Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
Message from KM_360i

Overview

General Information

Sample name:	Message from KM_360i
Analysis ID:	1426966
MD5:	cc69a1fef8939fa319178c5be871b5de
SHA1:	4a75d4e538b70a9a2deb101620ff7b9fc706a758
SHA256:	0ab6f5f6d7931d6d197cc06ac5eb8d1b1625e7a404f2dd5f6c02c8fc4abb7fbd
Infos:

Detection

Score:	1
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

Creates a process in suspended mode (likely to inject code)

Queries the volume information (name, serial number etc) of a device

Classification

×

Process Tree

System is w10x64_ra

OpenWith.exe (PID: 408 cmdline: C:\Windows\system32\OpenWith.exe -Embedding MD5: E4A834784FA08C17D47A1E72429C5109)

notepad.exe (PID: 4892 cmdline: "C:\Windows\system32\NOTEPAD.EXE" C:\Users\user\Desktop\Message from KM_360i MD5: 27F71B12CB585541885A31BE22F61C83)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: classification engine

Classification label: clean1.win@3/0@0/0

Source: C:\Windows\System32\OpenWith.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:408:120:WilError_03

Source: C:\Windows\System32\OpenWith.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\System32\OpenWith.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\OpenWith.exe C:\Windows\system32\OpenWith.exe -Embedding
Source: C:\Windows\System32\OpenWith.exe	Process created: C:\Windows\System32\notepad.exe "C:\Windows\system32\NOTEPAD.EXE" C:\Users\user\Desktop\Message from KM_360i
Source: C:\Windows\System32\OpenWith.exe	Process created: C:\Windows\System32\notepad.exe "C:\Windows\system32\NOTEPAD.EXE" C:\Users\user\Desktop\Message from KM_360i			Jump to behavior

Source: C:\Windows\System32\OpenWith.exe	Section loaded: kernel.appcore.dll			Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: uxtheme.dll			Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: onecoreuapcommonproxystub.dll			Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.storage.dll			Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: wldp.dll			Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: twinui.dll			Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: wintypes.dll			Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: powrprof.dll			Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dwmapi.dll			Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: pdh.dll			Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: umpdc.dll			Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: onecorecommonproxystub.dll			Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: actxprxy.dll			Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: propsys.dll			Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.staterepositoryps.dll			Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.ui.appdefaults.dll			Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.ui.immersive.dll			Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: profapi.dll			Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: ntmarta.dll			Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: uiautomationcore.dll			Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dui70.dll			Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: duser.dll			Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dwrite.dll			Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: bcp47mrm.dll			Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: uianimation.dll			Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d11.dll			Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dxgi.dll			Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d10warp.dll			Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: resourcepolicyclient.dll			Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dxcore.dll			Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dcomp.dll			Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: oleacc.dll			Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: edputil.dll			Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.ui.dll			Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windowmanagementapi.dll			Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: textinputframework.dll			Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: inputhost.dll			Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: coremessaging.dll			Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: coreuicomponents.dll			Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: coreuicomponents.dll			Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: coremessaging.dll			Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: twinapi.appcore.dll			Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: coremessaging.dll			Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: twinapi.appcore.dll			Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windowscodecs.dll			Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: thumbcache.dll			Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: policymanager.dll			Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: msvcp110_win.dll			Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: sxs.dll			Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: directmanipulation.dll			Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: textshaping.dll			Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: urlmon.dll			Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: iertutil.dll			Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: srvcli.dll			Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: netutils.dll			Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: sspicli.dll			Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: appresolver.dll			Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: bcp47langs.dll			Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: slc.dll			Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: userenv.dll			Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: sppc.dll			Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: pcacli.dll			Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: mpr.dll			Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: sfc_os.dll			Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: kernel.appcore.dll			Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: uxtheme.dll			Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: mrmcorer.dll			Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: windows.storage.dll			Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: wldp.dll			Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: textshaping.dll			Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: efswrt.dll			Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: mpr.dll			Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: wintypes.dll			Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: twinapi.appcore.dll			Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: oleacc.dll			Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: textinputframework.dll			Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: coreuicomponents.dll			Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: coremessaging.dll			Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: ntmarta.dll			Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: urlmon.dll			Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: iertutil.dll			Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: srvcli.dll			Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: netutils.dll			Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: propsys.dll			Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: policymanager.dll			Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: msvcp110_win.dll			Jump to behavior

Source: C:\Windows\System32\OpenWith.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\InProcServer32

Jump to behavior

Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Source: C:\Windows\System32\OpenWith.exe

Process created: C:\Windows\System32\notepad.exe "C:\Windows\system32\NOTEPAD.EXE" C:\Users\user\Desktop\Message from KM_360i

Jump to behavior

Source: C:\Windows\System32\OpenWith.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation			Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation			Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation			Jump to behavior
Source: C:\Windows\System32\notepad.exe	Queries volume information: C:\Users\user\Desktop\Message from KM_360i VolumeInformation			Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	11 Process Injection	11 Process Injection	OS Credential Dumping	1 File and Directory Discovery	Remote Services	Data from Local System	Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 DLL Side-Loading	LSASS Memory	11 System Information Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

⊘No Antivirus matches

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1426966
Start date and time:	2024-04-16 20:08:40 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 8s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	12
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Message from KM_360i
Detection:	CLEAN
Classification:	clean1.win@3/0@0/0
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): fs.microsoft.com, slscr.update.microsoft.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: Message from KM_360i

Simulations

Behavior and APIs

Time	Type	Description
20:09:48	API Interceptor	1x Sleep call for process: OpenWith.exe modified

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	ASCII text, with very long lines (749), with CRLF line terminators
Entropy (8bit):	6.1126371807981865
TrID:
File name:	Message from KM_360i
File size:	68'494 bytes
MD5:	cc69a1fef8939fa319178c5be871b5de
SHA1:	4a75d4e538b70a9a2deb101620ff7b9fc706a758
SHA256:	0ab6f5f6d7931d6d197cc06ac5eb8d1b1625e7a404f2dd5f6c02c8fc4abb7fbd
SHA512:	eae4ec93cb64f218f9579193dd57c55602623c0662dceb785ad19db633511e89392a526c69a596cd58f7e87b92769d73a4bb8ba160a6bf41dbaeaa02fb947418
SSDEEP:	1536:1Xqxa2M53DGURwnmk4yIIjl5ilZfwsofdd0Hbbz/UwZ5hERk2qa6pn:5qM7wnIIjl5ilZrh/zc65hAo
TLSH:	7963BF0ADE020C75C38255EA1DDD78C35CFF3F9F546370527E38364109865E99BEAA8A
File Content Preview:	X-MS-Exchange-Organization-InternalOrgSender: False..Received: from DS7PR03CA0341.namprd03.prod.outlook.com (2603:10b6:8:55::23) by.. MW3PR16MB3673.namprd16.prod.outlook.com (2603:10b6:303:44::10) with Microsoft.. SMTP Server (version=TLS1_2, cipher=TLS_E

File Icon


Icon Hash:	72e2a2a292a2a2b2

Network Behavior

⊘No network behavior found

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: OpenWith.exePID: 408, Parent PID: 804

General

Target ID:	8
Start time:	20:09:48
Start date:	16/04/2024
Path:	C:\Windows\System32\OpenWith.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\OpenWith.exe -Embedding
Imagebase:	0x7ff7dc540000
File size:	123'984 bytes
MD5 hash:	E4A834784FA08C17D47A1E72429C5109
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: notepad.exePID: 4892, Parent PID: 408

General

Target ID:	9
Start time:	20:09:53
Start date:	16/04/2024
Path:	C:\Windows\System32\notepad.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\NOTEPAD.EXE" C:\Users\user\Desktop\Message from KM_360i
Imagebase:	0x7ff7cda80000
File size:	201'216 bytes
MD5 hash:	27F71B12CB585541885A31BE22F61C83
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly