Edit tour

Windows Analysis Report
AO_RDS01_2024-04-18_16_39_30.221.zip

Overview

General Information

Sample name:	AO_RDS01_2024-04-18_16_39_30.221.zip
Analysis ID:	1428288
MD5:	f827a1fd82ba3c0a6e29b52c846350c4
SHA1:	0cbaa6e35f322eb6cb783b3c78f7c2ba98c727d4
SHA256:	704784b07c98d684e9d8bc49631f333ae54cedd94f2fbbc7ce3506ddc0f6b221
Infos:

Detection

Score:	48
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for dropped file

Allocates memory with a write watch (potentially for evading sandboxes)

Detected potential crypto function

Drops PE files

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries the volume information (name, serial number etc) of a device

Searches for user specific document files

Classification

Process Tree

System is w10x64_ra

rundll32.exe (PID: 5096 cmdline: C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding MD5: EF3179D498793BF4234F708D3BE28633)

7zG.exe (PID: 6992 cmdline: "C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\" -spe -an -ai#7zMap23008:124:7zEvent13671 MD5: 50F289DF0C19484E970849AAC4E6F977)

AccountRestore.exe (PID: 1668 cmdline: "C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221C:\Users\jjohnson\Music\AccountRestore.exe" MD5: 5A01695BE573F95DFC0CF73AB6B5234D)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for dropped file

Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe

ReversingLabs: Detection: 54%

Source:

Binary string: C:\Users\user.DESKTOP-3VUNKBC\Downloads\Account\CrackAccount\obj\Debug\test.pdb source: 7zG.exe, 0000000E.00000003.1581912628.0000014075E30000.00000004.00000800.00020000.00000000.sdmp, AccountRestore.exe, 00000011.00000000.1756166927.00000000004E2000.00000002.00000001.01000000.00000008.sdmp, AccountRestore.exe.14.dr

Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior

Source: AccountRestore.exe, 00000011.00000002.2281631957.0000000002901000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/View/MainWindow.xamlP
Source: AccountRestore.exe, 00000011.00000002.2281631957.0000000002901000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/View/MainWindow.xamll
Source: AccountRestore.exe, 00000011.00000002.2281631957.0000000002901000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/View/MainWindow.xamlP
Source: AccountRestore.exe, 00000011.00000002.2281631957.0000000002901000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/View/MainWindow.xamll
Source: AccountRestore.exe, 00000011.00000002.2281631957.0000000002901000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/bar/view/mainwindow.baml
Source: AccountRestore.exe, 00000011.00000002.2281631957.0000000002901000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/bar/view/mainwindow.bamlP
Source: AccountRestore.exe, 00000011.00000002.2281631957.0000000002901000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/bar/view/mainwindow.bamll

Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Code function: 17_2_0ABD66F0		17_2_0ABD66F0
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Code function: 17_2_0ABD66E2		17_2_0ABD66E2

Source: manifest.json.14.dr

Binary string: [{"included":true,"path":"\\Device\\HarddiskVolume4\\Users\\jjohnson\\Music\\AccountRestore.exe","reason":"","sha1":"28400c267815762e49c200e8b481a592c67f9cf7","sha256":"e97bdf7fafb1cb2a2bf0a4e14f51e18a34f3ff2f6f7b99731e93070d50801bef","size":29184}]

Source: classification engine

Classification label: mal48.winZIP@3/2@0/0

Source: C:\Program Files\7-Zip\7zG.exe

File created: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221

Jump to behavior

Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe

Mutant created: NULL

Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\System32\rundll32.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown

Process created: C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

Source: unknown	Process created: C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
Source: unknown	Process created: C:\Program Files\7-Zip\7zG.exe "C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\" -spe -an -ai#7zMap23008:124:7zEvent13671
Source: unknown	Process created: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe "C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221C:\Users\jjohnson\Music\AccountRestore.exe"

Source: C:\Program Files\7-Zip\7zG.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files\7-Zip\7zG.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Program Files\7-Zip\7zG.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files\7-Zip\7zG.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Program Files\7-Zip\7zG.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Program Files\7-Zip\7zG.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Program Files\7-Zip\7zG.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Program Files\7-Zip\7zG.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Program Files\7-Zip\7zG.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Program Files\7-Zip\7zG.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Program Files\7-Zip\7zG.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Program Files\7-Zip\7zG.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Section loaded: msvcp140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Section loaded: activeds.dll	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Section loaded: adsldpc.dll	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Section loaded: adsnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Section loaded: ntdsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Section loaded: d3d9.dll	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Section loaded: dataexchange.dll	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Section loaded: dcomp.dll	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Section loaded: msctfui.dll	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Section loaded: uiautomationcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Section loaded: d3dcompiler_47.dll	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Section loaded: thumbcache.dll	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Section loaded: windows.ui.fileexplorer.dll	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Section loaded: assignedaccessruntime.dll	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Section loaded: structuredquery.dll	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Section loaded: windows.storage.search.dll	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Section loaded: twinapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Section loaded: actxprxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Section loaded: networkexplorer.dll	Jump to behavior

Source: C:\Program Files\7-Zip\7zG.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{56FDF344-FD6D-11d0-958A-006097C9A090}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe

Window detected: Number of UI elements: 13

Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source:

Source: C:\Program Files\7-Zip\7zG.exe

File created: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe

Jump to dropped file

Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Registry key monitored for changes: HKEY_CURRENT_USER_Classes			Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Registry key monitored for changes: HKEY_CURRENT_USER_Classes			Jump to behavior

Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Memory allocated: 2860000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Memory allocated: 2900000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Memory allocated: 4900000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior

Source: AccountRestore.exe, 00000011.00000002.2285458013.0000000007DA3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D:\|
Source: AccountRestore.exe, 00000011.00000002.2285458013.0000000007DA3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D:
Source: AccountRestore.exe, 00000011.00000002.2288141082.000000000AEB8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: od_VMware_SATA_C

Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Queries volume information: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices.AccountManagement\v4.0_4.0.0.0__b77a5c561934e089\System.DirectoryServices.AccountManagement.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework-SystemXml\v4.0_4.0.0.0__b77a5c561934e089\PresentationFramework-SystemXml.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Queries volume information: C:\Windows\Fonts\seguili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Queries volume information: C:\Windows\Fonts\seguisli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Queries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Queries volume information: C:\Windows\Fonts\seguisbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Queries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Queries volume information: C:\Windows\Fonts\seguibl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Queries volume information: C:\Windows\Fonts\seguibli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\UIAutomationTypes\v4.0_4.0.0.0__31bf3856ad364e35\UIAutomationTypes.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\UIAutomationProvider\v4.0_4.0.0.0__31bf3856ad364e35\UIAutomationProvider.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Directory queried: C:\Users\user\Documents			Jump to behavior
Source: C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	Directory queried: C:\Users\user\Documents\PALRGUCVEH			Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	1 Process Injection	1 Masquerading	OS Credential Dumping	1 Query Registry	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	1 Data from Local System	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Disable or Modify Tools	Security Account Manager	1 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Process Injection	NTDS	12 File and Directory Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Rundll32	LSA Secrets	12 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe	54%	ReversingLabs	Win32.PUA.Generic

Name	Source	Malicious	Reputation
http://foo/View/MainWindow.xamll	AccountRestore.exe, 00000011.00000002.2281631957.0000000002901000.00000004.00000800.00020000.00000000.sdmp	false	low
http://defaultcontainer/View/MainWindow.xamll	AccountRestore.exe, 00000011.00000002.2281631957.0000000002901000.00000004.00000800.00020000.00000000.sdmp	false	low
http://foo/bar/view/mainwindow.bamll	AccountRestore.exe, 00000011.00000002.2281631957.0000000002901000.00000004.00000800.00020000.00000000.sdmp	false	low
http://defaultcontainer/View/MainWindow.xamlP	AccountRestore.exe, 00000011.00000002.2281631957.0000000002901000.00000004.00000800.00020000.00000000.sdmp	false	low
http://foo/bar/view/mainwindow.bamlP	AccountRestore.exe, 00000011.00000002.2281631957.0000000002901000.00000004.00000800.00020000.00000000.sdmp	false	low
http://foo/View/MainWindow.xamlP	AccountRestore.exe, 00000011.00000002.2281631957.0000000002901000.00000004.00000800.00020000.00000000.sdmp	false	low
http://foo/bar/view/mainwindow.baml	AccountRestore.exe, 00000011.00000002.2281631957.0000000002901000.00000004.00000800.00020000.00000000.sdmp	false	low

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1428288
Start date and time:	2024-04-18 19:13:15 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 21s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	20
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	AO_RDS01_2024-04-18_16_39_30.221.zip
Detection:	MAL
Classification:	mal48.winZIP@3/2@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 97% Number of executed functions: 38 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .zip

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, SIHClient.exe, backgroundTaskHost.exe, SgrmBroker.exe, MoUsoCoreWorker.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): www.bing.com, fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, evoke-windowsservices-tas.msedge.net, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: AO_RDS01_2024-04-18_16_39_30.221.zip

Simulations

Behavior and APIs

Time	Type	Description
19:15:36	API Interceptor	1x Sleep call for process: AccountRestore.exe modified

Process:	C:\Program Files\7-Zip\7zG.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	29184
Entropy (8bit):	5.724804053256654
Encrypted:	false
SSDEEP:	384:frG7kKgtNehIpakQyE0zfYaUmGvt22ATmEkMFTBel8YRmgx3ll+8ft63S1pfm:a77gahIpy1Szt7n3eiYMgxE3
MD5:	5A01695BE573F95DFC0CF73AB6B5234D
SHA1:	28400C267815762E49C200E8B481A592C67F9CF7
SHA-256:	E97BDF7FAFB1CB2A2BF0A4E14F51E18A34F3FF2F6F7B99731E93070D50801BEF
SHA-512:	B47D248EA32D6F1FCDF1C8996E5D01CDA11F4D11FA4BEBF819C9ABEF2A378356E6134F8840E3EEB3B377063BFA241B6D952DEF1CED0E8EE115978FCCC139E010
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 54%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......].........."...0..h.............. ........@.. ....................................`.................................p...O...................................8................................................ ............... ..H............text....g... ...h.................. ..`.rsrc................j..............@..@.reloc...............p..............@..B........................H........6...?..........@v..............................................R..r...p.s....(.........0...........s......o......o....&".(.....B.( ......(......0...........{......,..+...}....r+..p.s.......(!.......0.................+...t....}....+...}....&.(".........0..9........~.........,".ru..p.....(#...o$...s%...........~.....+......0...........~.....+.."........0...........~.....+..".(&....Vs....('...t............0..)........{.........((...t!.....\|......(...+...3.

C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\manifest.json

Download File

Process:	C:\Program Files\7-Zip\7zG.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.05024577539805
Encrypted:	false
SSDEEP:	6:lQ2P70eTMfPEjq6sfCHNi8C5ZFw3KxRVAUGnPocck434Vn:LP1TConm8C7FswPgPoC4in
MD5:	65D31CAAE0A3287E5BAFB5D49F32A19F
SHA1:	C7984EC3D628BF38A34C86DF7B138B1F060852E0
SHA-256:	7E330274CC48E8BEF1D16539FDD6BAFAA52D2C422FC55CCDCDE0B5E349B56083
SHA-512:	BF18E249D912E62C8E16D85E953AB860246C9721B4EACEC24877AAA53044027979FA8B517485173CB411FF8BB915674143545CB5D12729D4F781AE1094A37593
Malicious:	false
Reputation:	low
Preview:	[{"included":true,"path":"\\Device\\HarddiskVolume4\\Users\\jjohnson\\Music\\AccountRestore.exe","reason":"","sha1":"28400c267815762e49c200e8b481a592c67f9cf7","sha256":"e97bdf7fafb1cb2a2bf0a4e14f51e18a34f3ff2f6f7b99731e93070d50801bef","size":29184}]

Static File Info

General

File type:	Zip archive data, at least v4.5 to extract, compression method=deflate
Entropy (8bit):	7.973895919178688
TrID:	ZIP compressed archive (8000/1) 100.00%
File name:	AO_RDS01_2024-04-18_16_39_30.221.zip
File size:	13'972 bytes
MD5:	f827a1fd82ba3c0a6e29b52c846350c4
SHA1:	0cbaa6e35f322eb6cb783b3c78f7c2ba98c727d4
SHA256:	704784b07c98d684e9d8bc49631f333ae54cedd94f2fbbc7ce3506ddc0f6b221
SHA512:	00e3fe2edfffbb06dc9142e85e4e4eecf5a79e3cdcbe3a8dfc5b5b644269ae89a2ca1e87e54ea79e87c11d743fc1354ac10612589054a57df8845f171cfad469
SSDEEP:	192:NxUpx1FrhtrHuApM3jQA2gg8qEuUlAfdxxBW2F69w3oLGkk0ZL1r8fh78eq6mk+0:NxKDtrHuApTQJluVUmoaq98578eq655X
TLSH:	EC52D19B656FD907ED7028B938F5F5D4210B9907E615BC32C5CA80EC88DD3DE8443A72
File Content Preview:	PK..-.............W4...r..>...Device/HarddiskVolume4/Users/jjohnson/Music/AccountRestore.exe.....................=.2...m...^.....T...6.\~...c\..8......Zph./:W.R..V..._.Y-..l..@.A.<...#....&m.S...i.7....7S*=..C"t...Q}./>.}.?.TE.>K.8z..%..![.@....Y.......1.

File Icon


Icon Hash:	1c1c1e4e4ececedc

Target ID:	0
Start time:	19:13:44
Start date:	18/04/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
Imagebase:	0x7ff770e50000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	19:14:28
Start date:	18/04/2024
Path:	C:\Program Files\7-Zip\7zG.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\" -spe -an -ai#7zMap23008:124:7zEvent13671
Imagebase:	0x540000
File size:	700'416 bytes
MD5 hash:	50F289DF0C19484E970849AAC4E6F977
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	19:14:56
Start date:	18/04/2024
Path:	C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221C:\Users\jjohnson\Music\AccountRestore.exe"
Imagebase:	0x4e0000
File size:	29'184 bytes
MD5 hash:	5A01695BE573F95DFC0CF73AB6B5234D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 54%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	9.8%
Dynamic/Decrypted Code Coverage:	98.1%
Signature Coverage:	0%
Total number of Nodes:	155
Total number of Limit Nodes:	13

Executed Functions

Function 0ABD66F0 Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2287816205.000000000ABD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0ABD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_abd0000_AccountRestore.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a091fbd7dcdca778d56e69b2dddf74d537109b740ddd566337ce9bd9016d60ee
Instruction ID: 927cb5aaa09852cae5d01b000cbfe6731aea02dc585b60bf5bbeb2d2324fd5cf
Opcode Fuzzy Hash: a091fbd7dcdca778d56e69b2dddf74d537109b740ddd566337ce9bd9016d60ee
Instruction Fuzzy Hash: 8812AFF08247469BE310DF66E9481893FF9F7443A8B50420DD2A5ABAD2D7F9198BCF44

Uniqueness

Uniqueness Score: -1.00%

Function 0ABD66E2 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2287816205.000000000ABD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0ABD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_abd0000_AccountRestore.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e620af965b01aa47d04b4ecdda1b3e878ae22f8843444c9b34dadae27bd7d27d
Instruction ID: e0e6362ce7dddfec4cf87fd59b1757e9f73263d11c2b6c49715a5ea99c0aaa2b
Opcode Fuzzy Hash: e620af965b01aa47d04b4ecdda1b3e878ae22f8843444c9b34dadae27bd7d27d
Instruction Fuzzy Hash: 27C103B0C247469BE710DF66E8481897FB9FB853A8B61430DD161AB6D2D7F8188BCF44

Uniqueness

Uniqueness Score: -1.00%

Function 0ABD55D7 Relevance: 6.1, APIs: 4, Instructions: 133
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 0ABD5666
GetCurrentThread.KERNEL32 ref: 0ABD56A3
GetCurrentProcess.KERNEL32 ref: 0ABD56E0
GetCurrentThreadId.KERNEL32 ref: 0ABD5739

Memory Dump Source

Source File: 00000011.00000002.2287816205.000000000ABD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0ABD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_abd0000_AccountRestore.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 0ec807dfd5282216902737fe4d68deda55946d060b7a2273a114b36323859331
Instruction ID: 6e411cdd4cfa2692c5ecc3223eb9a005a4719764e0f475f6523ff36735adf0a2
Opcode Fuzzy Hash: 0ec807dfd5282216902737fe4d68deda55946d060b7a2273a114b36323859331
Instruction Fuzzy Hash: 9E5198B1D042498FDB14DFA9D548BAEBFF1EF88300F248599D049AB361D739A844CF69

Uniqueness

Uniqueness Score: -1.00%

Function 0ABD55E8 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 0ABD5666
GetCurrentThread.KERNEL32 ref: 0ABD56A3
GetCurrentProcess.KERNEL32 ref: 0ABD56E0
GetCurrentThreadId.KERNEL32 ref: 0ABD5739

Memory Dump Source

Source File: 00000011.00000002.2287816205.000000000ABD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0ABD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_abd0000_AccountRestore.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 1c2c91940299f67ddbe322122efbf53a458bf41555ed0d2d1e53e90fc1557191
Instruction ID: c166a27cdcd3fc072bebc0526182f558b27512fd706941195574895f24c44039
Opcode Fuzzy Hash: 1c2c91940299f67ddbe322122efbf53a458bf41555ed0d2d1e53e90fc1557191
Instruction Fuzzy Hash: DA5187B1D006098FDB14DFA9D548BAEBBF1EF88314F248199D009BB360D739A844CF69

Uniqueness

Uniqueness Score: -1.00%

Function 0ABD7BB0 Relevance: 3.2, APIs: 2, Instructions: 186
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetActiveWindow.USER32 ref: 0ABD7C31
GetFocus.USER32 ref: 0ABD7C97

Memory Dump Source

Source File: 00000011.00000002.2287816205.000000000ABD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0ABD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_abd0000_AccountRestore.jbxd

Similarity

API ID: ActiveFocusWindow
String ID:
API String ID: 2022189218-0
Opcode ID: f95500ec8bbcc48fa2817ef47550663656385b262d4b8143788d373e92a1e33f
Instruction ID: a4b87e34369c2eb51c34f24ec1ab0fa6bfd2bd79b314e228142582d0f0e78a7e
Opcode Fuzzy Hash: f95500ec8bbcc48fa2817ef47550663656385b262d4b8143788d373e92a1e33f
Instruction Fuzzy Hash: A5713CB4A002458FDB14DF69C584ABABBF5EF48204F198499D805EB362DB34ED81DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 02868379 Relevance: 1.9, APIs: 1, Instructions: 392
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000011.00000002.2281382292.0000000002860000.00000040.00000800.00020000.00000000.sdmp, Offset: 02860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2860000_AccountRestore.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87f45696d2349cff0a0b52e6f04c236dc8a2eefd4f3bc48091fc1041a33f0ef7
Instruction ID: de02c55080398b0b37f313283a77961ff2fb1f2d52d49e2149522eabaec5559a
Opcode Fuzzy Hash: 87f45696d2349cff0a0b52e6f04c236dc8a2eefd4f3bc48091fc1041a33f0ef7
Instruction Fuzzy Hash: 60C194B990E3D04FE703AB3858786AA7FB29F53114B0944DBD4C5DF5A3E628480DC7A6

Uniqueness

Uniqueness Score: -1.00%

Function 0ABD4278 Relevance: 1.7, APIs: 1, Instructions: 204
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetActiveWindow.USER32 ref: 0ABD4332

Memory Dump Source

Source File: 00000011.00000002.2287816205.000000000ABD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0ABD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_abd0000_AccountRestore.jbxd

Similarity

API ID: ActiveWindow
String ID:
API String ID: 2558294473-0
Opcode ID: 261891062b5d9af5526de96be48db605412642ae1307fe049af5991fc0c097a3
Instruction ID: a59e94253d6fde2b744a3e7effe6f3c22e5ae377791df13be24f7331985d1ca0
Opcode Fuzzy Hash: 261891062b5d9af5526de96be48db605412642ae1307fe049af5991fc0c097a3
Instruction Fuzzy Hash: 60718A71A102488FCB04EFA9D4586ADBFB6FF89310F2481A9D406EB364DB749C85CF95

Uniqueness

Uniqueness Score: -1.00%

Function 0ABD4267 Relevance: 1.7, APIs: 1, Instructions: 157
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetActiveWindow.USER32 ref: 0ABD4332

Memory Dump Source

Source File: 00000011.00000002.2287816205.000000000ABD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0ABD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_abd0000_AccountRestore.jbxd

Similarity

API ID: ActiveWindow
String ID:
API String ID: 2558294473-0
Opcode ID: d0619abd1248fe53226ea5818e44e20256792c4ad94b5d2799047ceaf7ca0761
Instruction ID: dfb3f68287278b7053a7423141b81a2c54749e7398392b6e88d178f25434b281
Opcode Fuzzy Hash: d0619abd1248fe53226ea5818e44e20256792c4ad94b5d2799047ceaf7ca0761
Instruction Fuzzy Hash: 0E616874E10248CFCB04DFA9D048AADBBB6FF88710F248169D406EB364DB749881DF55

Uniqueness

Uniqueness Score: -1.00%

Function 0ABD7EA8 Relevance: 1.6, APIs: 1, Instructions: 74
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 0ABD7F78

Memory Dump Source

Source File: 00000011.00000002.2287816205.000000000ABD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0ABD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_abd0000_AccountRestore.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 37d559ad9c9b30649212af8ac8ae8348fa45de1b62aa54e595a34df8cace300a
Instruction ID: d33d035f725e4705dd3f19d003df9f4671c6c23a10e85f4bf4ce14a11ad5fffb
Opcode Fuzzy Hash: 37d559ad9c9b30649212af8ac8ae8348fa45de1b62aa54e595a34df8cace300a
Instruction Fuzzy Hash: 08317A75A10248DFCB24DFA9D448ADEBBF5FB48310F10809AE916A7360DB71AC40DF64

Uniqueness

Uniqueness Score: -1.00%

Function 0ABD7400 Relevance: 1.6, APIs: 1, Instructions: 67
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 0ABD7492

Memory Dump Source

Source File: 00000011.00000002.2287816205.000000000ABD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0ABD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_abd0000_AccountRestore.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: 9d9003a57970f55cbc81afa1cd8401f9770f2010b5fd81865de4f137b7276a81
Instruction ID: 71191d08bf0e016af79dfdf5ca4ee83edd575756070d3ac2ddc53c806bb26513
Opcode Fuzzy Hash: 9d9003a57970f55cbc81afa1cd8401f9770f2010b5fd81865de4f137b7276a81
Instruction Fuzzy Hash: AE315671A0024A8FCB10DFA9D480AEEFBF0FB49314F148559C458AB322D339A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0ABD5828 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0ABD58B7

Memory Dump Source

Source File: 00000011.00000002.2287816205.000000000ABD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0ABD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_abd0000_AccountRestore.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: b2c54ca0e8a94c9a627c3765a9f5c2ed4726cc66d3cd6a8c8332a093155b78f2
Instruction ID: f512103bb3c8d1d58a420a4c55d5aea43984a25faa2dd84f406fe5f21ff6146a
Opcode Fuzzy Hash: b2c54ca0e8a94c9a627c3765a9f5c2ed4726cc66d3cd6a8c8332a093155b78f2
Instruction Fuzzy Hash: 4E2116B5D002499FDB10CFAAD484AEEBFF4EB48310F14815AE958B3350D379A944CF60

Uniqueness

Uniqueness Score: -1.00%

Function 0ABD5830 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0ABD58B7

Memory Dump Source

Source File: 00000011.00000002.2287816205.000000000ABD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0ABD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_abd0000_AccountRestore.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 9f832019a33ff9884b7f28d9b058bf18ef57cb6b3334470009832729d8860bb6
Instruction ID: 406ca834450f4ffc8eb50465f1c7d09992eb73dc564df8501768ce456dae9c55
Opcode Fuzzy Hash: 9f832019a33ff9884b7f28d9b058bf18ef57cb6b3334470009832729d8860bb6
Instruction Fuzzy Hash: 6A21E4B5D012499FDB10CF9AD584AEEBFF8EB48310F14801AE958B3350D379A940CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0ABD74F8 Relevance: 1.6, APIs: 1, Instructions: 61
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnumThreadWindows.USER32(?,00000000,?), ref: 0ABD7571

Memory Dump Source

Source File: 00000011.00000002.2287816205.000000000ABD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0ABD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_abd0000_AccountRestore.jbxd

Similarity

API ID: EnumThreadWindows
String ID:
API String ID: 2941952884-0
Opcode ID: 3ed37eea304dc84ec3d3323a8f5874512c559730811d34ce7efb13b379ee2a55
Instruction ID: 3f8f1f14e4736413bb21e7b124d4a022452ae213ba700b084ec4b102f3fcc1f4
Opcode Fuzzy Hash: 3ed37eea304dc84ec3d3323a8f5874512c559730811d34ce7efb13b379ee2a55
Instruction Fuzzy Hash: D12147B1D0024A8FDB14CFAAC845BEEFBF5EB88314F24842AD455A3350D778A945CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0ABD7500 Relevance: 1.6, APIs: 1, Instructions: 59
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnumThreadWindows.USER32(?,00000000,?), ref: 0ABD7571

Memory Dump Source

Source File: 00000011.00000002.2287816205.000000000ABD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0ABD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_abd0000_AccountRestore.jbxd

Similarity

API ID: EnumThreadWindows
String ID:
API String ID: 2941952884-0
Opcode ID: 8b335f5af0b465689792010a87d9ef81c06736a49ec9b0384370822fecc220aa
Instruction ID: fe3964d09143aacfb2a4c2cfe79c49426291d899bafd5c359d3246096819e1fd
Opcode Fuzzy Hash: 8b335f5af0b465689792010a87d9ef81c06736a49ec9b0384370822fecc220aa
Instruction Fuzzy Hash: 242108B1D0024A8FDB14CF9AC845BEEFBF5EB88314F14846AD455A3350D778A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 02865E17 Relevance: 1.6, APIs: 1, Instructions: 56
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlEncodePointer.NTDLL(00000000), ref: 02865EA2

Memory Dump Source

Source File: 00000011.00000002.2281382292.0000000002860000.00000040.00000800.00020000.00000000.sdmp, Offset: 02860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2860000_AccountRestore.jbxd

Similarity

API ID: EncodePointer
String ID:
API String ID: 2118026453-0
Opcode ID: 662975d85647d59283175b1a673cab050af4b0a47e3332f8696adfa0e94e9029
Instruction ID: 0bd5eeabdc2a371ea461ecc26796ec3d4b356ee23e64c408b8658e1be941ee2c
Opcode Fuzzy Hash: 662975d85647d59283175b1a673cab050af4b0a47e3332f8696adfa0e94e9029
Instruction Fuzzy Hash: 4421AE79D0474A8FDB20CFAAC5487AEBBF4FB49314F20841EC559A3241D7795944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 02864184 Relevance: 1.6, APIs: 1, Instructions: 55
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CompareStringW.KERNELBASE(04E116B0,?,?,?,?,?), ref: 028641FA

Memory Dump Source

Source File: 00000011.00000002.2281382292.0000000002860000.00000040.00000800.00020000.00000000.sdmp, Offset: 02860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2860000_AccountRestore.jbxd

Similarity

API ID: CompareString
String ID:
API String ID: 1825529933-0
Opcode ID: a6266264cdc993b7d689e3b9bdba0c8085c94fc418fd604d0debd9567fbf78fc
Instruction ID: 2dd4628fff94c6614dd593e3713c169157a59b379e3b1ad2a1786d1c3f36938d
Opcode Fuzzy Hash: a6266264cdc993b7d689e3b9bdba0c8085c94fc418fd604d0debd9567fbf78fc
Instruction Fuzzy Hash: 3D2167B58042889FCB11CFA9C844BDEBFF4EF49314F14844AE559B7211C3799914CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 02865E28 Relevance: 1.6, APIs: 1, Instructions: 54
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlEncodePointer.NTDLL(00000000), ref: 02865EA2

Memory Dump Source

Source File: 00000011.00000002.2281382292.0000000002860000.00000040.00000800.00020000.00000000.sdmp, Offset: 02860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2860000_AccountRestore.jbxd

Similarity

API ID: EncodePointer
String ID:
API String ID: 2118026453-0
Opcode ID: e850dc63b9516026304ed7f525d30176dd25899fcea349eb3fbd166f658a8a6f
Instruction ID: 0fd74ec1fcb0e31e7be817e87b0a0ebab165d5450cfac00f4b4b3dbc87efb7e7
Opcode Fuzzy Hash: e850dc63b9516026304ed7f525d30176dd25899fcea349eb3fbd166f658a8a6f
Instruction Fuzzy Hash: 9E11AC78D0030A8FDB10CFAAC5487AEBBF4FB48315F60842AC519E3241D779A940CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 02868748 Relevance: 1.6, APIs: 1, Instructions: 53libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNELBASE(00000000), ref: 028687B6

Memory Dump Source

Source File: 00000011.00000002.2281382292.0000000002860000.00000040.00000800.00020000.00000000.sdmp, Offset: 02860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2860000_AccountRestore.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 82504db547515986156d711e40cea22f4579d0b62ba07303ee3a6001b023bde6
Instruction ID: 76d79e9ef6f7bf2f810246a45374b84177bd6198dec00d574684fe2a233e4d6a
Opcode Fuzzy Hash: 82504db547515986156d711e40cea22f4579d0b62ba07303ee3a6001b023bde6
Instruction Fuzzy Hash: FA1112BAD002498FDB10CF9AC444AEEFBF5AB88218F14841AD519B7710D379A545CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0ABD7DE8 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,?), ref: 0ABD7E57

Memory Dump Source

Source File: 00000011.00000002.2287816205.000000000ABD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0ABD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_abd0000_AccountRestore.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 293e10bfd8f9813fe4a6b90eee6372bdbefa809e3c4903cbdbfa3cbc8c4977be
Instruction ID: 5d2c709a39cc44b3908e7fa89b2f830639db2b5ef3d671dd97a24df55bebbedd
Opcode Fuzzy Hash: 293e10bfd8f9813fe4a6b90eee6372bdbefa809e3c4903cbdbfa3cbc8c4977be
Instruction Fuzzy Hash: 1911287680064A8FDB10CF9AD545BEEBBF4EB48324F14845AD458B3350D338AA84DFA5

Uniqueness

Uniqueness Score: -1.00%

Function 02863D7C Relevance: 1.6, APIs: 1, Instructions: 51COMMON

Download Yara Rule

APIs

CompareStringW.KERNELBASE(04E116B0,?,?,?,?,?), ref: 028641FA

Memory Dump Source

Source File: 00000011.00000002.2281382292.0000000002860000.00000040.00000800.00020000.00000000.sdmp, Offset: 02860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2860000_AccountRestore.jbxd

Similarity

API ID: CompareString
String ID:
API String ID: 1825529933-0
Opcode ID: 2804687ea3812e59c3f23411b2d798dcd4dc3b885f7e5d798fb1dbfaf7355931
Instruction ID: 74eef8a7ebfab60f50f5ffd98be520089bec6abfe81f369846234775013c15d6
Opcode Fuzzy Hash: 2804687ea3812e59c3f23411b2d798dcd4dc3b885f7e5d798fb1dbfaf7355931
Instruction Fuzzy Hash: 731146B98002499FDB20CF99C844BEEBFF4EB48314F108419E519B7210C375A954CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 02868750 Relevance: 1.6, APIs: 1, Instructions: 50libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNELBASE(00000000), ref: 028687B6

Memory Dump Source

Source File: 00000011.00000002.2281382292.0000000002860000.00000040.00000800.00020000.00000000.sdmp, Offset: 02860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2860000_AccountRestore.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: b39601c9f24727bfd333ab76a613d1ddd5d19e48c04ed985259bd70cdb5ab57a
Instruction ID: 6a19a1bcf078b95f1ceabd6572dd80cbc71acf58d0c388fbd42513ce949c6b04
Opcode Fuzzy Hash: b39601c9f24727bfd333ab76a613d1ddd5d19e48c04ed985259bd70cdb5ab57a
Instruction Fuzzy Hash: 421102BAD002498FDB10CF9AC444AAEFBF9EF89324F14841AD569B7310D379A545CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0ABD7DF0 Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,?), ref: 0ABD7E57

Memory Dump Source

Source File: 00000011.00000002.2287816205.000000000ABD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0ABD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_abd0000_AccountRestore.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 3ef1dd007958a1e3647df545b5e0224e601259db7f67690dcbbf4084e4b6c275
Instruction ID: d60b8db7d5a0efc9ea344b888e9de9f4ee1e7865576206dfa6534ff736ee5db1
Opcode Fuzzy Hash: 3ef1dd007958a1e3647df545b5e0224e601259db7f67690dcbbf4084e4b6c275
Instruction Fuzzy Hash: FB113A768002498FDB10CF9AC445BEEBBF8EB48320F14846AD558B3351D378AA84CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 026DFE84 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2281059263.00000000026DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 026DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_26dd000_AccountRestore.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f0106d064ba19740f1dad8288e2a3369daeede470d36c21212229f6c30dd324
Instruction ID: 7d3f5ba86ddd5b105367cd7095ba331eed022071c8ff9e1b1df247701db17880
Opcode Fuzzy Hash: 8f0106d064ba19740f1dad8288e2a3369daeede470d36c21212229f6c30dd324
Instruction Fuzzy Hash: 70312872904244EFDF059F54C9C0F26BF76FB88310F24C599EE0A4A656C336D456CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 026DFD88 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2281059263.00000000026DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 026DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_26dd000_AccountRestore.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec2f065d01cae7f8b9e037116b84e607e3505051358eb5a8c61f616e37d2d17d
Instruction ID: ab32be49498716c11e200a3434d61d240d2cc3a971fed7cad3d538c63426b6ba
Opcode Fuzzy Hash: ec2f065d01cae7f8b9e037116b84e607e3505051358eb5a8c61f616e37d2d17d
Instruction Fuzzy Hash: B821F972904244EFDF158F64D9C0F16BFA6FB88314F24C699ED0A0A657C336D456CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 026CD06C Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2280967965.00000000026CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 026CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_26cd000_AccountRestore.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1058e7e14813f7ae03990784a3f3df676773cff213a51cca7a6dc682b8c34743
Instruction ID: 3027103286a6f6a0622fd2589cfb9715ca36cacda87493c958fb3ec8f7bdeecc
Opcode Fuzzy Hash: 1058e7e14813f7ae03990784a3f3df676773cff213a51cca7a6dc682b8c34743
Instruction Fuzzy Hash: 7121C772504244DFDB15AF18D9C4B26BFA5FB8C314F34856DE9090A755C33AD416CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 026CD5C8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2280967965.00000000026CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 026CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_26cd000_AccountRestore.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f228381eaa3c644877bc5af365cae4e4b333d7c36a59fbba8cc42289933fb198
Instruction ID: 5263e33ff481f926fac29e1645ae033c39429dcaf4dd2c097ef4ac8c49703a25
Opcode Fuzzy Hash: f228381eaa3c644877bc5af365cae4e4b333d7c36a59fbba8cc42289933fb198
Instruction Fuzzy Hash: 1A21C172504204DFDB15FF15D9C0B26BF65FB88314F34857DE90A4A256C336D456C6A1

Uniqueness

Uniqueness Score: -1.00%

Function 09770360 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2286638007.0000000009770000.00000040.00000800.00020000.00000000.sdmp, Offset: 09770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_9770000_AccountRestore.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c0f7305cb3e760698b76e4d08f8cc51e010eb37f8b494458d36f45c0dc2ce6d
Instruction ID: 042cbeb7226fcf7c5958c1c9812f7d0f33f032066cb1c0c73ab557f759f31637
Opcode Fuzzy Hash: 5c0f7305cb3e760698b76e4d08f8cc51e010eb37f8b494458d36f45c0dc2ce6d
Instruction Fuzzy Hash: 5A21F272604304DFDF04DF14D9C0B26FBA5FB85314F24C6ADE9495B292C33AD846CA61

Uniqueness

Uniqueness Score: -1.00%

Function 026DD01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2281059263.00000000026DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 026DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_26dd000_AccountRestore.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e66b8d9acd8a5e5c1c91af2312d1091e3e853984e1811978fb67353237b6e86
Instruction ID: a73100b0e9abcb9b1263fb60278fa062bf6b6a63728133d90780940fe74e1d97
Opcode Fuzzy Hash: 3e66b8d9acd8a5e5c1c91af2312d1091e3e853984e1811978fb67353237b6e86
Instruction Fuzzy Hash: 8721F572904288DFDB14EF14D980B16BBA5FBC8314F64C569D94A4B396C336D447CAA1

Uniqueness

Uniqueness Score: -1.00%

Function 026DFCA8 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2281059263.00000000026DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 026DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_26dd000_AccountRestore.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aba95ae969bc1a9bece01e360132b8528897111dc3b859c37ff2eff9d3a5c763
Instruction ID: d230a87e12564784753fd287d14c7061cf470c058d6c65fe0e271962dabdeba9
Opcode Fuzzy Hash: aba95ae969bc1a9bece01e360132b8528897111dc3b859c37ff2eff9d3a5c763
Instruction Fuzzy Hash: 29210171A04248DFDB14DF18D9C0B26BFA5FB88318F24C66DED0A4B796C336D846C6A1

Uniqueness

Uniqueness Score: -1.00%

Function 026DFE7F Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2281059263.00000000026DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 026DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_26dd000_AccountRestore.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc9dcd8a821203a1bd19814fe54a57aa9b463fdb0c93c74936c5b16d84cde03a
Instruction ID: bd41671dc149cb50630e5f036e7ce461dd8e9f73ea727bdbc37e15c26de3cef1
Opcode Fuzzy Hash: dc9dcd8a821203a1bd19814fe54a57aa9b463fdb0c93c74936c5b16d84cde03a
Instruction Fuzzy Hash: A1219276804244EFCF06CF54D9C0B56BF72FB48314F24C2A9ED094A66AC336D466DB91

Uniqueness

Uniqueness Score: -1.00%

Function 026DD004 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2281059263.00000000026DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 026DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_26dd000_AccountRestore.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85245ec2896eba1c3150818fb50123cdcd7c45ecbb2cb22be9bdb5fc02051921
Instruction ID: d23955d27673668a71ff549f21dacf8d3be70d87c9aab8fa86332ea835f4fb7a
Opcode Fuzzy Hash: 85245ec2896eba1c3150818fb50123cdcd7c45ecbb2cb22be9bdb5fc02051921
Instruction Fuzzy Hash: EF2192765093C48FCB12DF24D590715BF71EB86214F28C5DAD8498F6A7C33A980BCB62

Uniqueness

Uniqueness Score: -1.00%

Function 026DFD83 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2281059263.00000000026DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 026DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_26dd000_AccountRestore.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94d976c543fb1643bdbe8b5e3b6992184e4cbb3c6ad9218d786fd491f05bc371
Instruction ID: 60b048600a6b369146a3db2591f33309ba9d6fc81704b4e70617930c5e38ebec
Opcode Fuzzy Hash: 94d976c543fb1643bdbe8b5e3b6992184e4cbb3c6ad9218d786fd491f05bc371
Instruction Fuzzy Hash: 2C218E76804244EFCF16CF24D9C4B56BF72FB88314F24C6A9E9094A667C336D466CB91

Uniqueness

Uniqueness Score: -1.00%

Function 026CD067 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2280967965.00000000026CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 026CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_26cd000_AccountRestore.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86e2d0ad5966b4908552e02efda348fb7df0361686de0292c4c6c9527de2ff27
Instruction ID: c146e5156af73f4246aa3dacf178f3660207aec9a4d993891a8fc3761240d160
Opcode Fuzzy Hash: 86e2d0ad5966b4908552e02efda348fb7df0361686de0292c4c6c9527de2ff27
Instruction Fuzzy Hash: 3321CD76404280DFCB06DF00D9C4B26BFB2FB88314F24C6A9D9490B756C33AD426CB91

Uniqueness

Uniqueness Score: -1.00%

Function 026CD5C3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2280967965.00000000026CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 026CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_26cd000_AccountRestore.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2cdc662657c6c0affd5a20e4310f074f1f13e851f2143e19b38feb5762d19327
Instruction ID: 3b87e25545841aa223bdaad2a30012e2224c3614420ae7ed039c4bdd69888790
Opcode Fuzzy Hash: 2cdc662657c6c0affd5a20e4310f074f1f13e851f2143e19b38feb5762d19327
Instruction Fuzzy Hash: 5C11AF76504240DFCB16EF14D9C4B2ABF62FB84314F34C6ADD8094B256C336D45ACBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0977035B Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2286638007.0000000009770000.00000040.00000800.00020000.00000000.sdmp, Offset: 09770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_9770000_AccountRestore.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72f31758580e09dbfc95d14a71d78f444649c9c869c0fd5114a31a9b883b897b
Instruction ID: 7182587cda8dc8ceb30a334143becc0f3db377e416a99e806a7fb5a03dbb1f56
Opcode Fuzzy Hash: 72f31758580e09dbfc95d14a71d78f444649c9c869c0fd5114a31a9b883b897b
Instruction Fuzzy Hash: E311BB76504280CFCB05CF14D5C0B25FBB2FB85314F24C6AAE8494B696C33AD84ACBA1

Uniqueness

Uniqueness Score: -1.00%

Function 026DFCA3 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2281059263.00000000026DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 026DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_26dd000_AccountRestore.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d5dd3ab0ab7eac8606309f9eb1c2ea32df6541e7b6040bb9e732f3f45b54f77
Instruction ID: ecb651f8866f083dd5a9e22482acffac35641aea3b3390883e5a390324e61bff
Opcode Fuzzy Hash: 3d5dd3ab0ab7eac8606309f9eb1c2ea32df6541e7b6040bb9e732f3f45b54f77
Instruction Fuzzy Hash: 9811EF75904284CFCB05CF14C5C4B15BFA2FB88314F24C6AED84A4BBA6C33AD44ACB91

Uniqueness

Uniqueness Score: -1.00%

Function 026CDA35 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2280967965.00000000026CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 026CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_26cd000_AccountRestore.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07d6be1cb3f390e57bfd8b3d592a12d54e63e7201dd95a9b2264aaa2943615c8
Instruction ID: 4086c9a395afda580b5d2ed30124828cd1de0216d8e60d1b7828ddd56b547081
Opcode Fuzzy Hash: 07d6be1cb3f390e57bfd8b3d592a12d54e63e7201dd95a9b2264aaa2943615c8
Instruction Fuzzy Hash: 1A01F271508340AAE710AB69CCC4776BF98DF82328F28C47EED495A282D3799801CAB1

Uniqueness

Uniqueness Score: -1.00%

Function 026CDA34 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2280967965.00000000026CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 026CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_26cd000_AccountRestore.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40f04e5e3ed7748e6a2410c86cbd85c714b7ceba229ddf6ed4f7badef3c48754
Instruction ID: d777fc36065920263bb6c2d4601747392c431ff7c8d1dd86f8712b3533917bda
Opcode Fuzzy Hash: 40f04e5e3ed7748e6a2410c86cbd85c714b7ceba229ddf6ed4f7badef3c48754
Instruction Fuzzy Hash: FFF06272508344AEE7109E15CCC4B62FFD8EB81728F28C56AED485A386D3799845CAB1

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: `rundll32.exe {DLLname, DLLfunction}` ).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report AO_RDS01_2024-04-18_16_39_30.221.zip

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\Device\HarddiskVolume4\Users\jjohnson\Music\AccountRestore.exe

C:\Users\user\Desktop\AO_RDS01_2024-04-18_16_39_30.221\manifest.json

Static File Info

General

File Icon

Network Behavior

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

Behavior

System Behavior

Analysis Process: rundll32.exePID: 5096, Parent PID: 804

General

Chronological Activities

Analysis Process: 7zG.exePID: 6992, Parent PID: 4552

General

Chronological Activities

Analysis Process: AccountRestore.exePID: 1668, Parent PID: 4552

General

Chronological Activities

Disassembly

Analysis Process: AccountRestore.exePID: 1668, Parent PID: 4552COMMON

Execution Graph

Windows Analysis Report
AO_RDS01_2024-04-18_16_39_30.221.zip

Function 0ABD55D7 Relevance: 6.1, APIs: 4, Instructions: 133
threadCOMMON

Function 0ABD55E8 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Function 0ABD7BB0 Relevance: 3.2, APIs: 2, Instructions: 186
windowCOMMON

Function 02868379 Relevance: 1.9, APIs: 1, Instructions: 392
COMMON

Function 0ABD4278 Relevance: 1.7, APIs: 1, Instructions: 204
COMMON

Function 0ABD4267 Relevance: 1.7, APIs: 1, Instructions: 157
COMMON

Function 0ABD7EA8 Relevance: 1.6, APIs: 1, Instructions: 74
COMMON

Function 0ABD7400 Relevance: 1.6, APIs: 1, Instructions: 67
threadCOMMON

Function 0ABD5828 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Function 0ABD5830 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Function 0ABD74F8 Relevance: 1.6, APIs: 1, Instructions: 61
threadCOMMON

Function 0ABD7500 Relevance: 1.6, APIs: 1, Instructions: 59
threadCOMMON

Function 02865E17 Relevance: 1.6, APIs: 1, Instructions: 56
COMMON

Function 02864184 Relevance: 1.6, APIs: 1, Instructions: 55
COMMON

Function 02865E28 Relevance: 1.6, APIs: 1, Instructions: 54
COMMON