Edit tour

Windows Analysis Report
SecuriteInfo.com.Win32.AdwareX-gen.9076.19863.exe

Overview

General Information

Sample name:	SecuriteInfo.com.Win32.AdwareX-gen.9076.19863.exe
Analysis ID:	1428463
MD5:	873d3f98aa31a6d5802e2033bbfa8ce3
SHA1:	1692b76af4b21f6c5e6fba7c54baf7fdc4e5d1f9
SHA256:	d9a6afcf1f17010c8432b8725d77eececa4d8fdfbebf3eeaf8d1d2d31f9bd9e9
Tags:	exe
Infos:

Detection

Score:	48
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Contains long sleeps (>= 3 min)

Detected potential crypto function

Found inlined nop instructions (likely shell or obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Potential key logger detected (key state polling based)

Program does not show much activity (idle)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Classification

Process Tree

System is w10x64

SecuriteInfo.com.Win32.AdwareX-gen.9076.19863.exe (PID: 4176 cmdline: "C:\Users\user\Desktop\SecuriteInfo.com.Win32.AdwareX-gen.9076.19863.exe" MD5: 873D3F98AA31A6D5802E2033BBFA8CE3)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: SecuriteInfo.com.Win32.AdwareX-gen.9076.19863.exe

ReversingLabs: Detection: 18%

Source: SecuriteInfo.com.Win32.AdwareX-gen.9076.19863.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:

Binary string: C:\OneDrive\OneDrive - Haley Consulting, LLC\Projects\Client\TCC\FPDesktop\obj\Debug\FPDesktop.pdb source: SecuriteInfo.com.Win32.AdwareX-gen.9076.19863.exe

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.AdwareX-gen.9076.19863.exe	Code function: 4x nop then jmp 06A06013h		0_2_06A05DA8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.AdwareX-gen.9076.19863.exe	Code function: 4x nop then jmp 06A06013h		0_2_06A05D99

Source: SecuriteInfo.com.Win32.AdwareX-gen.9076.19863.exe, 00000000.00000002.3329137545.0000000002501000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: SecuriteInfo.com.Win32.AdwareX-gen.9076.19863.exe	String found in binary or memory: http://www.xguardian.net/xguardian/aws_ec2_pool_vm.cfm?Domain=theconcretecompany.com&Pool=2

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.AdwareX-gen.9076.19863.exe

Code function: 0_2_06D4A5F8 GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,

0_2_06D4A5F8

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.AdwareX-gen.9076.19863.exe	Code function: 0_2_00B4C1B8	0_2_00B4C1B8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.AdwareX-gen.9076.19863.exe	Code function: 0_2_00B4DBD0	0_2_00B4DBD0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.AdwareX-gen.9076.19863.exe	Code function: 0_2_06A05C14	0_2_06A05C14
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.AdwareX-gen.9076.19863.exe	Code function: 0_2_06A05BD4	0_2_06A05BD4
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.AdwareX-gen.9076.19863.exe	Code function: 0_2_06A0F9E0	0_2_06A0F9E0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.AdwareX-gen.9076.19863.exe	Code function: 0_2_06A06438	0_2_06A06438
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.AdwareX-gen.9076.19863.exe	Code function: 0_2_06A06D91	0_2_06A06D91
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.AdwareX-gen.9076.19863.exe	Code function: 0_2_06A01B04	0_2_06A01B04
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.AdwareX-gen.9076.19863.exe	Code function: 0_2_06D47E58	0_2_06D47E58
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.AdwareX-gen.9076.19863.exe	Code function: 0_2_06D44DF0	0_2_06D44DF0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.AdwareX-gen.9076.19863.exe	Code function: 0_2_06D41E60	0_2_06D41E60
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.AdwareX-gen.9076.19863.exe	Code function: 0_2_06D47E58	0_2_06D47E58
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.AdwareX-gen.9076.19863.exe	Code function: 0_2_06D45CB0	0_2_06D45CB0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.AdwareX-gen.9076.19863.exe	Code function: 0_2_06D45BE4	0_2_06D45BE4
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.AdwareX-gen.9076.19863.exe	Code function: 0_2_06D44DF0	0_2_06D44DF0

Source: SecuriteInfo.com.Win32.AdwareX-gen.9076.19863.exe, 00000000.00000000.2082136568.00000000001A2000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameFPDesktop.exe4 vs SecuriteInfo.com.Win32.AdwareX-gen.9076.19863.exe
Source: SecuriteInfo.com.Win32.AdwareX-gen.9076.19863.exe, 00000000.00000002.3328353865.000000000090E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs SecuriteInfo.com.Win32.AdwareX-gen.9076.19863.exe
Source: SecuriteInfo.com.Win32.AdwareX-gen.9076.19863.exe	Binary or memory string: OriginalFilenameFPDesktop.exe4 vs SecuriteInfo.com.Win32.AdwareX-gen.9076.19863.exe

Source: classification engine

Classification label: mal48.winEXE@1/0@0/0

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.AdwareX-gen.9076.19863.exe

Mutant created: NULL

Source: SecuriteInfo.com.Win32.AdwareX-gen.9076.19863.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: SecuriteInfo.com.Win32.AdwareX-gen.9076.19863.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.AdwareX-gen.9076.19863.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: SecuriteInfo.com.Win32.AdwareX-gen.9076.19863.exe

ReversingLabs: Detection: 18%

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.AdwareX-gen.9076.19863.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.AdwareX-gen.9076.19863.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.AdwareX-gen.9076.19863.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.AdwareX-gen.9076.19863.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.AdwareX-gen.9076.19863.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.AdwareX-gen.9076.19863.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.AdwareX-gen.9076.19863.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.AdwareX-gen.9076.19863.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.AdwareX-gen.9076.19863.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.AdwareX-gen.9076.19863.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.AdwareX-gen.9076.19863.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.AdwareX-gen.9076.19863.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.AdwareX-gen.9076.19863.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.AdwareX-gen.9076.19863.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.AdwareX-gen.9076.19863.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.AdwareX-gen.9076.19863.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.AdwareX-gen.9076.19863.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.AdwareX-gen.9076.19863.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.AdwareX-gen.9076.19863.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.AdwareX-gen.9076.19863.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.AdwareX-gen.9076.19863.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.AdwareX-gen.9076.19863.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.AdwareX-gen.9076.19863.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.AdwareX-gen.9076.19863.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.AdwareX-gen.9076.19863.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.AdwareX-gen.9076.19863.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.AdwareX-gen.9076.19863.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.AdwareX-gen.9076.19863.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.AdwareX-gen.9076.19863.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.AdwareX-gen.9076.19863.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.AdwareX-gen.9076.19863.exe	Section loaded: wintypes.dll	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.AdwareX-gen.9076.19863.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: SecuriteInfo.com.Win32.AdwareX-gen.9076.19863.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: SecuriteInfo.com.Win32.AdwareX-gen.9076.19863.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: SecuriteInfo.com.Win32.AdwareX-gen.9076.19863.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:

Binary string: C:\OneDrive\OneDrive - Haley Consulting, LLC\Projects\Client\TCC\FPDesktop\obj\Debug\FPDesktop.pdb source: SecuriteInfo.com.Win32.AdwareX-gen.9076.19863.exe

Source: SecuriteInfo.com.Win32.AdwareX-gen.9076.19863.exe

Static PE information: 0xA3490A5B [Sun Oct 22 20:43:07 2056 UTC]

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.AdwareX-gen.9076.19863.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.AdwareX-gen.9076.19863.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.AdwareX-gen.9076.19863.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.AdwareX-gen.9076.19863.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.AdwareX-gen.9076.19863.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.AdwareX-gen.9076.19863.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.AdwareX-gen.9076.19863.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.AdwareX-gen.9076.19863.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.AdwareX-gen.9076.19863.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.AdwareX-gen.9076.19863.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.AdwareX-gen.9076.19863.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.AdwareX-gen.9076.19863.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.AdwareX-gen.9076.19863.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.AdwareX-gen.9076.19863.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.AdwareX-gen.9076.19863.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.AdwareX-gen.9076.19863.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.AdwareX-gen.9076.19863.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.AdwareX-gen.9076.19863.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.AdwareX-gen.9076.19863.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.AdwareX-gen.9076.19863.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.AdwareX-gen.9076.19863.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.AdwareX-gen.9076.19863.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.AdwareX-gen.9076.19863.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.AdwareX-gen.9076.19863.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.AdwareX-gen.9076.19863.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.AdwareX-gen.9076.19863.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.AdwareX-gen.9076.19863.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.AdwareX-gen.9076.19863.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.AdwareX-gen.9076.19863.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.AdwareX-gen.9076.19863.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.AdwareX-gen.9076.19863.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.AdwareX-gen.9076.19863.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.AdwareX-gen.9076.19863.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.AdwareX-gen.9076.19863.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.AdwareX-gen.9076.19863.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.AdwareX-gen.9076.19863.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.AdwareX-gen.9076.19863.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.AdwareX-gen.9076.19863.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.AdwareX-gen.9076.19863.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.AdwareX-gen.9076.19863.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.AdwareX-gen.9076.19863.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.AdwareX-gen.9076.19863.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.AdwareX-gen.9076.19863.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.AdwareX-gen.9076.19863.exe	Memory allocated: B40000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.AdwareX-gen.9076.19863.exe	Memory allocated: 2500000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.AdwareX-gen.9076.19863.exe	Memory allocated: 4500000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.AdwareX-gen.9076.19863.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.AdwareX-gen.9076.19863.exe TID: 2852

Thread sleep time: -922337203685477s >= -30000s

Jump to behavior

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.AdwareX-gen.9076.19863.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: SecuriteInfo.com.Win32.AdwareX-gen.9076.19863.exe, 00000000.00000002.3328353865.0000000000942000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllR

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.AdwareX-gen.9076.19863.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.AdwareX-gen.9076.19863.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.AdwareX-gen.9076.19863.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.AdwareX-gen.9076.19863.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.AdwareX-gen.9076.19863.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.AdwareX-gen.9076.19863.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.AdwareX-gen.9076.19863.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.AdwareX-gen.9076.19863.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Remoting\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.AdwareX-gen.9076.19863.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.AdwareX-gen.9076.19863.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	1 Input Capture	1 Security Software Discovery	Remote Services	1 Input Capture	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	31 Virtualization/Sandbox Evasion	LSASS Memory	31 Virtualization/Sandbox Evasion	Remote Desktop Protocol	1 Archive Collected Data	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Timestomp	Security Account Manager	12 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Obfuscated Files or Information	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
SecuriteInfo.com.Win32.AdwareX-gen.9076.19863.exe	18%	ReversingLabs	Win32.PUA.Generic

Name	Source	Malicious	Antivirus Detection	Reputation
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	SecuriteInfo.com.Win32.AdwareX-gen.9076.19863.exe, 00000000.00000002.3329137545.0000000002501000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.xguardian.net/xguardian/aws_ec2_pool_vm.cfm?Domain=theconcretecompany.com&Pool=2	SecuriteInfo.com.Win32.AdwareX-gen.9076.19863.exe	false		unknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1428463
Start date and time:	2024-04-19 00:39:09 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 15s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	SecuriteInfo.com.Win32.AdwareX-gen.9076.19863.exe
Detection:	MAL
Classification:	mal48.winEXE@1/0@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 41 Number of non-executed functions: 7
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded domains from analysis (whitelisted): client.wns.windows.com, fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: SecuriteInfo.com.Win32.AdwareX-gen.9076.19863.exe

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	5.667633961353233
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	SecuriteInfo.com.Win32.AdwareX-gen.9076.19863.exe
File size:	548'352 bytes
MD5:	873d3f98aa31a6d5802e2033bbfa8ce3
SHA1:	1692b76af4b21f6c5e6fba7c54baf7fdc4e5d1f9
SHA256:	d9a6afcf1f17010c8432b8725d77eececa4d8fdfbebf3eeaf8d1d2d31f9bd9e9
SHA512:	05f0955e79f226707269689232f938b2af5d509918ce34d6d6b3c36ee63490551d443918f456705dbe15be5c9dbb87bc7e9e4b1ea663741ae660153c2cad8022
SSDEEP:	12288:VvDZzYGzVAGLfOa9QpJIGzVAGLfO2GoVAGLrS:kGpAGLffQpJIGpAGLfnGKAGLr
TLSH:	25C4D562E541995BE43B3238011247392222AF547427D8AD29BB3D6B3D76E4F0D1F2FB
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...[.I..........."...P.................. ........@.. ....................................`................................

File Icon


Icon Hash:	a2a8f0b0b0b2aefc

Static PE Info

General

Entrypoint:	0x46d5ea
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0xA3490A5B [Sun Oct 22 20:43:07 2056 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x6d597	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x6e000	0x1a3b8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x8a000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x6d4e4	0x38	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x6b5f0	0x6b600	73c16cb2a8d183bbfa70f96800370825	False	0.2921865905122235	data	5.623865846070342	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x6e000	0x1a3b8	0x1a400	8e1d9f74546b87c3f0f9918212a28ac0	False	0.40172061011904764	data	5.644736606822636	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x8a000	0xc	0x200	b5200ded72c14f5cbca73eddeda559c4	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0x6e1a0	0x4f4d	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	0.9971429978818778
RT_ICON	0x73100	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 67584	0.21356323198864308
RT_ICON	0x83938	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	0.3852697095435685
RT_ICON	0x85ef0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	0.4280018761726079
RT_ICON	0x86fa8	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	0.5053278688524591
RT_ICON	0x87940	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	0.5824468085106383
RT_GROUP_ICON	0x87db8	0x5a	data	0.7777777777777778
RT_VERSION	0x87e24	0x394	OpenPGP Secret Key	0.4344978165938865
RT_MANIFEST	0x881c8	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Target ID:	0
Start time:	00:39:58
Start date:	19/04/2024
Path:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.AdwareX-gen.9076.19863.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\SecuriteInfo.com.Win32.AdwareX-gen.9076.19863.exe"
Imagebase:	0x160000
File size:	548'352 bytes
MD5 hash:	873D3F98AA31A6D5802E2033BBFA8CE3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	9.2%
Dynamic/Decrypted Code Coverage:	96.2%
Signature Coverage:	10.2%
Total number of Nodes:	264
Total number of Limit Nodes:	24

Executed Functions

Function 06A05C14 Relevance: 5.1, APIs: 3, Instructions: 605
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCapture.USER32 ref: 06A06EF7
GetActiveWindow.USER32 ref: 06A06F6F
GetProcessWindowStation.USER32 ref: 06A0758D

Memory Dump Source

Source File: 00000000.00000002.3330689694.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a00000_SecuriteInfo.jbxd

Similarity

API ID: Window$ActiveCaptureProcessStation
String ID:
API String ID: 2779997428-0
Opcode ID: fdfa7943cd650ddf1fc2f34ead6d1cc06ceaf78b90d391a465ddf98963e7096a
Instruction ID: e64a85531cbb549043192cc3791f49fb90c477deda86743b18f78ae23b47925d
Opcode Fuzzy Hash: fdfa7943cd650ddf1fc2f34ead6d1cc06ceaf78b90d391a465ddf98963e7096a
Instruction Fuzzy Hash: F7324130A002098FEB55EBB9D554BAEB7F6EF88300F244169E505EB391DF35AD41CB51

Uniqueness

Uniqueness Score: -1.00%

Function 06A06D91 Relevance: 3.3, APIs: 2, Instructions: 320
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCapture.USER32 ref: 06A06EF7
GetActiveWindow.USER32 ref: 06A06F6F
GetProcessWindowStation.USER32 ref: 06A0758D

Memory Dump Source

Source File: 00000000.00000002.3330689694.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a00000_SecuriteInfo.jbxd

Similarity

API ID: Window$ActiveCaptureProcessStation
String ID:
API String ID: 2779997428-0
Opcode ID: 78aa3fea9805b1ca5679fd69a4ab57151bb4eb159fcdc986341c676aab8d83d5
Instruction ID: f5c1205411c6c03dfeb08e399c3e3c7643bcd604a800e75c824bb21d97dfc62f
Opcode Fuzzy Hash: 78aa3fea9805b1ca5679fd69a4ab57151bb4eb159fcdc986341c676aab8d83d5
Instruction Fuzzy Hash: A1D13271E00209CFEB64EFB5D954A9DBBF2FF88304F244269E505AB291DB71A981CF10

Uniqueness

Uniqueness Score: -1.00%

Function 06D47E58 Relevance: 2.0, APIs: 1, Instructions: 514
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(00000000), ref: 06D482E6

Memory Dump Source

Source File: 00000000.00000002.3330851306.0000000006D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d40000_SecuriteInfo.jbxd

Similarity

API ID: BrushColor
String ID:
API String ID: 464657469-0
Opcode ID: 900e137836dc89db3d01c07deb8d2721c37c25bbdd407bb021416484c585fc5b
Instruction ID: fac1189c7c5e59b5a8975ff068f8c05aa196b5ad78fc9b36af08a0f0b2a88df4
Opcode Fuzzy Hash: 900e137836dc89db3d01c07deb8d2721c37c25bbdd407bb021416484c585fc5b
Instruction Fuzzy Hash: 8532253191061ACFDB61EF64C984BD9B7B2BF89300F1185E9E409AB261DB71EE85CF40

Uniqueness

Uniqueness Score: -1.00%

Function 06A0F9E0 Relevance: 1.9, APIs: 1, Instructions: 396
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.3330689694.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a00000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 511e677789927b9aa689b4489d3a12cd3f0fa998e3404436c3692d10468555e1
Instruction ID: 803033d058b0b5cacf7617f92871acf59ea17465b608d6b041aac477be3f511b
Opcode Fuzzy Hash: 511e677789927b9aa689b4489d3a12cd3f0fa998e3404436c3692d10468555e1
Instruction Fuzzy Hash: CFF15C30E00209CFEB64EFA9D944B9DBBF1BF89314F158159E905AF2A5DB70A945CF80

Uniqueness

Uniqueness Score: -1.00%

Function 06D44DF0 Relevance: .6, Instructions: 635COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3330851306.0000000006D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d40000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 476892986b0c5c306595e5640db050757d489faffd3c34055a612ba0103fadbf
Instruction ID: 3ece2485dac22aa74cefaa79e3b67b6ed68bc6e2f5f84bd205939e3f361ddcb7
Opcode Fuzzy Hash: 476892986b0c5c306595e5640db050757d489faffd3c34055a612ba0103fadbf
Instruction Fuzzy Hash: F4525B3590061ACFDB61EF64C844AE9B7B1FF49304F1485D9E549AB261EB71EE81CF80

Uniqueness

Uniqueness Score: -1.00%

Function 06A05BD4 Relevance: .4, Instructions: 434COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3330689694.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a00000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b70771ebe3e8a2b354016f99ba81636572792e897341a2940c08f7d1e0fd3d4
Instruction ID: cb95b582f7eeaf0bba9d02c65c6b6782542e646c9dc82aa7a0b97f723d219d4d
Opcode Fuzzy Hash: 6b70771ebe3e8a2b354016f99ba81636572792e897341a2940c08f7d1e0fd3d4
Instruction Fuzzy Hash: EE12F334A50218CFDB04EFA4C994E9DB7B2FF8A304F1181A9D50AAB365DB30AD85CF00

Uniqueness

Uniqueness Score: -1.00%

Function 06A06438 Relevance: .4, Instructions: 431COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3330689694.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a00000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53b4a3aa7830e393649bd4438386abcaf06b38a1e037d1ac3819b8b93b97f7ea
Instruction ID: 496b5fcb05a55b4ba61d9f1dad82e1d6df3d5fe1d4c1dfc89180311c51605489
Opcode Fuzzy Hash: 53b4a3aa7830e393649bd4438386abcaf06b38a1e037d1ac3819b8b93b97f7ea
Instruction Fuzzy Hash: 9312E234A50218CFDB04EFB4C994A9DB7B2FF8A304F1181A9D50AAB365DB71A985CF10

Uniqueness

Uniqueness Score: -1.00%

Function 06A05DA8 Relevance: .4, Instructions: 351COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3330689694.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a00000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f8298ae59288544fae6a5375058d3297da2623978e6371aa1658efa5036542a
Instruction ID: de11e1851e3e008f88569c15347cfebd03630d3a32732c5ebe6e723c1037e1c1
Opcode Fuzzy Hash: 9f8298ae59288544fae6a5375058d3297da2623978e6371aa1658efa5036542a
Instruction Fuzzy Hash: 5EF1E474A01218CFDB54EFA4D998B9DBBB1FF4A305F1040A9D40AAB3A5DB31AD85CF10

Uniqueness

Uniqueness Score: -1.00%

Function 06A05D99 Relevance: .3, Instructions: 328COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3330689694.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a00000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64ad5b6193759de1eab7329a1a613452de27f39b3c7be8e99fb12e9cd1570b4c
Instruction ID: d36b61e3bab19710237d04effc9b5827b58607fe52d47cdb66c309243b4cde42
Opcode Fuzzy Hash: 64ad5b6193759de1eab7329a1a613452de27f39b3c7be8e99fb12e9cd1570b4c
Instruction Fuzzy Hash: 28F1D674A01218CFDB54EFA4D998B9DBBB1FF4A305F1041A9D409AB3A5DB31AD85CF10

Uniqueness

Uniqueness Score: -1.00%

Function 00B47540 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00B475BE
GetCurrentThread.KERNEL32 ref: 00B475FB
GetCurrentProcess.KERNEL32 ref: 00B47638
GetCurrentThreadId.KERNEL32 ref: 00B47691

Memory Dump Source

Source File: 00000000.00000002.3328642722.0000000000B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b40000_SecuriteInfo.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: c5d9eadc2fd1dc3913472bdc7fb0eeb2b2c0a2cf9c4e7b2529be282e41d58bfc
Instruction ID: 428ade5f828cfda0e388a44256359cfbf864d4e9111f06ad72c2a38c57d6ab5a
Opcode Fuzzy Hash: c5d9eadc2fd1dc3913472bdc7fb0eeb2b2c0a2cf9c4e7b2529be282e41d58bfc
Instruction Fuzzy Hash: 295144B090074ACFDB14DFA9D548B9EBBF1EF88314F208459E009A7360DB74A944CF65

Uniqueness

Uniqueness Score: -1.00%

Function 06A083E2 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 71
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 06A08472

Strings

K, xrefs: 06A084A3

Memory Dump Source

Source File: 00000000.00000002.3330689694.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a00000_SecuriteInfo.jbxd

Similarity

API ID: CurrentThread
String ID: K
API String ID: 2882836952-392817484
Opcode ID: 60407e9fa5d906570f65bff58927f2eb8fa305f459fa6cc80fc8b16db6dbf821
Instruction ID: 6206702dc60b75b821ddbf40d20ea6a2fd6203ac61ae69153f6329195182873e
Opcode Fuzzy Hash: 60407e9fa5d906570f65bff58927f2eb8fa305f459fa6cc80fc8b16db6dbf821
Instruction Fuzzy Hash: 3C3147B090024A8FDB40DF99D884ADEFFB0FF49314F14855AE419AB352C375A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 06A083F0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 63
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 06A08472

Strings

K, xrefs: 06A084A3

Memory Dump Source

Source File: 00000000.00000002.3330689694.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a00000_SecuriteInfo.jbxd

Similarity

API ID: CurrentThread
String ID: K
API String ID: 2882836952-392817484
Opcode ID: 1e8bb9418d41629e7d138e53ab25adab31318fdb79133b49ad79e2a81d3f6ecf
Instruction ID: 3b222d00e1da26b469410e187e24e738cf79f62a2e628410dd0cc68cb42f8fd6
Opcode Fuzzy Hash: 1e8bb9418d41629e7d138e53ab25adab31318fdb79133b49ad79e2a81d3f6ecf
Instruction Fuzzy Hash: DA2133B090024ACFDB40EF99E884A9EFFF0FB48314F148519E419AB352C779A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00B4D4C8 Relevance: 1.7, APIs: 1, Instructions: 203
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 00B4D72E

Memory Dump Source

Source File: 00000000.00000002.3328642722.0000000000B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b40000_SecuriteInfo.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 3f7d713a5d82977551e858042a1186988383ef8266478581764de6ce71474b7f
Instruction ID: dd2d4986f1af7c32e202d542e6750f012a04f62125e5c6cffb7a4e5afd7320ed
Opcode Fuzzy Hash: 3f7d713a5d82977551e858042a1186988383ef8266478581764de6ce71474b7f
Instruction Fuzzy Hash: A7812370A00B058FD764DF69C44575ABBF1FF88304F00896EE48ADBA50DB75E949CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00B4FAD0 Relevance: 1.6, APIs: 1, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 00B4FBE2

Memory Dump Source

Source File: 00000000.00000002.3328642722.0000000000B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b40000_SecuriteInfo.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 307f648afbe4a6e28dc36b6a3feede71f154d6addf5683aa92f9005aa073704d
Instruction ID: 09ea7f284e01485984bd2ba6e2e3e628da5d461bfc98f2f43602005358a5cfb2
Opcode Fuzzy Hash: 307f648afbe4a6e28dc36b6a3feede71f154d6addf5683aa92f9005aa073704d
Instruction Fuzzy Hash: 2841ADB1D00349AFDB14CF9AC884ADEBBF5FF48314F24816AE818AB211D775A945CF90

Uniqueness

Uniqueness Score: -1.00%

Function 06D40040 Relevance: 1.6, APIs: 1, Instructions: 95
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetActiveWindow.USER32 ref: 06D400BB

Memory Dump Source

Source File: 00000000.00000002.3330851306.0000000006D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d40000_SecuriteInfo.jbxd

Similarity

API ID: ActiveWindow
String ID:
API String ID: 2558294473-0
Opcode ID: bdcea0e54b4b3860a1bc5823801893b591a5b109cd752e821f62dde1825b5301
Instruction ID: 10d93a70b3b53a16d75aac0e9ce971898392ddf901a160d1897f9baf2a7ba613
Opcode Fuzzy Hash: bdcea0e54b4b3860a1bc5823801893b591a5b109cd752e821f62dde1825b5301
Instruction Fuzzy Hash: 8E31A171900745CFEBA0EFAACD457AFBBF5FF84318F148429D655A2241C7789845CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00B47780 Relevance: 1.6, APIs: 1, Instructions: 66
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 00B4780F

Memory Dump Source

Source File: 00000000.00000002.3328642722.0000000000B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b40000_SecuriteInfo.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 83ef6bfb2e2149b8f7daa8556706d06e7d96be208de44e630efe4a6cb51e176d
Instruction ID: 106aae157485bc933700ac167c54b0ebd5fd5a08308dded4569feaec1fe2dbef
Opcode Fuzzy Hash: 83ef6bfb2e2149b8f7daa8556706d06e7d96be208de44e630efe4a6cb51e176d
Instruction Fuzzy Hash: D921D2B5900249EFDB10CFAAD984ADEFBF4FB48320F14845AE918A7310D774A950CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 06A07BFC Relevance: 1.6, APIs: 1, Instructions: 62
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnumThreadWindows.USER32(?,00000000,053ED49E,?,?,?,00000E20,?,?,06A084C0,035042D8,0254C094), ref: 06A08551

Memory Dump Source

Source File: 00000000.00000002.3330689694.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a00000_SecuriteInfo.jbxd

Similarity

API ID: EnumThreadWindows
String ID:
API String ID: 2941952884-0
Opcode ID: bc3cd2636024ddf8e52fdd8069f1245a4ccacb09b58c633511138eaf1f972726
Instruction ID: b753ab4038b2b68c8f8ac3b5d27ad22c3c857b0b9253f68288d4933c379f93d9
Opcode Fuzzy Hash: bc3cd2636024ddf8e52fdd8069f1245a4ccacb09b58c633511138eaf1f972726
Instruction Fuzzy Hash: 74213875D0024A9FEB50DF9AD844BEEFBF4FB88320F108429D419A7280D778A940CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00B47788 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 00B4780F

Memory Dump Source

Source File: 00000000.00000002.3328642722.0000000000B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b40000_SecuriteInfo.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 80388ba5c8dbe1ef250029bf594e367cd906aaa178213939749e2828299967d8
Instruction ID: 0dc69f1d7eb937207474f523c63b7e50c5c5289d091838bdd67cf06e52929e0b
Opcode Fuzzy Hash: 80388ba5c8dbe1ef250029bf594e367cd906aaa178213939749e2828299967d8
Instruction Fuzzy Hash: 3A21B3B59002499FDB10CFAAD984ADEFBF4FB48320F14845AE918A3350D774A954CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 06A084D8 Relevance: 1.6, APIs: 1, Instructions: 61
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnumThreadWindows.USER32(?,00000000,053ED49E,?,?,?,00000E20,?,?,06A084C0,035042D8,0254C094), ref: 06A08551

Memory Dump Source

Source File: 00000000.00000002.3330689694.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a00000_SecuriteInfo.jbxd

Similarity

API ID: EnumThreadWindows
String ID:
API String ID: 2941952884-0
Opcode ID: a4d7b372d00a0da9dc684ceb252a84a59161c190c8a0179c49e252c7acb05850
Instruction ID: 66d269afe85d7fca8ac6ca3bdf1e46d91e60ac4ba764716dafdd5f24602adaa6
Opcode Fuzzy Hash: a4d7b372d00a0da9dc684ceb252a84a59161c190c8a0179c49e252c7acb05850
Instruction Fuzzy Hash: AB2138B5D0020A8FEB10CFA9D845BEEFBF4FB48310F10842AD419A3250D778A940CF65

Uniqueness

Uniqueness Score: -1.00%

Function 00B4C3C8 Relevance: 1.6, APIs: 1, Instructions: 55
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,00B4D7A9,00000800,00000000,00000000), ref: 00B4D9BA

Memory Dump Source

Source File: 00000000.00000002.3328642722.0000000000B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b40000_SecuriteInfo.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 0b6f93f3beb4e8edac3d18f53f6f7c85f55c8de7406a8bda8d1df856d725ec83
Instruction ID: 09e2e457a83a266d559f5872793c4b44bb88a9a398efb1168d6c6ef8e79015fc
Opcode Fuzzy Hash: 0b6f93f3beb4e8edac3d18f53f6f7c85f55c8de7406a8bda8d1df856d725ec83
Instruction Fuzzy Hash: 1111D3B69003499FDB10DF9AD444B9EFBF4EB88310F10846AE519A7300C3B5A945CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00B4D948 Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,00B4D7A9,00000800,00000000,00000000), ref: 00B4D9BA

Memory Dump Source

Source File: 00000000.00000002.3328642722.0000000000B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b40000_SecuriteInfo.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: d14dafb0fd2110453e06fd1cc9f98154fef909b0f2a0cda82d897016edcd5d4a
Instruction ID: 3491e3bd018189e582fbbccf538e23ef0f77a8321fc64bff1be5355162bddf71
Opcode Fuzzy Hash: d14dafb0fd2110453e06fd1cc9f98154fef909b0f2a0cda82d897016edcd5d4a
Instruction Fuzzy Hash: D12103B69002499FDB10CFAAD444ADEFBF4EF88310F10855ED559A7200C7B9A545CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 06D40320 Relevance: 1.6, APIs: 1, Instructions: 53COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,?,?,?), ref: 06D4038D

Memory Dump Source

Source File: 00000000.00000002.3330851306.0000000006D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d40000_SecuriteInfo.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 468088024c2ce15a8114d67f9936d7d51ead535a1c9dd9838bc04ccab29b7203
Instruction ID: 31970b11c516cbfe32af63120881dd0f8259cfed91d747dc3f5dce5b333b16c6
Opcode Fuzzy Hash: 468088024c2ce15a8114d67f9936d7d51ead535a1c9dd9838bc04ccab29b7203
Instruction Fuzzy Hash: 1511D3B58002499FDB10DF9AD945BEEBBF4EB08310F10842AE958A3240D378A545CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 06D40328 Relevance: 1.6, APIs: 1, Instructions: 51COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,?,?,?), ref: 06D4038D

Memory Dump Source

Source File: 00000000.00000002.3330851306.0000000006D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d40000_SecuriteInfo.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 89d0f9aca1b93e44f388a13c145fc958580b292a84556aad24f2d5f8f853509f
Instruction ID: a7a83cbd70a2ec9b6fe926e7c5db56cbab7334481fe35f6d4f6f869374e0d6fc
Opcode Fuzzy Hash: 89d0f9aca1b93e44f388a13c145fc958580b292a84556aad24f2d5f8f853509f
Instruction Fuzzy Hash: 9F11C3B58003499FDB10DF9AD944BDEFBF8EB48324F10842AE958A3241D378A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 06A006C0 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,?,?,?), ref: 06A00725

Memory Dump Source

Source File: 00000000.00000002.3330689694.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a00000_SecuriteInfo.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: c97a33ce72bfb7399d19fc2f6472f4e899440314d86e44f658235b9412ba911e
Instruction ID: b5c57f2f2ce6541738f2601ddf4bbe358e2f3ef18565cf9242d024caf8bd9ecd
Opcode Fuzzy Hash: c97a33ce72bfb7399d19fc2f6472f4e899440314d86e44f658235b9412ba911e
Instruction Fuzzy Hash: 581122BA800749DFDB10CF99D985BDEFBF4EB08324F20844AD518A7600C379A544CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 00B4D6C8 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 00B4D72E

Memory Dump Source

Source File: 00000000.00000002.3328642722.0000000000B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b40000_SecuriteInfo.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 8f9225825bfbb204f13fbbbe79fe534de89e5894929880fda8bd9072a89bb112
Instruction ID: 419af29a1ca8859f9695dcb0642317f66e62ea71c95b4be1566bd734fd557974
Opcode Fuzzy Hash: 8f9225825bfbb204f13fbbbe79fe534de89e5894929880fda8bd9072a89bb112
Instruction Fuzzy Hash: 3411D2B6D007498FDB10CF9AD444B9EFBF5EF88324F10845AD419A7210D3B5A945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 06A05D88 Relevance: 1.5, APIs: 1, Instructions: 46comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 06A08005

Memory Dump Source

Source File: 00000000.00000002.3330689694.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a00000_SecuriteInfo.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 2e66fe8440cecb90b3a2643d81cf1183ea9da52f28285d8c0427caadff93f4ef
Instruction ID: ea5127177464d9407206490b1050d6eba280426af314a0ab65737534e6e49b9a
Opcode Fuzzy Hash: 2e66fe8440cecb90b3a2643d81cf1183ea9da52f28285d8c0427caadff93f4ef
Instruction Fuzzy Hash: FF1145B1804349CFDB20DF9AD444B9EFBF4EB48324F208459E519A7340D379A940CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 06D407F8 Relevance: 1.5, APIs: 1, Instructions: 45windowCOMMON

Download Yara Rule

APIs

DispatchMessageW.USER32 ref: 06D4085D

Memory Dump Source

Source File: 00000000.00000002.3330851306.0000000006D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d40000_SecuriteInfo.jbxd

Similarity

API ID: DispatchMessage
String ID:
API String ID: 2061451462-0
Opcode ID: a7434b9b6923ef35e513122a68002072995ea7769125925b9b706b310f78b4fd
Instruction ID: 4b13bca259a09da0d31eb3c323ca9a6ff10cfb201f933c65f809fa15d04664e8
Opcode Fuzzy Hash: a7434b9b6923ef35e513122a68002072995ea7769125925b9b706b310f78b4fd
Instruction Fuzzy Hash: EC11FEB5C00649CFDB10EFAAD944BDEFBF4EB48324F10842AD529A3211D378A544CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 06D49A71 Relevance: 1.5, APIs: 1, Instructions: 44windowCOMMON

Download Yara Rule

APIs

DispatchMessageA.USER32 ref: 06D49AD5

Memory Dump Source

Source File: 00000000.00000002.3330851306.0000000006D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d40000_SecuriteInfo.jbxd

Similarity

API ID: DispatchMessage
String ID:
API String ID: 2061451462-0
Opcode ID: 4f79e9d7d520f347f9e9acb03b761a4b077e0280960cf4b1cc7efeab83ba7061
Instruction ID: 30d95cfe3db951e7c3d2767fc44614f3cfa1065dc2d26670bba09d9da6875e79
Opcode Fuzzy Hash: 4f79e9d7d520f347f9e9acb03b761a4b077e0280960cf4b1cc7efeab83ba7061
Instruction Fuzzy Hash: 1411EDB5C006498FDB14DF9AD545BDEFBF4EB48324F10842AD428A7210D378A545CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 06A006C8 Relevance: 1.5, APIs: 1, Instructions: 44windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,?,?,?), ref: 06A00725

Memory Dump Source

Source File: 00000000.00000002.3330689694.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a00000_SecuriteInfo.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 31ac7723642167cbd4e5726859cb4f1efd9af037f8953ccde851134f1e7ddcbb
Instruction ID: a07cb4bfd07a40d48470e244b23b35d0f2024efe65deb349f5a9711f4c90dba1
Opcode Fuzzy Hash: 31ac7723642167cbd4e5726859cb4f1efd9af037f8953ccde851134f1e7ddcbb
Instruction Fuzzy Hash: 0E1103B5800349DFDB10DF9AD984BDEFBF8EB48324F108419E518A7240C379A544CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00B4FD18 Relevance: 1.5, APIs: 1, Instructions: 44COMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,?,?), ref: 00B4FD75

Memory Dump Source

Source File: 00000000.00000002.3328642722.0000000000B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b40000_SecuriteInfo.jbxd

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: 2932175394f5af2099cf1e9e860b2d994d4511f336ae2869e199c742267030e1
Instruction ID: a17f54aa9d7385fb194e366c604c73dcc36deaa127990f8f93cb3f945d951995
Opcode Fuzzy Hash: 2932175394f5af2099cf1e9e860b2d994d4511f336ae2869e199c742267030e1
Instruction Fuzzy Hash: 0211D3B58003499FDB10DF9AD585BDEFBF8EB48324F20845AD958A7340C3B5A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 06D49A78 Relevance: 1.5, APIs: 1, Instructions: 43windowCOMMON

Download Yara Rule

APIs

DispatchMessageA.USER32 ref: 06D49AD5

Memory Dump Source

Source File: 00000000.00000002.3330851306.0000000006D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d40000_SecuriteInfo.jbxd

Similarity

API ID: DispatchMessage
String ID:
API String ID: 2061451462-0
Opcode ID: 071b4446098fab89c977c2fdcdad02a118775b812a09a61d5bfbce707eca2d34
Instruction ID: 01cd61d75272c27e6a453238d4f7c1181e3a27d6e60be8b77a98ff9fb4cdc3a1
Opcode Fuzzy Hash: 071b4446098fab89c977c2fdcdad02a118775b812a09a61d5bfbce707eca2d34
Instruction Fuzzy Hash: 6A11CEB5C046498FDB10DF9AD544B9EFBF4EF48324F10851AD518A7210D378A544CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 06D40800 Relevance: 1.5, APIs: 1, Instructions: 43windowCOMMON

Download Yara Rule

APIs

DispatchMessageW.USER32 ref: 06D4085D

Memory Dump Source

Source File: 00000000.00000002.3330851306.0000000006D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d40000_SecuriteInfo.jbxd

Similarity

API ID: DispatchMessage
String ID:
API String ID: 2061451462-0
Opcode ID: 4f54e8c80455f6e5f3fa85a772438d881f8f42f99b9fec432602f940ac8b228a
Instruction ID: 76c866b5ec20d36addc0c4d7f829fdb5f8a385daf4a897f62575a3c608648ae1
Opcode Fuzzy Hash: 4f54e8c80455f6e5f3fa85a772438d881f8f42f99b9fec432602f940ac8b228a
Instruction Fuzzy Hash: 6A11CEB5C046498FDB10DF9AD944B9EFBF4EB48324F10842AD528A3211D378A544CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 06A07FA9 Relevance: 1.5, APIs: 1, Instructions: 42comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 06A08005

Memory Dump Source

Source File: 00000000.00000002.3330689694.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a00000_SecuriteInfo.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: f78f40ad490d8a3983bb9fb5ff830f6a654253f94189c99b79a0097ee952052a
Instruction ID: 1cb4553c675016733c837ae8dde61d1c49ee04ba07b903e120077b446236d915
Opcode Fuzzy Hash: f78f40ad490d8a3983bb9fb5ff830f6a654253f94189c99b79a0097ee952052a
Instruction Fuzzy Hash: C2111EB5800349CFDB20DF9AD588B8EFBF4EB48324F24845AE519A7350D379A544CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 008AD3EC Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3328029926.00000000008AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 008AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8ad000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c33196b2526231eae174aa92f1bc32f4a3bd45c9262fd2cdd222c3157edc2dab
Instruction ID: 29537ecafc8e4792560b57604ccc87ad46c3a6d30dcbeef17422d0a2cbe5c548
Opcode Fuzzy Hash: c33196b2526231eae174aa92f1bc32f4a3bd45c9262fd2cdd222c3157edc2dab
Instruction Fuzzy Hash: 7A212B76505304DFEB04DF14D5C0B26BF65FB98314F20C569D90ACBA56C336E856CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 008BD01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3328111609.00000000008BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 008BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8bd000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9daba7b547bed763118fef302b76cb936e08da03eef11ef40cc5456bb57c7584
Instruction ID: 99dccf988bbc6aad3e4fe5ed0ad3908d07b7d535857b44e943f5d7df06eb41a8
Opcode Fuzzy Hash: 9daba7b547bed763118fef302b76cb936e08da03eef11ef40cc5456bb57c7584
Instruction Fuzzy Hash: C0212275604B04EFCB14EF14D9C0B66BB61FB88318F20C56DD90A8B392D37AD807CA61

Uniqueness

Uniqueness Score: -1.00%

Function 008BD1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3328111609.00000000008BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 008BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8bd000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01f3df79a1579c86bea735ab9a1102fc378463cea192adee7652354251bcd6d7
Instruction ID: c0df67e47656b209609ed0f718bcf96b8de6f30f104f46ebba06f2368057e1c7
Opcode Fuzzy Hash: 01f3df79a1579c86bea735ab9a1102fc378463cea192adee7652354251bcd6d7
Instruction Fuzzy Hash: B4212275504384FFDB04DF14D9C0B66BBA1FB84318F20C56DE9098B392D37AE806CA61

Uniqueness

Uniqueness Score: -1.00%

Function 008BD006 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3328111609.00000000008BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 008BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8bd000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 378bd47a42572c8760d6ae940a6d40e8a2ff3fd0d00e729c9dceebe02b7f292e
Instruction ID: 3512c07090556b786db9a82f184a68ed50224a0dbcf87bc1e878f220475cc5cf
Opcode Fuzzy Hash: 378bd47a42572c8760d6ae940a6d40e8a2ff3fd0d00e729c9dceebe02b7f292e
Instruction Fuzzy Hash: 51217F755087809FCB02DF14D994B11BFB1FB46314F28C5EAD8498B2A7D33A981ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 008AD3E7 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3328029926.00000000008AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 008AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8ad000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fed46cca7f742b7caa711e8ed735342f41d2c2d3303e466d284e334843d61363
Instruction ID: 2a8d4e7b1db9aaadec594066fc79454f4bb49ae082f23665f109e20df7dfe080
Opcode Fuzzy Hash: fed46cca7f742b7caa711e8ed735342f41d2c2d3303e466d284e334843d61363
Instruction Fuzzy Hash: C3110376404380CFDB01CF00D5C0B16BF72FB98324F24C5A9D8098BA56C33AE856CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 008BD1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3328111609.00000000008BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 008BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8bd000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 703b7abd3718bd21aa6f36dac6c8dc0e73c65716f16ca45b46755fc1987422b6
Instruction ID: 8a25fc423401100abe8f039b8d593927245578f261d7243da257dece92db30fc
Opcode Fuzzy Hash: 703b7abd3718bd21aa6f36dac6c8dc0e73c65716f16ca45b46755fc1987422b6
Instruction Fuzzy Hash: 88118B75504384EFCB15CF10D5C4B55BFA2FB84314F24C6A9D8498B7A6D33AE84ACB61

Uniqueness

Uniqueness Score: -1.00%

Function 008AD667 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3328029926.00000000008AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 008AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8ad000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8b2bca898515ccb05ad189a6295f4b865cd6833439c9d03d41ae88270257120
Instruction ID: eff0916a1ed8ec6050c9f1f7cdd9a55e6c0dc377a3b054faf2a37b209badd142
Opcode Fuzzy Hash: b8b2bca898515ccb05ad189a6295f4b865cd6833439c9d03d41ae88270257120
Instruction Fuzzy Hash: 4DF0F976200604AF9720DF0AD984C23FBBDFFD5774715C55AE84A8BB12C671EC42CAA0

Uniqueness

Uniqueness Score: -1.00%

Function 008AD658 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3328029926.00000000008AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 008AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8ad000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 435c631879d1a760962404bc2f06e337ce99e578647ffebcbbe8c0314648639b
Instruction ID: d6f5d11606e9c18f37acb45aaf71cc9ef69064e6a7d71439c81f76a0e1b659d8
Opcode Fuzzy Hash: 435c631879d1a760962404bc2f06e337ce99e578647ffebcbbe8c0314648639b
Instruction Fuzzy Hash: 05F04475104784AFD315CF05C984C23BFB9FF867607198489E88A8B752C671FC42CBA0

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 06D4A5F8 Relevance: 7.6, APIs: 5, Instructions: 119keyboardCOMMON

Download Yara Rule

APIs

GetKeyState.USER32(00000001), ref: 06D4A655
GetKeyState.USER32(00000002), ref: 06D4A69A
GetKeyState.USER32(00000004), ref: 06D4A6DF
GetKeyState.USER32(00000005), ref: 06D4A724
GetKeyState.USER32(00000006), ref: 06D4A769

Memory Dump Source

Source File: 00000000.00000002.3330851306.0000000006D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d40000_SecuriteInfo.jbxd

Similarity

API ID: State
String ID:
API String ID: 1649606143-0
Opcode ID: 15b96d22bc3ee80c007bdfc86f2fb68a2c360574edb433c1da8bc110e509b3e4
Instruction ID: 16b4e8fa4d934ec85f4511239cd8536d4da886de4b7479f75724ac103c675131
Opcode Fuzzy Hash: 15b96d22bc3ee80c007bdfc86f2fb68a2c360574edb433c1da8bc110e509b3e4
Instruction Fuzzy Hash: AC41B471C01786CFEB51DF59C9487AFBFF4AB45308F24804AD458A7254C7B89645CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 06D45CB0 Relevance: 1.9, Strings: 1, Instructions: 693COMMON

Download Yara Rule

Strings

fff?, xrefs: 06D46317

Memory Dump Source

Source File: 00000000.00000002.3330851306.0000000006D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d40000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: fff?
API String ID: 0-4136771917
Opcode ID: bdd6b867849c25bf21111443b153f9692e68590d23e3f499ce55f8c96c92b1f7
Instruction ID: 774bc23aaf8dfb16e93004997c427c219f3ec7652f76fcc78ab8ca998a0b18f9
Opcode Fuzzy Hash: bdd6b867849c25bf21111443b153f9692e68590d23e3f499ce55f8c96c92b1f7
Instruction Fuzzy Hash: 85626B3280061ADFCF11DF50C984AD9B7B2FF9A300F1586D5E9096B125EB71AAD5CF80

Uniqueness

Uniqueness Score: -1.00%

Function 06D45BE4 Relevance: 1.8, Strings: 1, Instructions: 545COMMON

Download Yara Rule

Strings

fff?, xrefs: 06D46317

Memory Dump Source

Source File: 00000000.00000002.3330851306.0000000006D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d40000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: fff?
API String ID: 0-4136771917
Opcode ID: d289c6e11858716f643e630e6844faa2a570f9b1206a9dd36c4b171c3353f20d
Instruction ID: ad2dc87c30bfeeb5972d514a54ef3e37030927d7369aa952316e91d92788ed5d
Opcode Fuzzy Hash: d289c6e11858716f643e630e6844faa2a570f9b1206a9dd36c4b171c3353f20d
Instruction Fuzzy Hash: 7F129C36800649DFCF11DF50C984AE9BBB2FF49304F158195E9096F266EB72AE95CF80

Uniqueness

Uniqueness Score: -1.00%

Function 06D41E60 Relevance: 1.5, Strings: 1, Instructions: 263COMMON

Download Yara Rule

Strings

, xrefs: 06D41EFC

Memory Dump Source

Source File: 00000000.00000002.3330851306.0000000006D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d40000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 0c30a10e57968ce54a78fa9d14c7450e89fd2c860d4f33082ab9d6197f74f03e
Instruction ID: a9bfdd958c167407d75240428f5b72261975488ef732206c3874a3383ddf1bff
Opcode Fuzzy Hash: 0c30a10e57968ce54a78fa9d14c7450e89fd2c860d4f33082ab9d6197f74f03e
Instruction Fuzzy Hash: C1917D71E002159FEB58EF69D854AAFBAF6FFC8300F108529E805E7250DB359D46CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00B4DBD0 Relevance: .5, Instructions: 527COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3328642722.0000000000B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b40000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c2ad11f2eb119412e18747dace8e0eac02a70d3cf2d00abbe2bd6d444e8f460
Instruction ID: 433f374d258e513754f59d38cb9cf67fbe77c4624e00f8c73e354064d93870be
Opcode Fuzzy Hash: 8c2ad11f2eb119412e18747dace8e0eac02a70d3cf2d00abbe2bd6d444e8f460
Instruction Fuzzy Hash: 335205B0500B468FD724CF28EC88D9A7BB1FB58314F914269D5626B2B1DBB475CACF84

Uniqueness

Uniqueness Score: -1.00%

Function 06A01B04 Relevance: .4, Instructions: 444COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3330689694.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a00000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96380b846fc9987fe5c52c0afbaf456f4ac034ff4960486703e3efb851084561
Instruction ID: 419d4f9af723f7b6042526442902c934158f772fff17786e7d6da27e3e8f88ac
Opcode Fuzzy Hash: 96380b846fc9987fe5c52c0afbaf456f4ac034ff4960486703e3efb851084561
Instruction Fuzzy Hash: 32F15F347106118FFB95BB38E998B6E73A6AF85704F154469D8068B3E6DF34ED02C781

Uniqueness

Uniqueness Score: -1.00%

Function 00B4C1B8 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3328642722.0000000000B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b40000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47fb2ccb345f4acddcd31871f96f36394ed2e02f69547912b1766c80c03a1a24
Instruction ID: b58f5b9d72f95f565a624ba10d6316c9b4e81505b1ceb976a985c17e5f22c840
Opcode Fuzzy Hash: 47fb2ccb345f4acddcd31871f96f36394ed2e02f69547912b1766c80c03a1a24
Instruction Fuzzy Hash: E0A15E32E012158FCF45DFB5C88499EBBF2FF85700B1581AAE805AB265DB71EA15DB80

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SecuriteInfo.com.Win32.AdwareX-gen.9076.19863.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

System Behavior

Analysis Process: SecuriteInfo.com.Win32.AdwareX-gen.9076.19863.exePID: 4176, Parent PID: 4004

General

Chronological Activities

Disassembly

Analysis Process: SecuriteInfo.com.Win32.AdwareX-gen.9076.19863.exePID: 4176, Parent PID: 4004COMMON

Execution Graph

Graph

Executed Functions

Windows Analysis Report
SecuriteInfo.com.Win32.AdwareX-gen.9076.19863.exe

Function 06A05C14 Relevance: 5.1, APIs: 3, Instructions: 605
COMMON

Function 06A06D91 Relevance: 3.3, APIs: 2, Instructions: 320
COMMON

Function 06D47E58 Relevance: 2.0, APIs: 1, Instructions: 514
COMMON

Function 06A0F9E0 Relevance: 1.9, APIs: 1, Instructions: 396
COMMON

Function 00B47540 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Function 06A083E2 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 71
threadCOMMON

Function 06A083F0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 63
threadCOMMON

Function 00B4D4C8 Relevance: 1.7, APIs: 1, Instructions: 203
COMMON

Function 00B4FAD0 Relevance: 1.6, APIs: 1, Instructions: 113
COMMON

Function 06D40040 Relevance: 1.6, APIs: 1, Instructions: 95
COMMON

Function 00B47780 Relevance: 1.6, APIs: 1, Instructions: 66
COMMON

Function 06A07BFC Relevance: 1.6, APIs: 1, Instructions: 62
threadCOMMON

Function 00B47788 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Function 06A084D8 Relevance: 1.6, APIs: 1, Instructions: 61
threadCOMMON

Function 00B4C3C8 Relevance: 1.6, APIs: 1, Instructions: 55
libraryCOMMON