Edit tour

Windows Analysis Report
tehtris_offline_forensic_2.6.0.0.exe

Overview

General Information

Sample name:	tehtris_offline_forensic_2.6.0.0.exe
Analysis ID:	1426616
MD5:	b24e639470b5cc0a46baa9fec06504af
SHA1:	9eed36e3dc36693372baeef8538d3024e75b8d79
SHA256:	1448e64b1323ae0ee97bcd7d712f8cb3a501c7fa06fb486f15da3601f1fa0a09
Infos:

Detection

Score:	23
Range:	0 - 100
Whitelisted:	false
Confidence:	40%

Signatures

Found pyInstaller with non standard icon

Creates a process in suspended mode (likely to inject code)

Drops PE files

Enables debug privileges

Found dropped PE file which has not been started or loaded

Queries the volume information (name, serial number etc) of a device

Uses 32bit PE files

Yara detected Keylogger Generic

Classification

Analysis Advice

Sample drops PE files which have not been started, submit dropped PE samples for a secondary analysis to Joe Sandbox

Sample searches for specific file, try point organization specific fake files to the analysis machine

Sample tries to load a library which is not present or installed on the analysis machine, adding the library might reveal more behavior

Process Tree

System is w10x64_ra

tehtris_offline_forensic_2.6.0.0.exe (PID: 7044 cmdline: "C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe" MD5: B24E639470B5CC0A46BAA9FEC06504AF)

conhost.exe (PID: 7052 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tehtris_offline_forensic_2.6.0.0.exe (PID: 6084 cmdline: "C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe" MD5: B24E639470B5CC0A46BAA9FEC06504AF)

cmd.exe (PID: 7036 cmdline: C:\Windows\system32\cmd.exe /c wmic logicaldisk get name MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

WMIC.exe (PID: 2940 cmdline: wmic logicaldisk get name MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000003.00000003.1271581246.00000000063BD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
00000003.00000003.1275516925.00000000065AA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Source: tehtris_offline_forensic_2.6.0.0.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, 32BIT_MACHINE, DEBUG_STRIPPED

Source: tehtris_offline_forensic_2.6.0.0.exe

Static PE information: certificate valid

Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.9625_none_508ef7e4bcbbe589\MSVCR90.dll

Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	File opened: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Config\
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	File opened: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	File opened: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	File opened: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\GatherLogs\SystemIndex\
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	File opened: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\GatherLogs\
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	File opened: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\

Source: Yara match	File source: 00000003.00000003.1271581246.00000000063BD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.1275516925.00000000065AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY

Source: tehtris_offline_forensic_2.6.0.0.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, 32BIT_MACHINE, DEBUG_STRIPPED

Source: classification engine

Classification label: sus23.winEXE@8/100@0/0

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7052:120:WilError_03

Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe

File created: C:\Users\user\AppData\Local\Temp\_MEI70442

Source: tehtris_offline_forensic_2.6.0.0.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: unknown	Process created: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe "C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe"
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	Process created: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe "C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe"
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	Process created: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe "C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe"
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c wmic logicaldisk get name
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic logicaldisk get name
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c wmic logicaldisk get name
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic logicaldisk get name

Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	Section loaded: version.dll
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	Section loaded: pywintypes27.dll
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	Section loaded: secur32.dll
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	Section loaded: sspicli.dll
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	Section loaded: urlmon.dll
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	Section loaded: iertutil.dll
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	Section loaded: srvcli.dll
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	Section loaded: netutils.dll
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	Section loaded: sqlite3.dll
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	Section loaded: mswsock.dll
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	Section loaded: sfc.dll
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	Section loaded: sfc_os.dll
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	Section loaded: msimg32.dll
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	Section loaded: netapi32.dll
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	Section loaded: security.dll
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	Section loaded: ntdsapi.dll
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	Section loaded: logoncli.dll
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	Section loaded: amsi.dll
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	Section loaded: userenv.dll
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	Section loaded: profapi.dll
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	Section loaded: sxs.dll
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	Section loaded: powrprof.dll
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	Section loaded: umpdc.dll
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	Section loaded: napinsp.dll
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	Section loaded: wshbth.dll
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	Section loaded: winrnr.dll
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	Section loaded: msasn1.dll
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	Section loaded: gpapi.dll
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vbscript.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sxs.dll

Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI70442\bz2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI70442\eof.forensic_scripts.volume_shadow_copy.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI70442\eof.memorpy.utils.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI70442\mfcm90.dll	Jump to dropped file
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI70442\psutil._psutil_windows.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI70442\_socket.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI70442\eof.windows_scripts.installed_softwares.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI70442\eof.forensic.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI70442\eof.windows_scripts.signatures.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI70442\eof.disk.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI70442\msvcm90.dll	Jump to dropped file
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI70442\eof.browsers_scan.firefox.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI70442\eof.memorpy.structures.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI70442\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI70442\eof.forensic_scripts.app_compat_cache.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI70442\win32process.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI70442\win32ui.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI70442\eof.psutil_xp.psutil._psutil_windows.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI70442\eof.autostarts.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI70442\Crypto.Cipher._AES.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI70442\eof.config.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI70442\eof.forensic_scripts.prefetch.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI70442\eof.memorpy.Address.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI70442\select.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI70442\win32trace.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI70442\eof.forensic_scripts.amcache.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI70442\PIL._imaging.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI70442\mfc90.dll	Jump to dropped file
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI70442\cryptography.hazmat.bindings._openssl.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI70442\mfcm90u.dll	Jump to dropped file
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI70442\win32security.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI70442\pythoncom27.dll	Jump to dropped file
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI70442\eof.browsers_scan.opera.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI70442\eof.memorpy.WinProcess.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI70442\win32evtlog.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI70442\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI70442\eof.memorpy.Locator.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI70442\eof.browsers_scan.regkey.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI70442\eof.windows_scripts.hosts.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI70442\_bsddb.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI70442\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI70442\eof.advanced.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI70442\eof.browsers_scan.chrome.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI70442\pywintypes27.dll	Jump to dropped file
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI70442\PIL._imagingtk.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI70442\eof.forensic_scripts.registry_live.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI70442\eof.process.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI70442\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI70442\eof.tools.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI70442\eof.browsers_scan.ie.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI70442\eof.memorpy.WinStructures.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI70442\pyexpat.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI70442\eof.browsers_scan.browsers_scan.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI70442\_sqlite3.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI70442\eof.forensic_scripts.registry_tracks.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI70442\eof.memscan.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI70442\mfc90u.dll	Jump to dropped file
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI70442\win32pipe.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI70442\_testcapi.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI70442\win32console.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI70442\eof.forensic_scripts.registry_file.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI70442\win32com.shell.shell.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI70442\sqlite3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI70442\eof.memorpy.Process.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI70442\_win32sysloader.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI70442\msvcr90.dll	Jump to dropped file
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI70442\win32api.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI70442\eof.eof.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI70442\win32file.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI70442\eof.forensic_scripts.recent_file_cache.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI70442\eof.forensic_scripts.registry.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI70442\eof.yarapy.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI70442\eof.windows_scripts.security_products_state.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI70442\msvcp90.dll	Jump to dropped file
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI70442\win32gui.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI70442\_cffi_backend.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI70442\eof.memorpy.BaseProcess.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI70442\eof.memorpy.MemWorker.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI70442\python27.dll	Jump to dropped file
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI70442\cryptography.hazmat.bindings._constant_time.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI70442\eof.browsers_scan.optimizejars.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI70442\eof.windows_scripts.autostarts.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI70442\eof.browsers_scan.misc.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI70442\PIL._webp.pyd	Jump to dropped file

Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX

Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70442\bz2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70442\eof.forensic_scripts.volume_shadow_copy.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70442\eof.memorpy.utils.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70442\mfcm90.dll	Jump to dropped file
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70442\psutil._psutil_windows.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70442\eof.windows_scripts.installed_softwares.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70442\_socket.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70442\eof.forensic.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70442\eof.windows_scripts.signatures.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70442\eof.disk.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70442\msvcm90.dll	Jump to dropped file
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70442\eof.browsers_scan.firefox.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70442\eof.memorpy.structures.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70442\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70442\eof.forensic_scripts.app_compat_cache.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70442\win32process.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70442\win32ui.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70442\eof.psutil_xp.psutil._psutil_windows.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70442\eof.autostarts.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70442\Crypto.Cipher._AES.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70442\eof.config.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70442\eof.forensic_scripts.prefetch.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70442\eof.memorpy.Address.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70442\win32trace.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70442\select.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70442\eof.forensic_scripts.amcache.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70442\PIL._imaging.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70442\mfc90.dll	Jump to dropped file
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70442\cryptography.hazmat.bindings._openssl.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70442\mfcm90u.dll	Jump to dropped file
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70442\win32security.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70442\pythoncom27.dll	Jump to dropped file
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70442\eof.browsers_scan.opera.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70442\eof.memorpy.WinProcess.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70442\win32evtlog.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70442\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70442\eof.memorpy.Locator.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70442\eof.browsers_scan.regkey.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70442\eof.windows_scripts.hosts.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70442\_bsddb.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70442\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70442\eof.advanced.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70442\eof.browsers_scan.chrome.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70442\eof.process.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70442\PIL._imagingtk.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70442\eof.forensic_scripts.registry_live.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70442\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70442\eof.tools.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70442\eof.browsers_scan.ie.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70442\eof.memorpy.WinStructures.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70442\pyexpat.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70442\eof.browsers_scan.browsers_scan.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70442\eof.memscan.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70442\eof.forensic_scripts.registry_tracks.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70442\_sqlite3.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70442\mfc90u.dll	Jump to dropped file
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70442\win32pipe.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70442\_testcapi.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70442\win32console.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70442\eof.forensic_scripts.registry_file.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70442\win32com.shell.shell.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70442\eof.memorpy.Process.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70442\win32api.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70442\_win32sysloader.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70442\msvcr90.dll	Jump to dropped file
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70442\eof.eof.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70442\win32file.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70442\eof.forensic_scripts.recent_file_cache.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70442\eof.forensic_scripts.registry.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70442\eof.yarapy.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70442\eof.windows_scripts.security_products_state.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70442\msvcp90.dll	Jump to dropped file
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70442\win32gui.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70442\_cffi_backend.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70442\eof.memorpy.BaseProcess.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70442\eof.memorpy.MemWorker.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70442\python27.dll	Jump to dropped file
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70442\cryptography.hazmat.bindings._constant_time.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70442\eof.browsers_scan.optimizejars.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70442\eof.windows_scripts.autostarts.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70442\eof.browsers_scan.misc.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70442\PIL._webp.pyd	Jump to dropped file

Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	Process token adjusted: Debug
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	Process token adjusted: Debug
Source: C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe	Process token adjusted: Debug

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	11 Process Injection	11 Process Injection	OS Credential Dumping	1 Process Discovery	Remote Services	Data from Local System	Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 DLL Side-Loading	LSASS Memory	1 File and Directory Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	12 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact

Source	Detection	Scanner	Label	Link
tehtris_offline_forensic_2.6.0.0.exe	0%	ReversingLabs
tehtris_offline_forensic_2.6.0.0.exe	0%	Virustotal		Browse

Source	Detection	Scanner	Link
C:\Users\user\AppData\Local\Temp\_MEI70442\Crypto.Cipher._AES.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI70442\Crypto.Cipher._AES.pyd	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\_MEI70442\PIL._imaging.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI70442\PIL._imaging.pyd	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\_MEI70442\PIL._imagingtk.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI70442\PIL._imagingtk.pyd	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\_MEI70442\PIL._webp.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI70442\PIL._webp.pyd	1%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\_MEI70442\_bsddb.pyd	2%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI70442\_bsddb.pyd	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\_MEI70442\_cffi_backend.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI70442\_cffi_backend.pyd	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\_MEI70442\_ctypes.pyd	2%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI70442\_ctypes.pyd	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\_MEI70442\_hashlib.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI70442\_hashlib.pyd	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\_MEI70442\_socket.pyd	2%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI70442\_socket.pyd	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\_MEI70442\_sqlite3.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI70442\_sqlite3.pyd	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\_MEI70442\_ssl.pyd	2%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI70442\_ssl.pyd	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\_MEI70442\_testcapi.pyd	2%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI70442\_testcapi.pyd	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\_MEI70442\_win32sysloader.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI70442\_win32sysloader.pyd	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\_MEI70442\bz2.pyd	2%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI70442\bz2.pyd	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\_MEI70442\cryptography.hazmat.bindings._constant_time.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI70442\cryptography.hazmat.bindings._constant_time.pyd	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\_MEI70442\cryptography.hazmat.bindings._openssl.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI70442\cryptography.hazmat.bindings._openssl.pyd	1%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\_MEI70442\eof.advanced.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI70442\eof.advanced.pyd	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\_MEI70442\eof.autostarts.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI70442\eof.autostarts.pyd	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\_MEI70442\eof.browsers_scan.browsers_scan.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI70442\eof.browsers_scan.browsers_scan.pyd	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\_MEI70442\eof.browsers_scan.chrome.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI70442\eof.browsers_scan.chrome.pyd	0%	Virustotal	Browse

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1426616
Start date and time:	2024-04-16 11:52:04 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	17
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled
Analysis Mode:	stream
Analysis stop reason:	Timeout
Sample name:	tehtris_offline_forensic_2.6.0.0.exe
Detection:	SUS
Classification:	sus23.winEXE@8/100@0/0
Cookbook Comments:	Found application associated with file extension: .exe

Process:	C:\Users\user\Desktop\tehtris_offline_forensic_2.6.0.0.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	4
Entropy (8bit):	2.0
Encrypted:	false
SSDEEP:
MD5:	3F1D1D8D87177D3D8D897D7E421F84D6
SHA1:	DD082D742A5CB751290F1DB2BD519C286AA86D95
SHA-256:	F02285FB90ED8C81531FE78CF4E2ABB68A62BE73EE7D317623E2C3E3AEFDFFF2
SHA-512:	2AE2B3936F31756332CA7A4B877D18F3FCC50E41E9472B5CD45A70BEA82E29A0FA956EE6A9EE0E02F23D9DB56B41D19CB51D88AAC06E9C923A820A21023752A9
Malicious:	false
Reputation:	unknown
Preview:	blat

File type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows
Entropy (8bit):	7.998291471388156
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% VXD Driver (31/22) 0.00% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	tehtris_offline_forensic_2.6.0.0.exe
File size:	15'502'144 bytes
MD5:	b24e639470b5cc0a46baa9fec06504af
SHA1:	9eed36e3dc36693372baeef8538d3024e75b8d79
SHA256:	1448e64b1323ae0ee97bcd7d712f8cb3a501c7fa06fb486f15da3601f1fa0a09
SHA512:	a64578152ecdaf9039ca99253e7108cb4fa7c12173467185dcddd5dc1053d7d75d26a476202a9c1e4fd655c90fd9e88861db3cfa2b1952039936615b29e20e71
SSDEEP:	393216:nRNR3iYOSiUq075W+4nHOdvQRjlTKKvYqFHj7ybKxg:nrdDObodvQRjhLYQPyGxg
TLSH:	C4F633C1D9263557E0FA697474FAE06CAB74BE1BB74D8E546B8CBC4631BAB32053C108
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................./...............................@..................................o........ ............................

Entrypoint:	0x401500
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, 32BIT_MACHINE, DEBUG_STRIPPED
DLL Characteristics:
Time Stamp:	0x0 [Thu Jan 1 00:00:00 1970 UTC]
TLS Callbacks:	0x409b40, 0x409af0
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	4e3e7ce958acceeb80e70eeb7d75870e

Signature Valid:	true
Signature Issuer:	CN=DigiCert EV Code Signing CA (SHA2), OU=www.digicert.com, O=DigiCert Inc, C=US
Signature Validation Error:	The operation completed successfully
Error Number:	0
Not Before, Not After	24/05/2018 02:00:00 29/04/2021 14:00:00
Subject Chain	CN=TEHTRI-Security, O=TEHTRI-Security, L=PARIS, C=FR, SERIALNUMBER=521 474 445 00017, OID.2.5.4.15=Private Organization, OID.1.3.6.1.4.1.311.60.2.1.3=FR
Version:	3
Thumbprint MD5:	68AB01C5A7DD8D27F7B27BD99CBCF928
Thumbprint SHA-1:	7F0F48F2E1C2F6FE8EAAA34A74912538C12F0230
Thumbprint SHA-256:	8E322B71935AB0060FA658B6BEE55AE9164CE6CFA084D1DC2FFD7CA4854014E3
Serial:	0665328A22F9ACA9002C179C18013237

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x1e000	0xbdc	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x21000	0xf1d4	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0xec4d98	0x3da8
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x20004	0x18	.tls
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1e214	0x1c4	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x9ca4	0x9e00	3b08f27e662ea5b8b275fcceb3cb1d5d	False	0.523017207278481	data	6.10883565459153	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0xb000	0x34	0x200	b14de7668341501705224003fff0effb	False	0.09375	data	0.5844872522908916	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0xc000	0x4f08	0x5000	b2745ae7b9f401f2707f3295671445e2	False	0.598388671875	data	7.001070768837529	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ
.bss	0x11000	0xc608	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x1e000	0xbdc	0xc00	ed3bf2b5d855e49595c481453ac3a243	False	0.4114583333333333	data	5.162175151313857	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.CRT	0x1f000	0x34	0x200	9c7ff38071b82872ebefd029cc93a8ee	False	0.072265625	Matlab v4 mat-file (little endian) \240\231@, numeric, rows 4198704, columns 0	0.2711142780062829	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x20000	0x20	0x200	8879cda41c83e55045e7c097b64d3643	False	0.0546875	data	0.1755262916558982	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x21000	0xf1d4	0xf200	f174b96bfb3179cb689f50323bffee40	False	0.788723527892562	data	7.30929649276186	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x21280	0xb18	Device independent bitmap graphic, 32 x 56 x 24, image size 0			0.4725352112676056
RT_ICON	0x21d98	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0			0.7287906137184116
RT_ICON	0x22640	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0			0.7471098265895953
RT_ICON	0x22ba8	0x909b	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced			0.9971636186822983
RT_ICON	0x2bc44	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0			0.38309128630705397
RT_ICON	0x2e1ec	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0			0.4826454033771107
RT_ICON	0x2f294	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0			0.699468085106383
RT_GROUP_ICON	0x2f6fc	0x14	data			1.1
RT_GROUP_ICON	0x2f710	0x68	data			0.7019230769230769
RT_VERSION	0x2f778	0x3a4	data			0.4238197424892704
RT_MANIFEST	0x2fb1c	0x6b5	ASCII text, with CRLF line terminators	English	United States	0.3541059988351776

DLL	Import
KERNEL32.dll	CreateProcessW, DeleteCriticalSection, EnterCriticalSection, ExpandEnvironmentStringsW, FormatMessageA, GetCommandLineW, GetCurrentProcess, GetCurrentProcessId, GetCurrentThreadId, GetEnvironmentVariableW, GetExitCodeProcess, GetLastError, GetModuleFileNameW, GetModuleHandleA, GetProcAddress, GetShortPathNameW, GetStartupInfoW, GetSystemTimeAsFileTime, GetTempPathW, GetTickCount, InitializeCriticalSection, LeaveCriticalSection, LoadLibraryA, LoadLibraryExW, MultiByteToWideChar, QueryPerformanceCounter, SetDllDirectoryW, SetEnvironmentVariableW, SetUnhandledExceptionFilter, Sleep, TerminateProcess, TlsGetValue, UnhandledExceptionFilter, VirtualProtect, VirtualQuery, WaitForSingleObject, WideCharToMultiByte
msvcrt.dll	__argc, __dllonexit, __lconv_init, __set_app_type, __setusermatherr, __wargv, __wgetmainargs, __winitenv, _amsg_exit, _cexit, _findclose, _fileno, _fmode, _fullpath, _get_osfhandle, _getpid, _initterm, _iob, _lock, _onexit, _setmode, _stat, _strdup, _unlock, _vsnprintf, _vsnwprintf, _wcmdln, _wfindfirst, _wfindnext, _wfopen, _wmkdir, _wremove, _wrmdir, _wstat, _wtempnam, abort, calloc, clearerr, exit, fclose, feof, ferror, fflush, fprintf, fread, free, fseek, ftell, fwrite, getenv, malloc, mbstowcs, memcpy, setbuf, setlocale, signal, sprintf, strcat, strchr, strcmp, strcpy, strlen, strncat, strncmp, strncpy, strrchr, strtok, vfprintf, wcscat, wcscmp, wcscpy, wcslen
WS2_32.dll	ntohl

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report tehtris_offline_forensic_2.6.0.0.exe

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

Process Tree

Yara Signatures

Memory Dumps

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Compliance

Spreading

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

General Information

Warnings

Created / dropped Files

C:\Users\user\AppData\Local\Temp\09isgp

C:\Users\user\AppData\Local\Temp\_MEI70442\Crypto.Cipher._AES.pyd

C:\Users\user\AppData\Local\Temp\_MEI70442\Include\pyconfig.h

C:\Users\user\AppData\Local\Temp\_MEI70442\Microsoft.VC90.CRT.manifest

C:\Users\user\AppData\Local\Temp\_MEI70442\Microsoft.VC90.MFC.manifest

C:\Users\user\AppData\Local\Temp\_MEI70442\PIL._imaging.pyd

C:\Users\user\AppData\Local\Temp\_MEI70442\PIL._imagingtk.pyd

C:\Users\user\AppData\Local\Temp\_MEI70442\PIL._webp.pyd

C:\Users\user\AppData\Local\Temp\_MEI70442\_bsddb.pyd

C:\Users\user\AppData\Local\Temp\_MEI70442\_cffi_backend.pyd

C:\Users\user\AppData\Local\Temp\_MEI70442\_ctypes.pyd

C:\Users\user\AppData\Local\Temp\_MEI70442\_hashlib.pyd

C:\Users\user\AppData\Local\Temp\_MEI70442\_socket.pyd

C:\Users\user\AppData\Local\Temp\_MEI70442\_sqlite3.pyd

C:\Users\user\AppData\Local\Temp\_MEI70442\_ssl.pyd

C:\Users\user\AppData\Local\Temp\_MEI70442\_testcapi.pyd

C:\Users\user\AppData\Local\Temp\_MEI70442\_win32sysloader.pyd

C:\Users\user\AppData\Local\Temp\_MEI70442\bz2.pyd

C:\Users\user\AppData\Local\Temp\_MEI70442\cryptography-1.7.2-py2.7.egg-info\DESCRIPTION.rst

C:\Users\user\AppData\Local\Temp\_MEI70442\cryptography-1.7.2-py2.7.egg-info\INSTALLER

C:\Users\user\AppData\Local\Temp\_MEI70442\cryptography-1.7.2-py2.7.egg-info\METADATA

C:\Users\user\AppData\Local\Temp\_MEI70442\cryptography-1.7.2-py2.7.egg-info\RECORD

C:\Users\user\AppData\Local\Temp\_MEI70442\cryptography-1.7.2-py2.7.egg-info\WHEEL

C:\Users\user\AppData\Local\Temp\_MEI70442\cryptography-1.7.2-py2.7.egg-info\entry_points.txt

C:\Users\user\AppData\Local\Temp\_MEI70442\cryptography-1.7.2-py2.7.egg-info\metadata.json

C:\Users\user\AppData\Local\Temp\_MEI70442\cryptography-1.7.2-py2.7.egg-info\top_level.txt

C:\Users\user\AppData\Local\Temp\_MEI70442\cryptography.hazmat.bindings._constant_time.pyd

C:\Users\user\AppData\Local\Temp\_MEI70442\cryptography.hazmat.bindings._openssl.pyd

C:\Users\user\AppData\Local\Temp\_MEI70442\embedded\yara\tehtris_enc.yar

C:\Users\user\AppData\Local\Temp\_MEI70442\eof.advanced.pyd

C:\Users\user\AppData\Local\Temp\_MEI70442\eof.autostarts.pyd

C:\Users\user\AppData\Local\Temp\_MEI70442\eof.browsers_scan.browsers_scan.pyd

C:\Users\user\AppData\Local\Temp\_MEI70442\eof.browsers_scan.chrome.pyd

C:\Users\user\AppData\Local\Temp\_MEI70442\eof.browsers_scan.firefox.pyd

C:\Users\user\AppData\Local\Temp\_MEI70442\eof.browsers_scan.ie.pyd

Windows Analysis Report
tehtris_offline_forensic_2.6.0.0.exe

C:\Users\user\AppData\Local\Temp\tmpo8tal6\gen_py\init.py

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre