Edit tour

Windows Analysis Report
WWAddToLocalAdmins.exe

Overview

General Information

Sample name:	WWAddToLocalAdmins.exe
Analysis ID:	1544497
MD5:	cd54d0f310489d1cdcec2692cf9ef236
SHA1:	18b7ade73903e3562d3989515e6a5ebdbb21e058
SHA256:	291b83adc7d7d4bc86ddc24c75a26fd2c4d740a432da8d4cbf2b9e2fc4b517c4
Infos:

Detection

Score:	48
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Found decision node followed by non-executed suspicious APIs

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

WWAddToLocalAdmins.exe (PID: 2408 cmdline: "C:\Users\user\Desktop\WWAddToLocalAdmins.exe" MD5: CD54D0F310489D1CDCEC2692CF9EF236)

conhost.exe (PID: 5384 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cscript.exe (PID: 1848 cmdline: "C:\Windows\system32\CScript.exe" //noLogo C:\Temp\60875D.vbs MD5: CB601B41D4C8074BE8A84AED564A94DC)

cleanup

Sigma Signatures

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: "C:\Windows\system32\CScript.exe" //noLogo C:\Temp\60875D.vbs, CommandLine: "C:\Windows\system32\CScript.exe" //noLogo C:\Temp\60875D.vbs, CommandLine|base64offset|contains: .(, Image: C:\Windows\SysWOW64\cscript.exe, NewProcessName: C:\Windows\SysWOW64\cscript.exe, OriginalFileName: C:\Windows\SysWOW64\cscript.exe, ParentCommandLine: "C:\Users\user\Desktop\WWAddToLocalAdmins.exe", ParentImage: C:\Users\user\Desktop\WWAddToLocalAdmins.exe, ParentProcessId: 2408, ParentProcessName: WWAddToLocalAdmins.exe, ProcessCommandLine: "C:\Windows\system32\CScript.exe" //noLogo C:\Temp\60875D.vbs, ProcessId: 1848, ProcessName: cscript.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: WWAddToLocalAdmins.exe

ReversingLabs: Detection: 16%

Source: WWAddToLocalAdmins.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: C:\Users\user\Desktop\WWAddToLocalAdmins.exe

Code function: 0_2_00401467 FindResourceA,LoadResource,GetVersionExA,SetCurrentDirectoryA,LockResource,SizeofResource,KiUserExceptionDispatcher,LogonUserA,GetTickCount,GetFileAttributesA,SetFileAttributesA,SetFileAttributesA,GetExitCodeProcess,GetExitCodeProcess,Sleep,GetLastError,FormatMessageA,CreateProcessAsUserA,GetExitCodeProcess,Sleep,GetLastError,FormatMessageA,CreateProcessA,GetExitCodeProcess,Sleep,GetLastError,FormatMessageA,GetFileAttributesA,SetFileAttributesA,

0_2_00401467

Source: C:\Users\user\Desktop\WWAddToLocalAdmins.exe	Code function: 0_2_00402757	0_2_00402757
Source: C:\Users\user\Desktop\WWAddToLocalAdmins.exe	Code function: 0_2_00408917	0_2_00408917
Source: C:\Users\user\Desktop\WWAddToLocalAdmins.exe	Code function: 0_2_004037C1	0_2_004037C1
Source: C:\Users\user\Desktop\WWAddToLocalAdmins.exe	Code function: 0_2_00404DDD	0_2_00404DDD
Source: C:\Users\user\Desktop\WWAddToLocalAdmins.exe	Code function: 0_2_00402FBA	0_2_00402FBA

Source: WWAddToLocalAdmins.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: classification engine

Classification label: mal48.winEXE@4/3@0/0

Source: C:\Users\user\Desktop\WWAddToLocalAdmins.exe

0_2_00401467

Source: C:\Users\user\Desktop\WWAddToLocalAdmins.exe

0_2_00401467

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5384:120:WilError_03

Source: C:\Users\user\Desktop\WWAddToLocalAdmins.exe

File created: C:\Temp\60875D.vbs

Jump to behavior

Source: C:\Users\user\Desktop\WWAddToLocalAdmins.exe

Process created: C:\Windows\SysWOW64\cscript.exe "C:\Windows\system32\CScript.exe" //noLogo C:\Temp\60875D.vbs

Source: WWAddToLocalAdmins.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\WWAddToLocalAdmins.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: WWAddToLocalAdmins.exe

ReversingLabs: Detection: 16%

Source: unknown	Process created: C:\Users\user\Desktop\WWAddToLocalAdmins.exe "C:\Users\user\Desktop\WWAddToLocalAdmins.exe"
Source: C:\Users\user\Desktop\WWAddToLocalAdmins.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\WWAddToLocalAdmins.exe	Process created: C:\Windows\SysWOW64\cscript.exe "C:\Windows\system32\CScript.exe" //noLogo C:\Temp\60875D.vbs
Source: C:\Users\user\Desktop\WWAddToLocalAdmins.exe	Process created: C:\Windows\SysWOW64\cscript.exe "C:\Windows\system32\CScript.exe" //noLogo C:\Temp\60875D.vbs	Jump to behavior

Source: C:\Users\user\Desktop\WWAddToLocalAdmins.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cscript.exe	Section loaded: adsnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cscript.exe	Section loaded: activeds.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cscript.exe	Section loaded: adsldpc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cscript.exe	Section loaded: adsldpc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cscript.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cscript.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cscript.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cscript.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cscript.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cscript.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cscript.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cscript.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cscript.exe	Section loaded: dpapi.dll	Jump to behavior

Source: C:\Windows\SysWOW64\cscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B54F3741-5B07-11cf-A4B0-00AA004A55E8}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\WWAddToLocalAdmins.exe

Code function: 0_2_00401C42 LoadLibraryA,GetProcAddress,GetLastError,FreeLibrary,GetLastError,WinExec,

0_2_00401C42

Source: C:\Users\user\Desktop\WWAddToLocalAdmins.exe

Code function: 0_2_004060C0 push eax; ret

0_2_004060EE

Source: C:\Windows\SysWOW64\cscript.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\cscript.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Source: C:\Users\user\Desktop\WWAddToLocalAdmins.exe

Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)

graph_0-6040

Source: cscript.exe, 00000002.00000003.2252805429.00000000031D5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RA
Source: cscript.exe, 00000002.00000003.2252789003.00000000031E6000.00000004.00000020.00020000.00000000.sdmp, cscript.exe, 00000002.00000003.2252770380.00000000031DA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\WWAddToLocalAdmins.exe

Code function: 0_2_00407B44 WriteFile,LdrInitializeThunk,GetLastError,WriteFile,GetLastError,

0_2_00407B44

Source: C:\Users\user\Desktop\WWAddToLocalAdmins.exe

Code function: 0_2_00401C42 LoadLibraryA,GetProcAddress,GetLastError,FreeLibrary,GetLastError,WinExec,

0_2_00401C42

Source: C:\Users\user\Desktop\WWAddToLocalAdmins.exe

0_2_00401467

Source: C:\Users\user\Desktop\WWAddToLocalAdmins.exe

Process created: C:\Windows\SysWOW64\cscript.exe "C:\Windows\system32\CScript.exe" //noLogo C:\Temp\60875D.vbs

Jump to behavior

Source: C:\Users\user\Desktop\WWAddToLocalAdmins.exe

0_2_00401467

Source: C:\Windows\SysWOW64\cscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	2 Valid Accounts	1 Native API	2 Valid Accounts	2 Valid Accounts	2 Valid Accounts	OS Credential Dumping	1 Security Software Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Scripting	2 Access Token Manipulation	2 Access Token Manipulation	LSASS Memory	3 System Information Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 DLL Side-Loading	11 Process Injection	11 Process Injection	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 DLL Side-Loading	1 DLL Side-Loading	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Obfuscated Files or Information	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
WWAddToLocalAdmins.exe	17%	ReversingLabs

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1544497
Start date and time:	2024-10-29 14:07:01 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 4s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	WWAddToLocalAdmins.exe
Detection:	MAL
Classification:	mal48.winEXE@4/3@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 22 Number of non-executed functions: 27
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: WWAddToLocalAdmins.exe

Process:	C:\Users\user\Desktop\WWAddToLocalAdmins.exe
File Type:	ASCII text, with very long lines (2611), with no line terminators
Category:	dropped
Size (bytes):	2611
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:v//////////////////////////////////////////////////////////////X:P
MD5:	7DBE7E58FF8EE7A504F65B2EB0CE7E68
SHA1:	A862D6B97147B26F28634606DA26658CF308BFA7
SHA-256:	5048D4CEE2439D67EE5BB920C974A27EC39CEB6F4401BC509114510D85F735E7
SHA-512:	197B4977BE912125FB343C12755E478ACA4E70EDBFAA7E6F472E42E5058927EC18BAF99AC0D973D9AD3B3103941E48488F8CB86CFFE6CD7E605835C8E41ACA16
Malicious:	false
Reputation:	low
Preview:	ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ

**\Device\Mup\849224*\MAILSLOT\NET\NETLOGON**

Download File

Process:	C:\Windows\SysWOW64\cscript.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	3.545063206984032
Encrypted:	false
SSDEEP:	3:5cl115lll55I2Y1AnWSgll//8lLn:Cl11sGWJltMLn
MD5:	A512AF01F8D61D059A2D7BA9CD9DE5DD
SHA1:	14016E22BA3F95C5B981AB14BC7DDE8E9F2F8BED
SHA-256:	46BA59EFD5A050C1AE1841E73158FC85D997307553936C1412D212FCD52D1C76
SHA-512:	86548C3C9F6134BFB55F08DA330DEBA82AA35DF5F70BCAFDB3009BEB0608E4C787F7116A68B5CA8C3B844D13D4F97637D02B3F51C0087852229B78BCA15C485A
Malicious:	false
Reputation:	low
Preview:	....8.4.9.2.2.4.....\MAILSLOT\NET\GETDCD4937D94.................

**\Device\Mup\SSO*\MAILSLOT\NET\NETLOGON**

Download File

Process:	C:\Windows\SysWOW64\cscript.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	3.7249034414266404
Encrypted:	false
SSDEEP:	3:5cl115lll55I2Y1AnJjUSRPlslLn:Cl11sGm1Ln
MD5:	435F9258D5A586F18107CD87EE1B3B2E
SHA1:	8E1943296338E330E9C8D5D98A93E59025195E37
SHA-256:	D18141FAA09D353285AEB932775DF94EC72D4C3F950C057FDB18CE79414DD622
SHA-512:	9EA0505B09A418E50C4FE345E4F7AECCE5760E6E91C74E8186DF746BC0C1252B31B224E315D6FA5129AAD4B998D06FE45347F6D450A357DF8D273CC3CE3E490A
Malicious:	false
Reputation:	low
Preview:	....8.4.9.2.2.4.....\MAILSLOT\NET\GETDCF5F17330.................

Static File Info

General

File type:	PE32 executable (console) Intel 80386, for MS Windows
Entropy (8bit):	5.6126558170625005
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	WWAddToLocalAdmins.exe
File size:	90'112 bytes
MD5:	cd54d0f310489d1cdcec2692cf9ef236
SHA1:	18b7ade73903e3562d3989515e6a5ebdbb21e058
SHA256:	291b83adc7d7d4bc86ddc24c75a26fd2c4d740a432da8d4cbf2b9e2fc4b517c4
SHA512:	f5b51b42cf57ccc1dce94739e1f727b16c51e0b29c575ea514e338f2fab8c8f022bbceac261aac5d50e0ccafa57f700b9d6339c230d0aa2b83b2476d9e2de1c2
SSDEEP:	1536:Qpgvvf/afJnTsK8W1tBq5eGWclBjleBKBw/C:vvn/6wwt3hclBhX
TLSH:	6F938C13B9D0CA7ED5B04232E8904BF26B79FE31E1695887A7487CC93D32594932739B
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........<..do..do..do..ho..doF.jo..do..no..doF.9o..do..eo..do..oo..do..bo..doRich..do................PE..L...uhNE...................

File Icon


Icon Hash:	49033b1f17170d01

Static PE Info

General

Entrypoint:	0x40689e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:
Time Stamp:	0x454E6875 [Sun Nov 5 22:40:53 2006 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	9ee1751483a7b7cb180cbb92cd46f3cc

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
push FFFFFFFFh
push 0040D950h
push 00409F30h
mov eax, dword ptr fs:[00000000h]
push eax
mov dword ptr fs:[00000000h], esp
sub esp, 10h
push ebx
push esi
push edi
mov dword ptr [ebp-18h], esp
call dword ptr [0040C0C4h]
xor edx, edx
mov dl, ah
mov dword ptr [00412210h], edx
mov ecx, eax
and ecx, 000000FFh
mov dword ptr [0041220Ch], ecx
shl ecx, 08h
add ecx, edx
mov dword ptr [00412208h], ecx
shr eax, 10h
mov dword ptr [00412204h], eax
push 00000000h
call 00007F295D0B7B72h
pop ecx
test eax, eax
jne 00007F295D0B640Ah
push 0000001Ch
call 00007F295D0B649Fh
pop ecx
and dword ptr [ebp-04h], 00000000h
call 00007F295D0B9780h
call dword ptr [0040C0C0h]
mov dword ptr [00413764h], eax
call 00007F295D0B963Eh
mov dword ptr [0041226Ch], eax
call 00007F295D0B93E7h
call 00007F295D0B9329h
call 00007F295D0B5916h
mov eax, dword ptr [00412220h]
mov dword ptr [00412224h], eax
push eax
push dword ptr [00412218h]
push dword ptr [00412214h]
call 00007F295D0B0AB3h
add esp, 0Ch
mov dword ptr [ebp-1Ch], eax
push eax
call 00007F295D0B591Bh
mov eax, dword ptr [ebp-14h]
mov ecx, dword ptr [eax]
mov ecx, dword ptr [ecx]

Rich Headers

Programming Language:

[ C ] VS98 (6.0) SP6 build 8804
[C++] VS98 (6.0) SP6 build 8804
[EXP] VC++ 6.0 SP5 build 8804

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xdd78	0x50	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x14000	0x3fc0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xc000	0x14c	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xafc7	0xb000	5dec2932e9370d540d41369bf4fc5305	False	0.6299493963068182	data	6.635325183892252	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0xc000	0x24c6	0x3000	0d6280f6031e8522806e3c860459b92f	False	0.3296712239583333	data	3.847678121234383	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xf000	0x477c	0x3000	0ea8fb085d66882d27ec5e633512752c	False	0.10400390625	data	1.3123505764154129	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x14000	0x3fc0	0x4000	d8de76a0b21f87ec7f5741ae5ec431c0	False	0.42315673828125	data	5.058362822093357	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0x14178	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	0.28921161825726144
RT_ICON	0x16720	0xca8	Device independent bitmap graphic, 32 x 64 x 24, image size 3200	0.6185185185185185
RT_ICON	0x173c8	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	0.6897163120567376
RT_RCDATA	0x17830	0x320	data	0.0475
RT_RCDATA	0x17b50	0x43e	data	1.0101289134438305
RT_GROUP_ICON	0x17f90	0x30	data	0.9166666666666666

Imports

DLL	Import
KERNEL32.dll	GetWindowsDirectoryA, LockResource, LoadResource, FindResourceA, SizeofResource, CreateProcessA, FormatMessageA, GetLastError, Sleep, GetExitCodeProcess, SetFileAttributesA, GetFileAttributesA, GetTickCount, GetVersionExA, FreeLibrary, MultiByteToWideChar, lstrlenA, GetProcAddress, GetSystemDirectoryA, WinExec, RemoveDirectoryA, DeleteFileA, SetFilePointer, GetFileType, DuplicateHandle, GetCurrentProcess, CreateFileA, CloseHandle, ReadFile, SystemTimeToFileTime, DosDateTimeToFileTime, CreateDirectoryA, SetFileTime, WriteFile, SetEnvironmentVariableA, CompareStringW, GetTempPathA, GetModuleHandleA, SetCurrentDirectoryA, GetCurrentDirectoryA, LoadLibraryA, ExitProcess, TerminateProcess, HeapAlloc, HeapFree, GetCommandLineA, GetVersion, WideCharToMultiByte, LCMapStringA, LCMapStringW, GetFullPathNameA, GetModuleFileNameA, GetEnvironmentVariableA, HeapDestroy, HeapCreate, VirtualFree, VirtualAlloc, HeapReAlloc, GetCPInfo, GetACP, GetOEMCP, UnhandledExceptionFilter, FreeEnvironmentStringsA, FreeEnvironmentStringsW, GetEnvironmentStrings, GetEnvironmentStringsW, SetHandleCount, GetStdHandle, GetStartupInfoA, RtlUnwind, GetStringTypeA, GetStringTypeW, GetDriveTypeA, SetStdHandle, FlushFileBuffers, CompareStringA, SetEndOfFile
USER32.dll	PostQuitMessage
ADVAPI32.dll	LogonUserA, CreateProcessAsUserA

Target ID:	0
Start time:	09:07:53
Start date:	29/10/2024
Path:	C:\Users\user\Desktop\WWAddToLocalAdmins.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\WWAddToLocalAdmins.exe"
Imagebase:	0x400000
File size:	90'112 bytes
MD5 hash:	CD54D0F310489D1CDCEC2692CF9EF236
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	09:07:53
Start date:	29/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	09:07:53
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\cscript.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\CScript.exe" //noLogo C:\Temp\60875D.vbs
Imagebase:	0xc60000
File size:	144'896 bytes
MD5 hash:	CB601B41D4C8074BE8A84AED564A94DC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	11.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	8.7%
Total number of Nodes:	1121
Total number of Limit Nodes:	9

Executed Functions

Function 00401467 Relevance: 74.0, APIs: 27, Strings: 15, Instructions: 475
sleepwindowprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindResourceA.KERNEL32(00000004,0000000A), ref: 0040147D
LoadResource.KERNEL32(00000000), ref: 00401496
GetVersionExA.KERNEL32(?), ref: 004014CC
SetCurrentDirectoryA.KERNELBASE(C:\Temp), ref: 00401508
LockResource.KERNEL32(00000000), ref: 0040150F
SizeofResource.KERNEL32(?), ref: 00401520
LogonUserA.ADVAPI32(00412060,00000000,004120A0,00000002,00000000,004010B3), ref: 004015F3
GetTickCount.KERNEL32 ref: 00401642
GetFileAttributesA.KERNEL32(?), ref: 004016C4
SetFileAttributesA.KERNEL32(?,00000000), ref: 004016D4
SetFileAttributesA.KERNELBASE(?,00000002), ref: 0040172F
GetExitCodeProcess.KERNEL32(?,?), ref: 0040185D
Sleep.KERNEL32(000001F4), ref: 0040187D
GetLastError.KERNEL32(00412060,00000000,004120A0,00000001,00000000,?,00000020,00000000,C:\Temp,?,?), ref: 0040188C
FormatMessageA.KERNEL32(00001200,00000000,00000000,00000400,?,00000104,00000000), ref: 004018AB
CreateProcessAsUserA.ADVAPI32(004010B3,00000000,?,00000000,00000000,00000000,00000020,00000000,C:\Temp,?,?), ref: 004018D9
GetExitCodeProcess.KERNEL32(?,?), ref: 004018EA
Sleep.KERNEL32(000001F4), ref: 0040190E
GetLastError.KERNEL32 ref: 00401916
FormatMessageA.KERNEL32(00001200,00000000,00000000,00000400,?,00000104,00000000), ref: 00401935

Part of subcall function 00401A85: LoadLibraryA.KERNEL32(ADVAPI32.DLL,C:\Temp,00000000,00000000), ref: 00401A93

CreateProcessA.KERNELBASE(00000000,?,00000000,00000000,00000001,00000020,00000000,C:\Temp,?,?), ref: 0040196C
GetExitCodeProcess.KERNELBASE(?,?), ref: 0040197D
Sleep.KERNELBASE(000001F4), ref: 0040199D
GetLastError.KERNEL32 ref: 004019A5
FormatMessageA.KERNEL32(00001200,00000000,00000000,00000400,?,00000104,00000000), ref: 004019C4
GetFileAttributesA.KERNELBASE(?), ref: 00401A24
SetFileAttributesA.KERNELBASE(?,00000000), ref: 00401A34

Strings

%s\%lX%s, xrefs: 00401655
A, xrefs: 00401795
PATH, xrefs: 0040158A
Unknown error, xrefs: 004019E1, 004019E6
C:\Temp, xrefs: 00401503, 00401648, 0040164E, 0040166B, 0040169D, 00401829, 0040195D, 00401A01
Cannot run Script, error: %s, xrefs: 004019E7
Cannot write Script %s, error: %lX, xrefs: 00401A71
Could not create Script %s, xrefs: 0040170D
hsdiafwiuera, xrefs: 00401528
" //noLogo , xrefs: 004015BF
` A, xrefs: 004015D5
WScript.exe, xrefs: 0040156A
Attempted to run %s in %s, xrefs: 00401A03
Could not authenticate user., xrefs: 004015FD
CScript.exe, xrefs: 00401563

Memory Dump Source

Source File: 00000000.00000002.2257332837.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2257310034.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257352202.000000000040C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257369707.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257386782.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257403242.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257420562.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_WWAddToLocalAdmins.jbxd

Similarity

API ID: AttributesFileProcess$Resource$CodeErrorExitFormatLastMessageSleep$CreateLoadUser$CountCurrentDirectoryFindLibraryLockLogonSizeofTickVersion
String ID: " //noLogo $%s\%lX%s$Attempted to run %s in %s$C:\Temp$CScript.exe$Cannot run Script, error: %s$Cannot write Script %s, error: %lX$Could not authenticate user.$Could not create Script %s$PATH$Unknown error$WScript.exe$` A$hsdiafwiuera$ A
API String ID: 3301788104-2447094157
Opcode ID: d375ef8543d51523e7b4bc8a60d577cf8fd657b75d507abcd1158d50155941e2
Instruction ID: e918a6faa2df6874cc42cb38bddcd89b605ddef7fcad1811ab43352918cc14cf
Opcode Fuzzy Hash: d375ef8543d51523e7b4bc8a60d577cf8fd657b75d507abcd1158d50155941e2
Instruction Fuzzy Hash: BFF16F72940618EAEB20EBA1DD89EDF777CEB04744F504177F609F2091DA789A84CF68

Function 00407B44 Relevance: 6.1, APIs: 4, Instructions: 139
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNEL32(?,?,?,00000000,00000000,00000001,?,?), ref: 00407C1C

Memory Dump Source

Source File: 00000000.00000002.2257332837.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2257310034.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257352202.000000000040C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257369707.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257386782.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257403242.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257420562.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_WWAddToLocalAdmins.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 73d54d88d52b8ceae6ecfa69a519c1f4018bb9d428d6ba41dadd3f09c591db4a
Instruction ID: 0e682b5179343e49248b36a4ff5e99b2184ab8e0deec907a994f54ade6ff0f55
Opcode Fuzzy Hash: 73d54d88d52b8ceae6ecfa69a519c1f4018bb9d428d6ba41dadd3f09c591db4a
Instruction Fuzzy Hash: C851E471D08208EFDB11CF68C984AAE7BB0FF45344F20817AE815EB2D1D374AA40DB5A

Function 004010D5 Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 108
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindResourceA.KERNEL32(00000001,0000000A), ref: 004010EA
LoadResource.KERNEL32(00000000), ref: 004010FF
LockResource.KERNEL32(00000000), ref: 0040110E
GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00401134
GetSystemDirectoryA.KERNEL32(C:\Windows\system32,00000104), ref: 00401166
GetTempPathA.KERNEL32(00000104,C:\Temp), ref: 004011C4
SetCurrentDirectoryA.KERNEL32(C:\Temp), ref: 004011E7
GetCurrentDirectoryA.KERNEL32(00000104,C:\Temp), ref: 00401207

Strings

Cannot create temporary folder, please repackage with a specific folder., xrefs: 0040121D
C:\Temp, xrefs: 00401189, 0040118E, 004011A0, 004011A6, 004011C2, 004011E6, 004011F1, 00401201, 00401215
:\Temp, xrefs: 00401147
WWAddToLocalAdmins, xrefs: 0040111A
C:\Windows\system32, xrefs: 00401152, 00401157, 00401165, 0040116E

Memory Dump Source

Source File: 00000000.00000002.2257332837.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2257310034.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257352202.000000000040C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257369707.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257386782.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257403242.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257420562.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_WWAddToLocalAdmins.jbxd

Similarity

API ID: Directory$Resource$Current$FindLoadLockPathSystemTempWindows
String ID: :\Temp$C:\Temp$C:\Windows\system32$Cannot create temporary folder, please repackage with a specific folder.$WWAddToLocalAdmins
API String ID: 780872135-4288872780
Opcode ID: d2bff73f274509ca4c9be196e664c1e963386f4b45b4bd8c7cd39236907d45f8
Instruction ID: 4486252a737e8019c9e66440aacd954fea89cf482f7f45f74bf97b6ae9de44dc
Opcode Fuzzy Hash: d2bff73f274509ca4c9be196e664c1e963386f4b45b4bd8c7cd39236907d45f8
Instruction Fuzzy Hash: 5031D531500104FBE625A7A2AE49FDB36ADDF15745F10013BFA04F51E1EBBC8A45C96D

Function 004051B3 Relevance: 16.0, APIs: 5, Strings: 4, Instructions: 241
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

:, xrefs: 00405347
..\, xrefs: 00405360
\, xrefs: 0040533E
../, xrefs: 00405373

Memory Dump Source

Source File: 00000000.00000002.2257332837.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2257310034.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257352202.000000000040C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257369707.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257386782.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257403242.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257420562.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_WWAddToLocalAdmins.jbxd

Similarity

API ID:
String ID: ../$..\$:$\
API String ID: 0-80979867
Opcode ID: 098fd24160655073bd609300c283440aa3e54eed2f455fa83b508cd1f0f440e7
Instruction ID: 608a6b31dc1b68860e86a3379f04e42f945a3dd6272acdf9cb53df45074aca12
Opcode Fuzzy Hash: 098fd24160655073bd609300c283440aa3e54eed2f455fa83b508cd1f0f440e7
Instruction Fuzzy Hash: 09811072500A04EBDB20AE64D884BAB77A8EF40314F2445BFF994B32D1D7399D858E19

Function 0040B257 Relevance: 13.7, APIs: 9, Instructions: 221
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CompareStringW.KERNEL32(00000000,00000000,0040D960,00000001,0040D960,00000001,00000000,02010C6C,?,0040789C,00000000,?,00000000,?,00000000,00000000), ref: 0040B295
CompareStringA.KERNEL32(00000000,00000000,0040D95C,00000001,0040D95C,00000001), ref: 0040B2B2
CompareStringA.KERNEL32(00000000,?,00000000,00405F90,00000000,00000000,00000000,02010C6C,?,0040789C,00000000,?,00000000,?,00000000,00000000), ref: 0040B310
GetCPInfo.KERNEL32(?,00000000,00000000,02010C6C,?,0040789C,00000000,?,00000000,?,00000000,00000000,00405F90), ref: 0040B361
MultiByteToWideChar.KERNEL32(00000000,00000009,00000000,00000000,00000000,00000000), ref: 0040B3E0
MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,00000000,?,?), ref: 0040B441
MultiByteToWideChar.KERNEL32(00000000,00000009,00000000,?,00000000,00000000), ref: 0040B454
MultiByteToWideChar.KERNEL32(?,00000001,?,?,?,00000000), ref: 0040B4A0
CompareStringW.KERNEL32(00000000,?,00000000,00000000,?,00000000,?,00000000), ref: 0040B4B8

Memory Dump Source

Source File: 00000000.00000002.2257332837.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2257310034.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257352202.000000000040C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257369707.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257386782.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257403242.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257420562.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_WWAddToLocalAdmins.jbxd

Similarity

API ID: ByteCharCompareMultiStringWide$Info
String ID:
API String ID: 1651298574-0
Opcode ID: a5a2720d8c65915fd193b2154b074084265cb018b18010a80a50086f9a861c72
Instruction ID: 09a9e0b578cbae60a846b3132b9d2162a968b3ca070cf25f5d7143338ae21658
Opcode Fuzzy Hash: a5a2720d8c65915fd193b2154b074084265cb018b18010a80a50086f9a861c72
Instruction Fuzzy Hash: 9871AA31900249EFCF229F948C85AAF7BB9EF05714F24413BF915B22A1D3398951DB9C

Function 0040A977 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 230
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(00000001,80000000,?,0000000C,00000001,00000080,00000000,00000001,00000000,00000000), ref: 0040AB23
GetFileType.KERNELBASE(00000000), ref: 0040AB30
CloseHandle.KERNEL32(00000000), ref: 0040AB3B
GetLastError.KERNEL32 ref: 0040AB41

Strings

@, xrefs: 0040AB5A
H, xrefs: 0040AB90

Memory Dump Source

Source File: 00000000.00000002.2257332837.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2257310034.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257352202.000000000040C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257369707.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257386782.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257403242.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257420562.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_WWAddToLocalAdmins.jbxd

Similarity

API ID: File$CloseCreateErrorHandleLastType
String ID: @$H
API String ID: 1809617866-104103126
Opcode ID: dfe4def5e1587e50a71c1d94a33598ac66e38608b3f4543a3698f3156f830137
Instruction ID: b23a8f7d8326d3abc55ea2deab760222e5db5aabd53c33d92e542b4d051bae52
Opcode Fuzzy Hash: dfe4def5e1587e50a71c1d94a33598ac66e38608b3f4543a3698f3156f830137
Instruction Fuzzy Hash: 4381D671A083059BEF208B6889447EF7B60AB01318F25863BE961762D1C7BD4DA5DB4F

Function 0040BE46 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 45
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetCurrentDirectoryA.KERNELBASE(00401DC5), ref: 0040BE52
GetCurrentDirectoryA.KERNEL32(00000105,?), ref: 0040BE68
SetEnvironmentVariableA.KERNEL32(0000003D,?), ref: 0040BEAC
GetLastError.KERNEL32 ref: 0040BEBA

Strings

=, xrefs: 0040BE8C
:, xrefs: 0040BEA8

Memory Dump Source

Source File: 00000000.00000002.2257332837.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2257310034.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257352202.000000000040C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257369707.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257386782.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257403242.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257420562.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_WWAddToLocalAdmins.jbxd

Similarity

API ID: CurrentDirectory$EnvironmentErrorLastVariable
String ID: :$=
API String ID: 373561786-2134709475
Opcode ID: baae35d1e41d6b42a2b544fe7a6bfdcfd7b39894f94f77840b4b72554d617489
Instruction ID: 62db2d784908df531214304bdf886296fe33e598e1e228673604f14bc714f9d5
Opcode Fuzzy Hash: baae35d1e41d6b42a2b544fe7a6bfdcfd7b39894f94f77840b4b72554d617489
Instruction Fuzzy Hash: 7E01D431204148AADF219BB4DC44BDB3BAD8B15344F0441B6EAC8E51C1DB78C6C9C7ED

Function 00409C8D Relevance: 7.6, APIs: 5, Instructions: 143
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStartupInfoA.KERNEL32(?), ref: 00409CE6
GetFileType.KERNEL32(00000800), ref: 00409D8C
GetStdHandle.KERNEL32(-000000F6), ref: 00409DE5
GetFileType.KERNELBASE(00000000), ref: 00409DF3
SetHandleCount.KERNEL32 ref: 00409E2A

Memory Dump Source

Source File: 00000000.00000002.2257332837.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2257310034.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257352202.000000000040C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257369707.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257386782.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257403242.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257420562.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_WWAddToLocalAdmins.jbxd

Similarity

API ID: FileHandleType$CountInfoStartup
String ID:
API String ID: 1710529072-0
Opcode ID: 4015822d68b95a3e461a97c81ee0ab713367f3eb2842ebde40fb01baa5aca4d8
Instruction ID: 5d08c526bcdc084a3a6ede86523a1377e4bf278c30fd4f585b16d6e8718200cd
Opcode Fuzzy Hash: 4015822d68b95a3e461a97c81ee0ab713367f3eb2842ebde40fb01baa5aca4d8
Instruction Fuzzy Hash: 885124715482408BD7218F28CD84BA67BA0AF51324F19833EE4A6EB3E3D7789C55C79D

Function 00401000 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 69
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(00000000,?,?,00406952,02010C70), ref: 00401004

Strings

Corrupt image file!, xrefs: 004010A1
A, xrefs: 00401016
/DIAG, xrefs: 0040107B

Memory Dump Source

Source File: 00000000.00000002.2257332837.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2257310034.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257352202.000000000040C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257369707.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257386782.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257403242.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257420562.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_WWAddToLocalAdmins.jbxd

Similarity

API ID: HandleModule
String ID: /DIAG$Corrupt image file!$ A
API String ID: 4139908857-2500719215
Opcode ID: a6714358d863857f0070df51bbfdf8cad990ca1bce6a0dd81486542c388b0182
Instruction ID: 7b2249f0f974e851b4cdf7c302836ab6fa53be86b1d261b2a57aa044d99181cd
Opcode Fuzzy Hash: a6714358d863857f0070df51bbfdf8cad990ca1bce6a0dd81486542c388b0182
Instruction Fuzzy Hash: 8911C632504341A9F635BB229C86F7B23A8DF41728F60003FF884B56D2DB7D58C1992E

Function 00405E96 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 49
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(00401A85,C:\Temp,00405E81,00000000,00000000,00000000,00401A85,00000001), ref: 00405EA6
TerminateProcess.KERNEL32(00000000), ref: 00405EAD
ExitProcess.KERNEL32 ref: 00405F27

Strings

C:\Temp, xrefs: 00405E96

Memory Dump Source

Source File: 00000000.00000002.2257332837.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2257310034.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257352202.000000000040C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257369707.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257386782.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257403242.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257420562.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_WWAddToLocalAdmins.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID: C:\Temp
API String ID: 1703294689-984105843
Opcode ID: 0cb5bf8f8a793ebc4945a21551dd41bf13c9db70fb5804bb92f44856e766ced3
Instruction ID: 0d8711f069f6ad519bdffe1f7ca9d3ba300f9ed896b8a6131d8e13c5b37178e4
Opcode Fuzzy Hash: 0cb5bf8f8a793ebc4945a21551dd41bf13c9db70fb5804bb92f44856e766ced3
Instruction Fuzzy Hash: 8C0180B1604A41DBD6209F69FE89A5B7BA4FB84314B10813BE480B21E1DB796A44CF6D

Function 0040689E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersion.KERNEL32 ref: 004068C4

Part of subcall function 00408069: HeapCreate.KERNELBASE(00000000,00001000,00000000,004068FC,00000000), ref: 0040807A
Part of subcall function 00408069: HeapDestroy.KERNEL32 ref: 004080B9

GetCommandLineA.KERNEL32 ref: 00406912

Part of subcall function 004069A2: ExitProcess.KERNEL32 ref: 004069BF

Strings

$/, xrefs: 0040692C

Memory Dump Source

Source File: 00000000.00000002.2257332837.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2257310034.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257352202.000000000040C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257369707.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257386782.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257403242.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257420562.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_WWAddToLocalAdmins.jbxd

Similarity

API ID: Heap$CommandCreateDestroyExitLineProcessVersion
String ID: $/
API String ID: 1387771204-3188213859
Opcode ID: 9288b119891a44d6506e9c13f41e88025181ea9bb74fdbb80cdd9ca44a034c24
Instruction ID: 2efe7ca91c5146f39dc8c46c34f82c9a2b89eda9845153d788af090991f350dd
Opcode Fuzzy Hash: 9288b119891a44d6506e9c13f41e88025181ea9bb74fdbb80cdd9ca44a034c24
Instruction Fuzzy Hash: A41160B19406059FE708AFA6DE46B6977A4EB44304F10817EF511E72E2DA7C4910CB5D

Function 00401F25 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileA.KERNELBASE(00401A46,00000000,00401A46,?), ref: 00401F72

Strings

C:\Temp, xrefs: 00401F4E
r+b, xrefs: 00401F26

Memory Dump Source

Source File: 00000000.00000002.2257332837.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2257310034.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257352202.000000000040C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257369707.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257386782.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257403242.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257420562.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_WWAddToLocalAdmins.jbxd

Similarity

API ID: DeleteFile
String ID: C:\Temp$r+b
API String ID: 4033686569-657028590
Opcode ID: d5485071e094d885dc6be93397eaf6692831278514cbcbb92fff3306e7c6b516
Instruction ID: 70a1ea3c8e72db8569322dda9569e27dfc438ed77bd5eea858534cc8199ba7f3
Opcode Fuzzy Hash: d5485071e094d885dc6be93397eaf6692831278514cbcbb92fff3306e7c6b516
Instruction Fuzzy Hash: 12E0ED3224861235DA21326AAC06B9F6A49CF82778F21017FF408B92E2DB7D884240DD

Function 00405C69 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 29
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetCurrentDirectoryA.KERNELBASE(?,?,0040127D,-00000040,00000000), ref: 00405C8A
GetLastError.KERNEL32(?,0040127D,-00000040,00000000), ref: 00405C98

Strings

:, xrefs: 00405C86

Memory Dump Source

Source File: 00000000.00000002.2257332837.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2257310034.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257352202.000000000040C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257369707.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257386782.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257403242.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257420562.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_WWAddToLocalAdmins.jbxd

Similarity

API ID: CurrentDirectoryErrorLast
String ID: :
API String ID: 152501406-336475711
Opcode ID: d3d322219eed68f5ba2c8ea391bc9d1e865504202b0f248afd6a35fdb85c0b55
Instruction ID: 5883ee4a9f5f26ae96e6c7cee46c698dbc8f21274b4e510c5e90d3e2e25b049b
Opcode Fuzzy Hash: d3d322219eed68f5ba2c8ea391bc9d1e865504202b0f248afd6a35fdb85c0b55
Instruction Fuzzy Hash: 53F0A7711086499EFB009FA4D94878A3F98EB0135CF108176F56DDE2C1D778C5548F59

Function 0040A1BA Relevance: 3.1, APIs: 2, Instructions: 51
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFilePointer.KERNELBASE(00000000,00407BA2,00000000,00401227,00000000,00401227,?,00407BA2,00401227,00000000,00000002,00000001,?,?), ref: 0040A209
GetLastError.KERNEL32 ref: 0040A216

Memory Dump Source

Source File: 00000000.00000002.2257332837.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2257310034.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257352202.000000000040C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257369707.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257386782.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257403242.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257420562.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_WWAddToLocalAdmins.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: af44716e2dbff77b9c48b1bcfb5e7fca248be1cd744590c1be24b44883aca208
Instruction ID: 8e06b0b98e8b5163bc1f639ae4622e3fced4bf3c930368a3184e95425e106e84
Opcode Fuzzy Hash: af44716e2dbff77b9c48b1bcfb5e7fca248be1cd744590c1be24b44883aca208
Instruction Fuzzy Hash: 0A1104325083019BC710DBB89D88A563790AB45338F21477EE532E73E2D77AC865D70A

Function 00408069 Relevance: 3.0, APIs: 2, Instructions: 30
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HeapCreate.KERNELBASE(00000000,00001000,00000000,004068FC,00000000), ref: 0040807A

Part of subcall function 00407F21: GetVersionExA.KERNEL32 ref: 00407F40

HeapDestroy.KERNEL32 ref: 004080B9

Part of subcall function 004080C6: HeapAlloc.KERNEL32(00000000,00000140,004080A2,000003F8), ref: 004080D3

Memory Dump Source

Source File: 00000000.00000002.2257332837.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2257310034.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257352202.000000000040C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257369707.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257386782.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257403242.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257420562.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_WWAddToLocalAdmins.jbxd

Similarity

API ID: Heap$AllocCreateDestroyVersion
String ID:
API String ID: 2507506473-0
Opcode ID: 006f06b5b64bdd850d6f085a5395eab8e7166bab1cd7ec123ba1ca1db08b8992
Instruction ID: 682c225415af963ada1f81d6e2be094aa027d906d8257a4d767d7ebd7d6c45c6
Opcode Fuzzy Hash: 006f06b5b64bdd850d6f085a5395eab8e7166bab1cd7ec123ba1ca1db08b8992
Instruction Fuzzy Hash: 87F0ED30A55202DAEB302BB09F4A36A35D4DB10385F11843FF181E91E0EFB88484E50E

Function 00405C25 Relevance: 3.0, APIs: 2, Instructions: 19COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNELBASE(00000000,00401D36,00401174,00000000), ref: 00405C29
GetLastError.KERNEL32 ref: 00405C34

Memory Dump Source

Source File: 00000000.00000002.2257332837.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2257310034.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257352202.000000000040C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257369707.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257386782.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257403242.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257420562.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_WWAddToLocalAdmins.jbxd

Similarity

API ID: AttributesErrorFileLast
String ID:
API String ID: 1799206407-0
Opcode ID: ea93e283f85052d32674e5dc0906a6a0042ec20e4dffa219ed6709de4ef9c1f1
Instruction ID: 0514cc873e2fec5dac6a091e39a699ec2d92ff5bbeaf9aef268bcb6818ec584c
Opcode Fuzzy Hash: ea93e283f85052d32674e5dc0906a6a0042ec20e4dffa219ed6709de4ef9c1f1
Instruction Fuzzy Hash: A9E04F7000870096E70457709E4DB473A51AF41338F14876AE575A11E0C77885D4AF09

Function 004060EF Relevance: 3.0, APIs: 2, Instructions: 17COMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNELBASE(00000000,00000000,00401DD7,?,?,?,C:\Windows\system32), ref: 004060F5
GetLastError.KERNEL32(?,?,C:\Windows\system32), ref: 004060FF

Memory Dump Source

Source File: 00000000.00000002.2257332837.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2257310034.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257352202.000000000040C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257369707.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257386782.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257403242.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257420562.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_WWAddToLocalAdmins.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID:
API String ID: 1375471231-0
Opcode ID: 3d3e036ac298863ee8e6720c251a863e352e7cd4734cd597915e2c11bfce4341
Instruction ID: 3af6577d5b6731aa80c13da9b4ace1ec58e4f2b2cf44c323c5b5eddee6668fb8
Opcode Fuzzy Hash: 3d3e036ac298863ee8e6720c251a863e352e7cd4734cd597915e2c11bfce4341
Instruction Fuzzy Hash: 01D0A930200202D2EE002B709D0870B36945B40321F658B3AB01AF80E2EB78C8A0A419

Function 00407959 Relevance: 2.6, APIs: 2, Instructions: 66COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(00000000,00000100,00000000,?,00000000,0040AC0C,00000000), ref: 004079BE
GetLastError.KERNEL32(?,00000000,0040AC0C,00000000), ref: 004079C8

Memory Dump Source

Source File: 00000000.00000002.2257332837.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2257310034.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257352202.000000000040C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257369707.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257386782.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257403242.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257420562.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_WWAddToLocalAdmins.jbxd

Similarity

API ID: CloseErrorHandleLast
String ID:
API String ID: 918212764-0
Opcode ID: 043498f00bb74f7825b5244d18491a8620e66036629b85e54749b1a3d49db123
Instruction ID: c2fc600a40ef96b2a81b3450e8cc045333a5a44d02f120eab54ed0736bee021b
Opcode Fuzzy Hash: 043498f00bb74f7825b5244d18491a8620e66036629b85e54749b1a3d49db123
Instruction Fuzzy Hash: 17112B73E0C2049AE210A7A5ED8476A3354EB42729F15423FE410BB1D1DABCAC55965F

Function 004096D1 Relevance: 1.6, APIs: 1, Instructions: 89COMMON

Download Yara Rule

APIs

UnhandledExceptionFilter.KERNELBASE(?,?,?,0040696F,?,?,00000000), ref: 00409809

Memory Dump Source

Source File: 00000000.00000002.2257332837.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2257310034.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257352202.000000000040C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257369707.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257386782.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257403242.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257420562.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_WWAddToLocalAdmins.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: f14d06d052ffa44639dde9d2ebd4d0a9ab52a2d53f5ebbb3f52358ac368c2f99
Instruction ID: 572fc96877acae4735ca67d2067cf727a4c456a594ad748f908c0c510c717bbe
Opcode Fuzzy Hash: f14d06d052ffa44639dde9d2ebd4d0a9ab52a2d53f5ebbb3f52358ac368c2f99
Instruction Fuzzy Hash: 31318F36525101DEDB148F10E984BA57760B755324F25C13BDA46A73F2EF789C818B4E

Function 00406355 Relevance: 1.6, APIs: 1, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,?), ref: 004063C9

Memory Dump Source

Source File: 00000000.00000002.2257332837.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2257310034.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257352202.000000000040C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257369707.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257386782.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257403242.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257420562.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_WWAddToLocalAdmins.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 57e44b5f676807dc4bde4be0ea4a5a171c5a6852537fab65597e738d7f7e81a1
Instruction ID: c3e458dfc669340cf7b6ac2915cd0f61fe2f611aa44ca84ac91d6f4c9fd4709a
Opcode Fuzzy Hash: 57e44b5f676807dc4bde4be0ea4a5a171c5a6852537fab65597e738d7f7e81a1
Instruction Fuzzy Hash: A0110036400924A6DB2196289D41A9B7225DB813B0F23813BFC57FB3E0CB78EC7196CD

Function 00406532 Relevance: 1.5, APIs: 1, Instructions: 46memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,?,?,00406516,000000E0,00406503,?,00409C9E,00000100), ref: 0040659E

Memory Dump Source

Source File: 00000000.00000002.2257332837.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2257310034.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257352202.000000000040C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257369707.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257386782.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257403242.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257420562.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_WWAddToLocalAdmins.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 7fb311165520402941655bd1e6b9a1f181fae7d3338fd8a2f7e2312952eeed54
Instruction ID: cf6252139c9e4325123a9ceec45151b7cc1f9ab362881082ac388c0de40c3901
Opcode Fuzzy Hash: 7fb311165520402941655bd1e6b9a1f181fae7d3338fd8a2f7e2312952eeed54
Instruction Fuzzy Hash: 51F0D132905520BADA20A728BD407CB2355DB04360F170633FC56FB2E8D778ECB1868D

Function 004010B6 Relevance: 1.5, APIs: 1, Instructions: 8windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0040122C: FindResourceA.KERNEL32(00000002,0000000A), ref: 00401241
Part of subcall function 0040122C: LoadResource.KERNEL32(00000000), ref: 00401254

Part of subcall function 00401334: FindResourceA.KERNEL32(00000003,0000000A), ref: 00401349
Part of subcall function 00401334: LoadResource.KERNEL32(00000000), ref: 0040135C

Part of subcall function 00401467: FindResourceA.KERNEL32(00000004,0000000A), ref: 0040147D
Part of subcall function 00401467: LoadResource.KERNEL32(00000000), ref: 00401496

Part of subcall function 00401DEB: SetCurrentDirectoryA.KERNEL32(C:\Temp,?,?,004010CA,004010B3,00406952,02010C70), ref: 00401E1D
Part of subcall function 00401DEB: RemoveDirectoryA.KERNEL32(C:\Temp,?,004010CA,004010B3,00406952,02010C70), ref: 00401E64

PostQuitMessage.USER32(00000000), ref: 004010CC

Memory Dump Source

Source File: 00000000.00000002.2257332837.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2257310034.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257352202.000000000040C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257369707.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257386782.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257403242.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257420562.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_WWAddToLocalAdmins.jbxd

Similarity

API ID: Resource$FindLoad$Directory$CurrentMessagePostQuitRemove
String ID:
API String ID: 2424967511-0
Opcode ID: 9b0974e1c05ca15360a731211924880ebeaa8ba6a4e103af36bb5ef6d68bb730
Instruction ID: a19378402931b92c3d18c6f3c2988d76f50037f8c0c77d8dc61273735249f48a
Opcode Fuzzy Hash: 9b0974e1c05ca15360a731211924880ebeaa8ba6a4e103af36bb5ef6d68bb730
Instruction Fuzzy Hash: 11B09920A02000AAE2003BF22A8B38E20A00F0A30FF0008BFB000F80F3AE382000082F

Non-executed Functions

Function 00401C42 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 73libraryprocessloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(00000000,00000000,00000000), ref: 00401C82
GetProcAddress.KERNEL32(00000000,DllUnregisterServer), ref: 00401C90
GetLastError.KERNEL32 ref: 00401C9E
FreeLibrary.KERNEL32(00000000), ref: 00401CAE
GetLastError.KERNEL32 ref: 00401CB6
WinExec.KERNEL32(?,00000000), ref: 00401D05

Strings

regsvr32 scrobj.dll /n /i:"file://, xrefs: 00401CD0
DllRegisterServer, xrefs: 00401C7C, 00401C8E
.wsc, xrefs: 00401C4F
DllUnregisterServer, xrefs: 00401C75
.WSC, xrefs: 00401C60

Memory Dump Source

Source File: 00000000.00000002.2257332837.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2257310034.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257352202.000000000040C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257369707.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257386782.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257403242.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257420562.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_WWAddToLocalAdmins.jbxd

Similarity

API ID: ErrorLastLibrary$AddressExecFreeLoadProc
String ID: .WSC$.wsc$DllRegisterServer$DllUnregisterServer$regsvr32 scrobj.dll /n /i:"file://
API String ID: 390581759-2585386122
Opcode ID: fcfaf696a8d7f8cdc508c1cbc23b8d9ad9a8760556e8c3ee3c71b0d58d73487b
Instruction ID: 5afef6b34bda9e0d23eba7401d9adee522cc5dee57257b0d7833439319c2e802
Opcode Fuzzy Hash: fcfaf696a8d7f8cdc508c1cbc23b8d9ad9a8760556e8c3ee3c71b0d58d73487b
Instruction Fuzzy Hash: 851100B6944510EBDB20B7F1AC4DA8B33AC8F44324B60057BF904F31D1EA7CD9498AAC

Function 00404DDD Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 265COMMON

Download Yara Rule

Strings

7U@, xrefs: 00404F54

Memory Dump Source

Source File: 00000000.00000002.2257332837.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2257310034.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257352202.000000000040C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257369707.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257386782.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257403242.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257420562.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_WWAddToLocalAdmins.jbxd

Similarity

API ID:
String ID: 7U@
API String ID: 0-1869988486
Opcode ID: d635e9eeebc94a6c803d08760003b16c3dcb35be832c8a412f436ccb6714deb4
Instruction ID: bcafebdf1a2d875a350eb63c55a0fe1a5094f2e8c86803f19a1a4c443a4327bb
Opcode Fuzzy Hash: d635e9eeebc94a6c803d08760003b16c3dcb35be832c8a412f436ccb6714deb4
Instruction Fuzzy Hash: 74A1C3B1904644AFCB25CFA8C441BDBBBF4EF44304F14857FE599AB282C779A544CB98

Function 00402757 Relevance: .7, Instructions: 681COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2257332837.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2257310034.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257352202.000000000040C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257369707.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257386782.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257403242.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257420562.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_WWAddToLocalAdmins.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43c706d9e41836376d7e933e65d268e2c2d93b9f3cd133d49fa2d7fc833ae050
Instruction ID: bc919f1cfe57e20b710b131fa944e87a88d5cb6ab0d6f0fdfc3ffe4fa386c13e
Opcode Fuzzy Hash: 43c706d9e41836376d7e933e65d268e2c2d93b9f3cd133d49fa2d7fc833ae050
Instruction Fuzzy Hash: 85520F75900606EFCB14CF69C684AAABBF1FF48314F10852EE85AA7780D378EA55DF44

Function 00402FBA Relevance: .3, Instructions: 333COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2257332837.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2257310034.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257352202.000000000040C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257369707.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257386782.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257403242.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257420562.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_WWAddToLocalAdmins.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd456d0a2ac21f22572992089a0a9e31470b378cf8197db732d88eec0fe28859
Instruction ID: af894359beaddcc2ce52179a952eaaab2aa5b99a09cec0b42aec96077bba2180
Opcode Fuzzy Hash: bd456d0a2ac21f22572992089a0a9e31470b378cf8197db732d88eec0fe28859
Instruction Fuzzy Hash: D4D11571A002199FDF18CFA9D8805EDBBB5FF88315F25827AD819B7391D734AA42CB44

Function 00408917 Relevance: .3, Instructions: 259COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2257332837.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2257310034.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257352202.000000000040C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257369707.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257386782.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257403242.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257420562.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_WWAddToLocalAdmins.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc60ecf50bd115ca0c6ea2745a91e2bccda0b72c85d336beea95e2ba67d1c3a9
Instruction ID: 201f1171485459bda58d5e11fb484342f72e17f8d6f8643914d83c2c9fdacb85
Opcode Fuzzy Hash: fc60ecf50bd115ca0c6ea2745a91e2bccda0b72c85d336beea95e2ba67d1c3a9
Instruction Fuzzy Hash: EAB17F75A0020ADFDB15CF04C6D0AA9BBA1BF58314F14C1AED8596B782DB35FA42CF94

Function 004037C1 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2257332837.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2257310034.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257352202.000000000040C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257369707.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257386782.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257403242.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257420562.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_WWAddToLocalAdmins.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ed0f164fed82f9ac8f52ec8c8882a6a4305a3065b2b61dc034e22c4e9027543
Instruction ID: 824e0285a62d5f1bcd73da554a8541ea15a1c03f1a81e75757b060958326733f
Opcode Fuzzy Hash: 8ed0f164fed82f9ac8f52ec8c8882a6a4305a3065b2b61dc034e22c4e9027543
Instruction Fuzzy Hash: 84317C33E285B607C364CEBA8C40026F7D1AB8A13674A87B5EDD8F7251E138ED59C6D4

Function 00401A85 Relevance: 28.2, APIs: 13, Strings: 3, Instructions: 180libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(ADVAPI32.DLL,C:\Temp,00000000,00000000), ref: 00401A93
GetProcAddress.KERNEL32(00000000,CreateProcessWithLogonW), ref: 00401AB0

Strings

ADVAPI32.DLL, xrefs: 00401A8E
C:\Temp, xrefs: 00401A8D
CreateProcessWithLogonW, xrefs: 00401AAA

Memory Dump Source

Source File: 00000000.00000002.2257332837.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2257310034.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257352202.000000000040C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257369707.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257386782.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257403242.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257420562.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_WWAddToLocalAdmins.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: ADVAPI32.DLL$C:\Temp$CreateProcessWithLogonW
API String ID: 2574300362-574701402
Opcode ID: b145b83ac4a3aef92451d4112d5cd12f11878ab6b496ddcc8232cf482edba3c3
Instruction ID: b6ada4a75b711fb35fc7f87ae417241eade80d1bc67f75d3df4f252d30f9eefb
Opcode Fuzzy Hash: b145b83ac4a3aef92451d4112d5cd12f11878ab6b496ddcc8232cf482edba3c3
Instruction Fuzzy Hash: 20516871940219FFCF119FA5CC458DE7FB4FF09370B204626F825A22A0D3398A61DBA9

Function 00409B5B Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 132COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,00406922), ref: 00409B76
GetEnvironmentStrings.KERNEL32(?,?,?,?,?,?,00406922), ref: 00409B8A
GetEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,00406922), ref: 00409BB6
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000000,00000000,00000000,?,?,?,?,?,?,00406922), ref: 00409BEE
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,?,?,?,?,?,?,00406922), ref: 00409C10
FreeEnvironmentStringsW.KERNEL32(00000000,?,?,?,?,?,?,00406922), ref: 00409C29
GetEnvironmentStrings.KERNEL32(?,?,?,?,?,?,00406922), ref: 00409C3C
FreeEnvironmentStringsA.KERNEL32(00000000), ref: 00409C7A

Strings

"i@, xrefs: 00409C24, 00409C16

Memory Dump Source

Source File: 00000000.00000002.2257332837.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2257310034.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257352202.000000000040C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257369707.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257386782.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257403242.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257420562.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_WWAddToLocalAdmins.jbxd

Similarity

API ID: EnvironmentStrings$ByteCharFreeMultiWide
String ID: "i@
API String ID: 1823725401-107731682
Opcode ID: d89070a92739fc2796e77cb5414c833da9f757392d7e30c84c35e933de504e15
Instruction ID: 94e1259f872e4914e771df492c50690a73832ef06b9b9c7de2987bfeef47e925
Opcode Fuzzy Hash: d89070a92739fc2796e77cb5414c833da9f757392d7e30c84c35e933de504e15
Instruction Fuzzy Hash: 753124B290C2655FF7203BB85CC483BB6DCF689314715053BF952E3283E6385C4186AD

Function 0040B1C5 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 50libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(user32.dll,?,00000000,?,0040A165,?,Microsoft Visual C++ Runtime Library,00012010,?,0040DC88,?,0040DCD8,?,?,?,Runtime Error!Program: ), ref: 0040B1D7
GetProcAddress.KERNEL32(00000000,MessageBoxA), ref: 0040B1EF
GetProcAddress.KERNEL32(00000000,GetActiveWindow), ref: 0040B200
GetProcAddress.KERNEL32(00000000,GetLastActivePopup), ref: 0040B20D

Strings

user32.dll, xrefs: 0040B1D2
GetLastActivePopup, xrefs: 0040B202
MessageBoxA, xrefs: 0040B1E9
GetActiveWindow, xrefs: 0040B1FA

Memory Dump Source

Source File: 00000000.00000002.2257332837.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2257310034.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257352202.000000000040C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257369707.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257386782.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257403242.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257420562.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_WWAddToLocalAdmins.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: GetActiveWindow$GetLastActivePopup$MessageBoxA$user32.dll
API String ID: 2238633743-4044615076
Opcode ID: 6dfa0b7cc4f67fe8872337b4a380bae8fede927f76dd41b834cf8e45c9ce6dde
Instruction ID: 05fbd66abe9ce7c237790b4204e0f1ef7c21c0d2e14d305025a9e371f713d731
Opcode Fuzzy Hash: 6dfa0b7cc4f67fe8872337b4a380bae8fede927f76dd41b834cf8e45c9ce6dde
Instruction Fuzzy Hash: F3017531A403099FD7109FF49D84A9B7AE8EE59BC0704447FB914E22A0D7FC88559BAD

Function 00406CC5 Relevance: 13.7, APIs: 9, Instructions: 177COMMON

Download Yara Rule

APIs

LCMapStringW.KERNEL32(00000000,00000100,0040D960,00000001,00000000,00000000,00000103,00000001,?,?,0040AD77,00200020,00000000,?,?,00000000), ref: 00406D07
LCMapStringA.KERNEL32(00000000,00000100,0040D95C,00000001,00000000,00000000,?,0040AD77,00200020,00000000,?,?,00000000,00000001), ref: 00406D23
LCMapStringA.KERNEL32(?,?,00000000,00200020,0040AD77,?,00000103,00000001,?,?,0040AD77,00200020,00000000,?,?,00000000), ref: 00406D6C
MultiByteToWideChar.KERNEL32(?,00000002,00000000,00200020,00000000,00000000,00000103,00000001,?,?,0040AD77,00200020,00000000,?,?,00000000), ref: 00406DA4
MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,00200020,?,00000000,?,0040AD77,00200020,00000000), ref: 00406DFC
LCMapStringW.KERNEL32(?,?,00000000,00000000,00000000,00000000,?,0040AD77,00200020,00000000), ref: 00406E12
LCMapStringW.KERNEL32(?,?,0040AD77,00000000,0040AD77,?,?,0040AD77,00200020,00000000), ref: 00406E45
LCMapStringW.KERNEL32(?,?,?,?,?,00000000,?,0040AD77,00200020,00000000), ref: 00406EAD

Memory Dump Source

Source File: 00000000.00000002.2257332837.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2257310034.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257352202.000000000040C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257369707.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257386782.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257403242.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257420562.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_WWAddToLocalAdmins.jbxd

Similarity

API ID: String$ByteCharMultiWide
String ID:
API String ID: 352835431-0
Opcode ID: 9e92d4d4351f2e05af2cb40de8b6b938a16e2c8d0823cb613cc3cdd9841c90e0
Instruction ID: af85f41c90454e270544ce4d013514648539a93f9ccd7443570df16a1398394f
Opcode Fuzzy Hash: 9e92d4d4351f2e05af2cb40de8b6b938a16e2c8d0823cb613cc3cdd9841c90e0
Instruction Fuzzy Hash: 5C518E31900209EFCF219F94CD45ADF7FB5FB48B54F11812AF916B22A0D3398921DBA8

Function 00401334 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 104COMMON

Download Yara Rule

APIs

FindResourceA.KERNEL32(00000003,0000000A), ref: 00401349
LoadResource.KERNEL32(00000000), ref: 0040135C
SetCurrentDirectoryA.KERNEL32(C:\Temp), ref: 0040138C
LockResource.KERNEL32(00000000), ref: 00401393
SizeofResource.KERNEL32(00000000), ref: 004013A2

Strings

hsdiafwiuera, xrefs: 004013AA
C:\Temp, xrefs: 00401387

Memory Dump Source

Source File: 00000000.00000002.2257332837.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2257310034.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257352202.000000000040C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257369707.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257386782.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257403242.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257420562.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_WWAddToLocalAdmins.jbxd

Similarity

API ID: Resource$CurrentDirectoryFindLoadLockSizeof
String ID: C:\Temp$hsdiafwiuera
API String ID: 1796454961-707658950
Opcode ID: de88e136f147ee5bc5e434993557e715239736817a89eba247ada6407f615412
Instruction ID: 29e710c566d4959c2791851d6b61095080c5a340387e2b2aae7574b25f24c880
Opcode Fuzzy Hash: de88e136f147ee5bc5e434993557e715239736817a89eba247ada6407f615412
Instruction Fuzzy Hash: 4031F732900610BAE722AB61DD4AFDF366CDB45754F10417BF900F21E1DA789B41CA6C

Function 0040A041 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 100fileCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,00000000), ref: 0040A0AE
GetStdHandle.KERNEL32(000000F4,0040DC88,00000000,?,00000000,00000000), ref: 0040A184
WriteFile.KERNEL32(00000000), ref: 0040A18B

Strings

<program name unknown>, xrefs: 0040A0BE
..., xrefs: 0040A100
Microsoft Visual C++ Runtime Library, xrefs: 0040A15A
Runtime Error!Program: , xrefs: 0040A114

Memory Dump Source

Source File: 00000000.00000002.2257332837.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2257310034.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257352202.000000000040C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257369707.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257386782.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257403242.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257420562.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_WWAddToLocalAdmins.jbxd

Similarity

API ID: File$HandleModuleNameWrite
String ID: ...$<program name unknown>$Microsoft Visual C++ Runtime Library$Runtime Error!Program:
API String ID: 3784150691-4022980321
Opcode ID: 0c5ebb539f968db322c75e07349606a0b90fc57d7a54e2a32721a8344c2796e1
Instruction ID: 8244f97efe4f3eb91ac7641534c6eaeae898094714453c5effc5a3d2ddc1360e
Opcode Fuzzy Hash: 0c5ebb539f968db322c75e07349606a0b90fc57d7a54e2a32721a8344c2796e1
Instruction Fuzzy Hash: B731A272A40208AEEF20EB60CD86FDB336CEB45304F50057BF545F61D0D678E994CA5A

Function 0040122C Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 93COMMON

Download Yara Rule

APIs

FindResourceA.KERNEL32(00000002,0000000A), ref: 00401241
LoadResource.KERNEL32(00000000), ref: 00401254
SetCurrentDirectoryA.KERNEL32(C:\Windows\system32), ref: 00401284
LockResource.KERNEL32(00000000), ref: 0040128B
SizeofResource.KERNEL32(00000000), ref: 0040129A

Strings

hsdiafwiuera, xrefs: 004012A2
C:\Windows\system32, xrefs: 0040127F

Memory Dump Source

Source File: 00000000.00000002.2257332837.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2257310034.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257352202.000000000040C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257369707.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257386782.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257403242.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257420562.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_WWAddToLocalAdmins.jbxd

Similarity

API ID: Resource$CurrentDirectoryFindLoadLockSizeof
String ID: C:\Windows\system32$hsdiafwiuera
API String ID: 1796454961-1451634567
Opcode ID: 3e59e55266f2ef64c96964f32da3999bbbe2091ecabaed5028506e86537535cd
Instruction ID: 55f1bcc0f2d2fdba3e565c3dce5fc56ee00eb4c5a17519726feeabf05d4f4b63
Opcode Fuzzy Hash: 3e59e55266f2ef64c96964f32da3999bbbe2091ecabaed5028506e86537535cd
Instruction Fuzzy Hash: A021D672900610BAE721A7719D0AFDF766CDF85750F10017AFA01F61E1DA78DA018AAD

Function 0040A2F0 Relevance: 9.1, APIs: 6, Instructions: 117COMMON

Download Yara Rule

APIs

GetStringTypeW.KERNEL32(00000001,0040D960,00000001,?,00000103,00000001,?,0040AD77,00200020,00000000,?,?,00000000,00000001), ref: 0040A32F
GetStringTypeA.KERNEL32(00000000,00000001,0040D95C,00000001,?,?,?,00000000,00000001), ref: 0040A349
GetStringTypeA.KERNEL32(?,?,?,00000000,00200020,00000103,00000001,?,0040AD77,00200020,00000000,?,?,00000000,00000001), ref: 0040A37D
MultiByteToWideChar.KERNEL32(0040AD77,00000002,?,00000000,00000000,00000000,00000103,00000001,?,0040AD77,00200020,00000000,?,?,00000000,00000001), ref: 0040A3B5
MultiByteToWideChar.KERNEL32(?,00000001,?,?,?,?), ref: 0040A40B
GetStringTypeW.KERNEL32(?,?,00000000,?,?,?), ref: 0040A41D

Memory Dump Source

Source File: 00000000.00000002.2257332837.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2257310034.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257352202.000000000040C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257369707.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257386782.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257403242.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257420562.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_WWAddToLocalAdmins.jbxd

Similarity

API ID: StringType$ByteCharMultiWide
String ID:
API String ID: 3852931651-0
Opcode ID: b2d121207fa3acec4dedabfb98e039319e6b803671e8b5dae72f73dadcc49b53
Instruction ID: c48cd55efd676305c8ee148f184b1436a8f3d4f3304d3e6b7a2e38095fc1850f
Opcode Fuzzy Hash: b2d121207fa3acec4dedabfb98e039319e6b803671e8b5dae72f73dadcc49b53
Instruction Fuzzy Hash: 83418D76900219EFCF219F94CC89EAF3F68EB08754F104536F911E2290D3788960CB96

Function 00403EBF Relevance: 9.1, APIs: 6, Instructions: 104fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000,?,00000000,?,0040F150,0040F150,?,00404DBA,?,?), ref: 00403F0F
GetCurrentProcess.KERNEL32(?,00000000,00000000,00000002,?,00000000,?,0040F150,0040F150,?,00404DBA,?,?,00000001,?,004054E3), ref: 00403F38
GetCurrentProcess.KERNEL32(?,00000000,?,00000000,?,0040F150,0040F150,?,00404DBA,?,?,00000001,?,004054E3,00000000,00000000), ref: 00403F3C
DuplicateHandle.KERNEL32(00000000,?,00000000,?,0040F150,0040F150,?,00404DBA,?,?,00000001,?,004054E3,00000000,00000000,00000000), ref: 00403F3F
GetFileType.KERNEL32(?,?,00000000,?,0040F150,0040F150,?,00404DBA,?,?,00000001,?,004054E3,00000000,00000000,00000000), ref: 00403F57
SetFilePointer.KERNEL32(?,00000000,00000000,00000001,?,00000000,?,0040F150,0040F150,?,00404DBA,?,?,00000001,?,004054E3), ref: 00403FB4

Memory Dump Source

Source File: 00000000.00000002.2257332837.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2257310034.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257352202.000000000040C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257369707.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257386782.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257403242.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257420562.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_WWAddToLocalAdmins.jbxd

Similarity

API ID: File$CurrentProcess$CreateDuplicateHandlePointerType
String ID:
API String ID: 3364526186-0
Opcode ID: 285bf0fe0c087221b4a8362fc5d0f559cc79482a17957e5985dbb6e5847a0a94
Instruction ID: a50cb37393e663217fafab8c3b5f7ea66dc72f9b7629ebc68b04251fe7fd08d8
Opcode Fuzzy Hash: 285bf0fe0c087221b4a8362fc5d0f559cc79482a17957e5985dbb6e5847a0a94
Instruction Fuzzy Hash: 7231AEB0904346EFDB21CF69D884AAABFF8EB05304F10456FF585A7280C3759E45CB25

Function 00407F21 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 115COMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32 ref: 00407F40
GetEnvironmentVariableA.KERNEL32(__MSVCRT_HEAP_SELECT,?,00001090), ref: 00407F75
GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 00407FD5

Strings

__MSVCRT_HEAP_SELECT, xrefs: 00407F70
__GLOBAL_HEAP_SELECTED, xrefs: 00407FAF

Memory Dump Source

Source File: 00000000.00000002.2257332837.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2257310034.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257352202.000000000040C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257369707.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257386782.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257403242.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257420562.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_WWAddToLocalAdmins.jbxd

Similarity

API ID: EnvironmentFileModuleNameVariableVersion
String ID: __GLOBAL_HEAP_SELECTED$__MSVCRT_HEAP_SELECT
API String ID: 1385375860-4131005785
Opcode ID: 2ac008044fa46832c24f9c74d6315bbf1f1f2528545629dd9902514b44da0ffe
Instruction ID: a25e26a89c14d68997db0fc0c447714964b3a35302d8c92fd51af37b3928528a
Opcode Fuzzy Hash: 2ac008044fa46832c24f9c74d6315bbf1f1f2528545629dd9902514b44da0ffe
Instruction Fuzzy Hash: A0313971C452896DEB3196705C81BEF77689B06304F1400FFE184F62C2DA39AE8DCB1A

Function 0040A655 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 66COMMON

Download Yara Rule

APIs

GetCurrentDirectoryA.KERNEL32(00000104,?,?), ref: 0040A6C4

Part of subcall function 0040A726: GetDriveTypeA.KERNEL32(00000000,?,0040A66C,00000000,?), ref: 0040A745

GetFullPathNameA.KERNEL32(00000000,00000104,?,00000000,?), ref: 0040A6B0

Strings

., xrefs: 0040A6AC
:, xrefs: 0040A6A8

Memory Dump Source

Source File: 00000000.00000002.2257332837.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2257310034.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257352202.000000000040C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257369707.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257386782.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257403242.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257420562.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_WWAddToLocalAdmins.jbxd

Similarity

API ID: CurrentDirectoryDriveFullNamePathType
String ID: .$:
API String ID: 3995704478-4202072812
Opcode ID: 527862646a73509c1b87d2488bc40414a97d04ab29ed0a298b802d938cbb142b
Instruction ID: d0d7adeba3d55cac9c0e97b675772e4d7d8b2ddf163c6e72a244caea50d2a54d
Opcode Fuzzy Hash: 527862646a73509c1b87d2488bc40414a97d04ab29ed0a298b802d938cbb142b
Instruction Fuzzy Hash: FE21C371204305AFEB10CF54C884BEA37BCAB10308F18847BED91E61C1DAB9D5A89B1F

Function 0040BA81 Relevance: 6.5, APIs: 5, Instructions: 246COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2257332837.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2257310034.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257352202.000000000040C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257369707.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257386782.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257403242.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257420562.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_WWAddToLocalAdmins.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1549d2bf6c9b3ab25e7f724843e39966609f9ba4f811e2543127d7056baac74a
Instruction ID: cf1df4f8894d31fcc75c1994c72c5d5a06e42c8ae05ae8b2d5161b8ed9708502
Opcode Fuzzy Hash: 1549d2bf6c9b3ab25e7f724843e39966609f9ba4f811e2543127d7056baac74a
Instruction Fuzzy Hash: ED710432500511BBEB226A25CD41FAB3A29DF507A4F15413AFC14BA3E2EB78ED5197CC

Function 00408C0D Relevance: 6.4, APIs: 5, Instructions: 102memoryCOMMON

Download Yara Rule

APIs

HeapAlloc.KERNEL32(00000000,00002020,?,?,?,?,004080AF), ref: 00408C2E
VirtualAlloc.KERNEL32(00000000,00400000,00002000,00000004,?,?,?,?,004080AF), ref: 00408C52
VirtualAlloc.KERNEL32(00000000,00010000,00001000,00000004,?,?,?,?,004080AF), ref: 00408C6C
VirtualFree.KERNEL32(00000000,00000000,00008000,?,?,?,?,004080AF), ref: 00408D2D
HeapFree.KERNEL32(00000000,00000000,?,?,?,?,004080AF), ref: 00408D44

Memory Dump Source

Source File: 00000000.00000002.2257332837.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2257310034.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257352202.000000000040C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257369707.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257386782.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257403242.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257420562.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_WWAddToLocalAdmins.jbxd

Similarity

API ID: AllocVirtual$FreeHeap
String ID:
API String ID: 714016831-0
Opcode ID: f2b80fa3411928d67fe619ad67d36df7e9011d6a4e4a13ec76101a7497c8b7c1
Instruction ID: 0e0310a963c65e94c388ecc36a93ac941a661daba8f536ae0d05e24d5c8470ba
Opcode Fuzzy Hash: f2b80fa3411928d67fe619ad67d36df7e9011d6a4e4a13ec76101a7497c8b7c1
Instruction Fuzzy Hash: A4319E71640705DBE7308F24DE85B22B7A4EB54764F10823EE1AAB6AD0DB78A8449B5C

Function 00408139 Relevance: 6.3, APIs: 3, Strings: 1, Instructions: 265memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00008000,00004000,7591DFF0,?,00000000), ref: 00408391
VirtualFree.KERNEL32(?,00000000,00008000), ref: 004083EC
HeapFree.KERNEL32(00000000,?), ref: 004083FE

Strings

"i@, xrefs: 00408139

Memory Dump Source

Source File: 00000000.00000002.2257332837.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2257310034.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257352202.000000000040C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257369707.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257386782.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257403242.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257420562.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_WWAddToLocalAdmins.jbxd

Similarity

API ID: Free$Virtual$Heap
String ID: "i@
API String ID: 2016334554-107731682
Opcode ID: 381dadccf8a02492c5b931a84fa54eb20eddd9c8c26bac619cb6f2ccd54e09e3
Instruction ID: 98aa62cd6c22a1406a8100b1fe6e4a77c99e6256c610f6b9dd8956f9e9411f38
Opcode Fuzzy Hash: 381dadccf8a02492c5b931a84fa54eb20eddd9c8c26bac619cb6f2ccd54e09e3
Instruction Fuzzy Hash: AEB14D35A00205DFDB18CF44DAD0AAABBA1FB58314F24C1AED8596F392DB75ED41CB44

Function 0040B88B Relevance: 6.2, APIs: 4, Instructions: 174fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000100,00000000), ref: 0040B90F
GetLastError.KERNEL32 ref: 0040B919
ReadFile.KERNEL32(?,?,00000001,00000000,00000000), ref: 0040B9E0
GetLastError.KERNEL32 ref: 0040B9EA

Memory Dump Source

Source File: 00000000.00000002.2257332837.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2257310034.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257352202.000000000040C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257369707.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257386782.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257403242.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257420562.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_WWAddToLocalAdmins.jbxd

Similarity

API ID: ErrorFileLastRead
String ID:
API String ID: 1948546556-0
Opcode ID: b2f4c1c601df130273a3fce86dc77e676e33ae042848530fd29d4a04c5ee9d08
Instruction ID: b9c471dc716487e451a362c20dc039e76419b6aff140a08e5a0f9b602173eb0a
Opcode Fuzzy Hash: b2f4c1c601df130273a3fce86dc77e676e33ae042848530fd29d4a04c5ee9d08
Instruction Fuzzy Hash: F061D570A04385DFDB118F58C884BAA7BB1EF02314F1481BBE961AB3D1D3799946CB9D

Function 0040B412 Relevance: 6.1, APIs: 4, Instructions: 67COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,00000000,?,?), ref: 0040B441
MultiByteToWideChar.KERNEL32(00000000,00000009,00000000,?,00000000,00000000), ref: 0040B454
MultiByteToWideChar.KERNEL32(?,00000001,?,?,?,00000000), ref: 0040B4A0
CompareStringW.KERNEL32(00000000,?,00000000,00000000,?,00000000,?,00000000), ref: 0040B4B8

Memory Dump Source

Source File: 00000000.00000002.2257332837.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2257310034.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257352202.000000000040C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257369707.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257386782.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257403242.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257420562.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_WWAddToLocalAdmins.jbxd

Similarity

API ID: ByteCharMultiWide$CompareString
String ID:
API String ID: 376665442-0
Opcode ID: b7b3f07b48c9e36fe601482ba537f4b12fe32fe19777de958c498be900a6cc78
Instruction ID: b1ac21c2b05d2af04f814aee59bdd92160d358ff5afb255c5cc9886bcf31a569
Opcode Fuzzy Hash: b7b3f07b48c9e36fe601482ba537f4b12fe32fe19777de958c498be900a6cc78
Instruction Fuzzy Hash: 87211A72910249EBCF228F94CC41ADE7FB5FF48754F10422AFA15722A0C3369A61DB98

Function 004092DA Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 135COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(00000000,?,?,?,00000000,?,?,0040692C), ref: 00409322

Strings

&A, xrefs: 00409389
&A, xrefs: 00409336

Memory Dump Source

Source File: 00000000.00000002.2257332837.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2257310034.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257352202.000000000040C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257369707.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257386782.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257403242.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257420562.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_WWAddToLocalAdmins.jbxd

Similarity

API ID: Info
String ID: &A$ &A
API String ID: 1807457897-867171739
Opcode ID: 00e7c2d3ed4bc82c66f44946780b955a361cbd1b3950f41a68451ed522669418
Instruction ID: 2445c3f2c9308626724333ca318f69eac529f370d44fbfe06a0bbbbae862447a
Opcode Fuzzy Hash: 00e7c2d3ed4bc82c66f44946780b955a361cbd1b3950f41a68451ed522669418
Instruction Fuzzy Hash: 2841297190C150AED711CF74D9903AB7BA1DB49308F24807BD945EB2D3D27D4D568B8D

Function 00409519 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 124COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,00000000), ref: 0040952D

Strings

, xrefs: 00409576
, xrefs: 00409552

Memory Dump Source

Source File: 00000000.00000002.2257332837.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2257310034.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257352202.000000000040C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257369707.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257386782.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257403242.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257420562.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_WWAddToLocalAdmins.jbxd

Similarity

API ID: Info
String ID: $
API String ID: 1807457897-3032137957
Opcode ID: f92b3679540dce79cc676c1bd81217f44bb2d80ca95de5b9ed7c3c9e1f6076af
Instruction ID: 28a485a423bafadc3e6c3eef1310479a3dd225f578bb93d465437164b642b0e6
Opcode Fuzzy Hash: f92b3679540dce79cc676c1bd81217f44bb2d80ca95de5b9ed7c3c9e1f6076af
Instruction Fuzzy Hash: 04417B310042586EEB168754CEA9BF77FA9DB05700F1408F6D54AEB1D3C2BA4D64CBAE

Function 00401DEB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

RemoveDirectoryA.KERNEL32(C:\Temp,?,004010CA,004010B3,00406952,02010C70), ref: 00401E64

Part of subcall function 00405C69: SetCurrentDirectoryA.KERNELBASE(?,?,0040127D,-00000040,00000000), ref: 00405C8A

SetCurrentDirectoryA.KERNEL32(C:\Temp,?,?,004010CA,004010B3,00406952,02010C70), ref: 00401E1D

Part of subcall function 00401F25: DeleteFileA.KERNELBASE(00401A46,00000000,00401A46,?), ref: 00401F72

Strings

C:\Temp, xrefs: 00401DF3, 00401E1C, 00401E63

Memory Dump Source

Source File: 00000000.00000002.2257332837.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2257310034.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257352202.000000000040C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257369707.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257386782.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257403242.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257420562.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_WWAddToLocalAdmins.jbxd

Similarity

API ID: Directory$Current$DeleteFileRemove
String ID: C:\Temp
API String ID: 3214568825-984105843
Opcode ID: 54cf79a39e3e3a9006f30395d77832fdfd4183540962d0a43cf782960d39855a
Instruction ID: 30fa742a723170139d6ae70fb92aa88087bccd2281eea06a35cdd0a985e60323
Opcode Fuzzy Hash: 54cf79a39e3e3a9006f30395d77832fdfd4183540962d0a43cf782960d39855a
Instruction Fuzzy Hash: 57F0FF32508200EAE62023A2FD4EBAB2E68DB01764F10403BF904F91F2CBBD4891C59C

Function 0040A726 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 24COMMON

Download Yara Rule

APIs

GetDriveTypeA.KERNEL32(00000000,?,0040A66C,00000000,?), ref: 0040A745

Strings

:, xrefs: 0040A73D
\, xrefs: 0040A741

Memory Dump Source

Source File: 00000000.00000002.2257332837.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2257310034.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257352202.000000000040C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257369707.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257386782.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257403242.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257420562.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_WWAddToLocalAdmins.jbxd

Similarity

API ID: DriveType
String ID: :$\
API String ID: 338552980-1166558509
Opcode ID: 89430a0576dfbcd3bfa4ef4d4caf674c4aee9498fdd7a7be1406ea59f922ea3a
Instruction ID: 22cb121c1e7cbb52da834dc01990f0aabc534af87251f75d6e6a69d830149672
Opcode Fuzzy Hash: 89430a0576dfbcd3bfa4ef4d4caf674c4aee9498fdd7a7be1406ea59f922ea3a
Instruction Fuzzy Hash: 5CE0D83120838C99EF019F74949478A3FA84B01784F08C066F94CDE281D1B4D655C396

Function 0040876B Relevance: 5.1, APIs: 4, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

HeapReAlloc.KERNEL32(00000000,00000050,?,00000000,00408533,?,?,?,00000100), ref: 00408793
HeapAlloc.KERNEL32(00000008,000041C4,?,00000000,00408533,?,?,?,00000100), ref: 004087C7
VirtualAlloc.KERNEL32(00000000,00100000,00002000,00000004,?,00000000,00408533,?,?,?,00000100), ref: 004087E1
HeapFree.KERNEL32(00000000,?,?,00000000,00408533,?,?,?,00000100), ref: 004087F8

Memory Dump Source

Source File: 00000000.00000002.2257332837.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2257310034.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257352202.000000000040C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257369707.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257386782.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257403242.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2257420562.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_WWAddToLocalAdmins.jbxd

Similarity

API ID: AllocHeap$FreeVirtual
String ID:
API String ID: 3499195154-0
Opcode ID: 853f28b01196f95eff01be115f6dd33f179c89e7d789a2ce60d310de0f6083ae
Instruction ID: a4a623b30882b7fb99c15638d422b73f65525efb1e349e4a451275745edb24fd
Opcode Fuzzy Hash: 853f28b01196f95eff01be115f6dd33f179c89e7d789a2ce60d310de0f6083ae
Instruction Fuzzy Hash: 16112B31200601DFD7219F59EE859937BB6FB84764760863EF1A2D61F0C7B19861DB18

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report WWAddToLocalAdmins.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Temp\60875D.vbs

\Device\Mup\849224*\MAILSLOT\NET\NETLOGON

\Device\Mup\SSO*\MAILSLOT\NET\NETLOGON

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Network Behavior

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

Behavior

System Behavior

Analysis Process: WWAddToLocalAdmins.exePID: 2408, Parent PID: 1028

General

Chronological Activities

Analysis Process: conhost.exePID: 5384, Parent PID: 2408

General

Windows Analysis Report
WWAddToLocalAdmins.exe

**\Device\Mup\849224*\MAILSLOT\NET\NETLOGON**

**\Device\Mup\SSO*\MAILSLOT\NET\NETLOGON**

Function 00401467 Relevance: 74.0, APIs: 27, Strings: 15, Instructions: 475
sleepwindowprocessCOMMON

Function 00407B44 Relevance: 6.1, APIs: 4, Instructions: 139
fileCOMMON

Function 004010D5 Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 108
COMMON

Function 004051B3 Relevance: 16.0, APIs: 5, Strings: 4, Instructions: 241
COMMON

Function 0040B257 Relevance: 13.7, APIs: 9, Instructions: 221
COMMON

Function 0040A977 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 230
fileCOMMON

Function 0040BE46 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 45
COMMON

Function 00409C8D Relevance: 7.6, APIs: 5, Instructions: 143
COMMON

Function 00401000 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 69
COMMON

Function 00405E96 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 49
COMMON

Function 0040689E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62
COMMON

Function 00401F25 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35
fileCOMMON

Function 00405C69 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 29
COMMON

Function 0040A1BA Relevance: 3.1, APIs: 2, Instructions: 51
COMMON

Function 00408069 Relevance: 3.0, APIs: 2, Instructions: 30
memoryCOMMON