Windows Analysis Report
y83WAR4vQc.exe

ID:	1562314
Product:	CloudBasic
Start time:	13:53:34
Start date:	25.11.2024
Sample:	y83WAR4vQc.exe
Cookbook:	default.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	4effe13b0f91976bd70825f2eff1077a
SHA1:	65990fc883bdd4c6c59cf039e5979c43d3d3d0d2
SHA256:	f9401786d00286b50c0d2228fa06d6777d0a5c32294470c297db161a8625ac5b
Filetype:	Win32 Executable (generic) a (10002005/4) 99.96%

Name	Type	MD5	SHA1	SHA256

AV Detection

Source: y83WAR4vQc.exe

Avira: detected

Source: y83WAR4vQc.exe

ReversingLabs: Detection: 23%

Source: Submited Sample

Integrated Neural Analysis Model: Matched 92.7% probability

Compliance

Source: y83WAR4vQc.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Spreading

Source: C:\Users\user\Desktop\y83WAR4vQc.exe	Code function: 0_2_0040276E FindFirstFileW,		0_2_0040276E
Source: C:\Users\user\Desktop\y83WAR4vQc.exe	Code function: 0_2_00405629 GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,		0_2_00405629
Source: C:\Users\user\Desktop\y83WAR4vQc.exe	Code function: 0_2_004060E4 FindFirstFileW,FindClose,		0_2_004060E4

Networking

Source: y83WAR4vQc.exe, 00000000.00000002.1362400372.000000000062E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://nsis.sf.net/NSIS_Error
Source: y83WAR4vQc.exe	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError

Key, Mouse, Clipboard, Microphone and Screen Capturing

Source: C:\Users\user\Desktop\y83WAR4vQc.exe

Code function: 0_2_0040518A GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_0040518A

System Summary

Source: C:\Users\user\Desktop\y83WAR4vQc.exe

Code function: 0_2_00403229 EntryPoint,#17,SetErrorMode,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,CoUninitialize,ExitProcess,lstrcatW,lstrcmpiW,CreateDirectoryW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,ExitWindowsEx,ExitProcess,

0_2_00403229

Source: C:\Users\user\Desktop\y83WAR4vQc.exe	Code function: 0_2_00406547		0_2_00406547
Source: C:\Users\user\Desktop\y83WAR4vQc.exe	Code function: 0_2_00406D1E		0_2_00406D1E
Source: C:\Users\user\Desktop\y83WAR4vQc.exe	Code function: 0_2_004049C7		0_2_004049C7

Source: y83WAR4vQc.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: classification engine

Classification label: mal60.winEXE@1/0@0/0

Source: C:\Users\user\Desktop\y83WAR4vQc.exe

Code function: 0_2_00404481 GetDlgItem,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,

0_2_00404481

Source: C:\Users\user\Desktop\y83WAR4vQc.exe

Code function: 0_2_0040206A CoCreateInstance,

0_2_0040206A

Source: C:\Users\user\Desktop\y83WAR4vQc.exe

File created: C:\Users\user~1\AppData\Local\Temp\nsmADFC.tmp

Jump to behavior

Source: y83WAR4vQc.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\y83WAR4vQc.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\y83WAR4vQc.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: y83WAR4vQc.exe

ReversingLabs: Detection: 23%

Source: C:\Users\user\Desktop\y83WAR4vQc.exe

File read: C:\Users\user\Desktop\y83WAR4vQc.exe

Jump to behavior

Source: C:\Users\user\Desktop\y83WAR4vQc.exe	Section loaded: apphelp.dll			Jump to behavior
Source: C:\Users\user\Desktop\y83WAR4vQc.exe	Section loaded: version.dll			Jump to behavior
Source: C:\Users\user\Desktop\y83WAR4vQc.exe	Section loaded: kernel.appcore.dll			Jump to behavior
Source: C:\Users\user\Desktop\y83WAR4vQc.exe	Section loaded: uxtheme.dll			Jump to behavior
Source: C:\Users\user\Desktop\y83WAR4vQc.exe	Section loaded: shfolder.dll			Jump to behavior
Source: C:\Users\user\Desktop\y83WAR4vQc.exe	Section loaded: windows.storage.dll			Jump to behavior
Source: C:\Users\user\Desktop\y83WAR4vQc.exe	Section loaded: wldp.dll			Jump to behavior
Source: C:\Users\user\Desktop\y83WAR4vQc.exe	Section loaded: propsys.dll			Jump to behavior
Source: C:\Users\user\Desktop\y83WAR4vQc.exe	Section loaded: textshaping.dll			Jump to behavior
Source: C:\Users\user\Desktop\y83WAR4vQc.exe	Section loaded: textinputframework.dll			Jump to behavior
Source: C:\Users\user\Desktop\y83WAR4vQc.exe	Section loaded: coreuicomponents.dll			Jump to behavior
Source: C:\Users\user\Desktop\y83WAR4vQc.exe	Section loaded: coremessaging.dll			Jump to behavior
Source: C:\Users\user\Desktop\y83WAR4vQc.exe	Section loaded: ntmarta.dll			Jump to behavior
Source: C:\Users\user\Desktop\y83WAR4vQc.exe	Section loaded: coremessaging.dll			Jump to behavior
Source: C:\Users\user\Desktop\y83WAR4vQc.exe	Section loaded: wintypes.dll			Jump to behavior
Source: C:\Users\user\Desktop\y83WAR4vQc.exe	Section loaded: wintypes.dll			Jump to behavior
Source: C:\Users\user\Desktop\y83WAR4vQc.exe	Section loaded: wintypes.dll			Jump to behavior

Source: C:\Users\user\Desktop\y83WAR4vQc.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Data Obfuscation

Source: C:\Users\user\Desktop\y83WAR4vQc.exe

Code function: 0_2_0040610B GetModuleHandleA,LoadLibraryA,GetProcAddress,

0_2_0040610B

Source: y83WAR4vQc.exe

Static PE information: real checksum: 0xce445 should be: 0xa98e

Hooking and other Techniques for Hiding and Protection

Source: C:\Users\user\Desktop\y83WAR4vQc.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion

Source: C:\Users\user\Desktop\y83WAR4vQc.exe

API coverage: 7.8 %

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\y83WAR4vQc.exe	Code function: 0_2_0040276E FindFirstFileW,		0_2_0040276E
Source: C:\Users\user\Desktop\y83WAR4vQc.exe	Code function: 0_2_00405629 GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,		0_2_00405629
Source: C:\Users\user\Desktop\y83WAR4vQc.exe	Code function: 0_2_004060E4 FindFirstFileW,FindClose,		0_2_004060E4

Source: C:\Users\user\Desktop\y83WAR4vQc.exe

API call chain: ExitProcess graph end node

Anti Debugging

Source: C:\Users\user\Desktop\y83WAR4vQc.exe

Code function: 0_2_0040610B GetModuleHandleA,LoadLibraryA,GetProcAddress,

0_2_0040610B

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Language, Device and Operating System Detection

Source: C:\Users\user\Desktop\y83WAR4vQc.exe

Code function: 0_2_00405DC3 GetVersion,GetSystemDirectoryW,GetWindowsDirectoryW,SHGetSpecialFolderLocation,SHGetPathFromIDListW,CoTaskMemFree,lstrcatW,lstrlenW,

0_2_00405DC3