Edit tour

Windows Analysis Report
MSIAfterburnerInstaller465.exe

Overview

General Information

Sample name:	MSIAfterburnerInstaller465.exe
Analysis ID:	1544726
MD5:	b198b5b47aa6293222a21e6b4ced3bac
SHA1:	2aaacac5c0ee029a425c01c5923626416d40e0e8
SHA256:	b0e64d98d3b45bad13b5518b4cb0751246b2f84d41f5804753b168f5803bce3e
Infos:

Detection

Score:	48
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found potential dummy code loops (likely to delay analysis)

Uses Windows timers to delay execution

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Contains long sleeps (>= 3 min)

Detected potential crypto function

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

May sleep (evasive loops) to hinder dynamic analysis

Potential time zone aware malware

Program does not show much activity (idle)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

MSIAfterburnerInstaller465.exe (PID: 3784 cmdline: "C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe" MD5: B198B5B47AA6293222A21E6B4CED3BAC)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Source: MSIAfterburnerInstaller465.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: MSIAfterburnerInstaller465.exe, 00000000.00000002.4564151440.00000000066B5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/MSIAfterburnerSetup;Component/Images/btn_close_over.png
Source: MSIAfterburnerInstaller465.exe, 00000000.00000002.4564151440.00000000066B5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/MSIAfterburnerSetup;Component/Images/btn_close_over.pngd
Source: MSIAfterburnerInstaller465.exe, 00000000.00000002.4564151440.00000000066B5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/MSIAfterburnerSetup;Component/Images/ic_info_over_light.png
Source: MSIAfterburnerInstaller465.exe, 00000000.00000002.4564151440.00000000066B5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/MSIAfterburnerSetup;Component/Images/ic_info_over_light.pngd
Source: MSIAfterburnerInstaller465.exe, 00000000.00000002.4564151440.00000000066B5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/Images/btn_close_over.png
Source: MSIAfterburnerInstaller465.exe, 00000000.00000002.4564151440.00000000066B5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/Images/btn_close_over.pngd
Source: MSIAfterburnerInstaller465.exe, 00000000.00000002.4564151440.00000000066B5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/Images/ic_info_over_light.png
Source: MSIAfterburnerInstaller465.exe, 00000000.00000002.4564151440.00000000066B5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/Images/ic_info_over_light.pngd
Source: MSIAfterburnerInstaller465.exe, 00000000.00000002.4564151440.00000000066B5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/bar/images/btn_close_over.png
Source: MSIAfterburnerInstaller465.exe, 00000000.00000002.4564151440.00000000066B5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/bar/images/btn_close_over.pngd
Source: MSIAfterburnerInstaller465.exe, 00000000.00000002.4564151440.00000000066B5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/bar/images/ic_info_over_light.png
Source: MSIAfterburnerInstaller465.exe, 00000000.00000002.4564151440.00000000066B5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/bar/images/ic_info_over_light.pngd
Source: MSIAfterburnerInstaller465.exe, 00000000.00000002.4564151440.0000000006511000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: MSIAfterburnerInstaller465.exe	String found in binary or memory: https://br.msi.com/page/privacy-policy
Source: MSIAfterburnerInstaller465.exe	String found in binary or memory: https://br.msi.com/page/website-terms-of-use
Source: MSIAfterburnerInstaller465.exe	String found in binary or memory: https://cn.msi.com/page/privacy-policy
Source: MSIAfterburnerInstaller465.exe	String found in binary or memory: https://cn.msi.com/page/website-terms-of-use
Source: MSIAfterburnerInstaller465.exe	String found in binary or memory: https://de.msi.com/page/privacy-policy
Source: MSIAfterburnerInstaller465.exe	String found in binary or memory: https://de.msi.com/page/website-terms-of-use
Source: MSIAfterburnerInstaller465.exe	String found in binary or memory: https://es.msi.com/page/privacy-policy
Source: MSIAfterburnerInstaller465.exe	String found in binary or memory: https://es.msi.com/page/website-terms-of-use
Source: MSIAfterburnerInstaller465.exe	String found in binary or memory: https://fr.msi.com/page/privacy-policy
Source: MSIAfterburnerInstaller465.exe	String found in binary or memory: https://fr.msi.com/page/website-terms-of-use
Source: MSIAfterburnerInstaller465.exe	String found in binary or memory: https://it.msi.com/page/privacy-policy
Source: MSIAfterburnerInstaller465.exe	String found in binary or memory: https://it.msi.com/page/website-terms-of-use
Source: MSIAfterburnerInstaller465.exe	String found in binary or memory: https://jp.msi.com/page/privacy-policy
Source: MSIAfterburnerInstaller465.exe	String found in binary or memory: https://jp.msi.com/page/website-terms-of-use
Source: MSIAfterburnerInstaller465.exe	String found in binary or memory: https://kr.msi.com/page/privacy-policy
Source: MSIAfterburnerInstaller465.exe	String found in binary or memory: https://kr.msi.com/page/website-terms-of-use
Source: MSIAfterburnerInstaller465.exe	String found in binary or memory: https://pl.msi.com/page/privacy-policy
Source: MSIAfterburnerInstaller465.exe	String found in binary or memory: https://pl.msi.com/page/website-terms-of-use
Source: MSIAfterburnerInstaller465.exe	String found in binary or memory: https://ru.msi.com/page/privacy-policy
Source: MSIAfterburnerInstaller465.exe	String found in binary or memory: https://ru.msi.com/page/website-terms-of-use
Source: MSIAfterburnerInstaller465.exe	String found in binary or memory: https://tr.msi.com/page/privacy-policy
Source: MSIAfterburnerInstaller465.exe	String found in binary or memory: https://tr.msi.com/page/website-terms-of-use
Source: MSIAfterburnerInstaller465.exe	String found in binary or memory: https://tw.msi.com/page/privacy-policy
Source: MSIAfterburnerInstaller465.exe	String found in binary or memory: https://tw.msi.com/page/website-terms-of-use
Source: MSIAfterburnerInstaller465.exe	String found in binary or memory: https://www.msi.com/
Source: MSIAfterburnerInstaller465.exe	String found in binary or memory: https://www.msi.com/page/privacy-policy
Source: MSIAfterburnerInstaller465.exe	String found in binary or memory: https://www.msi.com/page/website-terms-of-use
Source: MSIAfterburnerInstaller465.exe	String found in binary or memory: https://www.nortonlifelock.com/br/pt/legal/license-services-agreement/
Source: MSIAfterburnerInstaller465.exe	String found in binary or memory: https://www.nortonlifelock.com/br/pt/privacy/privacy-notices/
Source: MSIAfterburnerInstaller465.exe	String found in binary or memory: https://www.nortonlifelock.com/cn/zh/legal/license-services-agreement/
Source: MSIAfterburnerInstaller465.exe	String found in binary or memory: https://www.nortonlifelock.com/cn/zh/privacy/privacy-notices/
Source: MSIAfterburnerInstaller465.exe	String found in binary or memory: https://www.nortonlifelock.com/de/de/legal/license-services-agreement/
Source: MSIAfterburnerInstaller465.exe	String found in binary or memory: https://www.nortonlifelock.com/de/de/privacy/privacy-notices/
Source: MSIAfterburnerInstaller465.exe	String found in binary or memory: https://www.nortonlifelock.com/es/es/legal/license-services-agreement/
Source: MSIAfterburnerInstaller465.exe	String found in binary or memory: https://www.nortonlifelock.com/es/es/privacy/privacy-notices/
Source: MSIAfterburnerInstaller465.exe	String found in binary or memory: https://www.nortonlifelock.com/fr/fr/legal/license-services-agreement/
Source: MSIAfterburnerInstaller465.exe	String found in binary or memory: https://www.nortonlifelock.com/fr/fr/privacy/privacy-notices/
Source: MSIAfterburnerInstaller465.exe	String found in binary or memory: https://www.nortonlifelock.com/it/it/legal/license-services-agreement/
Source: MSIAfterburnerInstaller465.exe	String found in binary or memory: https://www.nortonlifelock.com/it/it/privacy/privacy-notices/
Source: MSIAfterburnerInstaller465.exe	String found in binary or memory: https://www.nortonlifelock.com/jp/ja/legal/license-services-agreement/
Source: MSIAfterburnerInstaller465.exe	String found in binary or memory: https://www.nortonlifelock.com/jp/ja/privacy/privacy-notices/
Source: MSIAfterburnerInstaller465.exe	String found in binary or memory: https://www.nortonlifelock.com/kr/ko/legal/license-services-agreement/
Source: MSIAfterburnerInstaller465.exe	String found in binary or memory: https://www.nortonlifelock.com/kr/ko/privacy/privacy-notices/
Source: MSIAfterburnerInstaller465.exe	String found in binary or memory: https://www.nortonlifelock.com/tw/zh/legal/license-services-agreement/
Source: MSIAfterburnerInstaller465.exe	String found in binary or memory: https://www.nortonlifelock.com/tw/zh/privacy/privacy-notices/
Source: MSIAfterburnerInstaller465.exe	String found in binary or memory: https://www.nortonlifelock.com/us/en/legal/license-services-agreement/
Source: MSIAfterburnerInstaller465.exe	String found in binary or memory: https://www.nortonlifelock.com/us/en/privacy/privacy-notices/
Source: MSIAfterburnerInstaller465.exe	String found in binary or memory: https://www.nortonlifelock.com/us/en/privacy/privacy-notices/polish/

Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe	Code function: 0_2_048360B0	0_2_048360B0
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe	Code function: 0_2_04837208	0_2_04837208
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe	Code function: 0_2_04834D20	0_2_04834D20
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe	Code function: 0_2_0483BFC0	0_2_0483BFC0
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe	Code function: 0_2_0483FABA	0_2_0483FABA
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe	Code function: 0_2_04834DAA	0_2_04834DAA

Source: MSIAfterburnerInstaller465.exe, 00000000.00000002.4561496641.000000000484E000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: OriginalFilenameclr.dllT vs MSIAfterburnerInstaller465.exe

Source: classification engine

Classification label: mal48.evad.winEXE@1/0@0/0

Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe

Mutant created: NULL

Source: MSIAfterburnerInstaller465.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: MSIAfterburnerInstaller465.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 50.01%

Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe	Section loaded: msvcp140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe	Section loaded: d3d9.dll	Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe	Section loaded: dataexchange.dll	Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe	Section loaded: dcomp.dll	Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe	Section loaded: iconcodecservice.dll	Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe	Section loaded: msctfui.dll	Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe	Section loaded: uiautomationcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe	Section loaded: d3dcompiler_47.dll	Jump to behavior

Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9FC8E510-A27C-4B3B-B9A3-BF65F00256A8}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: MSIAfterburnerInstaller465.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: MSIAfterburnerInstaller465.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: MSIAfterburnerInstaller465.exe

Static file information: File size 59236352 > 1048576

Source: MSIAfterburnerInstaller465.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x3824a00

Source: MSIAfterburnerInstaller465.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: MSIAfterburnerInstaller465.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: MSIAfterburnerInstaller465.exe

Static PE information: 0x8B4D8C54 [Fri Jan 22 22:40:20 2044 UTC]

Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe	Code function: 0_2_04833532 pushad ; iretd	0_2_04833541
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe	Code function: 0_2_0483356B pushfd ; iretd	0_2_04833571
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe	Code function: 0_2_048336D2 push ebx; iretd	0_2_048336DA
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe	Code function: 0_2_048310C5 pushfd ; iretd	0_2_048310C9
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe	Code function: 0_2_04833A0A push esp; retf	0_2_04833A19
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe	Code function: 0_2_04833A33 push esp; retf	0_2_04833A19

Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Uses Windows timers to delay execution

Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe	User Timer Set: Timeout: 1ms	Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe	User Timer Set: Timeout: 1ms	Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe	User Timer Set: Timeout: 1ms	Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe	User Timer Set: Timeout: 1ms	Jump to behavior

Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe	Memory allocated: 4830000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe	Memory allocated: 6510000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe	Memory allocated: 8510000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe	Memory allocated: 8BA0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe	Memory allocated: CBA0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe	Window / User API: threadDelayed 3411			Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe	Window / User API: threadDelayed 6431			Jump to behavior

Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe TID: 5968

Thread sleep time: -28592453314249787s >= -30000s

Jump to behavior

Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe

System information queried: CurrentTimeZoneInformation

Jump to behavior

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: MSIAfterburnerInstaller465.exe

Binary or memory string: "}qemu+

Anti Debugging

Found potential dummy code loops (likely to delay analysis)

Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe

Process Stats: CPU usage > 42% for more than 60s

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe	Queries volume information: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework-SystemXml\v4.0_4.0.0.0__b77a5c561934e089\PresentationFramework-SystemXml.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\UIAutomationTypes\v4.0_4.0.0.0__31bf3856ad364e35\UIAutomationTypes.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\UIAutomationProvider\v4.0_4.0.0.0__31bf3856ad364e35\UIAutomationProvider.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	233 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Timestomp	Security Account Manager	233 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Obfuscated Files or Information	LSA Secrets	12 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
MSIAfterburnerInstaller465.exe	0%	ReversingLabs

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://it.msi.com/page/privacy-policy	MSIAfterburnerInstaller465.exe	false		unknown
https://www.nortonlifelock.com/br/pt/privacy/privacy-notices/	MSIAfterburnerInstaller465.exe	false		unknown
https://kr.msi.com/page/privacy-policy	MSIAfterburnerInstaller465.exe	false		unknown
https://tw.msi.com/page/privacy-policy	MSIAfterburnerInstaller465.exe	false		unknown
http://defaultcontainer/MSIAfterburnerSetup;Component/Images/btn_close_over.png	MSIAfterburnerInstaller465.exe, 00000000.00000002.4564151440.00000000066B5000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://es.msi.com/page/privacy-policy	MSIAfterburnerInstaller465.exe	false		unknown
https://www.nortonlifelock.com/kr/ko/privacy/privacy-notices/	MSIAfterburnerInstaller465.exe	false		unknown
https://tr.msi.com/page/privacy-policy	MSIAfterburnerInstaller465.exe	false		unknown
http://foo/Images/ic_info_over_light.png	MSIAfterburnerInstaller465.exe, 00000000.00000002.4564151440.00000000066B5000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://de.msi.com/page/website-terms-of-use	MSIAfterburnerInstaller465.exe	false		unknown
https://www.nortonlifelock.com/es/es/privacy/privacy-notices/	MSIAfterburnerInstaller465.exe	false		unknown
https://www.nortonlifelock.com/it/it/privacy/privacy-notices/	MSIAfterburnerInstaller465.exe	false		unknown
https://www.nortonlifelock.com/us/en/legal/license-services-agreement/	MSIAfterburnerInstaller465.exe	false		unknown
http://defaultcontainer/MSIAfterburnerSetup;Component/Images/ic_info_over_light.png	MSIAfterburnerInstaller465.exe, 00000000.00000002.4564151440.00000000066B5000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://br.msi.com/page/privacy-policy	MSIAfterburnerInstaller465.exe	false		unknown
https://cn.msi.com/page/website-terms-of-use	MSIAfterburnerInstaller465.exe	false		unknown
https://de.msi.com/page/privacy-policy	MSIAfterburnerInstaller465.exe	false		unknown
https://fr.msi.com/page/website-terms-of-use	MSIAfterburnerInstaller465.exe	false		unknown
https://pl.msi.com/page/privacy-policy	MSIAfterburnerInstaller465.exe	false		unknown
https://www.nortonlifelock.com/kr/ko/legal/license-services-agreement/	MSIAfterburnerInstaller465.exe	false		unknown
http://foo/bar/images/ic_info_over_light.pngd	MSIAfterburnerInstaller465.exe, 00000000.00000002.4564151440.00000000066B5000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://es.msi.com/page/website-terms-of-use	MSIAfterburnerInstaller465.exe	false		unknown
https://www.msi.com/page/privacy-policy	MSIAfterburnerInstaller465.exe	false		unknown
https://www.nortonlifelock.com/jp/ja/privacy/privacy-notices/	MSIAfterburnerInstaller465.exe	false		unknown
http://foo/bar/images/ic_info_over_light.png	MSIAfterburnerInstaller465.exe, 00000000.00000002.4564151440.00000000066B5000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://www.msi.com/page/website-terms-of-use	MSIAfterburnerInstaller465.exe	false		unknown
https://www.nortonlifelock.com/us/en/privacy/privacy-notices/polish/	MSIAfterburnerInstaller465.exe	false		unknown
http://defaultcontainer/MSIAfterburnerSetup;Component/Images/btn_close_over.pngd	MSIAfterburnerInstaller465.exe, 00000000.00000002.4564151440.00000000066B5000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	MSIAfterburnerInstaller465.exe, 00000000.00000002.4564151440.0000000006511000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.nortonlifelock.com/fr/fr/legal/license-services-agreement/	MSIAfterburnerInstaller465.exe	false		unknown
https://kr.msi.com/page/website-terms-of-use	MSIAfterburnerInstaller465.exe	false		unknown
http://defaultcontainer/MSIAfterburnerSetup;Component/Images/ic_info_over_light.pngd	MSIAfterburnerInstaller465.exe, 00000000.00000002.4564151440.00000000066B5000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://www.nortonlifelock.com/us/en/privacy/privacy-notices/	MSIAfterburnerInstaller465.exe	false		unknown
http://foo/Images/btn_close_over.png	MSIAfterburnerInstaller465.exe, 00000000.00000002.4564151440.00000000066B5000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://www.nortonlifelock.com/cn/zh/privacy/privacy-notices/	MSIAfterburnerInstaller465.exe	false		unknown
https://www.nortonlifelock.com/jp/ja/legal/license-services-agreement/	MSIAfterburnerInstaller465.exe	false		unknown
https://it.msi.com/page/website-terms-of-use	MSIAfterburnerInstaller465.exe	false		unknown
https://fr.msi.com/page/privacy-policy	MSIAfterburnerInstaller465.exe	false		unknown
https://ru.msi.com/page/privacy-policy	MSIAfterburnerInstaller465.exe	false		unknown
https://cn.msi.com/page/privacy-policy	MSIAfterburnerInstaller465.exe	false		unknown
https://www.nortonlifelock.com/br/pt/legal/license-services-agreement/	MSIAfterburnerInstaller465.exe	false		unknown
https://ru.msi.com/page/website-terms-of-use	MSIAfterburnerInstaller465.exe	false		unknown
https://www.nortonlifelock.com/cn/zh/legal/license-services-agreement/	MSIAfterburnerInstaller465.exe	false		unknown
https://jp.msi.com/page/website-terms-of-use	MSIAfterburnerInstaller465.exe	false		unknown
https://jp.msi.com/page/privacy-policy	MSIAfterburnerInstaller465.exe	false		unknown
https://www.nortonlifelock.com/fr/fr/privacy/privacy-notices/	MSIAfterburnerInstaller465.exe	false		unknown
https://br.msi.com/page/website-terms-of-use	MSIAfterburnerInstaller465.exe	false		unknown
https://www.nortonlifelock.com/tw/zh/privacy/privacy-notices/	MSIAfterburnerInstaller465.exe	false		unknown
http://foo/Images/btn_close_over.pngd	MSIAfterburnerInstaller465.exe, 00000000.00000002.4564151440.00000000066B5000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://tw.msi.com/page/website-terms-of-use	MSIAfterburnerInstaller465.exe	false		unknown
http://foo/bar/images/btn_close_over.pngd	MSIAfterburnerInstaller465.exe, 00000000.00000002.4564151440.00000000066B5000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://pl.msi.com/page/website-terms-of-use	MSIAfterburnerInstaller465.exe	false		unknown
http://foo/bar/images/btn_close_over.png	MSIAfterburnerInstaller465.exe, 00000000.00000002.4564151440.00000000066B5000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://www.nortonlifelock.com/es/es/legal/license-services-agreement/	MSIAfterburnerInstaller465.exe	false		unknown
http://foo/Images/ic_info_over_light.pngd	MSIAfterburnerInstaller465.exe, 00000000.00000002.4564151440.00000000066B5000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://www.nortonlifelock.com/de/de/legal/license-services-agreement/	MSIAfterburnerInstaller465.exe	false		unknown
https://www.nortonlifelock.com/de/de/privacy/privacy-notices/	MSIAfterburnerInstaller465.exe	false		unknown
https://tr.msi.com/page/website-terms-of-use	MSIAfterburnerInstaller465.exe	false		unknown
https://www.nortonlifelock.com/it/it/legal/license-services-agreement/	MSIAfterburnerInstaller465.exe	false		unknown
https://www.nortonlifelock.com/tw/zh/legal/license-services-agreement/	MSIAfterburnerInstaller465.exe	false		unknown
https://www.msi.com/	MSIAfterburnerInstaller465.exe	false		unknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1544726
Start date and time:	2024-10-29 16:49:34 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 44s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	5
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	MSIAfterburnerInstaller465.exe
Detection:	MAL
Classification:	mal48.evad.winEXE@1/0@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 20 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: MSIAfterburnerInstaller465.exe

Simulations

Behavior and APIs

Time	Type	Description
11:50:31	API Interceptor	10412679x Sleep call for process: MSIAfterburnerInstaller465.exe modified

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.999575412942881
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 50.01% Win32 Executable (generic) a (10002005/4) 49.97% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	MSIAfterburnerInstaller465.exe
File size:	59'236'352 bytes
MD5:	b198b5b47aa6293222a21e6b4ced3bac
SHA1:	2aaacac5c0ee029a425c01c5923626416d40e0e8
SHA256:	b0e64d98d3b45bad13b5518b4cb0751246b2f84d41f5804753b168f5803bce3e
SHA512:	112536895b85a74d604331a514d4831c40a3a7c1027aca31d42dc9a51f505f5f8223e0212746f3005d9980373ccb7a99f621c70c22d9369cdf3fb96fdcaccb55
SSDEEP:	1572864:d3Mu6Bw/3Zh8xIc+9q4qBn8pzpzhaaXMxAAPJm:dcn+RCxI8/Bn84XyAPJm
TLSH:	18D733B57511073CCEB74235702F468BA434BC980B618F1AAA27FA7E6EA1715D43F48E
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...T.M..........."...0..J...........i... ........@.. .......................@............`................................

File Icon


Icon Hash:	132c31794cd47959

Static PE Info

General

Entrypoint:	0x3c269f6
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x8B4D8C54 [Fri Jan 22 22:40:20 2044 UTC]
TLS Callbacks:
CLR (.Net) Version:	v4.0.30319
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x38269a1	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x3828000	0x59128	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x3882000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x38268fc	0x38	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x38249fc	0x3824a00	788ae31c8c581e7ea8e9d9afce6509c8	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x3828000	0x59128	0x59200	239b48f9a66b8b171ea3cb04e32b87a4	False	0.9670543697405329	data	7.940490488170869	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x3882000	0xc	0x200	4082f79ca13e7c49724f4f9ad9ccadf6	False	0.044921875	data	0.12227588125913882	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0x3828220	0x3c4	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced	1.0114107883817427
RT_ICON	0x38285f4	0x686	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced	1.0065868263473055
RT_ICON	0x3828c8c	0x9aa	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced	1.0044462409054162
RT_ICON	0x3829648	0x1197	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced	1.0024428159005108
RT_ICON	0x382a7f0	0x19bc	PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced	1.0016697024893746
RT_ICON	0x382c1bc	0x2ba6	PNG image data, 96 x 96, 8-bit/color RGBA, non-interlaced	1.000984428136746
RT_ICON	0x382ed74	0x3d45	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced	1.0007013069811923
RT_ICON	0x3832acc	0x8f6d	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	0.9979573494566549
RT_ICON	0x383ba4c	0x150a0	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced	0.9885002784998144
RT_ICON	0x3850afc	0x2ff5c	PNG image data, 1024 x 1024, 8-bit/color RGBA, non-interlaced	0.9535541935615239
RT_GROUP_ICON	0x3880a68	0x92	data	0.7123287671232876
RT_VERSION	0x3880b0c	0x41c	data	0.37832699619771865
RT_MANIFEST	0x3880f38	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

⊘No network behavior found

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

System Behavior

Analysis Process: MSIAfterburnerInstaller465.exePID: 3784, Parent PID: 1028

General

Target ID:	0
Start time:	11:50:25
Start date:	29/10/2024
Path:	C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe"
Imagebase:	0x970000
File size:	59'236'352 bytes
MD5 hash:	B198B5B47AA6293222A21E6B4CED3BAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: MSIAfterburnerInstaller465.exePID: 3784, Parent PID: 1028COMMON

Execution Graph

Execution Coverage:	9.3%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	13
Total number of Limit Nodes:	0

Executed Functions

Function 0483BFC0 Relevance: 16.2, Strings: 12, Instructions: 1181COMMON

Download Yara Rule

Strings

Nv\q, xrefs: 0483C2C8
$]q, xrefs: 0483C664
Haq, xrefs: 0483CD78
c]q, xrefs: 0483C98D
(_]q, xrefs: 0483CA75
,aq, xrefs: 0483CBDE
$]q, xrefs: 0483CFE3
4c]q, xrefs: 0483C939
4c]q, xrefs: 0483C953
c]q, xrefs: 0483C973
$]q, xrefs: 0483C64A
(_]q, xrefs: 0483CA5B

Memory Dump Source

Source File: 00000000.00000002.4561383219.0000000004830000.00000040.00000800.00020000.00000000.sdmp, Offset: 04830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4830000_MSIAfterburnerInstaller465.jbxd

Similarity

API ID:
String ID: (_]q$(_]q$,aq$4c]q$4c]q$Haq$Nv\q$$]q$$]q$$]q$c]q$c]q
API String ID: 0-67377238
Opcode ID: 1fed740b5ae7b2ef2071d9c36190bd4fb63f0756b45ef799c00775e25b1ce099
Instruction ID: c7b513302742e90838c9896efb14878537cd8c4d79c1d1e5a158f459e7739bd6
Opcode Fuzzy Hash: 1fed740b5ae7b2ef2071d9c36190bd4fb63f0756b45ef799c00775e25b1ce099
Instruction Fuzzy Hash: 31829531B401188FCB59AF7D585062D7AE77FCDB01B205E69D40AEB394EE64EC418BE2

Function 04837208 Relevance: 13.3, Strings: 10, Instructions: 814COMMON

Download Yara Rule

Strings

UR, xrefs: 04837EE7
UR, xrefs: 04837AF5
UR, xrefs: 04837567
UR, xrefs: 04837F06
UR, xrefs: 04837C4F
UR, xrefs: 048372E2
UR, xrefs: 04837222
UR, xrefs: 04837A8E
UR, xrefs: 048372BE
UR, xrefs: 04837849

Memory Dump Source

Source File: 00000000.00000002.4561383219.0000000004830000.00000040.00000800.00020000.00000000.sdmp, Offset: 04830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4830000_MSIAfterburnerInstaller465.jbxd

Similarity

API ID:
String ID: UR$ UR$ UR$ UR$ UR$ UR$ UR$ UR$ UR$ UR
API String ID: 0-3022799725
Opcode ID: 8eb57b055c53331c63a5c340651bf2467a598da0bc3650920aff77b9cd15f21b
Instruction ID: 73570070e192d36acd77b16cc3917217aa06fc2ecab8df2763fca656cf132fbd
Opcode Fuzzy Hash: 8eb57b055c53331c63a5c340651bf2467a598da0bc3650920aff77b9cd15f21b
Instruction Fuzzy Hash: E0826E78600216CFDB28CF28D545B7977F1BB4A309F1086A9D8099B792E734EC49DF92

Function 048360B0 Relevance: 6.7, Strings: 5, Instructions: 416
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Haq, xrefs: 048364D2
Haq, xrefs: 04836519
Haq, xrefs: 04836470
Haq, xrefs: 048364A1
Haq, xrefs: 04836560

Memory Dump Source

Source File: 00000000.00000002.4561383219.0000000004830000.00000040.00000800.00020000.00000000.sdmp, Offset: 04830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4830000_MSIAfterburnerInstaller465.jbxd

Similarity

API ID:
String ID: Haq$Haq$Haq$Haq$Haq
API String ID: 0-1792267638
Opcode ID: 1729595700694ac8567e4138cdce82ad6a39850e6f1b84c26d23421eb60c6821
Instruction ID: 0dd6ce84f17e0bcbe5ab51e3853c5c6a21a31ca0da1c056b6164df2fa09d61b1
Opcode Fuzzy Hash: 1729595700694ac8567e4138cdce82ad6a39850e6f1b84c26d23421eb60c6821
Instruction Fuzzy Hash: EBF1A331E00256DBCB29CF78C5502ADFBB2FF85301F258A69D405FB245E778AA85CB90

Function 0483FABA Relevance: 5.5, Strings: 4, Instructions: 495
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Haq, xrefs: 0483FCF3
Haq, xrefs: 0483FD9C
Haq, xrefs: 0483FD6B
Haq, xrefs: 0483FD24

Memory Dump Source

Source File: 00000000.00000002.4561383219.0000000004830000.00000040.00000800.00020000.00000000.sdmp, Offset: 04830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4830000_MSIAfterburnerInstaller465.jbxd

Similarity

API ID:
String ID: Haq$Haq$Haq$Haq
API String ID: 0-3862180702
Opcode ID: 57f7dda0fcd54a219c53374762a51f058207730f03f4e0ebe2ae18b14a4fa60c
Instruction ID: f9cc7dc22f4a677bb9abe84190616eb179c86e16cfb95fed820273e5ece8ba50
Opcode Fuzzy Hash: 57f7dda0fcd54a219c53374762a51f058207730f03f4e0ebe2ae18b14a4fa60c
Instruction Fuzzy Hash: C2B1E731F002258BCB199F79C4542BDBBE2AF85301F148A79D605DB385EB38ED4187D5

Function 04834D20 Relevance: .4, Instructions: 429COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4561383219.0000000004830000.00000040.00000800.00020000.00000000.sdmp, Offset: 04830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4830000_MSIAfterburnerInstaller465.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 326d5eb59036d56d8491628aadf93746961460edf04acbd1ff78fd8c1ba7ebce
Instruction ID: e0cfa407efe5aebd316adc1a847560d86a9fffdd9e895a5c96ddeaf3f8a47352
Opcode Fuzzy Hash: 326d5eb59036d56d8491628aadf93746961460edf04acbd1ff78fd8c1ba7ebce
Instruction Fuzzy Hash: BE02F638A002549FE718DF64D894A6DBBF7FB88700F1985A9D8099B361CB74EE81CF54

Function 04834DAA Relevance: .2, Instructions: 215COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4561383219.0000000004830000.00000040.00000800.00020000.00000000.sdmp, Offset: 04830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4830000_MSIAfterburnerInstaller465.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c62f8c832a316420b9ce3365c0663552ea48227e2d35555a0cc5698f2fe7b3a
Instruction ID: edf3d14d96848890e7f8067ef406d0aac8c54e0559386ff157c1a6dfad933987
Opcode Fuzzy Hash: 8c62f8c832a316420b9ce3365c0663552ea48227e2d35555a0cc5698f2fe7b3a
Instruction Fuzzy Hash: 4FA1B574A01214CFE718DF65C894BADBBB2FB88305F1985A9D809AB361CB75ED81CF50

Function 04839F79 Relevance: 1.6, APIs: 1, Instructions: 53
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNELBASE(00000000,?,?,?,?,00000000,00000E20,?,?,04839E36), ref: 04839FE6

Memory Dump Source

Source File: 00000000.00000002.4561383219.0000000004830000.00000040.00000800.00020000.00000000.sdmp, Offset: 04830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4830000_MSIAfterburnerInstaller465.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 1a1ee3b37f807e0788705f518e1e752ca7095ffed509549ee0fe8538c66c08db
Instruction ID: bae205adba2732198645f8022e6b5cd024b052b40040d4fc84e2d87d1199126c
Opcode Fuzzy Hash: 1a1ee3b37f807e0788705f518e1e752ca7095ffed509549ee0fe8538c66c08db
Instruction Fuzzy Hash: 5D1137B5C002098FDB10DF9AC444ADEFBF8EF49310F14841AE919B7250C3B9A545CFA1

Function 04839928 Relevance: 1.6, APIs: 1, Instructions: 53
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNELBASE(00000000,?,?,?,?,00000000,00000E20,?,?,04839E36), ref: 04839FE6

Memory Dump Source

Source File: 00000000.00000002.4561383219.0000000004830000.00000040.00000800.00020000.00000000.sdmp, Offset: 04830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4830000_MSIAfterburnerInstaller465.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 19eae991e7cc4bee293a3efd4cebed132165cafc75b797204c25fde4329eb3d8
Instruction ID: 1a3a260e291efd230a36c3bb46d8f685453f2833f3058df2f51109728127884a
Opcode Fuzzy Hash: 19eae991e7cc4bee293a3efd4cebed132165cafc75b797204c25fde4329eb3d8
Instruction Fuzzy Hash: 101112B5D046098FDB10DF9AC444ADEFBF4AB89310F14891AE919A7210D3B9A545CFA1

Function 047EEB48 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4561105974.00000000047ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 047ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_47ed000_MSIAfterburnerInstaller465.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 020575cc0ca23e60eccb3317d668d14c90f2ac46b80ab87d570d20c45aaba2b9
Instruction ID: 7099ee82d107f1b28b83dc47fc89864afc34e224363cc4cd2339b4bc950fcc0b
Opcode Fuzzy Hash: 020575cc0ca23e60eccb3317d668d14c90f2ac46b80ab87d570d20c45aaba2b9
Instruction Fuzzy Hash: ED31D572500240EFDF069F55D9C0F26BF66FB8C314F248AA9E9090A36AC336E456DB61

Function 047EEA4C Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4561105974.00000000047ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 047ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_47ed000_MSIAfterburnerInstaller465.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f7c0161b9d7cc1b4b2a83065170c658828f4541d351e0815e754d53847ed49d
Instruction ID: 3669051e060a1066dd00777ab1254dcdf98cc35edb740c8269bb383918554c31
Opcode Fuzzy Hash: 6f7c0161b9d7cc1b4b2a83065170c658828f4541d351e0815e754d53847ed49d
Instruction Fuzzy Hash: 8921B472504200DFCF158F55D9C0F36BF66FB8C314F248AA9E9094A356C336E456DB61

Function 047DD06C Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4560990602.00000000047DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 047DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_47dd000_MSIAfterburnerInstaller465.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45810a8e1c4aca7753135f604e12ea8b1474e7751bc6a119d74c3ab5f852778c
Instruction ID: 21f0e97a9a35b30357737dae175ea72f1d02bbcf98608d17859e1a815270dd17
Opcode Fuzzy Hash: 45810a8e1c4aca7753135f604e12ea8b1474e7751bc6a119d74c3ab5f852778c
Instruction Fuzzy Hash: 89212471210200DFCB259F54D9C0B26BFB5FB8C314F248569E9090A356C33BE416CBA1

Function 047ED01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4561105974.00000000047ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 047ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_47ed000_MSIAfterburnerInstaller465.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ad6dc529ef0f6ca41e1c3fc048e3a0a76e0384494c1a6856dc608fb395669ae
Instruction ID: 33a21adb4902d4eddaaa00e7197e9fbec14ff701ba005820d46dcdce632d1d98
Opcode Fuzzy Hash: 3ad6dc529ef0f6ca41e1c3fc048e3a0a76e0384494c1a6856dc608fb395669ae
Instruction Fuzzy Hash: 8B21F271604205DFCB24DF25E9C4B26BF65FB88314F28CA69D90A4B356C33AE407CA61

Function 047EEB43 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4561105974.00000000047ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 047ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_47ed000_MSIAfterburnerInstaller465.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd3f4ac0631ff22dd56ccf4d2f47cf00efda065eea4add5a65fc2f6b0320be09
Instruction ID: bbd2a68f55163c4bc8f3990627302f704f620f75ec57378741945723ff0d93ae
Opcode Fuzzy Hash: fd3f4ac0631ff22dd56ccf4d2f47cf00efda065eea4add5a65fc2f6b0320be09
Instruction Fuzzy Hash: E5219276404240DFCF16CF50D9C4B66BF72FB4C314F248699ED490A66AC336E46ADB51

Function 047EEA47 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4561105974.00000000047ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 047ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_47ed000_MSIAfterburnerInstaller465.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac706478ed8e0b975fac9fbf98c0c10b3f55379ed33725949e2df8455e538a30
Instruction ID: 0190e0e1b6dc82857e878d3ef627b07f731f7c45a6dde05d786a4587f878ed0d
Opcode Fuzzy Hash: ac706478ed8e0b975fac9fbf98c0c10b3f55379ed33725949e2df8455e538a30
Instruction Fuzzy Hash: B1217976504240DFCF068F50D9C4F66BF62FB88314F2486A9E9494A65AC336E426DB91

Function 047ED007 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4561105974.00000000047ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 047ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_47ed000_MSIAfterburnerInstaller465.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 954ac5e6ebd571e8ca28065d91dc40ffe81cf8a356236b22ce28bcd198c57e2b
Instruction ID: 9e397f8b67be15efadb9a25f45f05475c28f3880b1d3becc0caab01417e9b817
Opcode Fuzzy Hash: 954ac5e6ebd571e8ca28065d91dc40ffe81cf8a356236b22ce28bcd198c57e2b
Instruction Fuzzy Hash: 5B2181755093808FDB12CF24D994715BF71FB4A214F28C6DAD8498F6A7C33AD80ACB62

Function 047DD067 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4560990602.00000000047DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 047DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_47dd000_MSIAfterburnerInstaller465.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4df52cb15700b59c5b6b401fa95ea1d4e97f6e18881beb99e30f99f1fcf6035
Instruction ID: 02cb9e65342be245b55e2f207d082903f3c60388c1d17a4fbc5d9af264b4961f
Opcode Fuzzy Hash: b4df52cb15700b59c5b6b401fa95ea1d4e97f6e18881beb99e30f99f1fcf6035
Instruction Fuzzy Hash: 8B21DF76404280DFCB16CF00D9C4B16BF72FB88314F24C6A9D9480B256C33BE426CBA2

Function 047DDA79 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4560990602.00000000047DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 047DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_47dd000_MSIAfterburnerInstaller465.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05d2ac02054ef54be99b7495075c83ced8e33133f1dacb61ff878616c135f937
Instruction ID: 6e9b1948b582808f02d7d84287a0afdcb00bc3ade1b19abdf1c7d62edac0b16f
Opcode Fuzzy Hash: 05d2ac02054ef54be99b7495075c83ced8e33133f1dacb61ff878616c135f937
Instruction Fuzzy Hash: 8C01DB311193449AE7309B6ACD84B67BFACEFC5330F1CC56AED094A386D279AC45CA71

Function 047DD847 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4560990602.00000000047DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 047DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_47dd000_MSIAfterburnerInstaller465.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd8c2e93435f7edcbdebafba9f4d94ae2fd19d9bbe7faf30ae22189cb8dba4cf
Instruction ID: 45da04507dc3ce5f369794d3c0a6c3e4507bb775b147144e9aa0c3518715f4f8
Opcode Fuzzy Hash: dd8c2e93435f7edcbdebafba9f4d94ae2fd19d9bbe7faf30ae22189cb8dba4cf
Instruction Fuzzy Hash: 8401DA76100A44AFD7619F46C984C23FBBAFF88720355855EE98A4BA21C372F851DF60

Function 047DD838 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4560990602.00000000047DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 047DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_47dd000_MSIAfterburnerInstaller465.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5465f1650b99f26cc488bdcd17b1dd7d90018c03528eff8763d5035230912fc
Instruction ID: 3d9ab21abae5b5a4daa8cda362d0aa6880ae5bf0f517ea722e6f4deaf1e3df09
Opcode Fuzzy Hash: e5465f1650b99f26cc488bdcd17b1dd7d90018c03528eff8763d5035230912fc
Instruction Fuzzy Hash: 97011E75104780AFD7228F55C944C63BFBAFF89720719849DE9864BA22C232F852DF60

Function 047DDA78 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4560990602.00000000047DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 047DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_47dd000_MSIAfterburnerInstaller465.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8048ae49462d3e0364ef265ef9e2e6d409b5748af0c2cbb38e738d44573f87d1
Instruction ID: 51faec92adb7c130958d19b0e0cc581f4a6791c593360587dea8ff5d1975ff5c
Opcode Fuzzy Hash: 8048ae49462d3e0364ef265ef9e2e6d409b5748af0c2cbb38e738d44573f87d1
Instruction Fuzzy Hash: F2F062714093449EE7308E16D984B62FFA8EF85734F18C45AED494B386D279AC45CA71

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report MSIAfterburnerInstaller465.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Compliance

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

System Behavior

Analysis Process: MSIAfterburnerInstaller465.exePID: 3784, Parent PID: 1028

General

Chronological Activities

Disassembly

Analysis Process: MSIAfterburnerInstaller465.exePID: 3784, Parent PID: 1028COMMON

Execution Graph

Graph

Executed Functions

Function 0483BFC0 Relevance: 16.2, Strings: 12, Instructions: 1181COMMON

Function 04837208 Relevance: 13.3, Strings: 10, Instructions: 814COMMON

Function 048360B0 Relevance: 6.7, Strings: 5, Instructions: 416COMMON

Windows Analysis Report
MSIAfterburnerInstaller465.exe

Function 048360B0 Relevance: 6.7, Strings: 5, Instructions: 416
COMMON

Function 0483FABA Relevance: 5.5, Strings: 4, Instructions: 495
COMMON

Function 04839F79 Relevance: 1.6, APIs: 1, Instructions: 53
libraryCOMMON

Function 04839928 Relevance: 1.6, APIs: 1, Instructions: 53
libraryCOMMON