117647
RT_VERSION	0x2da474	0x38c	PGP symmetric key encrypted data - Plaintext or unencrypted data	0.42951541850220265

Imports

DLL	Import
shlwapi.dll	PathFindFileNameA
kernel32.dll	LockResource, lstrlenA, CloseHandle, CreateFileA, ExitProcess, FindResourceA, FreeResource, GetCommandLineA, GetEnvironmentVariableA, GetFileSize, GetModuleFileNameA, GetModuleHandleA, GetProcAddress, GetProcessHeap, GetSystemDirectoryA, GetTempPathA, GetWindowsDirectoryA, GlobalAlloc, GlobalFree, HeapAlloc, HeapFree, LoadLibraryA, LoadResource, lstrcpynA, RtlMoveMemory, SetFileAttributesA, SizeofResource, WriteFile, lstrcatA, lstrcpyA
user32.dll	CreateWindowExA, DefWindowProcA, DispatchMessageA, GetMessageA, LoadCursorA, LoadIconA, MessageBoxA, PostQuitMessage, RegisterClassExA, SendMessageA, ShowWindow, TranslateMessage, UpdateWindow

Target ID:	0
Start time:	10:29:05
Start date:	26/10/2024
Path:	C:\Users\user\Desktop\prog.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\prog.exe"
Imagebase:	0x400000
File size:	3'030'176 bytes
MD5 hash:	5F10F34B3EF012F1DB5F21755CAD4AB1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	10:29:10
Start date:	26/10/2024
Path:	C:\Users\user\AppData\Local\Temp\prog.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Temp\prog.exe"
Imagebase:	0x7ff7b7af0000
File size:	2'663'424 bytes
MD5 hash:	D3ADC3EC7B76556B7FAC591C33F31EA9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 74%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	10:29:15
Start date:	26/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	10:29:16
Start date:	26/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	10:29:18
Start date:	26/10/2024
Path:	C:\Windows\System32\wbem\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0x7ff6ef0c0000
File size:	496'640 bytes
MD5 hash:	60FF40CFD7FB8FE41EE4FE9AE5FE1C51
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	10:29:19
Start date:	26/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
Imagebase:	0x7ff7c8fe0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	10:29:19
Start date:	26/10/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe stop UsoSvc
Imagebase:	0x7ff62b170000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	10:29:19
Start date:	26/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	10:29:19
Start date:	26/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	10:29:19
Start date:	26/10/2024
Path:	C:\Windows\System32\wusa.exe
Wow64 process (32bit):	false
Commandline:	wusa /uninstall /kb:890830 /quiet /norestart
Imagebase:	0x7ff7d66f0000
File size:	345'088 bytes
MD5 hash:	FBDA2B8987895780375FE0E6254F6198
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	10:29:19
Start date:	26/10/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe stop WaaSMedicSvc
Imagebase:	0x7ff62b170000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	10:29:19
Start date:	26/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	10:29:19
Start date:	26/10/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe stop wuauserv
Imagebase:	0x7ff62b170000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	10:29:19
Start date:	26/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	10:29:19
Start date:	26/10/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe stop bits
Imagebase:	0x7ff62b170000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	10:29:19
Start date:	26/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	10:29:19
Start date:	26/10/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe stop dosvc
Imagebase:	0x7ff62b170000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	10:29:19
Start date:	26/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	10:29:19
Start date:	26/10/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
Imagebase:	0x7ff7d2600000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	10:29:19
Start date:	26/10/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
Imagebase:	0x7ff7d2600000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	10:29:19
Start date:	26/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	10:29:19
Start date:	26/10/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
Imagebase:	0x7ff7d2600000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	10:29:19
Start date:	26/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	10:29:19
Start date:	26/10/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
Imagebase:	0x7ff7d2600000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	10:29:19
Start date:	26/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	10:29:19
Start date:	26/10/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe delete "appdata"
Imagebase:	0x7ff62b170000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	10:29:19
Start date:	26/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	10:29:19
Start date:	26/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	10:29:20
Start date:	26/10/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe create "appdata" binpath= "C:\ProgramData\win32\svhost.exe" start= "auto"
Imagebase:	0x7ff62b170000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	10:29:20
Start date:	26/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	10:29:20
Start date:	26/10/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe stop eventlog
Imagebase:	0x7ff62b170000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	10:29:20
Start date:	26/10/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe start "appdata"
Imagebase:	0x7ff62b170000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	10:29:20
Start date:	26/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	10:29:20
Start date:	26/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	10:29:20
Start date:	26/10/2024
Path:	C:\ProgramData\win32\svhost.exe
Wow64 process (32bit):	false
Commandline:	C:\ProgramData\win32\svhost.exe
Imagebase:	0x7ff664860000
File size:	2'663'424 bytes
MD5 hash:	D3ADC3EC7B76556B7FAC591C33F31EA9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 74%, ReversingLabs
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	64.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	59.3%
Total number of Nodes:	81
Total number of Limit Nodes:	10

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 0040135A Relevance: 91.4, APIs: 43, Strings: 9, Instructions: 373
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryA.KERNEL32(C:\Windows\system32\,00001000), ref: 0040136B
PathAddBackslashA.SHLWAPI(C:\Windows\system32\), ref: 00401375
GetWindowsDirectoryA.KERNEL32(00404C84,00001000), ref: 00401385
GetTempPathA.KERNEL32(00001000,00405C84), ref: 0040139F
GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\Desktop\,00000200), ref: 004013BB
GetEnvironmentVariableA.KERNEL32(APPDATA,00407C84,00001000), ref: 004013DD

Part of subcall function 00401907: FindResourceA.KERNEL32(00000000,00001001,0000000A), ref: 00401917
Part of subcall function 00401907: ExitProcess.KERNEL32(00000000,00000000,0000000A,00000000), ref: 00401B18

FindResourceA.KERNEL32(00000000,00000001,0000000A), ref: 0040144C
SizeofResource.KERNEL32(00000000,00000000,00000000,00000001,0000000A,00000001), ref: 00401462
LoadResource.KERNEL32(00000000,00000000,00000000,00000000,00000001,0000000A,00000001), ref: 0040147D
ExitProcess.KERNEL32(?,?,?,?,004106BC,00000000,00406C84,C0000000,00000003,00000000,00000002,00000080,00000000,00406C84,prog.exe), ref: 00401897
ExitProcess.KERNEL32(00000000,?,?,?,?,004106BC,00000000,00406C84,C0000000,00000003,00000000,00000002,00000080,00000000,00406C84,prog.exe), ref: 0040189E

Strings

APPDATA, xrefs: 004013D8
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\, xrefs: 004013F1, 004013FE, 0040161F
C:\Users\user\Desktop\, xrefs: 004013B4, 004013C0, 00401605
C:\Users\user\AppData\Local\Temp\, xrefs: 00401829, 00401833, 00401840
C:\Windows\system32\, xrefs: 00401366, 00401370, 004015DE
u6(, xrefs: 00401470, 004014D2, 0040152C
prog.exe, xrefs: 0040155C, 0040165F
C:\Dir1\SubDir, xrefs: 0040159F, 00401639
open, xrefs: 00401859

Memory Dump Source

Source File: 00000000.00000002.2125958239.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2125938659.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125975729.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125997720.0000000000403000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125997720.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2126036558.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2126289883.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_prog.jbxd

Similarity

API ID: Resource$ExitProcess$DirectoryFindPath$BackslashEnvironmentFileLoadModuleNameSizeofSystemTempVariableWindows
String ID: APPDATA$C:\Dir1\SubDir$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\$C:\Users\user\Desktop\$C:\Windows\system32\$open$prog.exe$u6(
API String ID: 1865746177-1020812695
Opcode ID: 0b4706bb5c93686d89f6ed56fbf093ccd5effdb974abd12bc2b349d010d1b901
Instruction ID: 87517960ec9dbd09822493e96d6633269da166b851f384452dd9e845d648968f
Opcode Fuzzy Hash: 0b4706bb5c93686d89f6ed56fbf093ccd5effdb974abd12bc2b349d010d1b901
Instruction Fuzzy Hash: 3ED18271A44205AFFB24AFA1DD42FA93AB4EB04715F20403BF501B51F1DBBD6A908B1E

Function 004011CF Relevance: 47.3, APIs: 14, Strings: 13, Instructions: 53
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(Shell32.dll,0040111C), ref: 004011D4
GetProcAddress.KERNEL32(ShellExecuteA,Shell32.dll), ref: 004011E9
GetProcAddress.KERNEL32(SHGetSpecialFolderPathA,0040111C), ref: 004011FE
LoadLibraryA.KERNEL32(shlwapi.dll,SHGetSpecialFolderPathA,0040111C), ref: 0040120D
GetProcAddress.KERNEL32(PathFindFileNameA,shlwapi.dll), ref: 00401222
GetProcAddress.KERNEL32(PathAddBackslashA,PathFindFileNameA), ref: 00401237
LoadLibraryA.KERNEL32(advapi32.dll,PathAddBackslashA,PathFindFileNameA,shlwapi.dll,SHGetSpecialFolderPathA,0040111C), ref: 00401246
GetProcAddress.KERNEL32(RegCreateKeyExA,advapi32.dll), ref: 0040125B
GetProcAddress.KERNEL32(RegSetValueExA,RegCreateKeyExA), ref: 00401270
GetProcAddress.KERNEL32(RegCloseKey,RegSetValueExA), ref: 00401285
LoadLibraryA.KERNEL32(ntdll.dll,RegCloseKey,RegSetValueExA,RegCreateKeyExA,advapi32.dll,PathAddBackslashA,PathFindFileNameA,shlwapi.dll,SHGetSpecialFolderPathA,0040111C), ref: 00401294
GetProcAddress.KERNEL32(RtlDecompressBuffer,ntdll.dll), ref: 004012A9
GetModuleFileNameA.KERNEL32(00000000,0040BC84,00001000,RtlDecompressBuffer,ntdll.dll,RegCloseKey,RegSetValueExA,RegCreateKeyExA,advapi32.dll,PathAddBackslashA,PathFindFileNameA,shlwapi.dll,SHGetSpecialFolderPathA,0040111C), ref: 004012BF
GetEnvironmentVariableA.KERNEL32(ComSpec,0040FC84,00000500,00000000,0040BC84,00001000,RtlDecompressBuffer,ntdll.dll,RegCloseKey,RegSetValueExA,RegCreateKeyExA,advapi32.dll,PathAddBackslashA,PathFindFileNameA,shlwapi.dll,SHGetSpecialFolderPathA), ref: 004012D3

Strings

PathAddBackslashA, xrefs: 0040122C
RegCloseKey, xrefs: 0040127A
shlwapi.dll, xrefs: 00401208
Shell32.dll, xrefs: 004011CF
ntdll.dll, xrefs: 0040128F
advapi32.dll, xrefs: 00401241
ComSpec, xrefs: 004012CE
RtlDecompressBuffer, xrefs: 0040129E
SHGetSpecialFolderPathA, xrefs: 004011F3
RegSetValueExA, xrefs: 00401265
PathFindFileNameA, xrefs: 00401217
ShellExecuteA, xrefs: 004011DE
RegCreateKeyExA, xrefs: 00401250

Memory Dump Source

Source File: 00000000.00000002.2125958239.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2125938659.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125975729.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125997720.0000000000403000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125997720.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2126036558.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2126289883.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_prog.jbxd

Similarity

API ID: AddressProc$LibraryLoad$EnvironmentFileModuleNameVariable
String ID: ComSpec$PathAddBackslashA$PathFindFileNameA$RegCloseKey$RegCreateKeyExA$RegSetValueExA$RtlDecompressBuffer$SHGetSpecialFolderPathA$Shell32.dll$ShellExecuteA$advapi32.dll$ntdll.dll$shlwapi.dll
API String ID: 3647900824-1083084054
Opcode ID: ed63defba397cbb933b777222a0bacb8b6594ff129ae780b5b0ed5781ffeacf7
Instruction ID: a06bb1d97dbf063ac68fad512a01dcc274482fcad67705a1e8ff053d2cfa1aac
Opcode Fuzzy Hash: ed63defba397cbb933b777222a0bacb8b6594ff129ae780b5b0ed5781ffeacf7
Instruction Fuzzy Hash: AC11AA70A423046EE751BF32ED02BA93E75E790B45B20813BB440751F9E7FD19A19B1C

Function 00401AE1 Relevance: 6.0, APIs: 4, Instructions: 15
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCommandLineA.KERNEL32 ref: 00401AE1
GetModuleHandleA.KERNEL32(00000000), ref: 00401AED
GetProcessHeap.KERNEL32(00000000), ref: 00401AF7

Part of subcall function 00401000: LoadIconA.USER32(00403000,000001F4), ref: 0040104C
Part of subcall function 00401000: LoadCursorA.USER32(00000000,00007F00), ref: 0040105B
Part of subcall function 00401000: RegisterClassExA.USER32(00000030), ref: 0040106E
Part of subcall function 00401000: CreateWindowExA.USER32(00000000,WinClass32,WinClass32,00CF0000,?,?,?,?,00000000,00000000,00403000,00000000), ref: 004010AA
Part of subcall function 00401000: ShowWindow.USER32(00000001,?), ref: 004010BC
Part of subcall function 00401000: UpdateWindow.USER32(00000001), ref: 004010C7
Part of subcall function 00401000: GetMessageA.USER32(?,00000000,00000000,00000000), ref: 004010D6
Part of subcall function 00401000: TranslateMessage.USER32(?), ref: 004010E4
Part of subcall function 00401000: DispatchMessageA.USER32(?), ref: 004010ED

ExitProcess.KERNEL32(00000000,00000000,0000000A,00000000), ref: 00401B18

Memory Dump Source

Source File: 00000000.00000002.2125958239.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2125938659.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125975729.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125997720.0000000000403000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125997720.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2126036558.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2126289883.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_prog.jbxd

Similarity

API ID: MessageWindow$LoadProcess$ClassCommandCreateCursorDispatchExitHandleHeapIconLineModuleRegisterShowTranslateUpdate
String ID:
API String ID: 673778540-0
Opcode ID: cfbab243bfee9b5cb56ef1db76fa81e74447810506c232cb5a36ea3a31cdea14
Instruction ID: a064688063e39c940ae72a4b90be644b02f79907e5f24655d35d5466687fb791
Opcode Fuzzy Hash: cfbab243bfee9b5cb56ef1db76fa81e74447810506c232cb5a36ea3a31cdea14
Instruction Fuzzy Hash: FBD067749452006AE6217F71AE02B143E64E70074BF10407AB6057A1F5EB786A10670D

Function 004011AF Relevance: 1.5, APIs: 1, Instructions: 8
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32(00000000,00000000,0000000A,00000000), ref: 00401B18

Memory Dump Source

Source File: 00000000.00000002.2125958239.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2125938659.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125975729.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125997720.0000000000403000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125997720.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2126036558.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2126289883.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_prog.jbxd

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: b282020c020ec24376e01dd257daea11e10f1f4ac2a3929f2a510d4130da15fc
Instruction ID: 363a1f89bed63b7dcc895a87b01cf0a5ad2b70b8edfb3c7b62b81fcb133e7216
Opcode Fuzzy Hash: b282020c020ec24376e01dd257daea11e10f1f4ac2a3929f2a510d4130da15fc
Instruction Fuzzy Hash: E7C09234268A84CAE219AB08C15AF1133B5BB40B45FA1846BB2152A8F293BCA810E44A

Function 0040119D Relevance: 1.5, APIs: 1, Instructions: 8
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32(00000000,00000000,0000000A,00000000), ref: 00401B18

Memory Dump Source

Source File: 00000000.00000002.2125958239.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2125938659.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125975729.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125997720.0000000000403000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125997720.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2126036558.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2126289883.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_prog.jbxd

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 016bcc260c57d67281d0a185370db58a258a073e77d6077e442bffbde582f7fc
Instruction ID: e0a2e36e3d8c8f3e554d3af8483bffc66267ff5874ff8d07cdc79a1876b45754
Opcode Fuzzy Hash: 016bcc260c57d67281d0a185370db58a258a073e77d6077e442bffbde582f7fc
Instruction Fuzzy Hash: 62B092306599809AE21AA318801AF917AB26F40B45FDAC4A7F206298F253BCA944D10A

Function 00401907 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 119
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindResourceA.KERNEL32(00000000,00001001,0000000A), ref: 00401917
SizeofResource.KERNEL32(00000000,00000000), ref: 0040192D
ExitProcess.KERNEL32(00000000,00000000,0000000A,00000000), ref: 00401B18

Strings

u6(, xrefs: 0040193B, 00401984, 00401A52

Memory Dump Source

Source File: 00000000.00000002.2125958239.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2125938659.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125975729.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125997720.0000000000403000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125997720.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2126036558.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2126289883.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_prog.jbxd

Similarity

API ID: Resource$ExitFindProcessSizeof
String ID: u6(
API String ID: 1411291463-298994214
Opcode ID: b165bb457e95d8592b2aa645c08f3646812f0134a3116199941ac9cacd79966e
Instruction ID: d4e59189b2e6214e03afd5d0d5579af94f7f612efc73c1461bf72c218524a00d
Opcode Fuzzy Hash: b165bb457e95d8592b2aa645c08f3646812f0134a3116199941ac9cacd79966e
Instruction Fuzzy Hash: FD412BB1A54204EFFB00DF65ED81B693BB4EB54305F10407BF905BA2B1E7B46960DB19

Function 00401000 Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 67
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadIconA.USER32(00403000,000001F4), ref: 0040104C
LoadCursorA.USER32(00000000,00007F00), ref: 0040105B
RegisterClassExA.USER32(00000030), ref: 0040106E
CreateWindowExA.USER32(00000000,WinClass32,WinClass32,00CF0000,?,?,?,?,00000000,00000000,00403000,00000000), ref: 004010AA
ShowWindow.USER32(00000001,?), ref: 004010BC
UpdateWindow.USER32(00000001), ref: 004010C7
GetMessageA.USER32(?,00000000,00000000,00000000), ref: 004010D6
TranslateMessage.USER32(?), ref: 004010E4
DispatchMessageA.USER32(?), ref: 004010ED

Strings

WinClass32, xrefs: 0040103D, 0040109E, 004010A3
0, xrefs: 00401006

Memory Dump Source

Source File: 00000000.00000002.2125958239.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2125938659.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125975729.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125997720.0000000000403000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125997720.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2126036558.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2126289883.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_prog.jbxd

Similarity

API ID: MessageWindow$Load$ClassCreateCursorDispatchIconRegisterShowTranslateUpdate
String ID: 0$WinClass32
API String ID: 282685165-2329282442
Opcode ID: 286dd39defc53bc53642eb2300d05e627e30782ba9ed8b70d4df91332c1cf868
Instruction ID: db64ee9f6a3c3da8bd2a7b60d0102d68ead382408d30bf1f106ff4c9428f50ce
Opcode Fuzzy Hash: 286dd39defc53bc53642eb2300d05e627e30782ba9ed8b70d4df91332c1cf868
Instruction Fuzzy Hash: F7213C70D44248AAEF11DFD0CD46BDDBFB8AB04708F20802AF600BA1E5D7B966459B5C

Function 004010FB Relevance: 4.5, APIs: 3, Instructions: 30
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SendMessageA.USER32(?,00009D99,00000000,00000000), ref: 00401128
DefWindowProcA.USER32(?,00000002,?,?), ref: 0040114E

Part of subcall function 0040135A: GetSystemDirectoryA.KERNEL32(C:\Windows\system32\,00001000), ref: 0040136B
Part of subcall function 0040135A: PathAddBackslashA.SHLWAPI(C:\Windows\system32\), ref: 00401375
Part of subcall function 0040135A: GetWindowsDirectoryA.KERNEL32(00404C84,00001000), ref: 00401385
Part of subcall function 0040135A: GetTempPathA.KERNEL32(00001000,00405C84), ref: 0040139F
Part of subcall function 0040135A: GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\Desktop\,00000200), ref: 004013BB
Part of subcall function 0040135A: GetEnvironmentVariableA.KERNEL32(APPDATA,00407C84,00001000), ref: 004013DD
Part of subcall function 0040135A: FindResourceA.KERNEL32(00000000,00000001,0000000A), ref: 0040144C
Part of subcall function 0040135A: ExitProcess.KERNEL32(00000000,?,?,?,?,004106BC,00000000,00406C84,C0000000,00000003,00000000,00000002,00000080,00000000,00406C84,prog.exe), ref: 0040189E

Memory Dump Source

Source File: 00000000.00000002.2125958239.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2125938659.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125975729.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125997720.0000000000403000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125997720.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2126036558.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2126289883.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_prog.jbxd

Similarity

API ID: DirectoryPath$BackslashEnvironmentExitFileFindMessageModuleNameProcProcessResourceSendSystemTempVariableWindowWindows
String ID:
API String ID: 1588881643-0
Opcode ID: f65326d40c1053b06fdae5316820f508df888febf5844a30f467ce6d3140b480
Instruction ID: dbb62d9085e5d6b3fbefb86f4113f67887605609739cbfea317797e2dab6c195
Opcode Fuzzy Hash: f65326d40c1053b06fdae5316820f508df888febf5844a30f467ce6d3140b480
Instruction Fuzzy Hash: 51F01C31244209B6DF296E629C07B5A3762AB08719F10C03BFB197C0F297BDD561AA5E

Function 00401ABE Relevance: 1.5, APIs: 1, Instructions: 9
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MessageBoxA.USER32(00000000,0040143D), ref: 00401ADB

Memory Dump Source

Source File: 00000000.00000002.2125958239.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2125938659.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125975729.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125997720.0000000000403000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125997720.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2126036558.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2126289883.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_prog.jbxd

Similarity

API ID: Message
String ID:
API String ID: 2030045667-0
Opcode ID: 2dae6f7468d55e854ba061b4820b56f038b0161a6d690cd2386f641b59654c62
Instruction ID: a94ce0f91df8c92c28126cd46e7bb928af6228ff25a2827e821d2225f10bdedb
Opcode Fuzzy Hash: 2dae6f7468d55e854ba061b4820b56f038b0161a6d690cd2386f641b59654c62
Instruction Fuzzy Hash: 4BC04C35211004AFEF429F90AD42F913BA1B384341F448035F208508B0D7F594F0AB1D

Non-executed Functions

Function 004012D9 Relevance: .0, Instructions: 17
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2125958239.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2125938659.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125975729.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125997720.0000000000403000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125997720.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2126036558.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2126289883.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_prog.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9990774af4119fa70ef41400092c50f263bdf1d164bc37f887e3c0d7a250b32
Instruction ID: 0611be33569e033cf0bcc92f54b95211119f9e80a1ee943285cb6afbe40d6e6f
Opcode Fuzzy Hash: a9990774af4119fa70ef41400092c50f263bdf1d164bc37f887e3c0d7a250b32
Instruction Fuzzy Hash: 91C012B711004827CB08C549D8429D6B798E6B5265714411FF912EB291D97CE90185A4

Function 004018A8 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 22
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcpyA.KERNEL32(0040DC84), ref: 004018AD
lstrcatA.KERNEL32(0040DC84,0040AC84,0040DC84), ref: 004018BC
lstrcatA.KERNEL32(0040DC84," ",0040DC84,0040AC84,0040DC84), ref: 004018CB
lstrcatA.KERNEL32(0040DC84,0040BC84,0040DC84," ",0040DC84,0040AC84,0040DC84), ref: 004018DA
lstrcatA.KERNEL32(0040DC84," >> NUL,0040DC84,0040BC84,0040DC84," ",0040DC84,0040AC84,0040DC84), ref: 004018E9

Strings

" >> NUL, xrefs: 004018DF
" ", xrefs: 004018C1

Memory Dump Source

Source File: 00000000.00000002.2125958239.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2125938659.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125975729.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125997720.0000000000403000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125997720.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2126036558.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2126289883.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_prog.jbxd

Similarity

API ID: lstrcat$lstrcpy
String ID: " "$" >> NUL
API String ID: 2482611188-2884213582
Opcode ID: 8513afed51d29f5d4a89328734691a1c3423f533152e92d8ecba9f9dcbb9b028
Instruction ID: 98fcd78bc27786ddee7840aea87765605715515cd2fa121c906537a6fc253484
Opcode Fuzzy Hash: 8513afed51d29f5d4a89328734691a1c3423f533152e92d8ecba9f9dcbb9b028
Instruction Fuzzy Hash: CAE0A264BDD347B9F4A876E20E17F0825665B40F89F72417B7914341E66AFC7118802F

Function 00401157 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 17
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcpyA.KERNEL32(00410184,/c del ",0040188C,?,?,?,?,004106BC,00000000,00406C84,C0000000,00000003,00000000,00000002,00000080,00000000), ref: 00401161
lstrcatA.KERNEL32(00410184,0040BC84,00410184,/c del ",0040188C,?,?,?,?,004106BC,00000000,00406C84,C0000000,00000003,00000000,00000002), ref: 00401170
lstrcatA.KERNEL32(00410184," >> NUL,00410184,0040BC84,00410184,/c del ",0040188C,?,?,?,?,004106BC,00000000,00406C84,C0000000,00000003), ref: 0040117F

Strings

" >> NUL, xrefs: 00401175
/c del ", xrefs: 00401157

Memory Dump Source

Source File: 00000000.00000002.2125958239.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2125938659.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125975729.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125997720.0000000000403000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125997720.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2126036558.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2126289883.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_prog.jbxd

Similarity

API ID: lstrcat$lstrcpy
String ID: " >> NUL$/c del "
API String ID: 2482611188-2706327707
Opcode ID: cd28eb0aa4a3eae105e9b4c0d92c6737ded14966b8bac3c8ed0da2462ae44cb6
Instruction ID: 17b86c2f2bfb9d9544adc925f31abe5a394b04165ab65cbffe2899ad540e7a84
Opcode Fuzzy Hash: cd28eb0aa4a3eae105e9b4c0d92c6737ded14966b8bac3c8ed0da2462ae44cb6
Instruction Fuzzy Hash: 53D0C2747D534676E4747A910E17F8425645740F49F3101BB7514341E65EFE72C1401D

Analysis Process: prog.exePID: 5344, Parent PID: 1720COMMON

Execution Graph

Execution Coverage:	4.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	21.4%
Total number of Nodes:	210
Total number of Limit Nodes:	2

Executed Functions

Function 00007FF7B7AF118B Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 108
sleepstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32 ref: 00007FF7B7AF11A5
_amsg_exit.MSVCRT ref: 00007FF7B7AF11CC
_initterm.MSVCRT ref: 00007FF7B7AF120F
SetUnhandledExceptionFilter.KERNEL32(?,?,?,00007FF7B7AF1156), ref: 00007FF7B7AF124E
malloc.MSVCRT ref: 00007FF7B7AF127E
strlen.MSVCRT ref: 00007FF7B7AF12A4
malloc.MSVCRT ref: 00007FF7B7AF12B0
memcpy.MSVCRT ref: 00007FF7B7AF12C3
_cexit.MSVCRT ref: 00007FF7B7AF132D

Strings

&, xrefs: 00007FF7B7AF1265
;*, xrefs: 00007FF7B7AF1310

Memory Dump Source

Source File: 00000002.00000002.2219624638.00007FF7B7AF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF7B7AF0000, based on PE: true

Associated: 00000002.00000002.2219557953.00007FF7B7AF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2219667950.00007FF7B7AFB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2219696663.00007FF7B7AFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2219722920.00007FF7B7AFF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2220223433.00007FF7B7D7B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2220249902.00007FF7B7D7D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2220276615.00007FF7B7D80000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7b7af0000_prog.jbxd

Similarity

API ID: malloc$ExceptionFilterSleepUnhandled_amsg_exit_cexit_inittermmemcpystrlen
String ID: &$;*
API String ID: 2643109117-510990765
Opcode ID: f214d2cb23ad4a7d8a6f2e16a4dc08a5006247cdfdc4fc33eaf7806aa3e5334d
Instruction ID: 73feafeb122045342fb47cd477043d120384ccc8ca7bcf0a1774686a8848f550
Opcode Fuzzy Hash: f214d2cb23ad4a7d8a6f2e16a4dc08a5006247cdfdc4fc33eaf7806aa3e5334d
Instruction Fuzzy Hash: 52413F25A0964685F690BB2DE954B79A7A1AF67780FC04136CB0DCF7B9DE2DA4438330

Function 00007FF7B7AF1394 Relevance: 1.5, APIs: 1, Instructions: 24
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtContinue.NTDLL(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7B7AF1156), ref: 00007FF7B7AF13F7

Memory Dump Source

Source File: 00000002.00000002.2219624638.00007FF7B7AF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF7B7AF0000, based on PE: true

Associated: 00000002.00000002.2219557953.00007FF7B7AF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2219667950.00007FF7B7AFB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2219696663.00007FF7B7AFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2219722920.00007FF7B7AFF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2220223433.00007FF7B7D7B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2220249902.00007FF7B7D7D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2220276615.00007FF7B7D80000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7b7af0000_prog.jbxd

Similarity

API ID: Continue
String ID:
API String ID: 3935651977-0
Opcode ID: 59d44b6da759f21b666a868a4e6a88dd90aa5652e3e5bdc8205d5884860000a3
Instruction ID: 677519e4036d904a8ee44235549796d17ee32176b0cdb047c3695aa44e623c84
Opcode Fuzzy Hash: 59d44b6da759f21b666a868a4e6a88dd90aa5652e3e5bdc8205d5884860000a3
Instruction Fuzzy Hash: DBF0FF7294CB418AD650EB5DF85482AB761FB6A380B404836EB8D8B73DDF3CE051CB64

Non-executed Functions

Function 00007FF7B7AF6628 Relevance: 40.9, APIs: 22, Strings: 1, Instructions: 667
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wcslen.MSVCRT ref: 00007FF7B7AF6799
_wcsnicmp.MSVCRT ref: 00007FF7B7AF67C9
wcslen.MSVCRT ref: 00007FF7B7AF67D9
memset.MSVCRT ref: 00007FF7B7AF696B
wcscpy.MSVCRT ref: 00007FF7B7AF6976
wcscat.MSVCRT ref: 00007FF7B7AF6985
_time64.MSVCRT ref: 00007FF7B7AF69FC
srand.MSVCRT ref: 00007FF7B7AF6A00
_time64.MSVCRT ref: 00007FF7B7AF6A07

Strings

X&, xrefs: 00007FF7B7AF729F

Memory Dump Source

Source File: 00000002.00000002.2219624638.00007FF7B7AF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF7B7AF0000, based on PE: true

Associated: 00000002.00000002.2219557953.00007FF7B7AF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2219667950.00007FF7B7AFB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2219696663.00007FF7B7AFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2219722920.00007FF7B7AFF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2220223433.00007FF7B7D7B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2220249902.00007FF7B7D7D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2220276615.00007FF7B7D80000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7b7af0000_prog.jbxd

Similarity

API ID: _time64wcslen$_wcsnicmpmemsetsrandwcscatwcscpy
String ID: X&
API String ID: 2454069949-221892188
Opcode ID: d1337906cd7b87a5fc8dec7907ca3527d0c29fd3263de3f14483aafe266232c2
Instruction ID: b1ff71dfc7fa985556312147f9044c2e06da097ce5638773dfc6ca50a3393bd1
Opcode Fuzzy Hash: d1337906cd7b87a5fc8dec7907ca3527d0c29fd3263de3f14483aafe266232c2
Instruction Fuzzy Hash: 29827B51C2C69288F351AB2DA8416B4E364AF77384FC45332DB8D9D6BAEF6C6147C324

Function 00007FF7B7AF11D8 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 78
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_initterm.MSVCRT ref: 00007FF7B7AF120F
SetUnhandledExceptionFilter.KERNEL32(?,?,?,00007FF7B7AF1156), ref: 00007FF7B7AF124E
malloc.MSVCRT ref: 00007FF7B7AF127E
strlen.MSVCRT ref: 00007FF7B7AF12A4
malloc.MSVCRT ref: 00007FF7B7AF12B0
memcpy.MSVCRT ref: 00007FF7B7AF12C3
_cexit.MSVCRT ref: 00007FF7B7AF132D

Strings

&, xrefs: 00007FF7B7AF1265
;*, xrefs: 00007FF7B7AF1310

Memory Dump Source

Source File: 00000002.00000002.2219624638.00007FF7B7AF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF7B7AF0000, based on PE: true

Associated: 00000002.00000002.2219557953.00007FF7B7AF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2219667950.00007FF7B7AFB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2219696663.00007FF7B7AFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2219722920.00007FF7B7AFF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2220223433.00007FF7B7D7B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2220249902.00007FF7B7D7D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2220276615.00007FF7B7D80000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7b7af0000_prog.jbxd

Similarity

API ID: malloc$ExceptionFilterUnhandled_cexit_inittermmemcpystrlen
String ID: &$;*
API String ID: 3825114775-510990765
Opcode ID: bb6b8f63c8978df2cb712fb4502542c6b0eedd4902725eabed431cc5bfcc8d57
Instruction ID: 56ac5bf3d7022b3efe920ff7d9f51b092c46e15e235803bc4dad205aa713dbb7
Opcode Fuzzy Hash: bb6b8f63c8978df2cb712fb4502542c6b0eedd4902725eabed431cc5bfcc8d57
Instruction Fuzzy Hash: 8441212591C64284F691BB1DE954A79A7A1AF677C0FC04232CB4DCF7B9DE2DA4438330

Function 00007FF7B7AF3350 Relevance: 21.2, APIs: 9, Strings: 5, Instructions: 206
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00007FF7B7AF33B2
memset.MSVCRT ref: 00007FF7B7AF3445
wcscpy.MSVCRT ref: 00007FF7B7AF349D
wcscat.MSVCRT ref: 00007FF7B7AF34A8
wcslen.MSVCRT ref: 00007FF7B7AF34B9
memset.MSVCRT ref: 00007FF7B7AF35D4
wcscpy.MSVCRT ref: 00007FF7B7AF3635
wcscat.MSVCRT ref: 00007FF7B7AF3640
wcslen.MSVCRT ref: 00007FF7B7AF3654

Strings

0, xrefs: 00007FF7B7AF368D
@, xrefs: 00007FF7B7AF34F1
, xrefs: 00007FF7B7AF36DD
@, xrefs: 00007FF7B7AF3698
0, xrefs: 00007FF7B7AF34E6

Memory Dump Source

Source File: 00000002.00000002.2219624638.00007FF7B7AF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF7B7AF0000, based on PE: true

Associated: 00000002.00000002.2219557953.00007FF7B7AF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2219667950.00007FF7B7AFB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2219696663.00007FF7B7AFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2219722920.00007FF7B7AFF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2220223433.00007FF7B7D7B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2220249902.00007FF7B7D7D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2220276615.00007FF7B7D80000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7b7af0000_prog.jbxd

Similarity

API ID: memset$wcscatwcscpywcslen
String ID: $0$0$@$@
API String ID: 4263182637-1413854666
Opcode ID: 62e16f804d0a78f42930f5485aab4d55bda2c88156d1efd01dd84db9e24e5fef
Instruction ID: ad9ae55401b58f791e232e7a93068b3fa1e61361d29d4d0bfde72532510c53f0
Opcode Fuzzy Hash: 62e16f804d0a78f42930f5485aab4d55bda2c88156d1efd01dd84db9e24e5fef
Instruction Fuzzy Hash: 53B1822191C6C185F361AB1DE4057EBF7B0FBA6384F804236DB889A6B9DF7DD1468B10

Function 00007FF7B7AF2690 Relevance: 19.6, APIs: 8, Strings: 3, Instructions: 322
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wcsncmp.MSVCRT ref: 00007FF7B7AF2795
memset.MSVCRT ref: 00007FF7B7AF2865
wcscpy.MSVCRT ref: 00007FF7B7AF28CE
wcscat.MSVCRT ref: 00007FF7B7AF28D9
wcslen.MSVCRT ref: 00007FF7B7AF28E1
wcslen.MSVCRT ref: 00007FF7B7AF28F6
wcslen.MSVCRT ref: 00007FF7B7AF296D
wcslen.MSVCRT ref: 00007FF7B7AF29E8

Strings

0, xrefs: 00007FF7B7AF279A
`, xrefs: 00007FF7B7AF2B91
X, xrefs: 00007FF7B7AF2B79

Memory Dump Source

Source File: 00000002.00000002.2219624638.00007FF7B7AF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF7B7AF0000, based on PE: true

Associated: 00000002.00000002.2219557953.00007FF7B7AF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2219667950.00007FF7B7AFB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2219696663.00007FF7B7AFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2219722920.00007FF7B7AFF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2220223433.00007FF7B7D7B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2220249902.00007FF7B7D7D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2220276615.00007FF7B7D80000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7b7af0000_prog.jbxd

Similarity

API ID: wcslen$memsetwcscatwcscpywcsncmp
String ID: 0$X$`
API String ID: 329590056-2527496196
Opcode ID: 7bd2d40a281e62959ce0fd44c16303bd5a4e704b549ab88744f3f2b4b0171fba
Instruction ID: 1afe77b8153335d3b79ac60d0198bd1977c55a9cabce162aa6f062b75b06ff24
Opcode Fuzzy Hash: 7bd2d40a281e62959ce0fd44c16303bd5a4e704b549ab88744f3f2b4b0171fba
Instruction Fuzzy Hash: 53028322508B8185E761AB1DE4447AAB7A0FBA6794F804336DB9C4B7F9DF3CD186C710

Function 00007FF7B7AF1BA0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 106
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualQuery.KERNEL32(?,?,?,?,00007FF7B7AFD3B0,00007FF7B7AFD3B0,?,?,00007FF7B7AF0000,?,00007FF7B7AF1991), ref: 00007FF7B7AF1C63
VirtualProtect.KERNEL32(?,?,?,?,00007FF7B7AFD3B0,00007FF7B7AFD3B0,?,?,00007FF7B7AF0000,?,00007FF7B7AF1991), ref: 00007FF7B7AF1CC7
memcpy.MSVCRT ref: 00007FF7B7AF1CE0
GetLastError.KERNEL32(?,?,?,?,00007FF7B7AFD3B0,00007FF7B7AFD3B0,?,?,00007FF7B7AF0000,?,00007FF7B7AF1991), ref: 00007FF7B7AF1D23

Strings

VirtualQuery failed for %d bytes at address %p, xrefs: 00007FF7B7AF1D17
VirtualProtect failed with code 0x%x, xrefs: 00007FF7B7AF1D29
Address %p has no image-section, xrefs: 00007FF7B7AF1CF4

Memory Dump Source

Source File: 00000002.00000002.2219624638.00007FF7B7AF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF7B7AF0000, based on PE: true

Associated: 00000002.00000002.2219557953.00007FF7B7AF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2219667950.00007FF7B7AFB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2219696663.00007FF7B7AFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2219722920.00007FF7B7AFF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2220223433.00007FF7B7D7B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2220249902.00007FF7B7D7D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2220276615.00007FF7B7D80000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7b7af0000_prog.jbxd

Similarity

API ID: Virtual$ErrorLastProtectQuerymemcpy
String ID: VirtualProtect failed with code 0x%x$ VirtualQuery failed for %d bytes at address %p$Address %p has no image-section
API String ID: 2595394609-2123141913
Opcode ID: f71d7c17d8efb8792bd36a77065ce856a453be169e7440349e6f230ab35daf72
Instruction ID: 80d45a693c73ca04b5720a45d3cfd30eda851451d17714ef7f82ea3bca1645e0
Opcode Fuzzy Hash: f71d7c17d8efb8792bd36a77065ce856a453be169e7440349e6f230ab35daf72
Instruction Fuzzy Hash: 8D418861A0954781EA91AF0DD454AB8AB60EB66BC4F944133CF0DCB7B9DE3CD543C720

Function 00007FF7B7AF2104 Relevance: 9.1, APIs: 6, Instructions: 51
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32 ref: 00007FF7B7AF2118
TlsGetValue.KERNEL32 ref: 00007FF7B7AF214F
GetLastError.KERNEL32 ref: 00007FF7B7AF2154
LeaveCriticalSection.KERNEL32 ref: 00007FF7B7AF2212
free.MSVCRT ref: 00007FF7B7AF2234
DeleteCriticalSection.KERNEL32 ref: 00007FF7B7AF225D

Memory Dump Source

Source File: 00000002.00000002.2219624638.00007FF7B7AF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF7B7AF0000, based on PE: true

Associated: 00000002.00000002.2219557953.00007FF7B7AF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2219667950.00007FF7B7AFB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2219696663.00007FF7B7AFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2219722920.00007FF7B7AFF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2220223433.00007FF7B7D7B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2220249902.00007FF7B7D7D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2220276615.00007FF7B7D80000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7b7af0000_prog.jbxd

Similarity

API ID: CriticalSection$DeleteEnterErrorLastLeaveValuefree
String ID:
API String ID: 3326252324-0
Opcode ID: 30ded24aebec5e3133582754e9744752ca6952f0633bd4de7137b6fa68abc3ee
Instruction ID: 80556c6a555d6ac1184b440f713c51a22b16ee1f2159e1347b751d9b4aff2d54
Opcode Fuzzy Hash: 30ded24aebec5e3133582754e9744752ca6952f0633bd4de7137b6fa68abc3ee
Instruction Fuzzy Hash: 5F21C021A0994681F695A70DE96467D9360BF67B90FC50232CB0DCF6B8DF2CA9479224

Function 00007FF7B7AF1E10 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 77
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

CCG , xrefs: 00007FF7B7AF1E27

Memory Dump Source

Source File: 00000002.00000002.2219624638.00007FF7B7AF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF7B7AF0000, based on PE: true

Associated: 00000002.00000002.2219557953.00007FF7B7AF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2219667950.00007FF7B7AFB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2219696663.00007FF7B7AFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2219722920.00007FF7B7AFF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2220223433.00007FF7B7D7B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2220249902.00007FF7B7D7D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2220276615.00007FF7B7D80000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7b7af0000_prog.jbxd

Similarity

API ID:
String ID: CCG
API String ID: 0-1584390748
Opcode ID: aac3cff987aa207af6683fbdf05d97adeeaddfa67e5404ea55e0566f274569b7
Instruction ID: ba69a1190d4ee3f66ccf85214a548ff97169a6ca2bab0ae42271e6b7ee98c295
Opcode Fuzzy Hash: aac3cff987aa207af6683fbdf05d97adeeaddfa67e5404ea55e0566f274569b7
Instruction Fuzzy Hash: 03216D22F0810642FBA4621CD540B7999819FA67A4FA48137DB0D8B2FCDF2CA8838360

Function 00007FF7B7AF38E0 Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 45
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wcslen.MSVCRT ref: 00007FF7B7AF38F8
wcslen.MSVCRT ref: 00007FF7B7AF396E

Strings

@, xrefs: 00007FF7B7AF392A
0, xrefs: 00007FF7B7AF3922

Memory Dump Source

Source File: 00000002.00000002.2219624638.00007FF7B7AF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF7B7AF0000, based on PE: true

Associated: 00000002.00000002.2219557953.00007FF7B7AF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2219667950.00007FF7B7AFB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2219696663.00007FF7B7AFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2219722920.00007FF7B7AFF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2220223433.00007FF7B7D7B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2220249902.00007FF7B7D7D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2220276615.00007FF7B7D80000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7b7af0000_prog.jbxd

Similarity

API ID: wcslen
String ID: 0$@
API String ID: 4088430540-1545510068
Opcode ID: ef7ed66185c074b667720f16183e97d9ab3fb1e6636ca8cac5f9c7ec846e676b
Instruction ID: 82b4dc20fac9d44fabe80bc861506dc7d633732495f3a8227c3c94e3c67be8d3
Opcode Fuzzy Hash: ef7ed66185c074b667720f16183e97d9ab3fb1e6636ca8cac5f9c7ec846e676b
Instruction Fuzzy Hash: B0119D2252C68082E351EB18F44579AA7B4FFE9394F504125F78C87B68EF3DC146CB00

Function 00007FF7B7AF1880 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 138
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7B7AF1247), ref: 00007FF7B7AF19F9

Strings

Unknown pseudo relocation protocol version %d., xrefs: 00007FF7B7AF1B8B
Unknown pseudo relocation bit size %d., xrefs: 00007FF7B7AF1B7B

Memory Dump Source

Source File: 00000002.00000002.2219624638.00007FF7B7AF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF7B7AF0000, based on PE: true

Associated: 00000002.00000002.2219557953.00007FF7B7AF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2219667950.00007FF7B7AFB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2219696663.00007FF7B7AFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2219722920.00007FF7B7AFF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2220223433.00007FF7B7D7B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2220249902.00007FF7B7D7D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2220276615.00007FF7B7D80000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7b7af0000_prog.jbxd

Similarity

API ID: ProtectVirtual
String ID: Unknown pseudo relocation bit size %d.$ Unknown pseudo relocation protocol version %d.
API String ID: 544645111-395989641
Opcode ID: 6188dcfb9ba409927f7d43b305952e2ca18d87eecd447261aab3e5aaa2c983f9
Instruction ID: 6438378cbd8d01b5cf828c6e4f810e4bdbd6d9b9b8382a73ed25aad5f253cd96
Opcode Fuzzy Hash: 6188dcfb9ba409927f7d43b305952e2ca18d87eecd447261aab3e5aaa2c983f9
Instruction Fuzzy Hash: B7515221B08546C5EB54AB2DD844B74AB71AB36794F844232DB1C8BBBCCE3CE583C720

Function 00007FF7B7AF1800 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 30
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

fprintf.MSVCRT ref: 00007FF7B7AF185A

Strings

_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF7B7AF184D
Unknown error, xrefs: 00007FF7B7AF1824

Memory Dump Source

Source File: 00000002.00000002.2219624638.00007FF7B7AF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF7B7AF0000, based on PE: true

Associated: 00000002.00000002.2219557953.00007FF7B7AF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2219667950.00007FF7B7AFB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2219696663.00007FF7B7AFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2219722920.00007FF7B7AFF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2220223433.00007FF7B7D7B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2220249902.00007FF7B7D7D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2220276615.00007FF7B7D80000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7b7af0000_prog.jbxd

Similarity

API ID: fprintf
String ID: Unknown error$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-3474627141
Opcode ID: d196cce22733da6664e8edb65b95f02763a682be6f02ab55e526d30871c6c29c
Instruction ID: 1bf2206dff34bc4516520814eb51a4e0456c88a631737bc12bd57cc74b4e8682
Opcode Fuzzy Hash: d196cce22733da6664e8edb65b95f02763a682be6f02ab55e526d30871c6c29c
Instruction Fuzzy Hash: DEF04411A1898582E651BB2CA9414B9E371EB7A7C5F909232DF4D9B6A9DF1CE1438310

Function 00007FF7B7AF219E Relevance: 5.0, APIs: 4, Instructions: 34
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32 ref: 00007FF7B7AF21B2
TlsGetValue.KERNEL32 ref: 00007FF7B7AF21EB
GetLastError.KERNEL32 ref: 00007FF7B7AF21F0
LeaveCriticalSection.KERNEL32 ref: 00007FF7B7AF226C

Memory Dump Source

Source File: 00000002.00000002.2219624638.00007FF7B7AF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF7B7AF0000, based on PE: true

Associated: 00000002.00000002.2219557953.00007FF7B7AF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2219667950.00007FF7B7AFB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2219696663.00007FF7B7AFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2219722920.00007FF7B7AFF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2220223433.00007FF7B7D7B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2220249902.00007FF7B7D7D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2220276615.00007FF7B7D80000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7b7af0000_prog.jbxd

Similarity

API ID: CriticalSection$EnterErrorLastLeaveValue
String ID:
API String ID: 682475483-0
Opcode ID: 0d3f40a56fc230f51008cd68afb882d42e2fa9fd450aedc21c851e2dc6c825f8
Instruction ID: c639aba9eb2e03b5628423919765a31285da53b7dcb6ada2db03e5a996ecbb6e
Opcode Fuzzy Hash: 0d3f40a56fc230f51008cd68afb882d42e2fa9fd450aedc21c851e2dc6c825f8
Instruction Fuzzy Hash: FC011E21A0994281F686AB0DED14678D260BF26BD0FC50232CB0D9F6BCDF2CF9539224

Analysis Process: svhost.exePID: 5560, Parent PID: 632COMMON

Execution Graph

Execution Coverage:	4.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	209
Total number of Limit Nodes:	2

Executed Functions

Function 00007FF66486118B Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 108
sleepstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32 ref: 00007FF6648611A5
_amsg_exit.MSVCRT ref: 00007FF6648611CC
_initterm.MSVCRT ref: 00007FF66486120F
SetUnhandledExceptionFilter.KERNEL32(?,?,?,00007FF664861156), ref: 00007FF66486124E
malloc.MSVCRT ref: 00007FF66486127E
strlen.MSVCRT ref: 00007FF6648612A4
malloc.MSVCRT ref: 00007FF6648612B0
memcpy.MSVCRT ref: 00007FF6648612C3
_cexit.MSVCRT ref: 00007FF66486132D

Strings

;*, xrefs: 00007FF664861310
&, xrefs: 00007FF664861265

Memory Dump Source

Source File: 00000023.00000002.2220394179.00007FF664861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF664860000, based on PE: true

Associated: 00000023.00000002.2220373982.00007FF664860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000023.00000002.2220410664.00007FF66486B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000023.00000002.2220426642.00007FF66486E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000023.00000002.2220444144.00007FF66486F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000023.00000002.2220678281.00007FF664AEB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000023.00000002.2220703795.00007FF664AED000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000023.00000002.2220728924.00007FF664AF0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ff664860000_svhost.jbxd

Similarity

API ID: malloc$ExceptionFilterSleepUnhandled_amsg_exit_cexit_inittermmemcpystrlen
String ID: &$;*
API String ID: 2643109117-510990765
Opcode ID: f214d2cb23ad4a7d8a6f2e16a4dc08a5006247cdfdc4fc33eaf7806aa3e5334d
Instruction ID: 1227347b97d11de3ea5d75b164597fbd27d2ab6455258aac5c402e9354ba3577
Opcode Fuzzy Hash: f214d2cb23ad4a7d8a6f2e16a4dc08a5006247cdfdc4fc33eaf7806aa3e5334d
Instruction Fuzzy Hash: 4C418C31E29686C5F681EB1BE9D93792BB0BF85794F105039DA1DCF7AADE2DE4418300

Function 00007FF664861394 Relevance: 1.5, APIs: 1, Instructions: 24
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtSetIoCompletion.NTDLL(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF664861156), ref: 00007FF6648613F7

Memory Dump Source

Source File: 00000023.00000002.2220394179.00007FF664861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF664860000, based on PE: true

Associated: 00000023.00000002.2220373982.00007FF664860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000023.00000002.2220410664.00007FF66486B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000023.00000002.2220426642.00007FF66486E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000023.00000002.2220444144.00007FF66486F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000023.00000002.2220678281.00007FF664AEB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000023.00000002.2220703795.00007FF664AED000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000023.00000002.2220728924.00007FF664AF0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ff664860000_svhost.jbxd

Similarity

API ID: Completion
String ID:
API String ID: 2005611694-0
Opcode ID: 59d44b6da759f21b666a868a4e6a88dd90aa5652e3e5bdc8205d5884860000a3
Instruction ID: 6e7b969d21170e0a400c11d0fcd39e97c1fc3a7b2e4d322aeda8d50f5d5e7558
Opcode Fuzzy Hash: 59d44b6da759f21b666a868a4e6a88dd90aa5652e3e5bdc8205d5884860000a3
Instruction Fuzzy Hash: 99F0627292CB42C6D650EB52FC9556A77B0FB99780F005839EA8C8AB25DF3CE1508B51

Non-executed Functions

Function 00007FF6648611D8 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 78
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_initterm.MSVCRT ref: 00007FF66486120F
SetUnhandledExceptionFilter.KERNEL32(?,?,?,00007FF664861156), ref: 00007FF66486124E
malloc.MSVCRT ref: 00007FF66486127E
strlen.MSVCRT ref: 00007FF6648612A4
malloc.MSVCRT ref: 00007FF6648612B0
memcpy.MSVCRT ref: 00007FF6648612C3
_cexit.MSVCRT ref: 00007FF66486132D

Strings

;*, xrefs: 00007FF664861310
&, xrefs: 00007FF664861265

Memory Dump Source

Source File: 00000023.00000002.2220394179.00007FF664861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF664860000, based on PE: true

Associated: 00000023.00000002.2220373982.00007FF664860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000023.00000002.2220410664.00007FF66486B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000023.00000002.2220426642.00007FF66486E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000023.00000002.2220444144.00007FF66486F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000023.00000002.2220678281.00007FF664AEB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000023.00000002.2220703795.00007FF664AED000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000023.00000002.2220728924.00007FF664AF0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ff664860000_svhost.jbxd

Similarity

API ID: malloc$ExceptionFilterUnhandled_cexit_inittermmemcpystrlen
String ID: &$;*
API String ID: 3825114775-510990765
Opcode ID: bb6b8f63c8978df2cb712fb4502542c6b0eedd4902725eabed431cc5bfcc8d57
Instruction ID: c6690ca9af5028b1816dbcb536f5f92eeada5b1d2500bd20a3b756af6859eef5
Opcode Fuzzy Hash: bb6b8f63c8978df2cb712fb4502542c6b0eedd4902725eabed431cc5bfcc8d57
Instruction Fuzzy Hash: 0C416930A2DA82D4F681DB1AE9D93792BB0AF85794F104039D95ECF7AADF2DF4409300

Function 00007FF664863350 Relevance: 21.2, APIs: 9, Strings: 5, Instructions: 206
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00007FF6648633B2
memset.MSVCRT ref: 00007FF664863445
wcscpy.MSVCRT ref: 00007FF66486349D
wcscat.MSVCRT ref: 00007FF6648634A8
wcslen.MSVCRT ref: 00007FF6648634B9
memset.MSVCRT ref: 00007FF6648635D4
wcscpy.MSVCRT ref: 00007FF664863635
wcscat.MSVCRT ref: 00007FF664863640
wcslen.MSVCRT ref: 00007FF664863654

Strings

0, xrefs: 00007FF6648634E6
@, xrefs: 00007FF6648634F1
, xrefs: 00007FF6648636DD
@, xrefs: 00007FF664863698
0, xrefs: 00007FF66486368D

Memory Dump Source

Source File: 00000023.00000002.2220394179.00007FF664861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF664860000, based on PE: true

Associated: 00000023.00000002.2220373982.00007FF664860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000023.00000002.2220410664.00007FF66486B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000023.00000002.2220426642.00007FF66486E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000023.00000002.2220444144.00007FF66486F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000023.00000002.2220678281.00007FF664AEB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000023.00000002.2220703795.00007FF664AED000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000023.00000002.2220728924.00007FF664AF0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ff664860000_svhost.jbxd

Similarity

API ID: memset$wcscatwcscpywcslen
String ID: $0$0$@$@
API String ID: 4263182637-1413854666
Opcode ID: 62e16f804d0a78f42930f5485aab4d55bda2c88156d1efd01dd84db9e24e5fef
Instruction ID: e556d0b47007d4ca236c144977c73e4348a0cd98ef9d27f50dc1514b32ee3fcb
Opcode Fuzzy Hash: 62e16f804d0a78f42930f5485aab4d55bda2c88156d1efd01dd84db9e24e5fef
Instruction Fuzzy Hash: FBB1812191C7C2D5F361CB16E4893AAB7B0FF85348F100239EA889AAA9DF7DD545DB00

Function 00007FF664862690 Relevance: 19.6, APIs: 8, Strings: 3, Instructions: 322
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wcsncmp.MSVCRT ref: 00007FF664862795
memset.MSVCRT ref: 00007FF664862865
wcscpy.MSVCRT ref: 00007FF6648628CE
wcscat.MSVCRT ref: 00007FF6648628D9
wcslen.MSVCRT ref: 00007FF6648628E1
wcslen.MSVCRT ref: 00007FF6648628F6
wcslen.MSVCRT ref: 00007FF66486296D
wcslen.MSVCRT ref: 00007FF6648629E8

Strings

X, xrefs: 00007FF664862B79
0, xrefs: 00007FF66486279A
`, xrefs: 00007FF664862B91

Memory Dump Source

Source File: 00000023.00000002.2220394179.00007FF664861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF664860000, based on PE: true

Associated: 00000023.00000002.2220373982.00007FF664860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000023.00000002.2220410664.00007FF66486B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000023.00000002.2220426642.00007FF66486E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000023.00000002.2220444144.00007FF66486F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000023.00000002.2220678281.00007FF664AEB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000023.00000002.2220703795.00007FF664AED000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000023.00000002.2220728924.00007FF664AF0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ff664860000_svhost.jbxd

Similarity

API ID: wcslen$memsetwcscatwcscpywcsncmp
String ID: 0$X$`
API String ID: 329590056-2527496196
Opcode ID: 7bd2d40a281e62959ce0fd44c16303bd5a4e704b549ab88744f3f2b4b0171fba
Instruction ID: af2bad395803308ccdab2340aa6d213f81aa7ac33ab458dbe532aaefff094f91
Opcode Fuzzy Hash: 7bd2d40a281e62959ce0fd44c16303bd5a4e704b549ab88744f3f2b4b0171fba
Instruction Fuzzy Hash: 36026D22918BC6C5E761CB15E8893AA77A0FB85794F504339DAAC8BBA9DF3CD145C700

Function 00007FF664861BA0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 106
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualQuery.KERNEL32(?,?,?,?,00007FF66486D3B0,00007FF66486D3B0,?,?,00007FF664860000,?,00007FF664861991), ref: 00007FF664861C63
VirtualProtect.KERNEL32(?,?,?,?,00007FF66486D3B0,00007FF66486D3B0,?,?,00007FF664860000,?,00007FF664861991), ref: 00007FF664861CC7
memcpy.MSVCRT ref: 00007FF664861CE0
GetLastError.KERNEL32(?,?,?,?,00007FF66486D3B0,00007FF66486D3B0,?,?,00007FF664860000,?,00007FF664861991), ref: 00007FF664861D23

Strings

Address %p has no image-section, xrefs: 00007FF664861CF4
VirtualQuery failed for %d bytes at address %p, xrefs: 00007FF664861D17
VirtualProtect failed with code 0x%x, xrefs: 00007FF664861D29

Memory Dump Source

Source File: 00000023.00000002.2220394179.00007FF664861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF664860000, based on PE: true

Associated: 00000023.00000002.2220373982.00007FF664860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000023.00000002.2220410664.00007FF66486B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000023.00000002.2220426642.00007FF66486E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000023.00000002.2220444144.00007FF66486F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000023.00000002.2220678281.00007FF664AEB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000023.00000002.2220703795.00007FF664AED000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000023.00000002.2220728924.00007FF664AF0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ff664860000_svhost.jbxd

Similarity

API ID: Virtual$ErrorLastProtectQuerymemcpy
String ID: VirtualProtect failed with code 0x%x$ VirtualQuery failed for %d bytes at address %p$Address %p has no image-section
API String ID: 2595394609-2123141913
Opcode ID: f71d7c17d8efb8792bd36a77065ce856a453be169e7440349e6f230ab35daf72
Instruction ID: 258a1878e1b85c37be53ecf03b5c9e5f2941aac4685fd328b60ca103738be152
Opcode Fuzzy Hash: f71d7c17d8efb8792bd36a77065ce856a453be169e7440349e6f230ab35daf72
Instruction Fuzzy Hash: CF418E61A29A47D1EAA18B47D8C46BC2BB0EF94BD4F55413ACE0DCB7A6DE3CE541C300

Function 00007FF664862104 Relevance: 9.1, APIs: 6, Instructions: 51
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32 ref: 00007FF664862118
TlsGetValue.KERNEL32 ref: 00007FF66486214F
GetLastError.KERNEL32 ref: 00007FF664862154
LeaveCriticalSection.KERNEL32 ref: 00007FF664862212
free.MSVCRT ref: 00007FF664862234
DeleteCriticalSection.KERNEL32 ref: 00007FF66486225D

Memory Dump Source

Source File: 00000023.00000002.2220394179.00007FF664861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF664860000, based on PE: true

Associated: 00000023.00000002.2220373982.00007FF664860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000023.00000002.2220410664.00007FF66486B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000023.00000002.2220426642.00007FF66486E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000023.00000002.2220444144.00007FF66486F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000023.00000002.2220678281.00007FF664AEB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000023.00000002.2220703795.00007FF664AED000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000023.00000002.2220728924.00007FF664AF0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ff664860000_svhost.jbxd

Similarity

API ID: CriticalSection$DeleteEnterErrorLastLeaveValuefree
String ID:
API String ID: 3326252324-0
Opcode ID: 30ded24aebec5e3133582754e9744752ca6952f0633bd4de7137b6fa68abc3ee
Instruction ID: faea1be9e7cb411e4f9dfc94261ba985d912ee09698067f401fefbb5be05002a
Opcode Fuzzy Hash: 30ded24aebec5e3133582754e9744752ca6952f0633bd4de7137b6fa68abc3ee
Instruction Fuzzy Hash: 3721F921A29642D1FA95EB46E9C82B96370BF54B90F640678C91DCF6A8DF2CF8429300

Function 00007FF664861E10 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 77
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

CCG , xrefs: 00007FF664861E27

Memory Dump Source

Source File: 00000023.00000002.2220394179.00007FF664861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF664860000, based on PE: true

Associated: 00000023.00000002.2220373982.00007FF664860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000023.00000002.2220410664.00007FF66486B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000023.00000002.2220426642.00007FF66486E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000023.00000002.2220444144.00007FF66486F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000023.00000002.2220678281.00007FF664AEB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000023.00000002.2220703795.00007FF664AED000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000023.00000002.2220728924.00007FF664AF0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ff664860000_svhost.jbxd

Similarity

API ID:
String ID: CCG
API String ID: 0-1584390748
Opcode ID: aac3cff987aa207af6683fbdf05d97adeeaddfa67e5404ea55e0566f274569b7
Instruction ID: 9ac19a5485777e0caa3cb8154ed0f96ef3d6c783ee1d05f21b0b292cccc43eb2
Opcode Fuzzy Hash: aac3cff987aa207af6683fbdf05d97adeeaddfa67e5404ea55e0566f274569b7
Instruction Fuzzy Hash: 4221AC21F28106C1FAE5865A95D43791AA29F897A4F24853DDE1DCF3DADE6CE8818240

Function 00007FF6648638E0 Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 45
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wcslen.MSVCRT ref: 00007FF6648638F8
wcslen.MSVCRT ref: 00007FF66486396E

Strings

@, xrefs: 00007FF66486392A
0, xrefs: 00007FF664863922

Memory Dump Source

Source File: 00000023.00000002.2220394179.00007FF664861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF664860000, based on PE: true

Associated: 00000023.00000002.2220373982.00007FF664860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000023.00000002.2220410664.00007FF66486B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000023.00000002.2220426642.00007FF66486E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000023.00000002.2220444144.00007FF66486F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000023.00000002.2220678281.00007FF664AEB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000023.00000002.2220703795.00007FF664AED000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000023.00000002.2220728924.00007FF664AF0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ff664860000_svhost.jbxd

Similarity

API ID: wcslen
String ID: 0$@
API String ID: 4088430540-1545510068
Opcode ID: ef7ed66185c074b667720f16183e97d9ab3fb1e6636ca8cac5f9c7ec846e676b
Instruction ID: 95f63fc0c3b338549900181f40d4120c2d3f82e605169d2c915be6a2109c3ee8
Opcode Fuzzy Hash: ef7ed66185c074b667720f16183e97d9ab3fb1e6636ca8cac5f9c7ec846e676b
Instruction Fuzzy Hash: 94116A22528681C2E351DF15F48679AA7B4EFD4394F505128FA8D87BA9EF7DC14ACB00

Function 00007FF664861880 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 138
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF664861247), ref: 00007FF6648619F9

Strings

Unknown pseudo relocation protocol version %d., xrefs: 00007FF664861B8B
Unknown pseudo relocation bit size %d., xrefs: 00007FF664861B7B

Memory Dump Source

Source File: 00000023.00000002.2220394179.00007FF664861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF664860000, based on PE: true

Associated: 00000023.00000002.2220373982.00007FF664860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000023.00000002.2220410664.00007FF66486B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000023.00000002.2220426642.00007FF66486E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000023.00000002.2220444144.00007FF66486F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000023.00000002.2220678281.00007FF664AEB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000023.00000002.2220703795.00007FF664AED000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000023.00000002.2220728924.00007FF664AF0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ff664860000_svhost.jbxd

Similarity

API ID: ProtectVirtual
String ID: Unknown pseudo relocation bit size %d.$ Unknown pseudo relocation protocol version %d.
API String ID: 544645111-395989641
Opcode ID: 6188dcfb9ba409927f7d43b305952e2ca18d87eecd447261aab3e5aaa2c983f9
Instruction ID: 61f8bb5c35569aea3c9dbadad3621257925e9cfe80eea9075070c5d188a2134f
Opcode Fuzzy Hash: 6188dcfb9ba409927f7d43b305952e2ca18d87eecd447261aab3e5aaa2c983f9
Instruction Fuzzy Hash: 5E517121F28556D6EB91CF27D9C47B82BB1AB14BA8F544239D92C8B799CF3CE581C700

Function 00007FF664861800 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 30
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

fprintf.MSVCRT ref: 00007FF66486185A

Strings

Unknown error, xrefs: 00007FF664861824
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF66486184D

Memory Dump Source

Source File: 00000023.00000002.2220394179.00007FF664861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF664860000, based on PE: true

Associated: 00000023.00000002.2220373982.00007FF664860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000023.00000002.2220410664.00007FF66486B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000023.00000002.2220426642.00007FF66486E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000023.00000002.2220444144.00007FF66486F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000023.00000002.2220678281.00007FF664AEB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000023.00000002.2220703795.00007FF664AED000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000023.00000002.2220728924.00007FF664AF0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ff664860000_svhost.jbxd

Similarity

API ID: fprintf
String ID: Unknown error$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-3474627141
Opcode ID: d196cce22733da6664e8edb65b95f02763a682be6f02ab55e526d30871c6c29c
Instruction ID: 4db3c617e13c1d5fc17dc9acd269c32b6b2c320f5417d11defdc8831c391f437
Opcode Fuzzy Hash: d196cce22733da6664e8edb65b95f02763a682be6f02ab55e526d30871c6c29c
Instruction Fuzzy Hash: BEF0F611E28A55C2E291AB26A9810BDA371FB493C5F409239EF4DDB656DF2CF182C700

Function 00007FF66486219E Relevance: 5.0, APIs: 4, Instructions: 34
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32 ref: 00007FF6648621B2
TlsGetValue.KERNEL32 ref: 00007FF6648621EB
GetLastError.KERNEL32 ref: 00007FF6648621F0
LeaveCriticalSection.KERNEL32 ref: 00007FF66486226C

Memory Dump Source

Source File: 00000023.00000002.2220394179.00007FF664861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF664860000, based on PE: true

Associated: 00000023.00000002.2220373982.00007FF664860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000023.00000002.2220410664.00007FF66486B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000023.00000002.2220426642.00007FF66486E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000023.00000002.2220444144.00007FF66486F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000023.00000002.2220678281.00007FF664AEB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000023.00000002.2220703795.00007FF664AED000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000023.00000002.2220728924.00007FF664AF0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ff664860000_svhost.jbxd

Similarity

API ID: CriticalSection$EnterErrorLastLeaveValue
String ID:
API String ID: 682475483-0
Opcode ID: 0d3f40a56fc230f51008cd68afb882d42e2fa9fd450aedc21c851e2dc6c825f8
Instruction ID: 1a774e9d19ba889802ed541646ff8c8abd660bd47df8f61d371d2d1a95214ca3
Opcode Fuzzy Hash: 0d3f40a56fc230f51008cd68afb882d42e2fa9fd450aedc21c851e2dc6c825f8
Instruction Fuzzy Hash: E3011A21A1D642D2F685EB42ADC42B85270BF04B91F544179CA1DCFBA8DF2CF891C200

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report prog.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Change of critical system settings

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Change of critical system settings

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\win32\svhost.exe

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_c14qiz0m.w44.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_l2k44ady.woi.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pya4eufh.ber.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xqt1u0o5.fl2.psm1

C:\Users\user\AppData\Local\Temp\prog.exe

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Statistics

Windows Analysis Report
prog.exe