Windows Analysis Report
.com.exe

Source: C:\Users\user\Desktop\ .com.exe	Code function: 0_2_00507730	0_2_00507730
Source: C:\Users\user\Desktop\ .com.exe	Code function: 0_2_005011C9	0_2_005011C9
Source: C:\Windows\java.exe	Code function: 7_2_00507730	7_2_00507730

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Local\Temp\services.exe BF316F51D0C345D61EAEE3940791B64E81F676E3BCA42BAD61073227BEE6653C

Source: C:\Users\user\Desktop\ .com.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 3416 -s 1188

Source: C:\Users\user\Desktop\ .com.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ .com.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\ .com.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\ .com.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\ .com.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\ .com.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\ .com.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ .com.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ .com.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\ .com.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\ .com.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ .com.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ .com.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\ .com.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\services.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\services.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\services.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\services.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\services.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\services.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\services.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\services.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\services.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\services.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\services.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\services.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\services.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\services.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\services.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\services.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\services.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\services.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\services.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\services.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\services.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\java.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\java.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\java.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\java.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\java.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\java.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\java.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\java.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\java.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\java.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\java.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\java.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\java.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\java.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\java.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\java.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\java.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\java.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\java.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\java.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\java.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\java.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\services.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\services.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\services.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\services.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\services.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\services.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\services.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\services.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\services.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\services.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\services.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\services.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\services.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\services.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\services.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\services.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\services.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\services.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\services.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\services.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\services.exe	Section loaded: rasadhlp.dll	Jump to behavior

Source: .com.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: .com.exe	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: java.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: tmpF245.tmp.7.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: classification engine

Classification label: mal100.spre.expl.evad.winEXE@8/13@0/9

Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess3416
Source: C:\Windows\java.exe	Mutant created: \Sessions\1\BaseNamedObjects\494126root494126root4494126root494126root44

Source: C:\Users\user\Desktop\ .com.exe

File created: C:\Users\user\AppData\Local\Temp\zincite.log

Source: C:\Users\user\Desktop\ .com.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: .com.exe

ReversingLabs: Detection: 73%

Source: C:\Users\user\Desktop\ .com.exe

File read: C:\Users\user\Desktop\ .com.exe

Source: unknown	Process created: C:\Users\user\Desktop\ .com.exe C:\Users\user\Desktop\ .com.exe
Source: C:\Users\user\Desktop\ .com.exe	Process created: C:\Windows\services.exe C:\Windows\services.exe
Source: C:\Users\user\Desktop\ .com.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 3416 -s 1188
Source: unknown	Process created: C:\Windows\java.exe "C:\Windows\java.exe"
Source: C:\Windows\java.exe	Process created: C:\Users\user\AppData\Local\Temp\services.exe C:\Users\user\AppData\Local\Temp\services.exe
Source: unknown	Process created: C:\Windows\services.exe "C:\Windows\services.exe"
Source: C:\Users\user\Desktop\ .com.exe	Process created: C:\Windows\services.exe C:\Windows\services.exe	Jump to behavior
Source: C:\Windows\java.exe	Process created: C:\Users\user\AppData\Local\Temp\services.exe C:\Users\user\AppData\Local\Temp\services.exe	Jump to behavior

Source: C:\Users\user\Desktop\ .com.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Drops PE files with benign system names

Source: C:\Users\user\Desktop\ .com.exe

Code function: 0_2_00503620 GetModuleHandleA,LoadLibraryA,GetProcAddress,InternetGetConnectedState,

0_2_00503620

Source: services.exe.0.dr	Static PE information: section name: UPX2
Source: services.exe.7.dr	Static PE information: section name: UPX2

Source: C:\Users\user\Desktop\ .com.exe	Code function: 0_2_0050A42D push ds; ret	0_2_0050A42E
Source: C:\Users\user\Desktop\ .com.exe	Code function: 0_2_0050DEA6 push ds; ret	0_2_0050DEBE
Source: C:\Users\user\Desktop\ .com.exe	Code function: 0_2_0050A501 push ecx; retf	0_2_0050A53F
Source: C:\Users\user\Desktop\ .com.exe	Code function: 0_2_0050A50F push ecx; retf	0_2_0050A53F
Source: C:\Users\user\Desktop\ .com.exe	Code function: 0_2_00509BA2 push edx; retf	0_2_00509BAB
Source: C:\Windows\services.exe	Code function: 1_2_00405A55 push es; iretd	1_2_00405A8E
Source: C:\Windows\java.exe	Code function: 7_2_0050A42D push ds; ret	7_2_0050A42E
Source: C:\Windows\java.exe	Code function: 7_2_0050DEA6 push ds; ret	7_2_0050DEBE
Source: C:\Windows\java.exe	Code function: 7_2_0050A501 push ecx; retf	7_2_0050A53F
Source: C:\Windows\java.exe	Code function: 7_2_0050A50F push ecx; retf	7_2_0050A53F
Source: C:\Windows\java.exe	Code function: 7_2_00509BA2 push edx; retf	7_2_00509BAB

Source: .com.exe	Static PE information: section name: .text entropy: 6.805048281534057
Source: java.exe.0.dr	Static PE information: section name: .text entropy: 6.805048281534057
Source: tmpF245.tmp.7.dr	Static PE information: section name: .text entropy: 6.805048281534057

Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1

Persistence and Installation Behavior

Source: C:\Users\user\Desktop\ .com.exe	File created: C:\Windows\services.exe			Jump to dropped file
Source: C:\Windows\java.exe	File created: C:\Users\user\AppData\Local\Temp\services.exe			Jump to dropped file

Drops executables to the windows directory (C:\Windows) and starts them

Source: C:\Users\user\Desktop\ .com.exe	Executable created and started: C:\Windows\services.exe			Jump to behavior
Source: unknown	Executable created and started: C:\Windows\java.exe

Exploit detected, runtime environment dropped PE file

Source: C:\Windows\java.exe

File created: tmpF245.tmp.7.dr

Jump to dropped file

Source: C:\Users\user\Desktop\ .com.exe	File created: C:\Windows\java.exe	Jump to dropped file
Source: C:\Users\user\Desktop\ .com.exe	File created: C:\Windows\services.exe	Jump to dropped file
Source: C:\Windows\java.exe	File created: C:\Users\user\AppData\Local\Temp\services.exe	Jump to dropped file
Source: C:\Windows\java.exe	File created: C:\Users\user\AppData\Local\Temp\tmpF245.tmp	Jump to dropped file

Source: C:\Users\user\Desktop\ .com.exe	File created: C:\Windows\java.exe			Jump to dropped file
Source: C:\Users\user\Desktop\ .com.exe	File created: C:\Windows\services.exe			Jump to dropped file

Source: C:\Users\user\Desktop\ .com.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run JavaVM	Jump to behavior
Source: C:\Users\user\Desktop\ .com.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run JavaVM	Jump to behavior
Source: C:\Windows\services.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run Services	Jump to behavior
Source: C:\Windows\services.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run Services	Jump to behavior

Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking mutex)

Source: C:\Users\user\Desktop\ .com.exe	Evasive API call chain: CreateMutex,DecisionNodes,Sleep			graph_0-3007
Source: C:\Users\user\Desktop\ .com.exe	Evasive API call chain: CreateMutex,DecisionNodes,ExitProcess			graph_0-3007

Opens the same file many times (likely Sandbox evasion)

Source: C:\Users\user\AppData\Local\Temp\services.exe

File opened: \Device\Afd\Endpoint count: 30496

Source: C:\Windows\services.exe	Window / User API: threadDelayed 2844	Jump to behavior
Source: C:\Windows\java.exe	Window / User API: threadDelayed 1778	Jump to behavior
Source: C:\Windows\java.exe	Window / User API: threadDelayed 7290	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\services.exe	Window / User API: threadDelayed 7518	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\services.exe	Window / User API: threadDelayed 2480	Jump to behavior
Source: C:\Windows\services.exe	Window / User API: threadDelayed 9950	Jump to behavior

Source: C:\Windows\java.exe	Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)			graph_7-2834
Source: C:\Windows\services.exe	Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)			graph_1-1036

Source: C:\Windows\java.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\tmpF245.tmp

Jump to dropped file

Source: C:\Users\user\Desktop\ .com.exe TID: 5536	Thread sleep time: -48000s >= -30000s	Jump to behavior
Source: C:\Windows\services.exe TID: 6480	Thread sleep count: 2844 > 30	Jump to behavior
Source: C:\Windows\java.exe TID: 3328	Thread sleep count: 1778 > 30	Jump to behavior
Source: C:\Windows\java.exe TID: 3328	Thread sleep time: -1422400s >= -30000s	Jump to behavior
Source: C:\Windows\java.exe TID: 2612	Thread sleep count: 43 > 30	Jump to behavior
Source: C:\Windows\java.exe TID: 2612	Thread sleep count: 258 > 30	Jump to behavior
Source: C:\Windows\java.exe TID: 3328	Thread sleep count: 7290 > 30	Jump to behavior
Source: C:\Windows\java.exe TID: 3328	Thread sleep time: -5832000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\services.exe TID: 3524	Thread sleep count: 7518 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\services.exe TID: 3524	Thread sleep time: -1879500s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\services.exe TID: 3524	Thread sleep count: 2480 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\services.exe TID: 3524	Thread sleep time: -620000s >= -30000s	Jump to behavior
Source: C:\Windows\services.exe TID: 6768	Thread sleep count: 9950 > 30	Jump to behavior
Source: C:\Windows\services.exe TID: 6768	Thread sleep time: -2487500s >= -30000s	Jump to behavior
Source: C:\Windows\services.exe TID: 6768	Thread sleep count: 48 > 30	Jump to behavior

Source: C:\Users\user\Desktop\ .com.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\ .com.exe	Code function: 0_2_00505717 GetSystemTime followed by cmp: cmp word ptr [ebp-10h], 07dch and CTI: jbe 00505758h		0_2_00505717
Source: C:\Windows\java.exe	Code function: 7_2_00505717 GetSystemTime followed by cmp: cmp word ptr [ebp-10h], 07dch and CTI: jbe 00505758h		7_2_00505717

Source: C:\Users\user\Desktop\ .com.exe	Code function: 0_2_005052AD lstrcat,Sleep,lstrcpy,lstrcpy,lstrlen,lstrcat,lstrcat,memset,FindFirstFileA,FindNextFileA,lstrcpy,lstrlen,lstrcat,lstrcat,Sleep,FindClose,		0_2_005052AD
Source: C:\Windows\java.exe	Code function: 7_2_005052AD lstrcat,Sleep,lstrcpy,lstrcpy,lstrlen,lstrcat,lstrcat,memset,FindFirstFileA,FindNextFileA,lstrcpy,lstrlen,lstrcat,lstrcat,Sleep,FindClose,		7_2_005052AD

Source: C:\Users\user\Desktop\ .com.exe

Thread delayed: delay time: 48000

Source: C:\Windows\java.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\	Jump to behavior
Source: C:\Windows\java.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\UIThemes\	Jump to behavior
Source: C:\Windows\java.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\	Jump to behavior
Source: C:\Windows\java.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\	Jump to behavior
Source: C:\Windows\java.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\	Jump to behavior
Source: C:\Windows\java.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\	Jump to behavior

Source: Amcache.hve.6.dr	Binary or memory string: VMware
Source: Amcache.hve.6.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.6.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.6.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.6.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.6.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.6.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.6.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.6.dr	Binary or memory string: VMware-42 27 80 4d 99 30 0e 9c-c1 9b 2a 23 ea 1f c4 20
Source: Amcache.hve.6.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.6.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.6.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.6.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: services.exe, 00000001.00000002.4568799988.0000000000812000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000007.00000002.4570438309.000000000088E000.00000004.00000020.00020000.00000000.sdmp, services.exe, 00000009.00000002.4568741820.0000000000800000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: Amcache.hve.6.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.6.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.6.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: services.exe, 00000008.00000002.4568761248.0000000000812000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dlln
Source: Amcache.hve.6.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.6.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.6.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.6.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.6.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.6.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.6.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.6.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.6.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.6.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.6.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.6.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: .com.exe, 00000000.00000002.2204403538.000000000061E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllD
Source: Amcache.hve.6.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Users\user\Desktop\ .com.exe	API call chain: ExitProcess graph end node			graph_0-2984
Source: C:\Windows\services.exe	API call chain: ExitProcess graph end node			graph_1-1005

Source: C:\Users\user\Desktop\ .com.exe

Process queried: DebugPort

Source: C:\Users\user\Desktop\ .com.exe

Code function: 0_2_00505A45 LdrInitializeThunk,lstrcpy,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcpy,lstrcat,lstrcat,lstrcpy,lstrcpy,

0_2_00505A45

Source: C:\Users\user\Desktop\ .com.exe

Code function: 0_2_00503620 GetModuleHandleA,LoadLibraryA,GetProcAddress,InternetGetConnectedState,

0_2_00503620

Source: C:\Users\user\Desktop\ .com.exe

Code function: 0_2_00504E00 GetProcessHeap,RtlAllocateHeap,CreateFileA,ReadFile,ReadFile,FindCloseChangeNotification,GetProcessHeap,HeapFree,

0_2_00504E00

Source: C:\Users\user\Desktop\ .com.exe	Process created: C:\Windows\services.exe C:\Windows\services.exe			Jump to behavior
Source: C:\Windows\java.exe	Process created: C:\Users\user\AppData\Local\Temp\services.exe C:\Users\user\AppData\Local\Temp\services.exe			Jump to behavior

Source: C:\Users\user\Desktop\ .com.exe

Code function: 0_2_005032CB lstrlen,GetLocalTime,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeZoneInformation,lstrcat,wsprintfA,

0_2_005032CB

Source: C:\Users\user\Desktop\ .com.exe

Code function: 0_2_005032CB lstrlen,GetLocalTime,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeZoneInformation,lstrcat,wsprintfA,

0_2_005032CB

Source: Amcache.hve.6.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.6.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.6.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.6.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23090.2008-0\msmpeng.exe
Source: Amcache.hve.6.dr	Binary or memory string: MsMpEng.exe

Source: C:\Users\user\Desktop\ .com.exe	Code function: 0_2_0050311C FindWindowA,FindWindowA,FindWindowA,FindWindowA,RtlExitUserThread,		0_2_0050311C
Source: C:\Windows\java.exe	Code function: 7_2_0050311C FindWindowA,FindWindowA,FindWindowA,FindWindowA,RtlExitUserThread,GetModuleHandleA,GetProcAddress,		7_2_0050311C

Source: C:\Windows\services.exe

Code function: 1_2_00401F0E GetProcessHeap,RtlAllocateHeap,htons,htons,socket,closesocket,Sleep,htons,socket,bind,listen,CreateThread,select,Sleep,GetProcessHeap,RtlAllocateHeap,accept,closesocket,accept,GetProcessHeap,HeapFree,CreateThread,CloseHandle,

1_2_00401F0E

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Native API	1 Registry Run Keys / Startup Folder	11 Process Injection	22 Masquerading	OS Credential Dumping	12 System Time Discovery	Remote Services	1 Email Collection	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Exploitation for Client Execution	1 DLL Side-Loading	1 Registry Run Keys / Startup Folder	121 Virtualization/Sandbox Evasion	LSASS Memory	131 Security Software Discovery	Remote Desktop Protocol	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	11 Process Injection	Security Account Manager	121 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	21 Obfuscated Files or Information	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	21 Software Packing	LSA Secrets	2 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	2 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 File Deletion	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
.com.exe	74%	ReversingLabs	Win32.Trojan.FlyAgent
.com.exe	100%	Avira	TR/Spy.Banker.Gen
.com.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Windows\java.exe	100%	Avira	TR/Spy.Banker.Gen
C:\Users\user\AppData\Local\Temp\services.exe	100%	Avira	BDS/Backdoor.fszhy
C:\Users\user\AppData\Local\Temp\tmpF245.tmp	100%	Avira	TR/Spy.Banker.Gen
C:\Windows\services.exe	100%	Avira	BDS/Backdoor.fszhy
C:\Users\user\AppData\Local\Temp\tmp5339.tmp	100%	Joe Sandbox ML
C:\Windows\java.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\services.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\tmpF245.tmp	100%	Joe Sandbox ML
C:\Windows\services.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\services.exe	100%	ReversingLabs	Win32.Worm.Mydoom
C:\Windows\java.exe	74%	ReversingLabs	Win32.Trojan.FlyAgent
C:\Windows\services.exe	100%	ReversingLabs	Win32.Worm.Mydoom

Source	Detection	Scanner	Label
https://europe.dbgcreepp	0%	Avira URL Cloud	safe
https://denmark.smartscre_	0%	Avira URL Cloud	safe
https://denmark.smartscre_curlrcom	0%	Avira URL Cloud	safe
http://www.altavista.com/web/results?q=%s&kgs=0&kls=0	0%	Avira URL Cloud	safe
https://southkoreregid.1991-06.com.microsoftza	0%	Avira URL Cloud	safe
https://europe.d	0%	Avira URL Cloud	safe
https://unitedstates4.ss.wd.microsoft.us	0%	Avira URL Cloud	safe
https://southafrica.smartscreen.microsoft	0%	Avira URL Cloud	safe
https://unitedstates1.ss.wd.microsoft.us	0%	Avira URL Cloud	safe
https://unitedstates2.ss.wd.microsoft.us	0%	Avira URL Cloud	safe

Name	Source	Malicious	Antivirus Detection	Reputation
https://southafrica.smartscreen.microsoft	.com.exe, 00000000.00000002.2204403538.0000000000668000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.altavista.com/web/results?q=%s&kgs=0&kls=0	.com.exe, .com.exe, 00000000.00000002.2204036339.0000000000501000.00000040.00000001.01000000.00000003.sdmp, java.exe, java.exe, 00000007.00000002.4568272926.0000000000501000.00000040.00000001.01000000.00000007.sdmp	false	Avira URL Cloud: safe	unknown
http://www.google.com/search?hl=en&ie=UTF-8&oe=UTF-8&q=%s	.com.exe, .com.exe, 00000000.00000002.2204036339.0000000000501000.00000040.00000001.01000000.00000003.sdmp, java.exe, java.exe, 00000007.00000002.4568272926.0000000000501000.00000040.00000001.01000000.00000007.sdmp	false		high
https://denmark.smartscre_	.com.exe, 00000000.00000002.2204403538.0000000000668000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://search.lycos.com/default.asp?lpv=1&loc=searchhp&tab=web&query=%s&nbq=%dhttp://www.altavista.c	.com.exe, 00000000.00000002.2204036339.0000000000501000.00000040.00000001.01000000.00000003.sdmp, java.exe, 00000007.00000002.4568272926.0000000000501000.00000040.00000001.01000000.00000007.sdmp	false		high
http://upx.sf.net	Amcache.hve.6.dr	false		high
https://europe.dbgcreepp	.com.exe, 00000000.00000002.2204403538.0000000000668000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://search.lycos.com/default.asp?lpv=1&loc=searchhp&tab=web&query=%s	.com.exe, .com.exe, 00000000.00000002.2204036339.0000000000501000.00000040.00000001.01000000.00000003.sdmp, java.exe, java.exe, 00000007.00000002.4568272926.0000000000501000.00000040.00000001.01000000.00000007.sdmp	false		high
https://europe.d	.com.exe, 00000000.00000002.2204403538.0000000000668000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://search.yahoo.com/search?p=%s&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=	.com.exe, .com.exe, 00000000.00000002.2204036339.0000000000501000.00000040.00000001.01000000.00000003.sdmp, java.exe, java.exe, 00000007.00000002.4568272926.0000000000501000.00000040.00000001.01000000.00000007.sdmp	false		high
https://denmark.smartscre_curlrcom	.com.exe, 00000000.00000002.2204403538.0000000000668000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
https://unitedstates4.ss.wd.microsoft.us	.com.exe, 00000000.00000002.2204403538.0000000000668000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://southkoreregid.1991-06.com.microsoftza	.com.exe, 00000000.00000002.2204403538.0000000000668000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://unitedstates2.ss.wd.microsoft.us	.com.exe, 00000000.00000002.2204403538.000000000061E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://unitedstates1.ss.wd.microsoft.us	.com.exe, 00000000.00000002.2204403538.0000000000668000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious

Private

IP
172.16.1.166
10.0.2.15
172.16.1.4
192.168.2.14
10.127.0.3
172.16.1.2
172.16.1.104
192.168.2.18
192.168.2.9

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1410989
Start date and time:	2024-03-18 14:35:59 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 48s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	12
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	.com.exe renamed because original name is a hash value
Original Sample Name:	instruction.htm .com.exe
Detection:	MAL
Classification:	mal100.spre.expl.evad.winEXE@8/13@0/9
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 68 Number of non-executed functions: 66
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information.
Exclude process from analysis (whitelisted): dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.42.65.92, 17.179.253.242
Excluded domains from analysis (whitelisted): apple.com, client.wns.windows.com, onedsblobprdeus17.eastus.cloudapp.azure.com, ocsp.digicert.com, mx-in-rno.apple.com, login.live.com, slscr.update.microsoft.com, blobcollector.events.data.trafficmanager.net, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: .com.exe

Simulations

Behavior and APIs

Time	Type	Description
14:36:45	API Interceptor	1x Sleep call for process: .com.exe modified
14:36:47	Autostart	Run: HKLM\Software\Microsoft\Windows\CurrentVersion\Run JavaVM C:\Windows\java.exe
14:36:55	Autostart	Run: HKLM\Software\Microsoft\Windows\CurrentVersion\Run Services C:\Windows\services.exe
14:36:56	API Interceptor	1x Sleep call for process: WerFault.exe modified
14:37:29	API Interceptor	2500110x Sleep call for process: java.exe modified
14:37:31	API Interceptor	2166023x Sleep call for process: services.exe modified

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\services.exe	instruction.scr.exe	Get hash	malicious	MyDoom	Browse
	.scr.exe	Get hash	malicious	MyDoom	Browse
	message.com.exe	Get hash	malicious	MyDoom	Browse
	letter.com.exe	Get hash	malicious	MyDoom	Browse
	yBvb5QQho4.exe	Get hash	malicious	MyDoom	Browse
	fsjRK2SX4t.exe	Get hash	malicious	MyDoom	Browse
	SecuriteInfo.com.Win32.HLLM.MyDoom.54464.3216.exe	Get hash	malicious	MyDoom	Browse
	.exe	Get hash	malicious	MyDoom	Browse
	Cg7HLh2mus.exe	Get hash	malicious	MyDoom	Browse
	AHnFoINkgu.exe	Get hash	malicious	MyDoom	Browse

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_.com.exe_532a1c85ccf97a88b6c767898461e0aa5a7927b_c857d077_bd394482-40cb-47de-84be-3ef2afd40a7d\Report.wer

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8543619628301916
Encrypted:	false
SSDEEP:	96:g+FxLlLAx9syhM1yDfwQXIDcQvc6QcEVcw3cE/n+HbHg/opAnQzOqg7TlOy4aEuE:Pux9H0BU/gjdKzuiFrZ24IO87OM
MD5:	20673EC9C7AFCC45F423994ADC299BED
SHA1:	2388865D5980FB02F7FEF2D267E1255A1535EECD
SHA-256:	B7EF9675D9A94E35DAB6ADBC86A6BE09B6B03FCAE499F986D1698CB4B839A262
SHA-512:	8B97480448D97EE2D7B0E91549719670E6E57B6B18A0531411066FDE7F8A124BE1591E797A139A1FF988C62356744D888202C3F1C40FFEF06823F2C6D0F8D1C9
Malicious:	false
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.5.2.4.2.6.1.4.3.8.3.5.0.8.0.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.5.5.2.4.2.6.1.5.2.1.1.6.3.2.0.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.b.d.3.9.4.4.8.2.-.4.0.c.b.-.4.7.d.e.-.8.4.b.e.-.3.e.f.2.a.f.d.4.0.a.7.d.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.7.3.b.a.f.6.a.e.-.1.d.f.6.-.4.0.d.a.-.8.e.3.b.-.2.0.0.6.3.8.2.c.5.7.8.3.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=. . . . ...c.o.m...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.d.5.8.-.0.0.0.1.-.0.0.1.5.-.5.7.1.8.-.f.b.5.1.3.9.7.9.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.7.7.9.4.0.b.a.5.7.6.a.a.8.4.6.3.5.d.9.1.d.7.b.1.9.9.5.7.e.7.5.d.0.0.0.0.f.f.f.f.!.0.0.0.0.d.b.2.d.b.1.7.c.1.d.3.e.2.c.4.f.3.a.4.5.a.a.d.9.2.1.5.c.c.7.7.e.d.4.5.5.f.f.c.c.!. . . . ...c.o.m...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER72B1.tmp.dmp

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Mon Mar 18 13:36:54 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	99082
Entropy (8bit):	1.9719455879344538
Encrypted:	false
SSDEEP:	384:jna14Oqq498D+jmihIhhtqLItZSjopqNOCpyuNOfSU7ep/x:KjZ4HhINqo778
MD5:	BF830199210033620FC920E07D18EB81
SHA1:	B83577224BAF2095D266F26DEC5917219206DDAF
SHA-256:	7C50178B702FCAA9FDFADA2DF8CBF59681396AA44B3951F21186B29BC10A7F1A
SHA-512:	DDC2FD56BA951A6885F882FCAC794CE308B4467A74E5F444CBA9EFB6C882B2C409EA8EAF2AACAD3D17D85038DBE4EB11FC96C2181610CC224645C646788D2090
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... .......vC.e........................................*>..........T.......8...........T...............BT......................x...............................................................................eJ..............GenuineIntel............T.......X...mC.e.............................0..2...............W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER74A6.tmp.WERInternalMetadata.xml

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8316
Entropy (8bit):	3.693237086548923
Encrypted:	false
SSDEEP:	192:R6l7wVeJev626Y2DNSU9FTgmfnJjBpr189bansfk+m:R6lXJm626YASU9FTgmfnJj+asfU
MD5:	88977EC5A0476C714715927E9D7432C9
SHA1:	DDD1B3B8790DC43AA068F7AB49F4F0C1BC13981A
SHA-256:	C874A6AD45DD5413BDB47279BFCA653E54E4CE8B543E58AAFB799EA4547DA5FE
SHA-512:	7041D732BA069D28F21956D1C485012610FCCF3382B2EE5364A3A598FD0C8DE8B696186C009B2EC67ADD36B2B3102024928AFE143334402C7D073B8FF700176D
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.3.4.1.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER74E5.tmp.xml

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4567
Entropy (8bit):	4.414719805422548
Encrypted:	false
SSDEEP:	48:cvIwWl8zsnJg77aI9ZmWpW8VYoYm8M4J58FAvc+q8oTsjtR/x3mJd:uIjfJI77n7VUJTU/sjt5x3mJd
MD5:	C214B4089F941DC6F9DE76272113F1BF
SHA1:	017CC8C83D28931641575DE55667F0102A98ACEF
SHA-256:	E1E3B1B89FD579E01F2508548B63DD27F01631EE95AC436D9D84E34A795C5270
SHA-512:	CA10638BA95B4C591A42528600D49127670E2A813FAFB596D1B6DBB033B8137245766E5922B2AE524F0DEADE83E73F8D2F92F66A11A7E89DF810E15B02D812DE
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="240759" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Users\user\AppData\Local\Temp\services.exe

Process:	C:\Windows\java.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	6.951274251785221
Encrypted:	false
SSDEEP:	192:tZWNqWKIzebvOZnzCj6juhEJS3/Uf/tpfmG62X9f3:tZ6qWTYvczfahX/UHtF6e9f3
MD5:	B0FE74719B1B647E2056641931907F4A
SHA1:	E858C206D2D1542A79936CB00D85DA853BFC95E2
SHA-256:	BF316F51D0C345D61EAEE3940791B64E81F676E3BCA42BAD61073227BEE6653C
SHA-512:	9C82E88264696D0DADEF9C0442AD8D1183E48F0FB355A4FC9BF4FA5DB4E27745039F98B1FD1FEBFF620A5DED6DD493227F00D7D2E74B19757685AA8655F921C2
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 100%
Joe Sandbox View:	Filename: instruction.scr.exe, Detection: malicious, Browse Filename: .scr.exe, Detection: malicious, Browse Filename: message.com.exe, Detection: malicious, Browse Filename: letter.com.exe, Detection: malicious, Browse Filename: yBvb5QQho4.exe, Detection: malicious, Browse Filename: fsjRK2SX4t.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Win32.HLLM.MyDoom.54464.3216.exe, Detection: malicious, Browse Filename: .exe, Detection: malicious, Browse Filename: Cg7HLh2mus.exe, Detection: malicious, Browse Filename: AHnFoINkgu.exe, Detection: malicious, Browse
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................PE..L........................ .......@..pg...P...p....@..........................................................................p......................................................................................................................UPX0.....@..............................UPX1..... ...P......................@...UPX2.........p......................@..............................................................................................................................................................................................................................................................................................................................................................................................................................................1.24.UPX!....

C:\Users\user\AppData\Local\Temp\tmp5339.tmp

Process:	C:\Windows\java.exe
File Type:	Zip archive data, at least v1.0 to extract, compression method=store
Category:	modified
Size (bytes):	43082
Entropy (8bit):	5.919302793183291
Encrypted:	false
SSDEEP:	768:8EwHupU99d2JE0jNJJ83+8zzqgTdVY9/V:8EwVs+0jNDY1qi/qd
MD5:	124B7F11670EACBEF87715EB5246BF72
SHA1:	4150723F29428194B2C4A95A87353842D927EB26
SHA-256:	850AFFEA519E6280CCA2812E52BD61FC97C83CA9301D4A60FDFE9A46261B95B7
SHA-512:	2B535530CCD530A95B3A9768A91B97CED5B88E098D1AB8B366BC338F6D02748F34E43566DB9CA40B69B0BC8C2250D2AAB7CE47513AA71C85CE4C6C9A0122507D
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	low
Preview:	PK........Wf.0A.Uj..........apple.comMZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...............................................................................................PE..L........................b..........$.............P.............................................................................0...................................................................................................................UPX0....................................UPX1.....`.......`..................@....rsrc................d..............@....text................r.............. ....................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpF245.tmp

Process:	C:\Windows\java.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	42966
Entropy (8bit):	5.920540053120464
Encrypted:	false
SSDEEP:	768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/:AEwVs+0jNDY1qi/q
MD5:	29E4B34709AA95FA4189F0340FCD3869
SHA1:	579935A09FEB86FE6ED921B89C1D1C2AA7C116A8
SHA-256:	2EB6D37566A40E43AB4206214556921CA0F62AD8D76FF15CD9385BCA2365B46F
SHA-512:	679482ACD5F7F7638749A92BB05BB11C52FD2215C7D3D4C986BC172D266FAC42714B86D76AB387C682A12A073EE9703609CF923F4B68AAF9777082AB767E8DB1
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...............................................................................................PE..L........................b..........$.............P.............................................................................0...................................................................................................................UPX0....................................UPX1.....`.......`..................@....rsrc................d..............@....text................r.............. ..............................................................................................................................................................................................................................................................................................................................................................................1.24.UPX!....

C:\Users\user\AppData\Local\Temp\tmpF245.tmp:Zone.Identifier

Process:	C:\Windows\java.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Temp\zincite.log

Process:	C:\Users\user\Desktop\ .com.exe
File Type:	data
Category:	dropped
Size (bytes):	128
Entropy (8bit):	5.7528209267673045
Encrypted:	false
SSDEEP:	3:v+71kalcQ9VdJgjJZGpyPtPsbgqYUqXbGfL97t8Qh:vi1kutNJg4pylCg7XSfL97uQh
MD5:	0159C0BB4689222E72001A5D33336D4B
SHA1:	77E06830296F998584B2B9949C366822E4A4718D
SHA-256:	3BF6AF374EBA669A13BDEA8CED3C4D284616C5FB92F8199C465F54546485D023
SHA-512:	5B896547BF23FCA6EB0B9B7C2C339C8F85E76B3C6C5B2147E480B0790DC73F6C74B108D6FDA56B1955E7F1BE3808DCAF9D8450B9F9B38588C1A16B7A3ED7CFE2
Malicious:	false
Preview:	..`....^...Q.NN.@;7.@.r...0..(..y...*8.'F..EF..BF..^F..A.W.LF..@0..k.Wa..Wa..Wa..Wa..W..c.b2.Wa...Pc....8.................p.Q

C:\Windows\appcompat\Programs\Amcache.hve

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.4685561320578495
Encrypted:	false
SSDEEP:	6144:ozZfpi6ceLPx9skLmb0fpZWSP3aJG8nAgeiJRMMhA2zX4WABluuN5jDH5S:+ZHtpZWOKnMM6bFpnj4
MD5:	0979DB735B9DA0AF767D4F71077D959E
SHA1:	CBD04A82A455F507CD444C56FC0E31B36BC22630
SHA-256:	8C858C0E3E4449C2422A147931BC3EB8A042715BF45A90488DE3602FE3D04771
SHA-512:	8A1D483D0CBBCF9856CF8765AE0EF858FB0B3465F9FA243A2636270373674D7BB52D34733CCE1D1E5F3F8FA0667650790B9E44C8B39C785E57C6532462FE4C42
Malicious:	false
Preview:	regfH...H....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm...W9y..............................................................................................................................................................................................................................................................................................................................................e..c........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\java.exe

Process:	C:\Users\user\Desktop\ .com.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	42966
Entropy (8bit):	5.920676271954214
Encrypted:	false
SSDEEP:	768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/:AEwVs+0jNDY1qi/q
MD5:	B1F6A4CC592F3C9F7D4B69C02AC74D11
SHA1:	DB2DB17C1D3E2C4F3A45AAD9215CC77ED455FFCC
SHA-256:	3DB846A796CAA001666DF8F7CAE709FFF02F984711B0E70E0E79C457D631B4E5
SHA-512:	66C3D5CB3C9BF13604748853797E4C1A1EAE13D52CDF43F16DA0B1B180AD0C10102A2935D4D6BD0549F6E48427C0181CBB07F1EE664274727DFF0CC61E5075C5
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 74%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...............................................................................................PE..L........................b..........$.............P.............................................................................0...................................................................................................................UPX0....................................UPX1.....`.......`..................@....rsrc................d..............@....text................r.............. ..............................................................................................................................................................................................................................................................................................................................................................................1.24.UPX!....

C:\Windows\java.exe:Zone.Identifier

Process:	C:\Users\user\Desktop\ .com.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

C:\Windows\services.exe

Process:	C:\Users\user\Desktop\ .com.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	6.951274251785221
Encrypted:	false
SSDEEP:	192:tZWNqWKIzebvOZnzCj6juhEJS3/Uf/tpfmG62X9f3:tZ6qWTYvczfahX/UHtF6e9f3
MD5:	B0FE74719B1B647E2056641931907F4A
SHA1:	E858C206D2D1542A79936CB00D85DA853BFC95E2
SHA-256:	BF316F51D0C345D61EAEE3940791B64E81F676E3BCA42BAD61073227BEE6653C
SHA-512:	9C82E88264696D0DADEF9C0442AD8D1183E48F0FB355A4FC9BF4FA5DB4E27745039F98B1FD1FEBFF620A5DED6DD493227F00D7D2E74B19757685AA8655F921C2
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................PE..L........................ .......@..pg...P...p....@..........................................................................p......................................................................................................................UPX0.....@..............................UPX1..... ...P......................@...UPX2.........p......................@..............................................................................................................................................................................................................................................................................................................................................................................................................................................1.24.UPX!....

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Entropy (8bit):	5.920676271954214
TrID:	Win32 Executable (generic) a (10002005/4) 99.37% UPX compressed Win32 Executable (30571/9) 0.30% Win32 EXE Yoda's Crypter (26571/9) 0.26% Clipper DOS Executable (2020/12) 0.02% Generic Win/DOS Executable (2004/3) 0.02%
File name:	.com.exe
File size:	42'966 bytes
MD5:	b1f6a4cc592f3c9f7d4b69c02ac74d11
SHA1:	db2db17c1d3e2c4f3a45aad9215cc77ed455ffcc
SHA256:	3db846a796caa001666df8f7cae709fff02f984711b0e70e0e79c457d631b4e5
SHA512:	66c3d5cb3c9bf13604748853797e4c1a1eae13d52cdf43f16da0b1b180ad0c10102a2935d4d6bd0549f6e48427c0181cbb07f1ee664274727dff0cc61e5075c5
SSDEEP:	768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/:AEwVs+0jNDY1qi/q
TLSH:	8D13E0983E8FBD42D2840C382903EE7ABE52FD444D09268BB5B87B0BBDB1F95455DC46
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...............................................................................................PE..L........................b.........

File Icon


Icon Hash:	9361c4a092b08082

Static PE Info

General

Entrypoint:	0x510024
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x500000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:
Time Stamp:	0x0 [Thu Jan 1 00:00:00 1970 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	98cd465c2ab2841f9fd90d5e847563f4

Entrypoint Preview

Instruction
stc
jc 00007F6EC0C2DE49h
pop ds
xor esi, dword ptr [ecx-49h]
cwde
leave
jmp 00007F6EC0C2DEA2h
jmp 00007F6EC0C2DE45h
cmp dl, byte ptr [ebp+0006E8D2h]
add byte ptr [eax], al
dec ecx
stc
mov dl, EDh
pop ecx
pop ebx
jc 00007F6EC0C2DE49h
jne 00007F6EC0C2DDD7h
jnl 00007F6EC0C2DE25h
sbb dword ptr [edx-383C7EDCh], FFFFFFFFh

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xf514	0x130	.rsrc
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xf000	0x514	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x101f7	0x8	.text
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
UPX0	0x1000	0x8000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
UPX1	0x9000	0x6000	0x6000	95e7e2aea06fcf90374e473c416d1137	False	0.9812825520833334	data	7.938048293950375	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xf000	0x1000	0x800	60d328df3a5dff05a8db261a75a0deda	False	0.27880859375	data	2.6542421841999686	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.text	0x10000	0x1ff	0x200	49d1ec1d6eed7ca336017bbbebab7b7d	False	0.978515625	data	6.805048281534057	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xf0d8	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 640	English	United States	0.2782258064516129
RT_ICON	0xf3c4	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	United States	0.4189189189189189
RT_GROUP_ICON	0xf4f0	0x22	data	English	United States	1.0

Imports

DLL	Import
KERNEL32.DLL	LoadLibraryA, GetProcAddress, ExitProcess
ADVAPI32.dll	RegCloseKey
MSVCRT.dll	memset
USER32.dll	wsprintfA
WS2_32.dll	gethostname

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 18, 2024 14:36:47.602288961 CET	49713	1034	192.168.2.6	172.16.1.2
Mar 18, 2024 14:36:48.601149082 CET	49713	1034	192.168.2.6	172.16.1.2
Mar 18, 2024 14:36:50.601166964 CET	49713	1034	192.168.2.6	172.16.1.2
Mar 18, 2024 14:36:54.601149082 CET	49713	1034	192.168.2.6	172.16.1.2
Mar 18, 2024 14:37:02.601167917 CET	49713	1034	192.168.2.6	172.16.1.2
Mar 18, 2024 14:37:08.603070974 CET	49721	1034	192.168.2.6	172.16.1.4
Mar 18, 2024 14:37:09.616800070 CET	49721	1034	192.168.2.6	172.16.1.4
Mar 18, 2024 14:37:11.632421017 CET	49721	1034	192.168.2.6	172.16.1.4
Mar 18, 2024 14:37:15.632402897 CET	49721	1034	192.168.2.6	172.16.1.4
Mar 18, 2024 14:37:23.632411003 CET	49721	1034	192.168.2.6	172.16.1.4
Mar 18, 2024 14:37:29.633754969 CET	49724	1034	192.168.2.6	172.16.1.166
Mar 18, 2024 14:37:30.632405996 CET	49724	1034	192.168.2.6	172.16.1.166
Mar 18, 2024 14:37:32.632445097 CET	49724	1034	192.168.2.6	172.16.1.166
Mar 18, 2024 14:37:36.632396936 CET	49724	1034	192.168.2.6	172.16.1.166
Mar 18, 2024 14:37:44.632435083 CET	49724	1034	192.168.2.6	172.16.1.166
Mar 18, 2024 14:38:11.634995937 CET	49730	1034	192.168.2.6	10.0.2.15
Mar 18, 2024 14:38:12.648094893 CET	49730	1034	192.168.2.6	10.0.2.15
Mar 18, 2024 14:38:14.663645983 CET	49730	1034	192.168.2.6	10.0.2.15
Mar 18, 2024 14:38:18.757368088 CET	49730	1034	192.168.2.6	10.0.2.15
Mar 18, 2024 14:38:26.757381916 CET	49730	1034	192.168.2.6	10.0.2.15
Mar 18, 2024 14:38:54.555514097 CET	49733	1034	192.168.2.6	10.127.0.3
Mar 18, 2024 14:38:55.648008108 CET	49733	1034	192.168.2.6	10.127.0.3
Mar 18, 2024 14:38:57.648058891 CET	49733	1034	192.168.2.6	10.127.0.3
Mar 18, 2024 14:39:01.648014069 CET	49733	1034	192.168.2.6	10.127.0.3
Mar 18, 2024 14:39:09.648015976 CET	49733	1034	192.168.2.6	10.127.0.3
Mar 18, 2024 14:39:36.932564974 CET	49736	1034	192.168.2.6	172.16.1.4
Mar 18, 2024 14:39:37.944891930 CET	49736	1034	192.168.2.6	172.16.1.4
Mar 18, 2024 14:39:40.054251909 CET	49736	1034	192.168.2.6	172.16.1.4
Mar 18, 2024 14:39:44.054244041 CET	49736	1034	192.168.2.6	172.16.1.4
Mar 18, 2024 14:39:52.148000956 CET	49736	1034	192.168.2.6	172.16.1.4
Mar 18, 2024 14:40:19.259031057 CET	49738	1034	192.168.2.6	172.16.1.4
Mar 18, 2024 14:40:20.351142883 CET	49738	1034	192.168.2.6	172.16.1.4
Mar 18, 2024 14:40:22.444873095 CET	49738	1034	192.168.2.6	172.16.1.4
Mar 18, 2024 14:40:26.554239035 CET	49738	1034	192.168.2.6	172.16.1.4
Mar 18, 2024 14:40:34.554217100 CET	49738	1034	192.168.2.6	172.16.1.4
Mar 18, 2024 14:40:40.555363894 CET	49740	1034	192.168.2.6	172.16.1.104
Mar 18, 2024 14:40:41.554260015 CET	49740	1034	192.168.2.6	172.16.1.104
Mar 18, 2024 14:40:43.554259062 CET	49740	1034	192.168.2.6	172.16.1.104
Mar 18, 2024 14:40:47.757380962 CET	49740	1034	192.168.2.6	172.16.1.104
Mar 18, 2024 14:40:55.851130962 CET	49740	1034	192.168.2.6	172.16.1.104

Target ID:	0
Start time:	14:36:45
Start date:	18/03/2024
Path:	C:\Users\user\Desktop\ .com.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\ .com.exe
Imagebase:	0x500000
File size:	42'966 bytes
MD5 hash:	B1F6A4CC592F3C9F7D4B69C02AC74D11
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_MyDoom, Description: Yara detected MyDoom, Source: 00000000.00000002.2204036339.0000000000501000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Target ID:	1
Start time:	14:36:45
Start date:	18/03/2024
Path:	C:\Windows\services.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\services.exe
Imagebase:	0x400000
File size:	8'192 bytes
MD5 hash:	B0FE74719B1B647E2056641931907F4A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 100%, ReversingLabs
Reputation:	moderate
Has exited:	false

Target ID:	6
Start time:	14:36:54
Start date:	18/03/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 3416 -s 1188
Imagebase:	0x260000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	7
Start time:	14:36:55
Start date:	18/03/2024
Path:	C:\Windows\java.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\java.exe"
Imagebase:	0x500000
File size:	42'966 bytes
MD5 hash:	B1F6A4CC592F3C9F7D4B69C02AC74D11
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_MyDoom, Description: Yara detected MyDoom, Source: 00000007.00000002.4568272926.0000000000501000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 74%, ReversingLabs
Reputation:	low
Has exited:	false

Target ID:	8
Start time:	14:36:55
Start date:	18/03/2024
Path:	C:\Users\user\AppData\Local\Temp\services.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\services.exe
Imagebase:	0x400000
File size:	8'192 bytes
MD5 hash:	B0FE74719B1B647E2056641931907F4A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 100%, ReversingLabs
Reputation:	moderate
Has exited:	false

Target ID:	9
Start time:	14:37:03
Start date:	18/03/2024
Path:	C:\Windows\services.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\services.exe"
Imagebase:	0x400000
File size:	8'192 bytes
MD5 hash:	B0FE74719B1B647E2056641931907F4A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false