Windows Analysis Report
DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe

Overview

General Information

Sample name:	DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe
Analysis ID:	1428407
MD5:	bb365d6b7cc40a740a03ffafc56555a8
SHA1:	3132c62beaa5d5d6c83ae5eda22b1c0d7b992b02
SHA256:	82d326f98e0f8d143e7bc11ce8c465bcf79b2c34d4368f7ebe326fae200b5199
Tags:	DarkTortillaexe
Infos:

Detection

AgentTesla, DarkTortilla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected AgentTesla

Yara detected AntiVM3

Yara detected DarkTortilla Crypter

.NET source code contains method to dynamically call methods (often used by packers)

Contains functionality to log keystrokes (.Net Source)

Hides that the sample has been downloaded from the Internet (zone.identifier)

Initial sample is a PE file and has a suspicious name

Machine Learning detection for sample

Moves itself to temp directory

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Allocates memory with a write watch (potentially for evading sandboxes)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates processes with suspicious names

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Suspicious Outbound SMTP Connections

Uses SMTP (mail sending)

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Malware Threat Intel
Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://asec.ahnlab.com/ko/29133/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Name	Description	Attribution	Blogpost URLs	Link
DarkTortilla	DarkTortilla is a complex and highly configurable .NET-based crypter that has possibly been active since at least August 2015. It typically delivers popular information stealers and remote access trojans (RATs) such as AgentTesla, AsyncRat, NanoCore, and RedLine. While it appears to primarily deliver commodity malware, Secureworks Counter Threat Unit (CTU) researchers identified DarkTortilla samples delivering targeted payloads such as Cobalt Strike and Metasploit. It can also deliver "addon packages" such as additional malicious payloads, benign decoy documents, and executables. It features robust anti-analysis and anti-tamper controls that can make detection, analysis, and eradication challenging.From January 2021 through May 2022, an average of 93 unique DarkTortilla samples per week were uploaded to the VirusTotal analysis service. Code similarities suggest possible links between DarkTortilla and other malware: a crypter operated by the RATs Crew threat group, which was active between 2008 and 2012, and the Gameloader malware that emerged in 2021.	No Attribution	https://www.secureworks.com/research/darktortilla-malware-analysis	https://malpedia.caad.fkie.fraunhofer.de/details/win.darktortilla

Signatures

AV Detection

Antivirus / Scanner detection for submitted sample

Source: DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe

Avira: detected

Found malware configuration

Source: 0.2.DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe.4586b82.3.raw.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Port": "587", "Host": "cphost09.qhoster.net", "Username": "admin@80-80.online", "Password": "support@80-80.online"}

Multi AV Scanner detection for submitted file

Source: DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe

ReversingLabs: Detection: 63%

Machine Learning detection for sample

Source: DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe

Joe Sandbox ML: detected

Source: unknown

HTTPS traffic detected: 104.26.12.205:443 -> 192.168.2.4:49741 version: TLS 1.2

Source: DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: InstallUtil.pdb\rvr hr_CorExeMainmscoree.dll source: WIred1066.exe, 00000009.00000000.2649330024.0000000000012000.00000002.00000001.01000000.0000000E.sdmp, WIred1066.exe.7.dr
Source:	Binary string: InstallUtil.pdb source: WIred1066.exe, 00000009.00000000.2649330024.0000000000012000.00000002.00000001.01000000.0000000E.sdmp, WIred1066.exe.7.dr

Detected TCP or UDP traffic on non-standard ports

Source: global traffic

TCP traffic: 192.168.2.4:49742 -> 188.241.39.200:587

IP address seen in connection with other malware

Source: Joe Sandbox View

IP Address: 104.26.12.205 104.26.12.205

JA3 SSL client fingerprint seen in connection with other malware

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

May check the online IP address of the machine

Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org

Uses SMTP (mail sending)

Source: global traffic

TCP traffic: 192.168.2.4:49742 -> 188.241.39.200:587

Uses a known web browser user agent for HTTP communication

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: unknown

DNS traffic detected: queries for: api.ipify.org

Source: InstallUtil.exe, 00000007.00000002.3023945758.0000000003081000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.3023945758.0000000002F9C000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.3023945758.0000000003008000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cphost09.qhoster.net
Source: InstallUtil.exe, 00000007.00000002.3023945758.0000000002FA2000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.3023945758.0000000003081000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.3031886422.0000000006280000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.3022449694.000000000122D000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.3023945758.0000000003008000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: InstallUtil.exe, 00000007.00000002.3022449694.000000000122D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: InstallUtil.exe, 00000007.00000002.3023945758.0000000002FA2000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.3023945758.0000000003081000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.3031886422.0000000006280000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.3022449694.000000000122D000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.3023945758.0000000003008000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/COMODORSACertificationAuthority.crl0q
Source: InstallUtil.exe, 00000007.00000002.3023945758.0000000002FA2000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.3023945758.0000000003081000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.3031886422.0000000006280000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.3023945758.0000000003008000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.3021739874.00000000011CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/cPanelIncCertificationAuthority.crl0
Source: InstallUtil.exe, 00000007.00000002.3023945758.0000000002FA2000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.3023945758.0000000003081000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.3031886422.0000000006280000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.3022449694.000000000122D000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.3023945758.0000000003008000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.3021739874.00000000011CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: InstallUtil.exe, 00000007.00000002.3023945758.0000000002F21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe, 00000000.00000002.1847738998.0000000007702000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe, 00000000.00000002.1847738998.0000000007702000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe, 00000000.00000002.1847738998.0000000007702000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe, 00000000.00000002.1847738998.0000000007702000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe, 00000000.00000002.1847738998.0000000007702000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe, 00000000.00000002.1847738998.0000000007702000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe, 00000000.00000002.1847738998.0000000007702000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe, 00000000.00000002.1847738998.0000000007702000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe, 00000000.00000002.1847738998.0000000007702000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe, 00000000.00000002.1847738998.0000000007702000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe, 00000000.00000002.1847738998.0000000007702000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.com
Source: DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe, 00000000.00000002.1847738998.0000000007702000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe, 00000000.00000002.1847738998.0000000007702000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe, 00000000.00000002.1847738998.0000000007702000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe, 00000000.00000002.1847738998.0000000007702000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe, 00000000.00000002.1847738998.0000000007702000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe, 00000000.00000002.1847738998.0000000007702000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe, 00000000.00000002.1847738998.0000000007702000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe, 00000000.00000002.1847738998.0000000007702000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe, 00000000.00000002.1847738998.0000000007702000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.com
Source: DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe, 00000000.00000002.1847738998.0000000007702000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe, 00000000.00000002.1847738998.0000000007702000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.com
Source: DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe, 00000000.00000002.1847738998.0000000007702000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.typography.netD
Source: DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe, 00000000.00000002.1847738998.0000000007702000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: WIred1066.exe, 0000000B.00000002.2734112971.000000000277F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.w3.or
Source: DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe, 00000000.00000002.1847738998.0000000007702000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe, 00000000.00000002.1843811889.00000000046D6000.00000004.00000800.00020000.00000000.sdmp, DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe, 00000000.00000002.1843811889.00000000045EE000.00000004.00000800.00020000.00000000.sdmp, DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe, 00000000.00000002.1843811889.00000000044CE000.00000004.00000800.00020000.00000000.sdmp, word.exe, 00000002.00000002.2561847271.0000000003A4E000.00000004.00000800.00020000.00000000.sdmp, word.exe, 00000002.00000002.2561847271.0000000003BDB000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000006.00000002.2222799732.0000000000622000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/
Source: DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe, 00000000.00000002.1843811889.00000000046D6000.00000004.00000800.00020000.00000000.sdmp, DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe, 00000000.00000002.1843811889.00000000045EE000.00000004.00000800.00020000.00000000.sdmp, DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe, 00000000.00000002.1843811889.00000000044CE000.00000004.00000800.00020000.00000000.sdmp, word.exe, 00000002.00000002.2561847271.0000000003A4E000.00000004.00000800.00020000.00000000.sdmp, word.exe, 00000002.00000002.2561847271.0000000003BDB000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000006.00000002.2222799732.0000000000622000.00000040.00000400.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.3023945758.0000000002F21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org
Source: InstallUtil.exe, 00000007.00000002.3023945758.0000000002F21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/
Source: InstallUtil.exe, 00000007.00000002.3023945758.0000000002F21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/t
Source: InstallUtil.exe, 00000007.00000002.3023945758.0000000002FA2000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.3023945758.0000000003081000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.3031886422.0000000006280000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.3023945758.0000000003008000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.3021739874.00000000011CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sectigo.com/CPS0

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443

Source: unknown

HTTPS traffic detected: 104.26.12.205:443 -> 192.168.2.4:49741 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: 0.2.DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe.4586b82.3.raw.unpack, cPKWk.cs	.Net Code: _2RDg35lD6S
Source: 0.2.DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe.450b9b2.4.raw.unpack, cPKWk.cs	.Net Code: _2RDg35lD6S
Source: 0.2.DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe.45492a2.0.raw.unpack, cPKWk.cs	.Net Code: _2RDg35lD6S
Source: 0.2.DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe.465b132.5.raw.unpack, cPKWk.cs	.Net Code: _2RDg35lD6S
Source: 0.2.DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe.46d62c0.2.raw.unpack, cPKWk.cs	.Net Code: _2RDg35lD6S
Source: 2.2.word.exe.3a8c72a.3.raw.unpack, cPKWk.cs	.Net Code: _2RDg35lD6S

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe.46d62c0.2.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe.45492a2.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe.4586b82.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 2.2.word.exe.3b078fa.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe.465b132.5.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 6.2.InstallUtil.exe.620000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe.45ee5e0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 2.2.word.exe.3a8c72a.3.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 2.2.word.exe.3aca01a.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe.465b132.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe.46d62c0.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe.4586b82.3.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe.45492a2.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe.450b9b2.4.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 2.2.word.exe.3b078fa.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 2.2.word.exe.3aca01a.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe.450b9b2.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 2.2.word.exe.3a8c72a.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen

Initial sample is a PE file and has a suspicious name

Source: initial sample	Static PE information: Filename: DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe
Source: initial sample	Static PE information: Filename: DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe

Detected potential crypto function

Source: C:\Users\user\Desktop\DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe	Code function: 0_2_01848049	0_2_01848049
Source: C:\Users\user\Desktop\DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe	Code function: 0_2_01847168	0_2_01847168
Source: C:\Users\user\Desktop\DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe	Code function: 0_2_01845090	0_2_01845090
Source: C:\Users\user\Desktop\DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe	Code function: 0_2_018456A8	0_2_018456A8
Source: C:\Users\user\Desktop\DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe	Code function: 0_2_018492E8	0_2_018492E8
Source: C:\Users\user\Desktop\DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe	Code function: 0_2_076AA6E4	0_2_076AA6E4
Source: C:\Users\user\Desktop\DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe	Code function: 0_2_076A2388	0_2_076A2388
Source: C:\Users\user\Desktop\DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe	Code function: 0_2_076A2378	0_2_076A2378
Source: C:\Users\user\Desktop\DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe	Code function: 0_2_076AC2B0	0_2_076AC2B0
Source: C:\Users\user\Desktop\DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe	Code function: 0_2_076C1848	0_2_076C1848
Source: C:\Users\user\Desktop\DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe	Code function: 0_2_076CC2A0	0_2_076CC2A0
Source: C:\Users\user\Desktop\DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe	Code function: 0_2_076CC290	0_2_076CC290
Source: C:\Users\user\Desktop\DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe	Code function: 0_2_07C40B30	0_2_07C40B30
Source: C:\Users\user\Desktop\DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe	Code function: 0_2_07C4D260	0_2_07C4D260
Source: C:\Users\user\AppData\Local\Temp\word.exe	Code function: 2_2_00BA0448	2_2_00BA0448
Source: C:\Users\user\AppData\Local\Temp\word.exe	Code function: 2_2_00E18049	2_2_00E18049
Source: C:\Users\user\AppData\Local\Temp\word.exe	Code function: 2_2_00E15090	2_2_00E15090
Source: C:\Users\user\AppData\Local\Temp\word.exe	Code function: 2_2_00E17440	2_2_00E17440
Source: C:\Users\user\AppData\Local\Temp\word.exe	Code function: 2_2_00E156A8	2_2_00E156A8
Source: C:\Users\user\AppData\Local\Temp\word.exe	Code function: 2_2_00E192E8	2_2_00E192E8
Source: C:\Users\user\AppData\Local\Temp\word.exe	Code function: 2_2_05C91848	2_2_05C91848
Source: C:\Users\user\AppData\Local\Temp\word.exe	Code function: 2_2_05C9C290	2_2_05C9C290
Source: C:\Users\user\AppData\Local\Temp\word.exe	Code function: 2_2_05C9C2A0	2_2_05C9C2A0
Source: C:\Users\user\AppData\Local\Temp\word.exe	Code function: 2_2_0739DDA8	2_2_0739DDA8
Source: C:\Users\user\AppData\Local\Temp\word.exe	Code function: 2_2_07390B30	2_2_07390B30
Source: C:\Users\user\AppData\Local\Temp\word.exe	Code function: 2_2_0739DD98	2_2_0739DD98
Source: C:\Users\user\AppData\Local\Temp\word.exe	Code function: 2_2_0739EC50	2_2_0739EC50
Source: C:\Users\user\AppData\Local\Temp\word.exe	Code function: 2_2_0739EC40	2_2_0739EC40
Source: C:\Users\user\AppData\Local\Temp\word.exe	Code function: 2_2_0739FB38	2_2_0739FB38
Source: C:\Users\user\AppData\Local\Temp\word.exe	Code function: 2_2_0739F838	2_2_0739F838
Source: C:\Users\user\AppData\Local\Temp\word.exe	Code function: 2_2_0739F848	2_2_0739F848
Source: C:\Users\user\AppData\Local\Temp\word.exe	Code function: 2_2_07390B17	2_2_07390B17
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_02C9E458	7_2_02C9E458
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_02C94AF0	7_2_02C94AF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_02C93ED8	7_2_02C93ED8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_02C94220	7_2_02C94220
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_02C9F1A5	7_2_02C9F1A5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_02C9B450	7_2_02C9B450
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_067027E8	7_2_067027E8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_0670EC30	7_2_0670EC30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_06763438	7_2_06763438
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_06765570	7_2_06765570
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_0676C518	7_2_0676C518
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_06766588	7_2_06766588
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_0676B1C0	7_2_0676B1C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_06765C7F	7_2_06765C7F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_06767D20	7_2_06767D20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_06767640	7_2_06767640
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_0676E748	7_2_0676E748
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_06760040	7_2_06760040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_0676003B	7_2_0676003B

Sample file is different than original file name gathered from version info

Source: DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe, 00000000.00000002.1839629481.000000000158E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe
Source: DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe, 00000000.00000002.1843811889.00000000046D6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename6e000584-3699-45ba-a4f2-5b5eb1bf0358.exe4 vs DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe
Source: DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe, 00000000.00000002.1843811889.00000000045EE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMiPro.dll, vs DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe
Source: DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe, 00000000.00000002.1843811889.00000000045EE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename6e000584-3699-45ba-a4f2-5b5eb1bf0358.exe4 vs DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe
Source: DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe, 00000000.00000002.1843811889.00000000044CE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename6e000584-3699-45ba-a4f2-5b5eb1bf0358.exe4 vs DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe
Source: DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe, 00000000.00000002.1845428280.0000000005A60000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameMiPro.dll, vs DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe

Yara signature match

Source: 0.2.DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe.46d62c0.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe.45492a2.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe.4586b82.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 2.2.word.exe.3b078fa.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe.465b132.5.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 6.2.InstallUtil.exe.620000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe.45ee5e0.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 2.2.word.exe.3a8c72a.3.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 2.2.word.exe.3aca01a.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe.465b132.5.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe.46d62c0.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe.4586b82.3.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe.45492a2.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe.450b9b2.4.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 2.2.word.exe.3b078fa.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 2.2.word.exe.3aca01a.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe.450b9b2.4.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 2.2.word.exe.3a8c72a.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers

Source: DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe, Sx9.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe.4586b82.3.raw.unpack, cPs8D.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe.4586b82.3.raw.unpack, 72CF8egH.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe.4586b82.3.raw.unpack, G5CXsdn.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe.4586b82.3.raw.unpack, 3uPsILA6U.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe.4586b82.3.raw.unpack, 6oQOw74dfIt.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe.4586b82.3.raw.unpack, aMIWm.cs	Cryptographic APIs: 'CreateDecryptor', 'TransformBlock'
Source: 0.2.DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe.4586b82.3.raw.unpack, 3QjbQ514BDx.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe.4586b82.3.raw.unpack, 3QjbQ514BDx.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@11/6@2/2

Source: C:\Users\user\Desktop\DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe.log

Source: C:\Users\user\AppData\Roaming\WIred1066\WIred1066.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2076:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7384:120:WilError_03

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: unknown	Process created: C:\Users\user\Desktop\DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe "C:\Users\user\Desktop\DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe"
Source: C:\Users\user\Desktop\DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe	Process created: C:\Users\user\AppData\Local\Temp\word.exe "C:\Users\user\AppData\Local\Temp\word.exe"
Source: C:\Users\user\AppData\Local\Temp\word.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Source: C:\Users\user\AppData\Local\Temp\word.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\WIred1066\WIred1066.exe "C:\Users\user\AppData\Roaming\WIred1066\WIred1066.exe"
Source: C:\Users\user\AppData\Roaming\WIred1066\WIred1066.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Roaming\WIred1066\WIred1066.exe "C:\Users\user\AppData\Roaming\WIred1066\WIred1066.exe"
Source: C:\Users\user\AppData\Roaming\WIred1066\WIred1066.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe	Process created: C:\Users\user\AppData\Local\Temp\word.exe "C:\Users\user\AppData\Local\Temp\word.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\word.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\word.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"	Jump to behavior

Source: C:\Users\user\Desktop\DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\word.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\word.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\word.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\word.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\word.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\word.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\word.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\word.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\word.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\word.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\word.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\word.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\word.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\word.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\word.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\word.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\word.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\word.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\word.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\word.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WIred1066\WIred1066.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WIred1066\WIred1066.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WIred1066\WIred1066.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WIred1066\WIred1066.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WIred1066\WIred1066.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WIred1066\WIred1066.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WIred1066\WIred1066.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WIred1066\WIred1066.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WIred1066\WIred1066.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WIred1066\WIred1066.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WIred1066\WIred1066.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WIred1066\WIred1066.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WIred1066\WIred1066.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WIred1066\WIred1066.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WIred1066\WIred1066.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WIred1066\WIred1066.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WIred1066\WIred1066.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WIred1066\WIred1066.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WIred1066\WIred1066.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WIred1066\WIred1066.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WIred1066\WIred1066.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WIred1066\WIred1066.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WIred1066\WIred1066.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WIred1066\WIred1066.exe	Section loaded: cryptbase.dll	Jump to behavior

Source: Yara match	File source: 0.2.DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe.45ee5e0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe.5a60000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe.5a60000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe.45492a2.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.word.exe.3b078fa.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe.4586b82.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe.465b132.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe.45ee5e0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.word.exe.3a8c72a.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.word.exe.3aca01a.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe.465b132.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe.4586b82.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe.450b9b2.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.word.exe.3b078fa.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.word.exe.3aca01a.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe.45492a2.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe.450b9b2.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.word.exe.3a8c72a.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1841909174.0000000003693000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1843811889.00000000045EE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1845428280.0000000005A60000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1841909174.0000000003341000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2553017101.00000000028C1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1843811889.00000000044CE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2561847271.0000000003A4E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe PID: 6732, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: word.exe PID: 7292, type: MEMORYSTR

Source: C:\Users\user\Desktop\DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe	Code function: 0_2_076A2E00 pushad ; ret	0_2_076A2E0D
Source: C:\Users\user\Desktop\DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe	Code function: 0_2_076CFC3D push FFFFFFE9h; ret	0_2_076CFC47
Source: C:\Users\user\Desktop\DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe	Code function: 0_2_076CFB46 push FFFFFFE9h; retn 0001h	0_2_076CFB48
Source: C:\Users\user\Desktop\DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe	Code function: 0_2_07C4E385 push FFFFFF8Bh; iretd	0_2_07C4E387
Source: C:\Users\user\Desktop\DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe	Code function: 0_2_07C4CB65 push FFFFFF8Bh; iretd	0_2_07C4CB6F
Source: C:\Users\user\AppData\Local\Temp\word.exe	Code function: 2_2_0739BB58 pushad ; ret	2_2_0739C0B3
Source: C:\Users\user\AppData\Local\Temp\word.exe	Code function: 2_2_07398126 pushad ; ret	2_2_07398163
Source: C:\Users\user\AppData\Local\Temp\word.exe	Code function: 2_2_0739C055 pushad ; ret	2_2_0739C0B3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_02C90C95 push edi; retf	7_2_02C90C3A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_02C90C3D push edi; ret	7_2_02C90CC2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_06709CF1 push es; ret	7_2_06709D00

Source: C:\Users\user\Desktop\DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe	File created: \documents of ownership and payment requirements.exe
Source: C:\Users\user\Desktop\DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe	File created: \documents of ownership and payment requirements.exe			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run WIred1066			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run WIred1066			Jump to behavior

Source: C:\Users\user\Desktop\DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe	File opened: C:\Users\user\Desktop\DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe\:Zone.Identifier read attributes \| delete	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\word.exe	File opened: C:\Users\user\AppData\Local\Temp\word.exe\:Zone.Identifier read attributes \| delete	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Roaming\WIred1066\WIred1066.exe:Zone.Identifier read attributes \| delete	Jump to behavior

Source: C:\Users\user\Desktop\DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe	Memory allocated: 1840000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe	Memory allocated: 3340000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe	Memory allocated: 1860000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\word.exe	Memory allocated: E10000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\word.exe	Memory allocated: 28C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\word.exe	Memory allocated: 48C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\word.exe	Memory allocated: 7F00000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\word.exe	Memory allocated: 8F00000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\word.exe	Memory allocated: 90D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\word.exe	Memory allocated: A0D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\word.exe	Memory allocated: A470000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\word.exe	Memory allocated: B470000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\word.exe	Memory allocated: C470000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 13A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 2F20000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 2E20000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WIred1066\WIred1066.exe	Memory allocated: 2130000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WIred1066\WIred1066.exe	Memory allocated: 22D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WIred1066\WIred1066.exe	Memory allocated: 42D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WIred1066\WIred1066.exe	Memory allocated: 24F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WIred1066\WIred1066.exe	Memory allocated: 2750000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WIred1066\WIred1066.exe	Memory allocated: 2560000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\word.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WIred1066\WIred1066.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WIred1066\WIred1066.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\word.exe	Window / User API: threadDelayed 2068	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\word.exe	Window / User API: threadDelayed 7783	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Window / User API: threadDelayed 1845	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Window / User API: threadDelayed 8006	Jump to behavior

Source: C:\Users\user\Desktop\DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe TID: 8	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\word.exe TID: 7348	Thread sleep time: -32281802128991695s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\word.exe TID: 7348	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 8172	Thread sleep count: 36 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 8172	Thread sleep time: -33204139332677172s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 8172	Thread sleep time: -100000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 8176	Thread sleep count: 1845 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 8172	Thread sleep time: -99890s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 8176	Thread sleep count: 8006 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 8172	Thread sleep time: -99781s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 8172	Thread sleep time: -99672s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 8172	Thread sleep time: -99555s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 8172	Thread sleep time: -99450s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 8172	Thread sleep time: -99344s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 8172	Thread sleep time: -99234s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 8172	Thread sleep time: -99125s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 8172	Thread sleep time: -99015s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 8172	Thread sleep time: -98906s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 8172	Thread sleep time: -98797s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 8172	Thread sleep time: -98687s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 8172	Thread sleep time: -98578s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 8172	Thread sleep time: -98469s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 8172	Thread sleep time: -98359s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 8172	Thread sleep time: -98250s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 8172	Thread sleep time: -98140s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 8172	Thread sleep time: -98031s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 8172	Thread sleep time: -97922s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 8172	Thread sleep time: -97812s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 8172	Thread sleep time: -97703s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 8172	Thread sleep time: -97593s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 8172	Thread sleep time: -97484s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 8172	Thread sleep time: -97375s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 8172	Thread sleep time: -97253s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 8172	Thread sleep time: -97125s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 8172	Thread sleep time: -97016s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 8172	Thread sleep time: -99969s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 8172	Thread sleep time: -99859s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 8172	Thread sleep time: -99750s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 8172	Thread sleep time: -99640s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 8172	Thread sleep time: -99531s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 8172	Thread sleep time: -99422s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 8172	Thread sleep time: -99312s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 8172	Thread sleep time: -99203s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 8172	Thread sleep time: -99093s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 8172	Thread sleep time: -98984s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 8172	Thread sleep time: -98875s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 8172	Thread sleep time: -98765s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 8172	Thread sleep time: -98639s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 8172	Thread sleep time: -98517s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 8172	Thread sleep time: -98390s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 8172	Thread sleep time: -98281s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 8172	Thread sleep time: -98172s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 8172	Thread sleep time: -98062s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 8172	Thread sleep time: -97953s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 8172	Thread sleep time: -97843s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 8172	Thread sleep time: -97734s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 8172	Thread sleep time: -97625s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WIred1066\WIred1066.exe TID: 5716	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WIred1066\WIred1066.exe TID: 5232	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe, 00000000.00000002.1843811889.00000000045EE000.00000004.00000800.00020000.00000000.sdmp, DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe, 00000000.00000002.1845428280.0000000005A60000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: VBoxTray
Source: DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe, 00000000.00000002.1845428280.0000000005A60000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: sandboxierpcssGSOFTWARE\VMware, Inc.\VMware VGAuth
Source: InstallUtil.exe, 00000007.00000002.3031886422.0000000006280000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\word.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process token adjusted: Debug	Jump to behavior

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.26.12.205	api.ipify.org	United States		13335	CLOUDFLARENETUS	false
188.241.39.200	cphost09.qhoster.net	Belize		25369	BANDWIDTH-ASGB	false

Name	IP	Active
cphost09.qhoster.net	188.241.39.200	true
api.ipify.org	104.26.12.205	true

ID:	1428407
Product:	CloudBasic
Start time:	22:34:08
Start date:	18.04.2024
Sample:	DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe
Cookbook:	default.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	bb365d6b7cc40a740a03ffafc56555a8
SHA1:	3132c62beaa5d5d6c83ae5eda22b1c0d7b992b02
SHA256:	82d326f98e0f8d143e7bc11ce8c465bcf79b2c34d4368f7ebe326fae200b5199
Filetype:	Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe.log	ASCII text, with CRLF line terminators	479CC1A13F046249B18E7FB2F48E02E7	782907CB9575BABB176CE804B5EE490CCEB06309	66137D065EC494A9F5FFA59A32374B2CE8678C029BA04A0AF4BF025C7A2A1673
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\WIred1066.exe.log	CSV text	E54FE55F93C5501D5C4737CCF0E6E48B	BEF9C1A7166E3E8C2C7762C42F8FCBB753B63283	2434AE4C4C8436A64A4F3317638DF77C38CB7FFC226037ADE1DC6F6CD4745619
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\word.exe.log	ASCII text, with CRLF line terminators	479CC1A13F046249B18E7FB2F48E02E7	782907CB9575BABB176CE804B5EE490CCEB06309	66137D065EC494A9F5FFA59A32374B2CE8678C029BA04A0AF4BF025C7A2A1673
C:\Users\user\AppData\Roaming\WIred1066\WIred1066.exe	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows	5D4073B2EB6D217C19F2B22F21BF8D57	F0209900FBF08D004B886A0B3BA33EA2B0BF9DA8	AC1A3F21FCC88F9CEE7BF51581EAFBA24CC76C924F0821DEB2AFDF1080DDF3D3
\Device\ConDrv	ASCII text, with CRLF line terminators	3BF802DEB390033F9A89736CBA5BFAFF	25A7177A92E0283B99C85538C4754A12AC8AD197	5202EB464D6118AC60F72E89FBAAACF1FB8CF6A232F98F47F88D0E7B2F3AFDB3

Windows Analysis Report DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe

Overview

General Information

Detection

Signatures

Classification

Malware Threat Intel Provided by

Signatures

AV Detection

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted Domains

Contacted URLs

Windows Analysis Report
DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe

Malware Threat Intel
Provided by