Windows Analysis Report
NetworkMiner.exe

ID:	1561663
Product:	CloudBasic
Start time:	03:48:11
Start date:	24.11.2024
Sample:	NetworkMiner.exe
Cookbook:	default.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	3aa776d3ae714443f7a8b226015f7b0c
SHA1:	5c4c0fdf0418820b8d47b5d050427ca3cdac22d2
SHA256:	7b108b27b80ded3ae980080788aff76efcc9846e42402f6f2ccb7bb1af1419c5
Filetype:	Win32 Executable (generic) Net Framework (10011505/4) 50.01%

Name	Type	MD5	SHA1	SHA256
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_NetworkMiner.exe_f281b5b9790767443dd1fe78f62f2e72e01496_05459224_085896d0-69e2-4d70-bfc8-b0551cfee7f6\Report.wer	Unicode text, UTF-16, little-endian text, with CRLF line terminators	0097C370E15386B34A7F9D2A8FEA3D92	9CD34DFF78AA38592C19357A3B1013052605918A	192B2845B44FCD19471B9D1299728A558D44108E8C59E6640E406DF85F62BCDF
C:\ProgramData\Microsoft\Windows\WER\Temp\WERA0A2.tmp.dmp	Mini DuMP crash report, 16 streams, Sun Nov 24 02:49:15 2024, 0x1205a4 type	525E6697D76521D9CCAD1F817058FA52	7D68CB805354FD12E0D87AD1792C434EE63ECEE6	B06DC3716857B2997C3CDA1C9B8E9578692CFD89812CF1B54C29E29B4219A75D
C:\ProgramData\Microsoft\Windows\WER\Temp\WERA18E.tmp.WERInternalMetadata.xml	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators	A4165DCE43A99F1D703A144AA3B0988A	02EE4A9C8FED523D6E84F734DA1AA0ED421B768E	6296339A29C57F7C1CC71D12FEF992D4A4AB999658CA5D91416C2E92E8942B38
C:\ProgramData\Microsoft\Windows\WER\Temp\WERA1BE.tmp.xml	XML 1.0 document, ASCII text, with CRLF line terminators	42EF032DE286BD46005FDD171F592BC5	377D608AC425893CD7D3A3DEF116E99D9092727F	6411E86C1C6A660EDBD49670B809E48A630EAEA575A6F306FB49D409C99BB2AD
C:\Windows\appcompat\Programs\Amcache.hve	MS Windows registry file, NT/2000 or above	AB8D28571B94FEF60B94250588814002	6ACDA63B6704F8965941A287E3D550C0958922A3	9982B2F87316949CBA29ECAB68D97DF9E35F8E257F86AFA13433084F66908006

Compliance

Source: NetworkMiner.exe

Static PE information: certificate valid

Source: NetworkMiner.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: System.Windows.Forms.pdb source: WERA0A2.tmp.dmp.3.dr
Source:	Binary string: System.Windows.Forms.pdbH source: WERA0A2.tmp.dmp.3.dr
Source:	Binary string: mscorlib.pdb source: WERA0A2.tmp.dmp.3.dr
Source:	Binary string: System.ni.pdbRSDS source: WERA0A2.tmp.dmp.3.dr
Source:	Binary string: System.Windows.Forms.ni.pdbRSDS source: WERA0A2.tmp.dmp.3.dr
Source:	Binary string: System.Windows.Forms.ni.pdb source: WERA0A2.tmp.dmp.3.dr
Source:	Binary string: System.Drawing.pdb source: WERA0A2.tmp.dmp.3.dr
Source:	Binary string: mscorlib.ni.pdb source: WERA0A2.tmp.dmp.3.dr
Source:	Binary string: System.Drawing.ni.pdb source: WERA0A2.tmp.dmp.3.dr
Source:	Binary string: System.Core.pdb source: WERA0A2.tmp.dmp.3.dr
Source:	Binary string: System.Core.pdbMZ source: WERA0A2.tmp.dmp.3.dr
Source:	Binary string: mscorlib.ni.pdbRSDS7^3l source: WERA0A2.tmp.dmp.3.dr
Source:	Binary string: System.Drawing.ni.pdbRSDS source: WERA0A2.tmp.dmp.3.dr
Source:	Binary string: System.ni.pdb source: WERA0A2.tmp.dmp.3.dr
Source:	Binary string: System.pdb source: WERA0A2.tmp.dmp.3.dr
Source:	Binary string: System.Core.ni.pdbRSDS source: WERA0A2.tmp.dmp.3.dr
Source:	Binary string: System.Core.ni.pdb source: WERA0A2.tmp.dmp.3.dr

Networking

Source: NetworkMiner.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: NetworkMiner.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: NetworkMiner.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: NetworkMiner.exe	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: NetworkMiner.exe	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y
Source: NetworkMiner.exe	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0
Source: NetworkMiner.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: NetworkMiner.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: NetworkMiner.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: NetworkMiner.exe	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#
Source: NetworkMiner.exe	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#
Source: NetworkMiner.exe	String found in binary or memory: http://ocsp.comodoca.com0
Source: NetworkMiner.exe	String found in binary or memory: http://ocsp.digicert.com0A
Source: NetworkMiner.exe	String found in binary or memory: http://ocsp.digicert.com0C
Source: NetworkMiner.exe	String found in binary or memory: http://ocsp.digicert.com0X
Source: NetworkMiner.exe	String found in binary or memory: http://ocsp.sectigo.com0
Source: Amcache.hve.3.dr	String found in binary or memory: http://upx.sf.net
Source: NetworkMiner.exe	String found in binary or memory: http://www.netresec.com/?page=NetworkMiner-Writing
Source: NetworkMiner.exe	String found in binary or memory: https://gchq.github.io/CyberChef/#input=
Source: NetworkMiner.exe	String found in binary or memory: https://github.com/hdm/mac-ages
Source: NetworkMiner.exe	String found in binary or memory: https://github.com/xnih/satori/
Source: NetworkMiner.exe	String found in binary or memory: https://lcamtuf.coredump.cx/p0f3/
Source: NetworkMiner.exe	String found in binary or memory: https://localhost=System.Net
Source: NetworkMiner.exe	String found in binary or memory: https://netresec.com/?b=228fddfcUnable
Source: NetworkMiner.exe	String found in binary or memory: https://sectigo.com/CPS0
Source: NetworkMiner.exe	String found in binary or memory: https://sslbl.abuse.ch/blacklist/
Source: NetworkMiner.exe	String found in binary or memory: https://team.vxstream-sandbox.com/
Source: NetworkMiner.exe	String found in binary or memory: https://www.netresec.com/
Source: NetworkMiner.exe	String found in binary or memory: https://www.netresec.com/?page=NetworkMiner

System Summary

Source: C:\Users\user\Desktop\NetworkMiner.exe

Code function: 0_2_00007FFD9B640468

0_2_00007FFD9B640468

Source: C:\Users\user\Desktop\NetworkMiner.exe

Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 6380 -s 840

Source: NetworkMiner.exe, ServerCert.cs

Base64 encoded string: 'MIIGegIBAzCCBkAGCSqGSIb3DQEHAaCCBjEEggYtMIIGKTCCAwcGCSqGSIb3DQEHBqCCAvgwggL0AgEAMIIC7QYJKoZIhvcNAQcBMBwGCiqGSIb3DQEMAQYwDgQIPreThQzDtVYCAggAgIICwNZFcsLcWMtkQ6eGkIlXQ5juO59gQPlyNFGG+K6fDR+Ovnfytz4DMFEr62mtHN0udwqbIq7p5ddFftAH9f6Ri5sYfe4E0X2LBGcpOx8UgyMotxUNh8Y8RmGUu8Ip5FTXSFLARUuvhFKUNgACwNZUVvv5tFlKuxc8PpJZZRInWK3K/jXC8jnVmha8EC8+qL9At4sAlZ2WRg4z4TS3AcbbIc9rj4mM/uPXUAIZGfczfuTsL0yRSxwnycqRiYWQGvS1kkG/FA38gjaSPic6pAOF8WA+S6vWNmEJ4Fm2bv2PK/ooNqnrioiV8Omc8vT48zoy6lwt9K7yAPnFDd4J+ezZgO0wURXSxnQLjilikaW7BNSzfKuViaNg2gS1oKo9cLOCw6UX+dq8bP8N3bnqgdIehxagVbzBVjvcF2UPbp31dGnGQFd8Bh8UIi5O8zl7fixwl/RX6Vzm7YAetuRgyQxFQysOqjsuWsI4fmDzx7m+/8yzSI41bA3QONH3l4QlL5Mk8cjOZT39A4ZGbsQ0g6r5JVyeiZOsC5Vz+65tSU6V1f2IKEsrxjitMP/scRC4UvW2HyoAWZ+ffPRrWGIxIvi6pSJw1rpfQI0Xg1bJ9insOxcSJYfnzZysn7hp0Ii5raCmZxRs5EUKyKOL1oYwGuLxF6ExqLkakRDPryv3szUzMCEhg9ZlYn7bGRnJruMI8ys1IXTRDqHtqnhYM8z+qWEf1v67KScULigYqaycVl7C5xJGXVnq2r734utHP88KMOkFHppFuZLMmGZtluh3Cf+T8a/cxaYpQjoKh6D3VAZYXJXlNT25sibeHAWQiZIBw7OQzFsNEJ6KI/jl5p1kDM6hyGR1BNqsrPvH1rvkGvZ4TBdhJ+vGuBbSc8PqU9wS3Yz0Naoeh+qsAWGg4czjXheF/i+5GgP9ZCnzzTWhR42j0kH5MIIDGgYJKoZIhvcNAQcBoIIDCwSCAwcwggMDMIIC/wYLKoZIhvcNAQwKAQKgggKmMIICojAcBgoqhkiG9w0BDAEDMA4ECIlyyyIDq1kRAgIIAASCAoDiM+zb/1h8elnS4V1YUC97JcS0WDXYOIedPQK2GN26/x6QlORDf+pGXLhj98aEiY7PMS5h0/ejrtsI+q2Oj90tB+AhqPt3APorRO4L0+j87Ox67WaN/QWTs6kBYsy5n2gd6oqjz1vvrwLFrww2Mznhv6kDWJgkxKyFTQZI50PZJGD+XNGr21BESq7q+I/nx1sa8cbyyBNHpiFGywoYlf723unuAjHYxz8rykBzA532eMTAOMxtdJnOMiXXs7Xz/rvo++HHQaU1XLXf4UlRQ1vwd+q5NcWO4uWc+s3whQzTSTodfq+EjeG+pg9qWTx6M3nUm0SGBJ6MstOs0oppDWyPnTv5E9MrAmZgs4hICQr+F1Zx1JeA5EHi3b7SVYjC+ot7InPTXfroxpd/klT8/GpJEE8z0r76Ij5PQoFOhqikqMMfdEmO5N8bXJht4axwMKN9IYwiK36KVhb8HioaMhWsu973jYkSNiNHEUmdB/+zZrhVb09FBXtLbirMcTcpmuLRpYuz1flxSckWDiO8Ws43WHPLxPqcMZmTYq6lWgeW1BLmUb1Qq+zcdwDNnJcYEWlmRkxPrVucsjp10F1CXd+YChfbTF5EUhx3z7LhFxXOTFA8Va79Rdb+MJZl5OFB6kkJ+Zhq5W1uQBr5qPI4g/s8MoJyFTwIvzvku7raA9d7vIlJaW1OwNbcMLIvZWlTYGs8vUJmeHvD5DNqNKvooxuy1NCmSt8YrzOOFNH1Opw5jyQknkV7pRpEvfKMAUS7Xf+fcRViu68pyDhb12tuRNeOm3W1apx3kHWprUPzYDostDKPATChEUNRy/RrKKXrKuRDY8QiIxOmXvhjuMoB69rsMUYwHwYJKoZIhvcNAQkUMRIeEABOAGUAdAByAGUAcwBlAGMwIwYJKoZIhvcNAQkVMRYEFHjL3fTeItADbUnyngbpK8c4M0EnMDEwITAJBgUrDgMCGgUABBQBfCuEB7m4fDEj9pVquwrqjSMa7gQIJw1p4Yn4bU4CAggA'

Source: classification engine

Classification label: clean3.winEXE@2/5@0/0

Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6380
Source: C:\Users\user\Desktop\NetworkMiner.exe	Mutant created: NULL

Source: C:\Windows\System32\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\138a5d3f-01f4-4141-ae2a-c50e9cdf57d6

Jump to behavior

Source: NetworkMiner.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: NetworkMiner.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 50.01%

Source: C:\Users\user\Desktop\NetworkMiner.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\NetworkMiner.exe

File read: C:\Users\user\Desktop\NetworkMiner.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\NetworkMiner.exe "C:\Users\user\Desktop\NetworkMiner.exe"
Source: C:\Users\user\Desktop\NetworkMiner.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 6380 -s 840

Source: C:\Users\user\Desktop\NetworkMiner.exe	Section loaded: mscoree.dll			Jump to behavior
Source: C:\Users\user\Desktop\NetworkMiner.exe	Section loaded: apphelp.dll			Jump to behavior
Source: C:\Users\user\Desktop\NetworkMiner.exe	Section loaded: kernel.appcore.dll			Jump to behavior
Source: C:\Users\user\Desktop\NetworkMiner.exe	Section loaded: version.dll			Jump to behavior
Source: C:\Users\user\Desktop\NetworkMiner.exe	Section loaded: vcruntime140_clr0400.dll			Jump to behavior
Source: C:\Users\user\Desktop\NetworkMiner.exe	Section loaded: ucrtbase_clr0400.dll			Jump to behavior
Source: C:\Users\user\Desktop\NetworkMiner.exe	Section loaded: uxtheme.dll			Jump to behavior
Source: C:\Users\user\Desktop\NetworkMiner.exe	Section loaded: cryptsp.dll			Jump to behavior
Source: C:\Users\user\Desktop\NetworkMiner.exe	Section loaded: rsaenh.dll			Jump to behavior
Source: C:\Users\user\Desktop\NetworkMiner.exe	Section loaded: cryptbase.dll			Jump to behavior

Source: C:\Users\user\Desktop\NetworkMiner.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\NetworkMiner.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: NetworkMiner.exe

Static PE information: certificate valid

Source: NetworkMiner.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: NetworkMiner.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: System.Windows.Forms.pdb source: WERA0A2.tmp.dmp.3.dr
Source:	Binary string: System.Windows.Forms.pdbH source: WERA0A2.tmp.dmp.3.dr
Source:	Binary string: mscorlib.pdb source: WERA0A2.tmp.dmp.3.dr
Source:	Binary string: System.ni.pdbRSDS source: WERA0A2.tmp.dmp.3.dr
Source:	Binary string: System.Windows.Forms.ni.pdbRSDS source: WERA0A2.tmp.dmp.3.dr
Source:	Binary string: System.Windows.Forms.ni.pdb source: WERA0A2.tmp.dmp.3.dr
Source:	Binary string: System.Drawing.pdb source: WERA0A2.tmp.dmp.3.dr
Source:	Binary string: mscorlib.ni.pdb source: WERA0A2.tmp.dmp.3.dr
Source:	Binary string: System.Drawing.ni.pdb source: WERA0A2.tmp.dmp.3.dr
Source:	Binary string: System.Core.pdb source: WERA0A2.tmp.dmp.3.dr
Source:	Binary string: System.Core.pdbMZ source: WERA0A2.tmp.dmp.3.dr
Source:	Binary string: mscorlib.ni.pdbRSDS7^3l source: WERA0A2.tmp.dmp.3.dr
Source:	Binary string: System.Drawing.ni.pdbRSDS source: WERA0A2.tmp.dmp.3.dr
Source:	Binary string: System.ni.pdb source: WERA0A2.tmp.dmp.3.dr
Source:	Binary string: System.pdb source: WERA0A2.tmp.dmp.3.dr
Source:	Binary string: System.Core.ni.pdbRSDS source: WERA0A2.tmp.dmp.3.dr
Source:	Binary string: System.Core.ni.pdb source: WERA0A2.tmp.dmp.3.dr

Hooking and other Techniques for Hiding and Protection

Source: C:\Users\user\Desktop\NetworkMiner.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\NetworkMiner.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\NetworkMiner.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\NetworkMiner.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\NetworkMiner.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\NetworkMiner.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\NetworkMiner.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\NetworkMiner.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\NetworkMiner.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\NetworkMiner.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\NetworkMiner.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\NetworkMiner.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\NetworkMiner.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\NetworkMiner.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\NetworkMiner.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\NetworkMiner.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion

Source: C:\Users\user\Desktop\NetworkMiner.exe	Memory allocated: 21EE2B60000 memory reserve | memory write watch			Jump to behavior
Source: C:\Users\user\Desktop\NetworkMiner.exe	Memory allocated: 21EFC450000 memory reserve | memory write watch			Jump to behavior

Source: Amcache.hve.3.dr	Binary or memory string: VMware
Source: Amcache.hve.3.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.3.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.3.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.3.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.3.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.3.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.3.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.3.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.3.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.3.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.3.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.3.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.3.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.3.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.3.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.3.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.3.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.3.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.3.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.3.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.3.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.3.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.3.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.3.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.3.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.3.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.3.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.3.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Anti Debugging

Source: C:\Users\user\Desktop\NetworkMiner.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\NetworkMiner.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\NetworkMiner.exe

Memory allocated: page read and write | page guard

Jump to behavior

Language, Device and Operating System Detection

Source: C:\Users\user\Desktop\NetworkMiner.exe

Queries volume information: C:\Users\user\Desktop\NetworkMiner.exe VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\NetworkMiner.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Source: Amcache.hve.3.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.3.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.3.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.3.dr	Binary or memory string: MsMpEng.exe