Windows Analysis Report
SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe

Overview

General Information

Sample name: SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe
Analysis ID: 1428965
MD5: 98978c705e7a64b2d3fffa565892ddab
SHA1: b6985aaf3ac01a8742f2d0dcf3d8c0db12752e3f
SHA256: 40cd90feea9b35d138b78aa98c39e86d6aed424ad90963f6ee02749de63432c3
Tags: exe
Infos:

Detection

Score: 60
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Detected unpacking (changes PE section rights)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Contains functionality to register a low level keyboard hook
Installs a global keyboard hook
Machine Learning detection for sample
Sample or dropped binary is a compiled AutoHotkey binary
Contains functionality for read data from the clipboard
Contains functionality to block mouse and keyboard input (often used to hinder debugging)
Contains functionality to call native functions
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Contains functionality to communicate with device drivers
Contains functionality to dynamically determine API calls
Contains functionality to launch a program with higher privileges
Contains functionality to modify clipboard data
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to read the clipboard data
Contains functionality to record screenshots
Contains functionality to retrieve information about pressed keystrokes
Contains functionality to shutdown / reboot the system
Contains functionality to simulate keystroke presses
Contains functionality to simulate mouse events
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Detected potential crypto function
Drops PE files
Enables debug privileges
Entry point lies outside standard sections
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
Installs a global mouse hook
JA3 SSL client fingerprint seen in connection with other malware
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
OS version to string mapping found (often used in BOTs)
PE / OLE file has an invalid certificate
PE file contains sections with non-standard names
Potential key logger detected (key state polling based)
Sample execution stops while process was sleeping (likely an evasion)
Sigma detected: Use Short Name Path in Command Line
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Uses taskkill to terminate processes
Uses the keyboard layout for branch decision (may execute only for specific keyboard layouts)

Classification

AV Detection
barindex
Multi AV Scanner detection for dropped file
Source: C:\Users\user\Desktop\Haims_ESC.exe ReversingLabs: Detection: 34%
Multi AV Scanner detection for submitted file
Source: SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe ReversingLabs: Detection: 23%
Machine Learning detection for sample
Source: SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe Joe Sandbox ML: detected
Uses 32bit PE files
Source: SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE, DEBUG_STRIPPED
Source: C:\Users\user\Desktop\Haims_ESC.exe File created: C:\Users\user\Desktop\readme.txt Jump to behavior
Source: C:\Users\user\Desktop\Haims_ESC.exe File created: C:\Users\user\Desktop\VNDCD_memo\readme.txt Jump to behavior
Source: unknown HTTPS traffic detected: 112.175.184.42:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown HTTPS traffic detected: 112.175.184.42:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown HTTPS traffic detected: 112.175.184.42:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown HTTPS traffic detected: 112.175.184.42:443 -> 192.168.2.4:49738 version: TLS 1.2
Source: unknown HTTPS traffic detected: 112.175.184.42:443 -> 192.168.2.4:49739 version: TLS 1.2
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe Code function: 0_2_004804F0 FindFirstFileW,FindClose,GetFileAttributesW, 0_2_004804F0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe Code function: 0_2_00480580 _wcschr,_wcschr,_wcschr,FindFirstFileW,FindClose,_wcschr,FindFirstFileW,FindClose, 0_2_00480580
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe Code function: 0_2_0045E1A0 _wcschr,_wcschr,GetFileAttributesW,FindFirstFileW,FindClose,CoInitialize, 0_2_0045E1A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe Code function: 0_2_0044D4F0 FindFirstFileW,GetTickCount,GetTickCount,PeekMessageW,GetTickCount,FindNextFileW,FindClose,GetLastError,FindFirstFileW,GetTickCount,GetTickCount,PeekMessageW,GetTickCount,__swprintf,FindNextFileW,FindClose, 0_2_0044D4F0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe Code function: 0_2_0044D7F0 FindFirstFileW,GetLastError,FindClose,FileTimeToLocalFileTime, 0_2_0044D7F0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe Code function: 0_2_00437AD0 FindFirstFileW,FindNextFileW,FindClose,FindNextFileW,FindClose,FindFirstFileW,FindNextFileW,FindClose,FindClose,FindClose,FindClose, 0_2_00437AD0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe Code function: 0_2_0047BAE0 FindFirstFileW,FindClose,GetFileAttributesW,CreateFileW,WriteFile,WriteFile,WriteFile,CloseHandle, 0_2_0047BAE0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe Code function: 0_2_0044DB30 CreateFileW,GetFileSizeEx,CloseHandle,FindFirstFileW,GetLastError,FindClose,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z, 0_2_0044DB30
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe Code function: 0_2_0045EE20 GetFullPathNameW,GetFullPathNameW,GetFullPathNameW,GetFileAttributesW,GetFileAttributesW,GetFileAttributesW,FindFirstFileW,GetLastError,_wcsrchr,_wcsrchr,_wcsncpy,GetTickCount,PeekMessageW,GetTickCount,MoveFileW,DeleteFileW,MoveFileW,GetLastError,CopyFileW,GetLastError,FindNextFileW,FindClose, 0_2_0045EE20
Source: C:\Users\user\Desktop\Haims_ESC.exe Code function: 2_2_004804F0 FindFirstFileW,FindClose,GetFileAttributesW, 2_2_004804F0
Source: C:\Users\user\Desktop\Haims_ESC.exe Code function: 2_2_00480580 _wcschr,_wcschr,_wcschr,FindFirstFileW,FindClose,_wcschr,FindFirstFileW,FindClose, 2_2_00480580
Source: C:\Users\user\Desktop\Haims_ESC.exe Code function: 2_2_0047BAE0 FindFirstFileW,FindClose,GetFileAttributesW,CreateFileW,WriteFile,WriteFile,WriteFile,CloseHandle, 2_2_0047BAE0
Source: C:\Users\user\Desktop\Haims_ESC.exe Code function: 2_2_0045E1A0 _wcschr,_wcschr,GetFileAttributesW,FindFirstFileW,FindClose,CoInitialize, 2_2_0045E1A0
Source: C:\Users\user\Desktop\Haims_ESC.exe Code function: 2_2_0044D4F0 FindFirstFileW,GetTickCount,GetTickCount,PeekMessageW,GetTickCount,FindNextFileW,FindClose,GetLastError,FindFirstFileW,GetTickCount,GetTickCount,PeekMessageW,GetTickCount,__swprintf,FindNextFileW,FindClose, 2_2_0044D4F0
Source: C:\Users\user\Desktop\Haims_ESC.exe Code function: 2_2_0044D7F0 FindFirstFileW,GetLastError,FindClose,FileTimeToLocalFileTime, 2_2_0044D7F0
Source: C:\Users\user\Desktop\Haims_ESC.exe Code function: 2_2_00437AD0 FindFirstFileW,FindNextFileW,FindClose,FindNextFileW,FindClose,FindFirstFileW,FindNextFileW,FindClose,FindClose,FindClose,FindClose, 2_2_00437AD0
Source: C:\Users\user\Desktop\Haims_ESC.exe Code function: 2_2_0044DB30 CreateFileW,GetFileSizeEx,CloseHandle,FindFirstFileW,GetLastError,FindClose,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z, 2_2_0044DB30
Source: C:\Users\user\Desktop\Haims_ESC.exe Code function: 2_2_0045EE20 GetFullPathNameW,GetFullPathNameW,GetFullPathNameW,GetFileAttributesW,GetFileAttributesW,GetFileAttributesW,FindFirstFileW,GetLastError,_wcsrchr,_wcsrchr,_wcsncpy,GetTickCount,PeekMessageW,GetTickCount,MoveFileW,DeleteFileW,MoveFileW,GetLastError,CopyFileW,GetLastError,FindNextFileW,FindClose, 2_2_0045EE20
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: 6271f898ce5be7dd52b0fc260d0662b3
Source: Joe Sandbox View JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1
Source: Joe Sandbox View JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe Code function: 0_2_0049C396 InternetReadFileExA,__flush,__write,__flsbuf, 0_2_0049C396
Source: global traffic HTTP traffic detected: GET /haims_esc/Haims_ESC.exe HTTP/1.1User-Agent: AutoHotkeyHost: runuo.krCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /haims_esc/ver.txt HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: runuo.kr
Source: global traffic HTTP traffic detected: GET /haims_esc/notice.txt HTTP/1.1User-Agent: AutoHotkeyHost: runuo.krCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /haims_esc/haims_localconnect.php HTTP/1.1Accept: text/html, application/xhtml+xml, image/jxr, */*Accept-Language: en-CHUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: runuo.krConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wlog/piwik.js HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://runuo.kr/haims_esc/haims_localconnect.phpAccept-Language: en-CHUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: runuo.krConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wlog/piwik.php?action_name=&idsite=1&rec=1&r=643131&h=23&m=25&s=22&url=https%3A%2F%2Frunuo.kr%2Fhaims_esc%2Fhaims_localconnect.php&_id=1aa1c3094c7d4b5f&_idts=1713561923&_idvc=1&_idn=1&_refts=0&_viewts=1713561923&cs=windows-1252&java=1&cookie=1&res=1280x1024&gt_ms=0 HTTP/1.1Accept: image/png, image/svg+xml, image/jxr, image/*;q=0.8, */*;q=0.5Referer: https://runuo.kr/haims_esc/haims_localconnect.phpAccept-Language: en-CHUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: runuo.krConnection: Keep-AliveCookie: _pk_id.1.041b=1aa1c3094c7d4b5f.1713561923.1.1713561923.1713561923.; _pk_ses.1.041b=*
Source: global traffic HTTP traffic detected: GET /favicon.ico HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: runuo.krConnection: Keep-AliveCookie: _pk_id.1.041b=1aa1c3094c7d4b5f.1713561923.1.1713561923.1713561923.; _pk_ses.1.041b=*
Source: global traffic HTTP traffic detected: GET /haims_esc/nosearch/Haims_CompanyCode_check.php?CompanyCode=0 HTTP/1.1User-Agent: AutoHotkeyHost: runuo.krCache-Control: no-cacheCookie: _pk_ses.1.041b=*; _pk_id.1.041b=1aa1c3094c7d4b5f.1713561923.1.1713561923.1713561923.
Source: unknown DNS traffic detected: queries for: runuo.kr
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 21:25:24 GMTServer: Apache/2.2.15 (CentOS)Content-Length: 209Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: piwik[1].js.6.dr String found in binary or memory: http://piwik.org
Source: piwik[1].js.6.dr String found in binary or memory: http://piwik.org/free-software/bsd/
Source: SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe, 00000000.00000002.1820994010.00000000004E3000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe, 00000000.00000002.1821601052.0000000002C30000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://runuo.co.kr/haims_esc/Haims_ESC.exe
Source: SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe, 00000000.00000002.1821601052.0000000002C30000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://runuo.co.kr/haims_esc/Haims_ESC.exe$
Source: haims_localconnect[1].htm.6.dr String found in binary or memory: http://runuo.kr/wlog/piwik.php?idsite=1
Source: Haims_ESC.exe, Haims_ESC.exe, 00000002.00000002.2975355981.0000000000401000.00000040.00000001.01000000.00000007.sdmp String found in binary or memory: https://autohotkey.com
Source: SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe, 00000000.00000002.1820994010.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Haims_ESC.exe, 00000002.00000002.2975355981.0000000000401000.00000040.00000001.01000000.00000007.sdmp String found in binary or memory: https://autohotkey.comCould
Source: piwik[1].js.6.dr String found in binary or memory: https://github.com/piwik/piwik/blob/master/js/piwik.js
Source: SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe, 00000000.00000002.1821601052.0000000002C30000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://office.runuo.kr/haims_esc/Haims_ESC.exe
Source: Haims_ESC.exe, 00000002.00000002.2976395327.0000000002BA0000.00000004.00000020.00020000.00000000.sdmp, Haims_ESC.exe, 00000002.00000002.2975355981.00000000004E3000.00000040.00000001.01000000.00000007.sdmp String found in binary or memory: https://office.runuo.kr:5001/sharing/cx22ddLq1
Source: SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe, 00000000.00000003.1820569878.0000000000AC3000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe, 00000000.00000002.1821271566.0000000000AC3000.00000004.00000020.00020000.00000000.sdmp, Haims_ESC.exe, 00000002.00000002.2978092664.0000000006880000.00000004.00000020.00020000.00000000.sdmp, Haims_ESC.exe, 00000002.00000002.2975923731.0000000000A7B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://runuo.kr/
Source: Haims_ESC.exe, 00000002.00000002.2975923731.0000000000A7B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://runuo.kr/O
Source: Haims_ESC.exe, 00000002.00000002.2975355981.00000000004E3000.00000040.00000001.01000000.00000007.sdmp String found in binary or memory: https://runuo.kr/gnu/Haims_ESC/2
Source: Haims_ESC.exe, 00000002.00000002.2976395327.0000000002BA0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://runuo.kr/gnu/Haims_ESC/2=
Source: Haims_ESC.exe String found in binary or memory: https://runuo.kr/hai
Source: Haims_ESC.exe, 00000002.00000002.2976395327.0000000002BA0000.00000004.00000020.00020000.00000000.sdmp, Haims_ESC.exe, 00000002.00000002.2975355981.00000000004E3000.00000040.00000001.01000000.00000007.sdmp String found in binary or memory: https://runuo.kr/haims_esc
Source: Haims_ESC.exe, 00000002.00000002.2977100207.0000000003150000.00000004.00000020.00020000.00000000.sdmp, Haims_ESC.exe, 00000002.00000003.1933080599.0000000006980000.00000004.00000800.00020000.00000000.sdmp, Haims_ESC.exe, 00000002.00000003.1931229919.0000000006980000.00000004.00000800.00020000.00000000.sdmp, Haims_ESC.exe, 00000002.00000003.1925136818.0000000006980000.00000004.00000800.00020000.00000000.sdmp, Haims_ESC.exe, 00000002.00000003.1932090189.0000000006980000.00000004.00000800.00020000.00000000.sdmp, Haims_ESC.exe, 00000002.00000003.1932134417.0000000006980000.00000004.00000800.00020000.00000000.sdmp, Haims_ESC.exe, 00000002.00000003.1932826201.0000000006980000.00000004.00000800.00020000.00000000.sdmp, Haims_ESC.exe, 00000002.00000003.1931843025.0000000006980000.00000004.00000800.00020000.00000000.sdmp, Haims_ESC.exe, 00000002.00000003.1930888894.0000000006980000.00000004.00000800.00020000.00000000.sdmp, Haims_ESC.exe, 00000002.00000003.1932231043.0000000006980000.00000004.00000800.00020000.00000000.sdmp, Haims_ESC.exe, 00000002.00000003.1932179913.0000000006980000.00000004.00000800.00020000.00000000.sdmp, Haims_ESC.exe, 00000002.00000003.1930939772.0000000006980000.00000004.00000800.00020000.00000000.sdmp, Haims_ESC.exe, 00000002.00000003.1931152410.0000000006980000.00000004.00000800.00020000.00000000.sdmp, Haims_ESC.exe, 00000002.00000003.1933030660.0000000006980000.00000004.00000800.00020000.00000000.sdmp, Haims_ESC.exe, 00000002.00000003.1931436456.0000000006980000.00000004.00000800.00020000.00000000.sdmp, Haims_ESC.exe, 00000002.00000003.1924489741.0000000006980000.00000004.00000800.00020000.00000000.sdmp, Haims_ESC.exe, 00000002.00000003.1923754529.0000000006980000.00000004.00000800.00020000.00000000.sdmp, Haims_ESC.exe, 00000002.00000003.1924897219.0000000006980000.00000004.00000800.00020000.00000000.sdmp, Haims_ESC.exe, 00000002.00000003.1931289757.0000000006980000.00000004.00000800.00020000.00000000.sdmp, Haims_ESC.exe, 00000002.00000003.1931094457.0000000006980000.00000004.00000800.00020000.00000000.sdmp, Haims_ESC.exe, 00000002.00000003.1924950407.0000000006980000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://runuo.kr/haims_esc/
Source: Haims_ESC.exe, 00000002.00000002.2975355981.00000000004E3000.00000040.00000001.01000000.00000007.sdmp String found in binary or memory: https://runuo.kr/haims_esc/#Function_key_user_config
Source: Haims_ESC.exe, 00000002.00000002.2976395327.0000000002BA0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://runuo.kr/haims_esc/#Function_key_user_config=
Source: Haims_ESC.exe, 00000002.00000002.2976395327.0000000002BA0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://runuo.kr/haims_esc/=
Source: SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe, 00000000.00000002.1821601052.0000000002C30000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe, 00000000.00000003.1820569878.0000000000B10000.00000004.00000020.00020000.00000000.sdmp, Haims_ESC.exe, Haims_ESC.exe, 00000002.00000002.2976395327.0000000002BA0000.00000004.00000020.00020000.00000000.sdmp, Haims_ESC.exe, 00000002.00000002.2975355981.00000000004E3000.00000040.00000001.01000000.00000007.sdmp String found in binary or memory: https://runuo.kr/haims_esc/Haims_ESC.exe
Source: SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe, 00000000.00000003.1820569878.0000000000AC3000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe, 00000000.00000002.1821271566.0000000000AC3000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://runuo.kr/haims_esc/Haims_ESC.exe32
Source: SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe, 00000000.00000003.1820569878.0000000000AC3000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe, 00000000.00000002.1821271566.0000000000AC3000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://runuo.kr/haims_esc/Haims_ESC.exeP
Source: SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe, 00000000.00000003.1820569878.0000000000AC3000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe, 00000000.00000002.1821271566.0000000000AC3000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://runuo.kr/haims_esc/Haims_ESC.exeoY
Source: Haims_ESC.exe, 00000002.00000002.2975355981.00000000004E3000.00000040.00000001.01000000.00000007.sdmp, ~DF79F3A13EFF4F3D66.TMP.5.dr, {500D0D6F-FE93-11EE-8C2C-ECF4BBEA1588}.dat.5.dr String found in binary or memory: https://runuo.kr/haims_esc/haims_localconnect.php
Source: Haims_ESC.exe, 00000002.00000002.2977100207.0000000003150000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://runuo.kr/haims_esc/haims_localconnect.php0ahk_exe
Source: Haims_ESC.exe, 00000002.00000002.2976395327.0000000002BA0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://runuo.kr/haims_esc/haims_localconnect.phpmin
Source: Haims_ESC.exe, 00000002.00000002.2975923731.0000000000A45000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://runuo.kr/haims_esc/haims_localconnect.phptCookies
Source: Haims_ESC.exe String found in binary or memory: https://runuo.kr/haims_esc/nosearch/HV41_NoSearch_Inv
Source: Haims_ESC.exe, 00000002.00000002.2975355981.00000000004E3000.00000040.00000001.01000000.00000007.sdmp String found in binary or memory: https://runuo.kr/haims_esc/nosearch/HV41_NoSearch_Invoke.php?CompanyCode=%getCode%&PartNo=%getPtno%
Source: Haims_ESC.exe, 00000002.00000002.2976395327.0000000002C14000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://runuo.kr/haims_esc/nosearch/HV41_NoSearch_Invoke.php?CompanyCode=%getCode%&PartNo=%getPtno%R
Source: Haims_ESC.exe String found in binary or memory: https://runuo.kr/haims_esc/nosearch/Hai
Source: Haims_ESC.exe, Haims_ESC.exe, 00000002.00000002.2976395327.0000000002C14000.00000004.00000020.00020000.00000000.sdmp, Haims_ESC.exe, 00000002.00000002.2975355981.00000000004E3000.00000040.00000001.01000000.00000007.sdmp String found in binary or memory: https://runuo.kr/haims_esc/nosearch/HaimsNoSearch.php?CompanyCode=%strCompanyCode%&PartNo=%UIA_HV41_
Source: Haims_ESC.exe, 00000002.00000002.2976395327.0000000002BA0000.00000004.00000020.00020000.00000000.sdmp, Haims_ESC.exe, 00000002.00000002.2975355981.00000000004E3000.00000040.00000001.01000000.00000007.sdmp String found in binary or memory: https://runuo.kr/haims_esc/nosearch/Haims_CompanyCode_check.php?CompanyCode=%cCode%
Source: Haims_ESC.exe, 00000002.00000002.2975923731.0000000000A7B000.00000004.00000020.00020000.00000000.sdmp, Haims_ESC.exe, 00000002.00000002.2975923731.0000000000AB1000.00000004.00000020.00020000.00000000.sdmp, Haims_ESC.exe, 00000002.00000002.2975923731.0000000000A9A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://runuo.kr/haims_esc/nosearch/Haims_CompanyCode_check.php?CompanyCode=0
Source: Haims_ESC.exe, 00000002.00000002.2975923731.0000000000AB1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://runuo.kr/haims_esc/nosearch/Haims_CompanyCode_check.php?CompanyCode=0eenKey_Use=1
Source: Haims_ESC.exe, Haims_ESC.exe, 00000002.00000002.2975923731.0000000000A7B000.00000004.00000020.00020000.00000000.sdmp, Haims_ESC.exe, 00000002.00000002.2975355981.00000000004E3000.00000040.00000001.01000000.00000007.sdmp String found in binary or memory: https://runuo.kr/haims_esc/notice.txt
Source: Haims_ESC.exe, 00000002.00000002.2976395327.0000000002BA0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://runuo.kr/haims_esc/notice.txtnotice.txt?
Source: Haims_ESC.exe, 00000002.00000002.2975355981.00000000004E3000.00000040.00000001.01000000.00000007.sdmp String found in binary or memory: https://runuo.kr/haims_esc/updater.exe
Source: Haims_ESC.exe, 00000002.00000002.2976395327.0000000002BA0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://runuo.kr/haims_esc/updater.exeupdater.exe?
Source: Haims_ESC.exe, 00000002.00000002.2975923731.00000000009FB000.00000004.00000020.00020000.00000000.sdmp, Haims_ESC.exe, 00000002.00000002.2976395327.0000000002BA0000.00000004.00000020.00020000.00000000.sdmp, Haims_ESC.exe, 00000002.00000002.2975355981.00000000004E3000.00000040.00000001.01000000.00000007.sdmp String found in binary or memory: https://runuo.kr/haims_esc/ver.txt
Source: Haims_ESC.exe, 00000002.00000002.2975923731.00000000009FB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://runuo.kr/haims_esc/ver.txtl)
Source: Haims_ESC.exe, 00000002.00000002.2975923731.00000000009FB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://runuo.kr/haims_esc/ver.txtr(
Source: Haims_ESC.exe, 00000002.00000002.2975923731.00000000009FB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://runuo.kr/r)
Source: Haims_ESC.exe, 00000002.00000002.2975923731.0000000000A2C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://runuo.kr:443/haims_esc/ver.txtXJ
Source: Haims_ESC.exe, Haims_ESC.exe, 00000002.00000003.1930994998.0000000006980000.00000004.00000800.00020000.00000000.sdmp, Haims_ESC.exe, 00000002.00000003.1932980145.0000000006980000.00000004.00000800.00020000.00000000.sdmp, Haims_ESC.exe, 00000002.00000003.1931481058.0000000006980000.00000004.00000800.00020000.00000000.sdmp, Haims_ESC.exe, 00000002.00000003.1932642347.0000000006980000.00000004.00000800.00020000.00000000.sdmp, Haims_ESC.exe, 00000002.00000003.1932881382.0000000006980000.00000004.00000800.00020000.00000000.sdmp, Haims_ESC.exe, 00000002.00000002.2977100207.0000000003150000.00000004.00000020.00020000.00000000.sdmp, Haims_ESC.exe, 00000002.00000003.1933080599.0000000006980000.00000004.00000800.00020000.00000000.sdmp, Haims_ESC.exe, 00000002.00000003.1931229919.0000000006980000.00000004.00000800.00020000.00000000.sdmp, Haims_ESC.exe, 00000002.00000003.1925136818.0000000006980000.00000004.00000800.00020000.00000000.sdmp, Haims_ESC.exe, 00000002.00000003.1932090189.0000000006980000.00000004.00000800.00020000.00000000.sdmp, Haims_ESC.exe, 00000002.00000003.1932134417.0000000006980000.00000004.00000800.00020000.00000000.sdmp, Haims_ESC.exe, 00000002.00000003.1932826201.0000000006980000.00000004.00000800.00020000.00000000.sdmp, Haims_ESC.exe, 00000002.00000003.1931843025.0000000006980000.00000004.00000800.00020000.00000000.sdmp, Haims_ESC.exe, 00000002.00000003.1930888894.0000000006980000.00000004.00000800.00020000.00000000.sdmp, Haims_ESC.exe, 00000002.00000003.1932231043.0000000006980000.00000004.00000800.00020000.00000000.sdmp, Haims_ESC.exe, 00000002.00000003.1932179913.0000000006980000.00000004.00000800.00020000.00000000.sdmp, Haims_ESC.exe, 00000002.00000003.1930939772.0000000006980000.00000004.00000800.00020000.00000000.sdmp, Haims_ESC.exe, 00000002.00000003.1931152410.0000000006980000.00000004.00000800.00020000.00000000.sdmp, Haims_ESC.exe, 00000002.00000003.1933030660.0000000006980000.00000004.00000800.00020000.00000000.sdmp, Haims_ESC.exe, 00000002.00000003.1931436456.0000000006980000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.daum.net/
Source: Haims_ESC.exe, 00000002.00000002.2977100207.0000000003150000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.daum.net/$
Source: Haims_ESC.exe, Haims_ESC.exe, 00000002.00000002.2976395327.0000000002C14000.00000004.00000020.00020000.00000000.sdmp, Haims_ESC.exe, 00000002.00000002.2975355981.00000000004E3000.00000040.00000001.01000000.00000007.sdmp String found in binary or memory: https://www.haims.co.kr/Haims
Source: Haims_ESC.exe, 00000002.00000002.2977100207.0000000003150000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.haims.co.kr/HaimsHYUNDAI
Source: Haims_ESC.exe, Haims_ESC.exe, 00000002.00000003.1930994998.0000000006980000.00000004.00000800.00020000.00000000.sdmp, Haims_ESC.exe, 00000002.00000003.1932980145.0000000006980000.00000004.00000800.00020000.00000000.sdmp, Haims_ESC.exe, 00000002.00000003.1931481058.0000000006980000.00000004.00000800.00020000.00000000.sdmp, Haims_ESC.exe, 00000002.00000003.1932642347.0000000006980000.00000004.00000800.00020000.00000000.sdmp, Haims_ESC.exe, 00000002.00000003.1932881382.0000000006980000.00000004.00000800.00020000.00000000.sdmp, Haims_ESC.exe, 00000002.00000003.1933080599.0000000006980000.00000004.00000800.00020000.00000000.sdmp, Haims_ESC.exe, 00000002.00000003.1931229919.0000000006980000.00000004.00000800.00020000.00000000.sdmp, Haims_ESC.exe, 00000002.00000003.1925136818.0000000006980000.00000004.00000800.00020000.00000000.sdmp, Haims_ESC.exe, 00000002.00000003.1932090189.0000000006980000.00000004.00000800.00020000.00000000.sdmp, Haims_ESC.exe, 00000002.00000003.1932134417.0000000006980000.00000004.00000800.00020000.00000000.sdmp, Haims_ESC.exe, 00000002.00000003.1932826201.0000000006980000.00000004.00000800.00020000.00000000.sdmp, Haims_ESC.exe, 00000002.00000003.1931843025.0000000006980000.00000004.00000800.00020000.00000000.sdmp, Haims_ESC.exe, 00000002.00000003.1930888894.0000000006980000.00000004.00000800.00020000.00000000.sdmp, Haims_ESC.exe, 00000002.00000003.1932231043.0000000006980000.00000004.00000800.00020000.00000000.sdmp, Haims_ESC.exe, 00000002.00000003.1932179913.0000000006980000.00000004.00000800.00020000.00000000.sdmp, Haims_ESC.exe, 00000002.00000003.1930939772.0000000006980000.00000004.00000800.00020000.00000000.sdmp, Haims_ESC.exe, 00000002.00000003.1931152410.0000000006980000.00000004.00000800.00020000.00000000.sdmp, Haims_ESC.exe, 00000002.00000003.1933030660.0000000006980000.00000004.00000800.00020000.00000000.sdmp, Haims_ESC.exe, 00000002.00000003.1931436456.0000000006980000.00000004.00000800.00020000.00000000.sdmp, Haims_ESC.exe, 00000002.00000003.1924489741.0000000006980000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.naver.com/
Source: Haims_ESC.exe, 00000002.00000002.2977100207.0000000003150000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.naver.com/1110C:
Source: Haims_ESC.exe, 00000002.00000002.2977100207.0000000003150000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.naver.com/x
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown HTTPS traffic detected: 112.175.184.42:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown HTTPS traffic detected: 112.175.184.42:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown HTTPS traffic detected: 112.175.184.42:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown HTTPS traffic detected: 112.175.184.42:443 -> 192.168.2.4:49738 version: TLS 1.2
Source: unknown HTTPS traffic detected: 112.175.184.42:443 -> 192.168.2.4:49739 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing
barindex
Contains functionality to register a low level keyboard hook
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe Code function: 0_2_0040E7E0 SetWindowsHookExW 0000000D,Function_00009E00,MZ@,00000000 0_2_0040E7E0
Installs a global keyboard hook
Source: C:\Users\user\Desktop\Haims_ESC.exe Windows user hook set: 0 keyboard low level C:\Users\user\Desktop\Haims_ESC.exe Jump to behavior
Source: C:\Users\user\Desktop\Haims_ESC.exe Windows user hook set: 0 mouse low level C:\Users\user\Desktop\Haims_ESC.exe Jump to behavior
Contains functionality for read data from the clipboard
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe Code function: 0_2_00405390 GetTickCount,IsClipboardFormatAvailable,GetTickCount,OpenClipboard,OpenClipboard,GetTickCount,OpenClipboard, 0_2_00405390
Contains functionality to modify clipboard data
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe Code function: 0_2_004050C0 EmptyClipboard,GlobalUnWire,CloseClipboard,GlobalUnWire,GlobalUnWire,GlobalFree,GlobalUnWire,CloseClipboard,SetClipboardData,GlobalUnWire,CloseClipboard, 0_2_004050C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe Code function: 0_2_00482940 EmptyClipboard,GlobalUnWire,CloseClipboard,GlobalAlloc,GlobalFix,GlobalUnWire,SetClipboardData,GlobalUnWire,CloseClipboard,GlobalFree,GlobalUnWire,CloseClipboard, 0_2_00482940
Source: C:\Users\user\Desktop\Haims_ESC.exe Code function: 2_2_004050C0 EmptyClipboard,GlobalUnWire,CloseClipboard,GlobalUnWire,GlobalUnWire,GlobalFree,GlobalUnWire,CloseClipboard,SetClipboardData,GlobalUnWire,CloseClipboard, 2_2_004050C0
Source: C:\Users\user\Desktop\Haims_ESC.exe Code function: 2_2_00482940 EmptyClipboard,GlobalUnWire,CloseClipboard,GlobalAlloc,GlobalFix,GlobalUnWire,SetClipboardData,GlobalUnWire,CloseClipboard,GlobalFree,GlobalUnWire,CloseClipboard, 2_2_00482940
Contains functionality to read the clipboard data
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe Code function: 0_2_00405290 GetClipboardFormatNameW,__wcsnicmp,__wcsicoll,__wcsicoll,__wcsicoll,__wcsicoll,__wcsicoll,__wcsicoll,GetClipboardData, 0_2_00405290
Contains functionality to record screenshots
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe Code function: 0_2_00444260 GetForegroundWindow,IsIconic,GetWindowRect,ClientToScreen,_wcsrchr,__wcsicoll,__wcsicoll,__wcsicoll,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,__wcsnicmp,__fassign,__wcsnicmp,_wcsncpy,__fassign,__fassign,__fassign,__fassign,GetDC,DestroyCursor,DeleteObject,DeleteObject,GetIconInfo,DeleteObject,DeleteObject,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,ReleaseDC,DeleteObject,SelectObject,DeleteDC,DeleteObject,_free,_free,_free, 0_2_00444260
Contains functionality to retrieve information about pressed keystrokes
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe Code function: 0_2_004160A0 GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState, 0_2_004160A0
Installs a global mouse hook
Source: C:\Users\user\Desktop\Haims_ESC.exe Windows user hook set: 0 mouse low level C:\Users\user\Desktop\Haims_ESC.exe Jump to behavior
Potential key logger detected (key state polling based)
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe Code function: 0_2_004014E4 GlobalUnWire,CloseClipboard,SetTimer,GetTickCount,GetTickCount,KiUserCallbackDispatcher,GetTickCount,GetFocus,TranslateAcceleratorW,GetKeyState,GetWindowLongW,IsWindowEnabled,GetKeyState,GetKeyState,GetKeyState,GetWindowLongW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,IsDialogMessageW,ShowWindow,GetForegroundWindow,GetWindowThreadProcessId,GetClassNameW,KillTimer,DragQueryFileW,DragFinish,GetTickCount,DragFinish,DragFinish,_wcsncpy,_wcsncpy,GetTickCount,_wcsncpy,GetTickCount,IsDialogMessageW,SetCurrentDirectoryW,TranslateAcceleratorW,TranslateMessage,DispatchMessageW, 0_2_004014E4
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe Code function: 0_2_004181B0 GetKeyState,GetKeyState,GetKeyState,GetForegroundWindow,GetWindowThreadProcessId,GetKeyState, 0_2_004181B0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe Code function: 0_2_00414920 __wcsnicmp,__wcsnicmp,GetWindowThreadProcessId,AttachThreadInput,GetKeyboardLayout,GetTickCount,GetCurrentThreadId,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetGUIThreadInfo,GetWindowThreadProcessId,GetTickCount,BlockInput,GetTickCount,GetTickCount,PeekMessageW,GetTickCount,_wcschr,_wcschr,__wcsnicmp,__wcsnicmp,_wcschr,__wcsnicmp,__wcsnicmp,__wcsnicmp,__wcsnicmp,__wcsnicmp,__wcsicoll,PostMessageW,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetTickCount,GetTickCount,PeekMessageW,GetTickCount,__wcsnicmp,__wcsnicmp,__fassign,PostMessageW,PostMessageW,PostMessageW,__itow,PostMessageW,_free,GetTickCount,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetKeyState,GetKeyState,GetKeyState,GetForegroundWindow,GetWindowThreadProcessId,AttachThreadInput,BlockInput,GetForegroundWindow,GetWindowThreadProcessId, 0_2_00414920
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe Code function: 0_2_00414B96 GetKeyboardLayout,GetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetGUIThreadInfo,GetWindowThreadProcessId,BlockInput,GetTickCount,GetTickCount,PeekMessageW,GetTickCount,_wcschr,_wcschr,__wcsnicmp,_free,GetKeyState,GetKeyState,GetKeyState,GetForegroundWindow,GetWindowThreadProcessId,AttachThreadInput,BlockInput, 0_2_00414B96
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe Code function: 0_2_00414D66 GetTickCount,GetTickCount,PeekMessageW,GetTickCount,_wcschr,_wcschr,__wcsnicmp,_free,GetKeyState,GetKeyState,GetKeyState,GetForegroundWindow,GetWindowThreadProcessId,AttachThreadInput,BlockInput, 0_2_00414D66
Source: C:\Users\user\Desktop\Haims_ESC.exe Code function: 2_2_004014E4 GlobalUnWire,CloseClipboard,SetTimer,GetTickCount,GetTickCount,KiUserCallbackDispatcher,GetTickCount,GetFocus,TranslateAcceleratorW,GetKeyState,GetWindowLongW,IsWindowEnabled,GetKeyState,GetKeyState,GetKeyState,GetWindowLongW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,IsDialogMessageW,ShowWindow,GetForegroundWindow,GetWindowThreadProcessId,GetClassNameW,KillTimer,DragQueryFileW,DragFinish,GetTickCount,DragFinish,DragFinish,_wcsncpy,_wcsncpy,GetTickCount,_wcsncpy,GetTickCount,IsDialogMessageW,SetCurrentDirectoryW,TranslateAcceleratorW,TranslateMessage,DispatchMessageW, 2_2_004014E4
Source: C:\Users\user\Desktop\Haims_ESC.exe Code function: 2_2_004181B0 GetKeyState,GetKeyState,GetKeyState,GetForegroundWindow,GetWindowThreadProcessId,GetKeyState, 2_2_004181B0
Source: C:\Users\user\Desktop\Haims_ESC.exe Code function: 2_2_00414920 __wcsnicmp,__wcsnicmp,GetWindowThreadProcessId,AttachThreadInput,GetKeyboardLayout,GetTickCount,GetCurrentThreadId,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetGUIThreadInfo,GetWindowThreadProcessId,GetTickCount,BlockInput,GetTickCount,GetTickCount,PeekMessageW,GetTickCount,_wcschr,_wcschr,__wcsnicmp,__wcsnicmp,_wcschr,__wcsnicmp,__wcsnicmp,__wcsnicmp,__wcsnicmp,__wcsnicmp,__wcsicoll,PostMessageW,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetTickCount,GetTickCount,PeekMessageW,GetTickCount,__wcsnicmp,__wcsnicmp,__fassign,PostMessageW,PostMessageW,PostMessageW,__itow,PostMessageW,_free,GetTickCount,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetKeyState,GetKeyState,GetKeyState,GetForegroundWindow,GetWindowThreadProcessId,AttachThreadInput,BlockInput,GetForegroundWindow,GetWindowThreadProcessId, 2_2_00414920
Source: C:\Users\user\Desktop\Haims_ESC.exe Code function: 2_2_00414B96 GetKeyboardLayout,GetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetGUIThreadInfo,GetWindowThreadProcessId,BlockInput,GetTickCount,GetTickCount,PeekMessageW,GetTickCount,_wcschr,_wcschr,__wcsnicmp,_free,GetKeyState,GetKeyState,GetKeyState,GetForegroundWindow,GetWindowThreadProcessId,AttachThreadInput,BlockInput, 2_2_00414B96
Source: C:\Users\user\Desktop\Haims_ESC.exe Code function: 2_2_00414D66 GetTickCount,GetTickCount,PeekMessageW,GetTickCount,_wcschr,_wcschr,__wcsnicmp,_free,GetKeyState,GetKeyState,GetKeyState,GetForegroundWindow,GetWindowThreadProcessId,AttachThreadInput,BlockInput, 2_2_00414D66

System Summary
barindex
Sample or dropped binary is a compiled AutoHotkey binary
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe Window found: window name: AutoHotkey Jump to behavior
Source: C:\Users\user\Desktop\Haims_ESC.exe Window found: window name: AutoHotkey Jump to behavior
Contains functionality to call native functions
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe Code function: 0_2_00444D60 RegisterClipboardFormatW,SetFocus,ShowWindow,ShowWindow,MoveWindow,GetSysColor,SetBkColor,SetTextColor,GetSysColorBrush,CreateCompatibleDC,SelectObject,BitBlt,SelectObject,DeleteDC,DrawIconEx,ExcludeClipRect,CreateRectRgn,GetClipRgn,GetSysColorBrush,FillRgn,DeleteObject,GetClipBox,FillRect,GetClientRect,MoveWindow,MoveWindow,MoveWindow,InvalidateRect,GetMenu,CheckMenuItem,Shell_NotifyIconW,Shell_NotifyIconW,Shell_NotifyIconW,RegisterClipboardFormatW,inet_ntoa,__itow,NtdllDefWindowProc_W,SendMessageTimeoutW,PostMessageW,SendMessageTimeoutW,PostMessageW,GlobalUnWire,CloseClipboard,GetCurrentProcessId,EnumWindows,SetTimer,PostMessageW,PostMessageW,IsWindow,GetWindowTextW,GetCurrentProcessId, 0_2_00444D60
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe Code function: 0_2_00471450 GetDlgCtrlID,SetTextColor,GetSysColor,SetTextColor,SetBkMode,GetStockObject,GetSysColor,SetBkColor,GetSysColorBrush,GetSysColor,SetBkColor,GetSysColorBrush,SetBkColor,SetBkColor,GetSysColor,SetBkColor,GetSysColorBrush,GetSysColor,SetBkColor,GetSysColorBrush,_memset,DragQueryPoint,ClientToScreen,EnumChildWindows,GetDlgCtrlID,PostMessageW,DragFinish,PostMessageW,NtdllDialogWndProc_W, 0_2_00471450
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe Code function: 0_2_0046F4D0 SetWindowTextW,IsZoomed,IsIconic,__wcsnicmp,__wcsnicmp,__wcsnicmp,__wcsnicmp,__wcsnicmp,__wcsnicmp,__wcsnicmp,__wcsnicmp,__wcsnicmp,MulDiv,MulDiv,ShowWindow,IsIconic,GetParent,GetWindowLongW,GetWindowRect,MapWindowPoints,GetWindowLongW,GetWindowRect,GetWindowLongW,GetWindowRect,GetClientRect,IsWindowVisible,GetWindowLongW,GetWindowLongW,GetMenu,GetWindowLongW,AdjustWindowRectEx,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,SendMessageW,GetClientRect,SystemParametersInfoW,GetWindowRect,IsZoomed,ShowWindow,MoveWindow,GetForegroundWindow,GetForegroundWindow,NtdllDialogWndProc_W,ShowWindow,GetAncestor,GetForegroundWindow,GetFocus,GetDlgCtrlID,GetDlgCtrlID,GetParent,GetDlgCtrlID,UpdateWindow,GetDlgCtrlID,SetFocus, 0_2_0046F4D0
Source: C:\Users\user\Desktop\Haims_ESC.exe Code function: 2_2_00471450 GetDlgCtrlID,SetTextColor,GetSysColor,SetTextColor,SetBkMode,GetStockObject,GetSysColor,SetBkColor,GetSysColorBrush,GetSysColor,SetBkColor,GetSysColorBrush,SetBkColor,SetBkColor,GetSysColor,SetBkColor,GetSysColorBrush,GetSysColor,SetBkColor,GetSysColorBrush,_memset,DragQueryPoint,ClientToScreen,EnumChildWindows,GetDlgCtrlID,PostMessageW,DragFinish,PostMessageW,NtdllDialogWndProc_W, 2_2_00471450
Source: C:\Users\user\Desktop\Haims_ESC.exe Code function: 2_2_0046F4D0 SetWindowTextW,IsZoomed,IsIconic,__wcsnicmp,__wcsnicmp,__wcsnicmp,__wcsnicmp,__wcsnicmp,__wcsnicmp,__wcsnicmp,__wcsnicmp,__wcsnicmp,MulDiv,MulDiv,ShowWindow,IsIconic,GetParent,GetWindowLongW,GetWindowRect,MapWindowPoints,GetWindowLongW,GetWindowRect,GetWindowLongW,GetWindowRect,GetClientRect,IsWindowVisible,GetWindowLongW,GetWindowLongW,GetMenu,GetWindowLongW,AdjustWindowRectEx,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,SendMessageW,GetClientRect,SystemParametersInfoW,GetWindowRect,IsZoomed,ShowWindow,MoveWindow,GetForegroundWindow,GetForegroundWindow,NtdllDialogWndProc_W,ShowWindow,GetAncestor,GetForegroundWindow,GetFocus,GetDlgCtrlID,GetDlgCtrlID,GetParent,GetDlgCtrlID,UpdateWindow,GetDlgCtrlID,SetFocus, 2_2_0046F4D0
Source: C:\Users\user\Desktop\Haims_ESC.exe Code function: 2_2_00444D60 RegisterClipboardFormatW,SetFocus,ShowWindow,ShowWindow,MoveWindow,GetSysColor,SetBkColor,SetTextColor,GetSysColorBrush,CreateCompatibleDC,SelectObject,BitBlt,SelectObject,DeleteDC,DrawIconEx,ExcludeClipRect,CreateRectRgn,GetClipRgn,GetSysColorBrush,FillRgn,DeleteObject,GetClipBox,FillRect,GetClientRect,MoveWindow,MoveWindow,MoveWindow,InvalidateRect,GetMenu,CheckMenuItem,Shell_NotifyIconW,Shell_NotifyIconW,Shell_NotifyIconW,RegisterClipboardFormatW,inet_ntoa,__itow,NtdllDefWindowProc_W,SendMessageTimeoutW,PostMessageW,SendMessageTimeoutW,PostMessageW,GlobalUnWire,CloseClipboard,GetCurrentProcessId,EnumWindows,SetTimer,PostMessageW,PostMessageW,IsWindow,GetWindowTextW,GetCurrentProcessId, 2_2_00444D60
Source: C:\Users\user\Desktop\Haims_ESC.exe Code function: 2_2_004714F6 SendMessageW,PostMessageW,NtdllDialogWndProc_W, 2_2_004714F6
Source: C:\Users\user\Desktop\Haims_ESC.exe Code function: 2_2_00471558 NtdllDialogWndProc_W, 2_2_00471558
Source: C:\Users\user\Desktop\Haims_ESC.exe Code function: 2_2_004715C3 NtdllDialogWndProc_W, 2_2_004715C3
Source: C:\Users\user\Desktop\Haims_ESC.exe Code function: 2_2_00471CA7 NtdllDialogWndProc_W, 2_2_00471CA7
Source: C:\Users\user\Desktop\Haims_ESC.exe Code function: 2_2_00471D5B NtdllDialogWndProc_W, 2_2_00471D5B
Source: C:\Users\user\Desktop\Haims_ESC.exe Code function: 2_2_00471D12 GetClipBox,FillRect,NtdllDialogWndProc_W, 2_2_00471D12
Source: C:\Users\user\Desktop\Haims_ESC.exe Code function: 2_2_00471D9F FillRect,SetBkColor,GetClassLongW,FillRect,SetTextColor,SendMessageW,SendMessageW,SendMessageW,DrawTextW,SetTextColor,NtdllDialogWndProc_W, 2_2_00471D9F
Source: C:\Users\user\Desktop\Haims_ESC.exe Code function: 2_2_00471EEE NtdllDialogWndProc_W, 2_2_00471EEE
Source: C:\Users\user\Desktop\Haims_ESC.exe Code function: 2_2_00471F16 _memset,ScreenToClient,EnumChildWindows,GetDlgCtrlID,PostMessageW,NtdllDialogWndProc_W, 2_2_00471F16
Source: C:\Users\user\Desktop\Haims_ESC.exe Code function: 2_2_00471FE5 NtdllDialogWndProc_W, 2_2_00471FE5
Contains functionality to communicate with device drivers
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe Code function: 0_2_00449AF0: __swprintf,CreateFileW,DeviceIoControl,CloseHandle, 0_2_00449AF0
Contains functionality to shutdown / reboot the system
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe Code function: 0_2_0045F390 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,ExitWindowsEx, 0_2_0045F390
Source: C:\Users\user\Desktop\Haims_ESC.exe Code function: 2_2_0045F390 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,ExitWindowsEx, 2_2_0045F390
Detected potential crypto function
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe Code function: 0_2_004014E4 0_2_004014E4
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe Code function: 0_2_00426070 0_2_00426070
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe Code function: 0_2_004A22CD 0_2_004A22CD
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe Code function: 0_2_0042A340 0_2_0042A340
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe Code function: 0_2_0040D3B0 0_2_0040D3B0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe Code function: 0_2_0042B4E0 0_2_0042B4E0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe Code function: 0_2_004A6509 0_2_004A6509
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe Code function: 0_2_004A95EE 0_2_004A95EE
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe Code function: 0_2_00411640 0_2_00411640
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe Code function: 0_2_0049C648 0_2_0049C648
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe Code function: 0_2_004A7655 0_2_004A7655
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe Code function: 0_2_0040D680 0_2_0040D680
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe Code function: 0_2_00451760 0_2_00451760
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe Code function: 0_2_004A1776 0_2_004A1776
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe Code function: 0_2_0041F7E4 0_2_0041F7E4
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe Code function: 0_2_00429780 0_2_00429780
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe Code function: 0_2_00414920 0_2_00414920
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe Code function: 0_2_00443A50 0_2_00443A50
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe Code function: 0_2_00438A90 0_2_00438A90
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe Code function: 0_2_00411C80 0_2_00411C80
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe Code function: 0_2_0048DE10 0_2_0048DE10
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe Code function: 0_2_00426070 0_2_00426070
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe Code function: 0_2_00401EF4 0_2_00401EF4
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe Code function: 0_2_00419EA1 0_2_00419EA1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe Code function: 0_2_00419EA0 0_2_00419EA0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe Code function: 0_2_0043BF60 0_2_0043BF60
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe Code function: 0_2_00412F30 0_2_00412F30
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe Code function: 0_2_0047EFC0 0_2_0047EFC0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe Code function: 0_2_004A5FB8 0_2_004A5FB8
Source: C:\Users\user\Desktop\Haims_ESC.exe Code function: 2_2_004014E4 2_2_004014E4
Source: C:\Users\user\Desktop\Haims_ESC.exe Code function: 2_2_0040D680 2_2_0040D680
Source: C:\Users\user\Desktop\Haims_ESC.exe Code function: 2_2_00451760 2_2_00451760
Source: C:\Users\user\Desktop\Haims_ESC.exe Code function: 2_2_00468E60 2_2_00468E60
Source: C:\Users\user\Desktop\Haims_ESC.exe Code function: 2_2_0043BF60 2_2_0043BF60
Source: C:\Users\user\Desktop\Haims_ESC.exe Code function: 2_2_00426070 2_2_00426070
Source: C:\Users\user\Desktop\Haims_ESC.exe Code function: 2_2_004A22CD 2_2_004A22CD
Source: C:\Users\user\Desktop\Haims_ESC.exe Code function: 2_2_0042A340 2_2_0042A340
Source: C:\Users\user\Desktop\Haims_ESC.exe Code function: 2_2_0040D3B0 2_2_0040D3B0
Source: C:\Users\user\Desktop\Haims_ESC.exe Code function: 2_2_0042B4E0 2_2_0042B4E0
Source: C:\Users\user\Desktop\Haims_ESC.exe Code function: 2_2_004A6509 2_2_004A6509
Source: C:\Users\user\Desktop\Haims_ESC.exe Code function: 2_2_004A95EE 2_2_004A95EE
Source: C:\Users\user\Desktop\Haims_ESC.exe Code function: 2_2_00411640 2_2_00411640
Source: C:\Users\user\Desktop\Haims_ESC.exe Code function: 2_2_0049C648 2_2_0049C648
Source: C:\Users\user\Desktop\Haims_ESC.exe Code function: 2_2_004A7655 2_2_004A7655
Source: C:\Users\user\Desktop\Haims_ESC.exe Code function: 2_2_004A1776 2_2_004A1776
Source: C:\Users\user\Desktop\Haims_ESC.exe Code function: 2_2_0041F7E4 2_2_0041F7E4
Source: C:\Users\user\Desktop\Haims_ESC.exe Code function: 2_2_00429780 2_2_00429780
Source: C:\Users\user\Desktop\Haims_ESC.exe Code function: 2_2_00414920 2_2_00414920
Source: C:\Users\user\Desktop\Haims_ESC.exe Code function: 2_2_00443A50 2_2_00443A50
Source: C:\Users\user\Desktop\Haims_ESC.exe Code function: 2_2_00438A90 2_2_00438A90
Source: C:\Users\user\Desktop\Haims_ESC.exe Code function: 2_2_00497AA0 2_2_00497AA0
Source: C:\Users\user\Desktop\Haims_ESC.exe Code function: 2_2_00411C80 2_2_00411C80
Source: C:\Users\user\Desktop\Haims_ESC.exe Code function: 2_2_0048DE10 2_2_0048DE10
Source: C:\Users\user\Desktop\Haims_ESC.exe Code function: 2_2_00426070 2_2_00426070
Source: C:\Users\user\Desktop\Haims_ESC.exe Code function: 2_2_00401EF4 2_2_00401EF4
Source: C:\Users\user\Desktop\Haims_ESC.exe Code function: 2_2_00419EA1 2_2_00419EA1
Source: C:\Users\user\Desktop\Haims_ESC.exe Code function: 2_2_00419EA0 2_2_00419EA0
Source: C:\Users\user\Desktop\Haims_ESC.exe Code function: 2_2_00412F30 2_2_00412F30
Source: C:\Users\user\Desktop\Haims_ESC.exe Code function: 2_2_0047EFC0 2_2_0047EFC0
Source: C:\Users\user\Desktop\Haims_ESC.exe Code function: 2_2_004A5FB8 2_2_004A5FB8
Found potential string decryption / allocating functions
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe Code function: String function: 0047F770 appears 64 times
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe Code function: String function: 0047F810 appears 53 times
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe Code function: String function: 00499409 appears 383 times
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe Code function: String function: 0043A0A0 appears 73 times
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe Code function: String function: 0043A380 appears 231 times
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe Code function: String function: 00499B8A appears 55 times
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe Code function: String function: 00408FA4 appears 36 times
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe Code function: String function: 0049A399 appears 35 times
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe Code function: String function: 004A7840 appears 47 times
Source: C:\Users\user\Desktop\Haims_ESC.exe Code function: String function: 0047F770 appears 66 times
Source: C:\Users\user\Desktop\Haims_ESC.exe Code function: String function: 0047F810 appears 53 times
Source: C:\Users\user\Desktop\Haims_ESC.exe Code function: String function: 00499409 appears 383 times
Source: C:\Users\user\Desktop\Haims_ESC.exe Code function: String function: 0043A0A0 appears 80 times
Source: C:\Users\user\Desktop\Haims_ESC.exe Code function: String function: 0043A380 appears 252 times
Source: C:\Users\user\Desktop\Haims_ESC.exe Code function: String function: 00499B8A appears 55 times
Source: C:\Users\user\Desktop\Haims_ESC.exe Code function: String function: 00408FA4 appears 36 times
Source: C:\Users\user\Desktop\Haims_ESC.exe Code function: String function: 0049A399 appears 34 times
Source: C:\Users\user\Desktop\Haims_ESC.exe Code function: String function: 004A7840 appears 47 times
PE / OLE file has an invalid certificate
Source: SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe Static PE information: invalid certificate
Uses 32bit PE files
Source: SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE, DEBUG_STRIPPED
Source: SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe Static PE information: Section: .MPRESS1 ZLIB complexity 1.0003240610986548
Source: Haims_ESC.exe.0.dr Static PE information: Section: .MPRESS1 ZLIB complexity 1.000320916077258
Source: classification engine Classification label: mal60.spyw.evad.winEXE@11/20@1/1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe Code function: 0_2_0043B080 GetFileAttributesW,__wcsicoll,__wcsicoll,__wcsicoll,__wcsicoll,__wcsicoll,__wcsicoll,__wcsicoll,__wcsicoll,__wcsicoll,__wcsicoll,__wcsicoll,__wcsicoll,_memset,__swprintf,CreateProcessW,CloseHandle,CloseHandle,GetLastError,_memset,__wcsicoll,_wcschr,SetCurrentDirectoryW,_wcschr,_wcschr,GetFileAttributesW,_wcschr,SetCurrentDirectoryW,ShellExecuteExW,GetModuleHandleW,GetProcAddress,GetLastError,FormatMessageW, 0_2_0043B080
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe Code function: 0_2_0045F390 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,ExitWindowsEx, 0_2_0045F390
Source: C:\Users\user\Desktop\Haims_ESC.exe Code function: 2_2_0045F390 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,ExitWindowsEx, 2_2_0045F390
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe Code function: 0_2_00449790 _wcsncpy,GetDiskFreeSpaceExW, 0_2_00449790
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe Code function: 0_2_0045F5A0 CreateToolhelp32Snapshot,Process32FirstW,__wcstoi64,Process32NextW,__wsplitpath,__wcsicoll,Process32NextW,CloseHandle,CloseHandle,CloseHandle, 0_2_0045F5A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe Code function: 0_2_0041F3CB _wcsncpy,CharUpperW,lstrcmpiW,lstrcmpiW,FindResourceW,LoadResource,LockResource,SizeofResource,FindResourceW, 0_2_0041F3CB
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe File created: C:\Users\user\Desktop\Haims_ESC.exe Jump to behavior
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5592:120:WilError_03
Source: C:\Users\user\Desktop\Haims_ESC.exe Mutant created: \Sessions\1\BaseNamedObjects\AHK Mouse
Source: C:\Users\user\Desktop\Haims_ESC.exe Mutant created: \Sessions\1\BaseNamedObjects\AHK Keybd
Source: C:\Program Files\Internet Explorer\iexplore.exe File created: C:\Users\user\AppData\Local\Temp\~DF1D0A298AAD15511E.TMP Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "iexplore.exe")
Source: C:\Users\user\Desktop\Haims_ESC.exe File read: C:\Users\user\Desktop\config.ini Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe ReversingLabs: Detection: 23%
Source: Haims_ESC.exe String found in binary or memory: nt while (!cEl.CurrentValue && (A_TickCount-startTime < timeOut)) Sleep, 20 } } } return cEl } ActivateChromiumAccessibility(hwnd:="A", cacheRequest:=0, timeOut:=500) { static activatedHwnds := {} if hwnd is not integer hwnd := WinExist(hwnd) if activatedHwnds
Source: unknown Process created: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe Process created: C:\Users\user\Desktop\Haims_ESC.exe Haims_ESC.exe
Source: unknown Process created: C:\Program Files\Internet Explorer\iexplore.exe "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
Source: C:\Program Files\Internet Explorer\iexplore.exe Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4476 CREDAT:17410 /prefetch:2
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe Process created: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe "C:\PROGRA~2\Java\jre-1.8\bin\ssvagent.exe" -new
Source: C:\Users\user\Desktop\Haims_ESC.exe Process created: C:\Windows\SysWOW64\taskkill.exe Taskkill /f /im iexplore.exe
Source: C:\Windows\SysWOW64\taskkill.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe Process created: C:\Users\user\Desktop\Haims_ESC.exe Haims_ESC.exe Jump to behavior
Source: C:\Users\user\Desktop\Haims_ESC.exe Process created: C:\Windows\SysWOW64\taskkill.exe Taskkill /f /im iexplore.exe Jump to behavior
Source: C:\Program Files\Internet Explorer\iexplore.exe Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4476 CREDAT:17410 /prefetch:2 Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe Process created: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe "C:\PROGRA~2\Java\jre-1.8\bin\ssvagent.exe" -new Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe Section loaded: wsock32.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe Section loaded: textinputframework.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe Section loaded: schannel.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe Section loaded: mskeyprotect.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe Section loaded: ncryptsslp.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\Haims_ESC.exe Section loaded: wsock32.dll Jump to behavior
Source: C:\Users\user\Desktop\Haims_ESC.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\Desktop\Haims_ESC.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\Haims_ESC.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\Desktop\Haims_ESC.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\Haims_ESC.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\Haims_ESC.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Users\user\Desktop\Haims_ESC.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\Haims_ESC.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\Haims_ESC.exe Section loaded: winhttpcom.dll Jump to behavior
Source: C:\Users\user\Desktop\Haims_ESC.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\Desktop\Haims_ESC.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\Haims_ESC.exe Section loaded: webio.dll Jump to behavior
Source: C:\Users\user\Desktop\Haims_ESC.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\Desktop\Haims_ESC.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\Haims_ESC.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\Desktop\Haims_ESC.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\Haims_ESC.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\Desktop\Haims_ESC.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\Desktop\Haims_ESC.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Users\user\Desktop\Haims_ESC.exe Section loaded: schannel.dll Jump to behavior
Source: C:\Users\user\Desktop\Haims_ESC.exe Section loaded: mskeyprotect.dll Jump to behavior
Source: C:\Users\user\Desktop\Haims_ESC.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\Haims_ESC.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Users\user\Desktop\Haims_ESC.exe Section loaded: ncryptsslp.dll Jump to behavior
Source: C:\Users\user\Desktop\Haims_ESC.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\Haims_ESC.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\Haims_ESC.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\Haims_ESC.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\Haims_ESC.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\Haims_ESC.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\Desktop\Haims_ESC.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\Haims_ESC.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\Haims_ESC.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\Haims_ESC.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\Desktop\Haims_ESC.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\Haims_ESC.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\Haims_ESC.exe Section loaded: textinputframework.dll Jump to behavior
Source: C:\Users\user\Desktop\Haims_ESC.exe Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Users\user\Desktop\Haims_ESC.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\Desktop\Haims_ESC.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\Desktop\Haims_ESC.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\Desktop\Haims_ESC.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\Haims_ESC.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\Haims_ESC.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\Haims_ESC.exe Section loaded: dwmapi.dll Jump to behavior
Source: C:\Users\user\Desktop\Haims_ESC.exe Section loaded: ieproxy.dll Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe Section loaded: vcruntime140.dll Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe Section loaded: version.dll Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe Section loaded: msvcp140.dll Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: framedynos.dll Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: dbghelp.dll Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: winsta.dll Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32 Jump to behavior
Source: C:\Users\user\Desktop\Haims_ESC.exe File written: C:\Users\user\Desktop\config.ini Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe Automated click: OK
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe Automated click: OK
Source: Window Recorder Window detected: More than 3 window changes detected

Data Obfuscation
barindex
Detected unpacking (changes PE section rights)
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe Unpacked PE file: 0.2.SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe.400000.0.unpack .MPRESS1:EW;.MPRESS2:EW;.rsrc:W; vs .MPRESS1:ER;.MPRESS2:ER;.rsrc:W;
Source: C:\Users\user\Desktop\Haims_ESC.exe Unpacked PE file: 2.2.Haims_ESC.exe.400000.0.unpack .MPRESS1:EW;.MPRESS2:EW;.rsrc:W; vs .MPRESS1:ER;.MPRESS2:ER;.rsrc:W;
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe Code function: 0_2_00473130 LoadLibraryW,GetProcAddress,FreeLibrary,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetSysColor,SendMessageW, 0_2_00473130
Entry point lies outside standard sections
Source: initial sample Static PE information: section where entry point is pointing to: .MPRESS2
PE file contains sections with non-standard names
Source: SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe Static PE information: section name: .MPRESS1
Source: SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe Static PE information: section name: .MPRESS2
Source: Haims_ESC.exe.0.dr Static PE information: section name: .MPRESS1
Source: Haims_ESC.exe.0.dr Static PE information: section name: .MPRESS2
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe Code function: 0_2_0049EB75 push ecx; ret 0_2_0049EB88
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe Code function: 0_2_004AAD28 push eax; ret 0_2_004AAD46
Source: C:\Users\user\Desktop\Haims_ESC.exe Code function: 2_2_0049EB75 push ecx; ret 2_2_0049EB88
Source: C:\Users\user\Desktop\Haims_ESC.exe Code function: 2_2_004AAD28 push eax; ret 2_2_004AAD46
Source: SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe Static PE information: section name: .MPRESS1 entropy: 7.999527045952774
Source: Haims_ESC.exe.0.dr Static PE information: section name: .MPRESS1 entropy: 7.999499195300892
Drops PE files
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe File created: C:\Users\user\Desktop\Haims_ESC.exe Jump to dropped file
Source: C:\Users\user\Desktop\Haims_ESC.exe File created: C:\Users\user\Desktop\readme.txt Jump to behavior
Source: C:\Users\user\Desktop\Haims_ESC.exe File created: C:\Users\user\Desktop\VNDCD_memo\readme.txt Jump to behavior
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe Code function: 0_2_00483940 GetWindowThreadProcessId,GetWindowThreadProcessId,GetForegroundWindow,IsIconic,ShowWindow,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,SetForegroundWindow,SetForegroundWindow,GetForegroundWindow,GetWindow,AttachThreadInput,AttachThreadInput,BringWindowToTop, 0_2_00483940
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe Code function: 0_2_0046C100 GetWindowLongW,GetWindowLongW,GetWindowLongW,__wcsnicmp,__wcsnicmp,__wcsicoll,SetWindowPos,__wcsicoll,__wcsicoll,__wcsnicmp,__wcsicoll,__wcsicoll,__wcsicoll,EnableWindow,__wcsnicmp,__wcsnicmp,__wcsicoll,__wcsicoll,__wcsicoll,__wcsnicmp,MulDiv,MulDiv,__wcsnicmp,MulDiv,MulDiv,__wcsicoll,__wcsicoll,__wcsicoll,__wcsicoll,__wcsicoll,__wcsicoll,__wcstoi64,IsWindow,SetParent,SetWindowLongW,SetParent,IsWindowVisible,IsIconic,SetWindowLongW,SetWindowLongW,SetWindowPos,InvalidateRect, 0_2_0046C100
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe Code function: 0_2_00444260 GetForegroundWindow,IsIconic,GetWindowRect,ClientToScreen,_wcsrchr,__wcsicoll,__wcsicoll,__wcsicoll,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,__wcsnicmp,__fassign,__wcsnicmp,_wcsncpy,__fassign,__fassign,__fassign,__fassign,GetDC,DestroyCursor,DeleteObject,DeleteObject,GetIconInfo,DeleteObject,DeleteObject,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,ReleaseDC,DeleteObject,SelectObject,DeleteDC,DeleteObject,_free,_free,_free, 0_2_00444260
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe Code function: 0_2_00473350 SendMessageW,SendMessageW,SendMessageW,GetWindowLongW,IsWindowVisible,IsIconic,GetFocus,GetWindowRect,GetPropW,ShowWindow,GetUpdateRect,SendMessageW,GetWindowLongW,ShowWindow,EnableWindow,GetWindowRect,PtInRect,PtInRect,PtInRect,SetFocus,SendMessageW,SendMessageW,ShowWindow,SetFocus,InvalidateRect,InvalidateRect,InvalidateRect,MapWindowPoints,InvalidateRect, 0_2_00473350
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe Code function: 0_2_0045C320 GetForegroundWindow,IsIconic,GetWindowRect,ClientToScreen,CreateDCW,GetDC,GetPixel,DeleteDC,ReleaseDC,__swprintf, 0_2_0045C320
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe Code function: 0_2_0046F4D0 SetWindowTextW,IsZoomed,IsIconic,__wcsnicmp,__wcsnicmp,__wcsnicmp,__wcsnicmp,__wcsnicmp,__wcsnicmp,__wcsnicmp,__wcsnicmp,__wcsnicmp,MulDiv,MulDiv,ShowWindow,IsIconic,GetParent,GetWindowLongW,GetWindowRect,MapWindowPoints,GetWindowLongW,GetWindowRect,GetWindowLongW,GetWindowRect,GetClientRect,IsWindowVisible,GetWindowLongW,GetWindowLongW,GetMenu,GetWindowLongW,AdjustWindowRectEx,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,SendMessageW,GetClientRect,SystemParametersInfoW,GetWindowRect,IsZoomed,ShowWindow,MoveWindow,GetForegroundWindow,GetForegroundWindow,NtdllDialogWndProc_W,ShowWindow,GetAncestor,GetForegroundWindow,GetFocus,GetDlgCtrlID,GetDlgCtrlID,GetParent,GetDlgCtrlID,UpdateWindow,GetDlgCtrlID,SetFocus, 0_2_0046F4D0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe Code function: 0_2_0046F4D0 SetWindowTextW,IsZoomed,IsIconic,__wcsnicmp,__wcsnicmp,__wcsnicmp,__wcsnicmp,__wcsnicmp,__wcsnicmp,__wcsnicmp,__wcsnicmp,__wcsnicmp,MulDiv,MulDiv,ShowWindow,IsIconic,GetParent,GetWindowLongW,GetWindowRect,MapWindowPoints,GetWindowLongW,GetWindowRect,GetWindowLongW,GetWindowRect,GetClientRect,IsWindowVisible,GetWindowLongW,GetWindowLongW,GetMenu,GetWindowLongW,AdjustWindowRectEx,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,SendMessageW,GetClientRect,SystemParametersInfoW,GetWindowRect,IsZoomed,ShowWindow,MoveWindow,GetForegroundWindow,GetForegroundWindow,NtdllDialogWndProc_W,ShowWindow,GetAncestor,GetForegroundWindow,GetFocus,GetDlgCtrlID,GetDlgCtrlID,GetParent,GetDlgCtrlID,UpdateWindow,GetDlgCtrlID,SetFocus, 0_2_0046F4D0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe Code function: 0_2_00442760 GetForegroundWindow,IsWindowVisible,GetWindowThreadProcessId,IsZoomed,IsIconic,GetWindowLongW,__swprintf,GetModuleHandleW,GetProcAddress,__swprintf, 0_2_00442760
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe Code function: 0_2_00483810 GetForegroundWindow,IsWindowVisible,IsIconic,ShowWindow, 0_2_00483810
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe Code function: 0_2_00443A50 GetForegroundWindow,IsIconic,GetWindowRect,ClientToScreen,GetDC,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,__swprintf,ReleaseDC,SelectObject,DeleteDC,DeleteObject,_free,GetPixel,ReleaseDC, 0_2_00443A50
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe Code function: 0_2_00446B40 GetCursorPos,GetForegroundWindow,IsIconic,GetWindowRect,ClientToScreen,WindowFromPoint,EnumChildWindows,_memset,EnumChildWindows,GetClassNameW,EnumChildWindows, 0_2_00446B40
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe Code function: 0_2_00480B70 GetForegroundWindow,IsIconic,GetWindowRect,ClientToScreen, 0_2_00480B70
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe Code function: 0_2_00480BD0 GetForegroundWindow,IsIconic,GetWindowRect,ClientToScreen, 0_2_00480BD0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe Code function: 0_2_00445CB0 SendMessageW,SendMessageW,SendMessageW,IsWindowVisible,ShowWindow,ShowWindow,IsIconic,ShowWindow,GetForegroundWindow,SetForegroundWindow,SendMessageW, 0_2_00445CB0
Source: C:\Users\user\Desktop\Haims_ESC.exe Code function: 2_2_0046F4D0 SetWindowTextW,IsZoomed,IsIconic,__wcsnicmp,__wcsnicmp,__wcsnicmp,__wcsnicmp,__wcsnicmp,__wcsnicmp,__wcsnicmp,__wcsnicmp,__wcsnicmp,MulDiv,MulDiv,ShowWindow,IsIconic,GetParent,GetWindowLongW,GetWindowRect,MapWindowPoints,GetWindowLongW,GetWindowRect,GetWindowLongW,GetWindowRect,GetClientRect,IsWindowVisible,GetWindowLongW,GetWindowLongW,GetMenu,GetWindowLongW,AdjustWindowRectEx,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,SendMessageW,GetClientRect,SystemParametersInfoW,GetWindowRect,IsZoomed,ShowWindow,MoveWindow,GetForegroundWindow,GetForegroundWindow,NtdllDialogWndProc_W,ShowWindow,GetAncestor,GetForegroundWindow,GetFocus,GetDlgCtrlID,GetDlgCtrlID,GetParent,GetDlgCtrlID,UpdateWindow,GetDlgCtrlID,SetFocus, 2_2_0046F4D0
Source: C:\Users\user\Desktop\Haims_ESC.exe Code function: 2_2_0046F4D0 SetWindowTextW,IsZoomed,IsIconic,__wcsnicmp,__wcsnicmp,__wcsnicmp,__wcsnicmp,__wcsnicmp,__wcsnicmp,__wcsnicmp,__wcsnicmp,__wcsnicmp,MulDiv,MulDiv,ShowWindow,IsIconic,GetParent,GetWindowLongW,GetWindowRect,MapWindowPoints,GetWindowLongW,GetWindowRect,GetWindowLongW,GetWindowRect,GetClientRect,IsWindowVisible,GetWindowLongW,GetWindowLongW,GetMenu,GetWindowLongW,AdjustWindowRectEx,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,SendMessageW,GetClientRect,SystemParametersInfoW,GetWindowRect,IsZoomed,ShowWindow,MoveWindow,GetForegroundWindow,GetForegroundWindow,NtdllDialogWndProc_W,ShowWindow,GetAncestor,GetForegroundWindow,GetFocus,GetDlgCtrlID,GetDlgCtrlID,GetParent,GetDlgCtrlID,UpdateWindow,GetDlgCtrlID,SetFocus, 2_2_0046F4D0
Source: C:\Users\user\Desktop\Haims_ESC.exe Code function: 2_2_00442760 GetForegroundWindow,IsWindowVisible,GetWindowThreadProcessId,IsZoomed,IsIconic,GetWindowLongW,__swprintf,GetModuleHandleW,GetProcAddress,__swprintf, 2_2_00442760
Source: C:\Users\user\Desktop\Haims_ESC.exe Code function: 2_2_00483940 GetWindowThreadProcessId,GetWindowThreadProcessId,GetForegroundWindow,IsIconic,ShowWindow,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,SetForegroundWindow,SetForegroundWindow,GetForegroundWindow,GetWindow,AttachThreadInput,AttachThreadInput,BringWindowToTop, 2_2_00483940
Source: C:\Users\user\Desktop\Haims_ESC.exe Code function: 2_2_00468E60 MulDiv,MulDiv,MulDiv,_wcschr,__wcsicoll,MulDiv,MulDiv,MulDiv,ReadConsoleOutputAttribute,GetDC,SelectObject,GetTextMetricsW,MulDiv,GetSystemMetrics,MulDiv,MulDiv,GetDC,SelectObject,GetTextMetricsW,GetSystemMetrics,GetDC,SelectObject,GetTextMetricsW,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,_wcschr,DrawTextW,DrawTextW,GetCharABCWidthsW,MulDiv,GetSystemMetrics,GetSystemMetrics,MulDiv,MulDiv,MulDiv,MulDiv,GetDC,SelectObject,GetTextMetricsW,MulDiv,GetSystemMetrics,IsWindowVisible,IsIconic,GetWindowLongW,GetPropW,MapWindowPoints,GetWindowLongW,SendMessageW,CreateWindowExW,CreateWindowExW,CreateWindowExW,CreateWindowExW,GetWindowLongW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,CreateWindowExW,SendMessageW,CreateWindowExW,SendMessageW,SendMessageW,MulDiv,MulDiv,MulDiv,MoveWindow,SelectObject,ReleaseDC,SendMessageW,SendMessageW,GetClientRect,SetWindowLongW,SendMessageW,SetWindowLongW,MoveWindow,GetWindowRect,SendMessageW,SetWindowPos,GetWindowRect,MapWindowPoints,InvalidateRect,SetWindowPos,SetWindowPos,MapWindowPoints, 2_2_00468E60
Source: C:\Users\user\Desktop\Haims_ESC.exe Code function: 2_2_0046C100 GetWindowLongW,GetWindowLongW,GetWindowLongW,__wcsnicmp,__wcsnicmp,__wcsicoll,SetWindowPos,__wcsicoll,__wcsicoll,__wcsnicmp,__wcsicoll,__wcsicoll,__wcsicoll,EnableWindow,__wcsnicmp,__wcsnicmp,__wcsicoll,__wcsicoll,__wcsicoll,__wcsnicmp,MulDiv,MulDiv,__wcsnicmp,MulDiv,MulDiv,__wcsicoll,__wcsicoll,__wcsicoll,__wcsicoll,__wcsicoll,__wcsicoll,__wcstoi64,IsWindow,SetParent,SetWindowLongW,SetParent,IsWindowVisible,IsIconic,SetWindowLongW,SetWindowLongW,SetWindowPos,InvalidateRect, 2_2_0046C100
Source: C:\Users\user\Desktop\Haims_ESC.exe Code function: 2_2_00444260 GetForegroundWindow,IsIconic,GetWindowRect,ClientToScreen,_wcsrchr,__wcsicoll,__wcsicoll,__wcsicoll,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,__wcsnicmp,__fassign,__wcsnicmp,_wcsncpy,__fassign,__fassign,__fassign,__fassign,GetDC,DestroyCursor,DeleteObject,DeleteObject,GetIconInfo,DeleteObject,DeleteObject,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,ReleaseDC,DeleteObject,SelectObject,DeleteDC,DeleteObject,_free,_free,_free, 2_2_00444260
Source: C:\Users\user\Desktop\Haims_ESC.exe Code function: 2_2_00473350 SendMessageW,SendMessageW,SendMessageW,GetWindowLongW,IsWindowVisible,IsIconic,GetFocus,GetWindowRect,GetPropW,ShowWindow,GetUpdateRect,SendMessageW,GetWindowLongW,ShowWindow,EnableWindow,GetWindowRect,PtInRect,PtInRect,PtInRect,SetFocus,SendMessageW,SendMessageW,ShowWindow,SetFocus,InvalidateRect,InvalidateRect,InvalidateRect,MapWindowPoints,InvalidateRect, 2_2_00473350
Source: C:\Users\user\Desktop\Haims_ESC.exe Code function: 2_2_0045C320 GetForegroundWindow,IsIconic,GetWindowRect,ClientToScreen,CreateDCW,GetDC,GetPixel,DeleteDC,ReleaseDC,__swprintf, 2_2_0045C320
Source: C:\Users\user\Desktop\Haims_ESC.exe Code function: 2_2_00483810 GetForegroundWindow,IsWindowVisible,IsIconic,ShowWindow, 2_2_00483810
Source: C:\Users\user\Desktop\Haims_ESC.exe Code function: 2_2_00443A50 GetForegroundWindow,IsIconic,GetWindowRect,ClientToScreen,GetDC,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,__swprintf,ReleaseDC,SelectObject,DeleteDC,DeleteObject,_free,GetPixel,ReleaseDC, 2_2_00443A50
Source: C:\Users\user\Desktop\Haims_ESC.exe Code function: 2_2_00446B40 GetCursorPos,GetForegroundWindow,IsIconic,GetWindowRect,ClientToScreen,WindowFromPoint,EnumChildWindows,_memset,EnumChildWindows,GetClassNameW,EnumChildWindows, 2_2_00446B40
Source: C:\Users\user\Desktop\Haims_ESC.exe Code function: 2_2_00480B70 GetForegroundWindow,IsIconic,GetWindowRect,ClientToScreen, 2_2_00480B70
Source: C:\Users\user\Desktop\Haims_ESC.exe Code function: 2_2_00480BD0 GetForegroundWindow,IsIconic,GetWindowRect,ClientToScreen, 2_2_00480BD0
Source: C:\Users\user\Desktop\Haims_ESC.exe Code function: 2_2_00445CB0 SendMessageW,SendMessageW,SendMessageW,IsWindowVisible,ShowWindow,ShowWindow,IsIconic,ShowWindow,GetForegroundWindow,SetForegroundWindow,SendMessageW, 2_2_00445CB0
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Source: C:\Users\user\Desktop\Haims_ESC.exe Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate Jump to behavior
Source: C:\Users\user\Desktop\Haims_ESC.exe Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Haims_ESC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Users\user\Desktop\Haims_ESC.exe Window / User API: foregroundWindowGot 526 Jump to behavior
Found large amount of non-executed APIs
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe API coverage: 4.1 %
Source: C:\Users\user\Desktop\Haims_ESC.exe API coverage: 6.0 %
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Uses the keyboard layout for branch decision (may execute only for specific keyboard layouts)
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe Code function: 0_2_0040C260 GetKeyboardLayout followed by cmp: cmp dword ptr [004db3c4h], edi and CTI: je 0040C434h 0_2_0040C260
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe Code function: 0_2_00419230 GetKeyboardLayout followed by cmp: cmp cl, 00000019h and CTI: ja 0041932Ch country: Russian (ru) 0_2_00419230
Source: C:\Users\user\Desktop\Haims_ESC.exe Code function: 2_2_0040C260 GetKeyboardLayout followed by cmp: cmp dword ptr [004db3c4h], edi and CTI: je 0040C434h 2_2_0040C260
Source: C:\Users\user\Desktop\Haims_ESC.exe Code function: 2_2_00419230 GetKeyboardLayout followed by cmp: cmp cl, 00000019h and CTI: ja 0041932Ch country: Russian (ru) 2_2_00419230
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe Code function: 0_2_004804F0 FindFirstFileW,FindClose,GetFileAttributesW, 0_2_004804F0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe Code function: 0_2_00480580 _wcschr,_wcschr,_wcschr,FindFirstFileW,FindClose,_wcschr,FindFirstFileW,FindClose, 0_2_00480580
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe Code function: 0_2_0045E1A0 _wcschr,_wcschr,GetFileAttributesW,FindFirstFileW,FindClose,CoInitialize, 0_2_0045E1A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe Code function: 0_2_0044D4F0 FindFirstFileW,GetTickCount,GetTickCount,PeekMessageW,GetTickCount,FindNextFileW,FindClose,GetLastError,FindFirstFileW,GetTickCount,GetTickCount,PeekMessageW,GetTickCount,__swprintf,FindNextFileW,FindClose, 0_2_0044D4F0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe Code function: 0_2_0044D7F0 FindFirstFileW,GetLastError,FindClose,FileTimeToLocalFileTime, 0_2_0044D7F0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe Code function: 0_2_00437AD0 FindFirstFileW,FindNextFileW,FindClose,FindNextFileW,FindClose,FindFirstFileW,FindNextFileW,FindClose,FindClose,FindClose,FindClose, 0_2_00437AD0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe Code function: 0_2_0047BAE0 FindFirstFileW,FindClose,GetFileAttributesW,CreateFileW,WriteFile,WriteFile,WriteFile,CloseHandle, 0_2_0047BAE0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe Code function: 0_2_0044DB30 CreateFileW,GetFileSizeEx,CloseHandle,FindFirstFileW,GetLastError,FindClose,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z, 0_2_0044DB30
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe Code function: 0_2_0045EE20 GetFullPathNameW,GetFullPathNameW,GetFullPathNameW,GetFileAttributesW,GetFileAttributesW,GetFileAttributesW,FindFirstFileW,GetLastError,_wcsrchr,_wcsrchr,_wcsncpy,GetTickCount,PeekMessageW,GetTickCount,MoveFileW,DeleteFileW,MoveFileW,GetLastError,CopyFileW,GetLastError,FindNextFileW,FindClose, 0_2_0045EE20
Source: C:\Users\user\Desktop\Haims_ESC.exe Code function: 2_2_004804F0 FindFirstFileW,FindClose,GetFileAttributesW, 2_2_004804F0
Source: C:\Users\user\Desktop\Haims_ESC.exe Code function: 2_2_00480580 _wcschr,_wcschr,_wcschr,FindFirstFileW,FindClose,_wcschr,FindFirstFileW,FindClose, 2_2_00480580
Source: C:\Users\user\Desktop\Haims_ESC.exe Code function: 2_2_0047BAE0 FindFirstFileW,FindClose,GetFileAttributesW,CreateFileW,WriteFile,WriteFile,WriteFile,CloseHandle, 2_2_0047BAE0
Source: C:\Users\user\Desktop\Haims_ESC.exe Code function: 2_2_0045E1A0 _wcschr,_wcschr,GetFileAttributesW,FindFirstFileW,FindClose,CoInitialize, 2_2_0045E1A0
Source: C:\Users\user\Desktop\Haims_ESC.exe Code function: 2_2_0044D4F0 FindFirstFileW,GetTickCount,GetTickCount,PeekMessageW,GetTickCount,FindNextFileW,FindClose,GetLastError,FindFirstFileW,GetTickCount,GetTickCount,PeekMessageW,GetTickCount,__swprintf,FindNextFileW,FindClose, 2_2_0044D4F0
Source: C:\Users\user\Desktop\Haims_ESC.exe Code function: 2_2_0044D7F0 FindFirstFileW,GetLastError,FindClose,FileTimeToLocalFileTime, 2_2_0044D7F0
Source: C:\Users\user\Desktop\Haims_ESC.exe Code function: 2_2_00437AD0 FindFirstFileW,FindNextFileW,FindClose,FindNextFileW,FindClose,FindFirstFileW,FindNextFileW,FindClose,FindClose,FindClose,FindClose, 2_2_00437AD0
Source: C:\Users\user\Desktop\Haims_ESC.exe Code function: 2_2_0044DB30 CreateFileW,GetFileSizeEx,CloseHandle,FindFirstFileW,GetLastError,FindClose,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z, 2_2_0044DB30
Source: C:\Users\user\Desktop\Haims_ESC.exe Code function: 2_2_0045EE20 GetFullPathNameW,GetFullPathNameW,GetFullPathNameW,GetFileAttributesW,GetFileAttributesW,GetFileAttributesW,FindFirstFileW,GetLastError,_wcsrchr,_wcsrchr,_wcsncpy,GetTickCount,PeekMessageW,GetTickCount,MoveFileW,DeleteFileW,MoveFileW,GetLastError,CopyFileW,GetLastError,FindNextFileW,FindClose, 2_2_0045EE20
Source: Haims_ESC.exe, 00000002.00000002.2975923731.0000000000A45000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAWz
Source: SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe, 00000000.00000003.1820569878.0000000000AC3000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe, 00000000.00000002.1821271566.0000000000AC3000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAWpg
Source: SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe, 00000000.00000003.1820569878.0000000000B30000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe, 00000000.00000002.1821271566.0000000000B30000.00000004.00000020.00020000.00000000.sdmp, Haims_ESC.exe, 00000002.00000002.2975923731.0000000000A45000.00000004.00000020.00020000.00000000.sdmp, Haims_ESC.exe, 00000002.00000002.2975923731.00000000009FB000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Contains functionality to block mouse and keyboard input (often used to hinder debugging)
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe Code function: 0_2_004164C0 GetCurrentThreadId,GetKeyboardState,SetKeyboardState,PostMessageW,PostMessageW,PostMessageW,BlockInput,GetForegroundWindow,GetAsyncKeyState,keybd_event,keybd_event,GetAsyncKeyState,keybd_event,GetAsyncKeyState,BlockInput, 0_2_004164C0
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe Code function: 0_2_004A1767 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 0_2_004A1767
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe Code function: 0_2_00473130 LoadLibraryW,GetProcAddress,FreeLibrary,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetSysColor,SendMessageW, 0_2_00473130
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe Code function: 0_2_004A8CEE __lseeki64_nolock,__lseeki64_nolock,GetProcessHeap,RtlAllocateHeap,__setmode_nolock,__write_nolock,__setmode_nolock,GetProcessHeap,HeapFree,__lseeki64_nolock,SetEndOfFile,GetLastError,__lseeki64_nolock, 0_2_004A8CEE
Enables debug privileges
Source: C:\Windows\SysWOW64\taskkill.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe Code function: 0_2_004A1767 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 0_2_004A1767
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe Code function: 0_2_0049DD65 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 0_2_0049DD65
Source: C:\Users\user\Desktop\Haims_ESC.exe Code function: 2_2_004A1767 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 2_2_004A1767
Source: C:\Users\user\Desktop\Haims_ESC.exe Code function: 2_2_0049DD65 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 2_2_0049DD65
Contains functionality to launch a program with higher privileges
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe Code function: 0_2_0043B080 GetFileAttributesW,__wcsicoll,__wcsicoll,__wcsicoll,__wcsicoll,__wcsicoll,__wcsicoll,__wcsicoll,__wcsicoll,__wcsicoll,__wcsicoll,__wcsicoll,__wcsicoll,_memset,__swprintf,CreateProcessW,CloseHandle,CloseHandle,GetLastError,_memset,__wcsicoll,_wcschr,SetCurrentDirectoryW,_wcschr,_wcschr,GetFileAttributesW,_wcschr,SetCurrentDirectoryW,ShellExecuteExW,GetModuleHandleW,GetProcAddress,GetLastError,FormatMessageW, 0_2_0043B080
Contains functionality to simulate keystroke presses
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe Code function: 0_2_00418090 keybd_event,GetTickCount,GetForegroundWindow,GetWindowTextW, 0_2_00418090
Contains functionality to simulate mouse events
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe Code function: 0_2_00417360 GetAsyncKeyState,GetSystemMetrics,GetSystemMetrics,GetCursorPos,WindowFromPoint,GetWindowThreadProcessId,SendMessageW,mouse_event,mouse_event, 0_2_00417360
Uses taskkill to terminate processes
Source: C:\Users\user\Desktop\Haims_ESC.exe Process created: C:\Windows\SysWOW64\taskkill.exe Taskkill /f /im iexplore.exe Jump to behavior
Source: SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe, Haims_ESC.exe Binary or memory string: Program Manager
Source: SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe, Haims_ESC.exe Binary or memory string: Shell_TrayWnd
Source: Haims_ESC.exe Binary or memory string: IN_JUMP } ie.Visible := false ie.Navigate(url) While ie.ReadyState != 4 || ie.Busy Sleep, 100 WinHide, ahk_class IEFrame WinActivate, ahk_class Shell_TrayWnd SetTimer, CloseIE, 500 MAIN_JUMP: GroupAdd GroupA, ahk_exe chrome.exe GroupAdd GroupA, ahk_exe whale.e
Source: Haims_ESC.exe, 00000002.00000002.2975355981.00000000004E3000.00000040.00000001.01000000.00000007.sdmp Binary or memory string: WinActivate, ahk_class Shell_TrayWnd
Source: Haims_ESC.exe, 00000002.00000002.2976395327.0000000002BA0000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: ahk_class Shell_TrayWndw
Source: Haims_ESC.exe, 00000002.00000002.2975644201.0000000000996000.00000004.00000010.00020000.00000000.sdmp Binary or memory string: IEFrameShell_TrayWnd <=
Source: SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe, 00000000.00000002.1820994010.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Haims_ESC.exe, 00000002.00000002.2975355981.0000000000401000.00000040.00000001.01000000.00000007.sdmp Binary or memory string: Gp6A08ATextLEFTLRIGHTRMIDDLEMX1X2WUWDWLWR{Blind}{ClickLl{}^+!#{}RawTempASC U+ ,LWin RWin LShift RShift LCtrl RCtrl LAlt RAlt SYSTEM\CurrentControlSet\Control\Keyboard Layouts\Layout FileKbdLayerDescriptorsc%03Xvk%02XSCALTDOWNALTUPSHIFTDOWNSHIFTUPCTRLDOWNCONTROLDOWNCTRLUPCONTROLUPLWINDOWNLWINUPRWINDOWNRWINUPRtlGetVersionntdll.dll%u.%u.%uStdOutAllUnreachableClassOverwriteUseEnvLocalSameAsGlobalUseUnsetGlobalUseUnsetLocalYYYYYWeekYearYDayWorkingDirWinDirWinDelayWDayUserNameTitleMatchModeSpeedTitleMatchModeTimeSinceThisHotkeyTimeSincePriorHotkeyTimeIdlePhysicalTimeIdleMouseTimeIdleKeyboardTimeIdleTickCountThisMenuItemPosThisMenuItemThisMenuThisLabelThisHotkeyThisFuncStoreCapslockModeStartupCommonStartupStartMenuCommonStartMenuSecScriptNameScriptHwndScriptFullPathScriptDirScreenWidthScreenHeightScreenDPIRegViewPtrSizeProgramsCommonProgramsPriorKeyPriorHotkeyOSVersionOSTypeNumBatchLinesNowUTCNowMyDocumentsMSecMouseDelayPlayMouseDelayMonMMMMMMMMMMinMDayLoopRegTypeLoopRegTimeModifiedLoopRegSubKeyLoopRegNameLoopRegKeyLoopReadLineLoopFileTimeModifiedLoopFileTimeCreatedLoopFileTimeAccessedLoopFileSizeMBLoopFileSizeKBLoopFileSizeLoopFileShortPathLoopFileShortNameLoopFilePathLoopFileNameLoopFileLongPathLoopFileFullPathLoopFileExtLoopFileDirLoopFileAttribLoopFieldLineNumberLineFileLastErrorLanguageKeyDurationPlayKeyDurationKeyDelayPlayKeyDelayIsUnicodeIsSuspendedIsPausedIsCriticalIsCompiledIsAdminIs64bitOSIPAddress4IPAddress3IPAddress2IPAddress1InitialWorkingDirIndexIconTipIconNumberIconHiddenIconFileHourGuiYGuiXGuiWidthGuiHeightGuiEventGuiControlEventFormatIntegerFormatFloatExitReasonEventInfoEndCharDesktopCommonDesktopDefaultTreeViewDefaultMouseSpeedDefaultListViewDefaultGuiDDDDDDDDDCursorCoordModeToolTipCoordModePixelCoordModeMouseCoordModeMenuCoordModeCaretControlDelayComputerNameCaretYCaretXBatchLinesAppDataCommonAppDataAhkVersionAhkPathTrueProgramFilesFalseComSpecClipboardAll...%s[%Iu of %Iu]: %-1.60s%sPropertyRegExMatch\:\:REG_SZREG_EXPAND_SZREG_MULTI_SZREG_DWORDREG_BINARYDefault3264MasterSpeakersHeadphonesDigitalLineMicrophoneSynthCDTelephonePCSpeakerWaveAuxAnalogVolVolumeOnOffMuteMonoLoudnessStereoEnhBassBoostPanQSoundPanBassTrebleEqualizerRegExFASTSLOWMonitorCountMonitorPrimaryMonitorMonitorWorkAreaMonitorNameAscChrDerefHTMLModPowExpSqrtLogLnRoundCeilFloorAbsSinCosTanASinACosATanBitAndBitOrBitXOrBitNotBitShiftLeftBitShiftRightShowAddRenameCheckUncheckToggleCheckEnableDisableToggleEnableStandardNoStandardColorNoDefaultDeleteAllTipIconNoIconMainWindowNoMainWindowSubmitCancelHideMinimizeMaximizeRestoreDestroyMarginFontListViewTreeViewFlashNewMoveMoveDrawFocusChooseChooseStringPosFocusVEnabledVisibleHwndNameButtonCheckboxRadioDDLDropDownListComboBoxListBoxUpDownSliderTab2Tab3GroupBoxPicPictureDateTimeMonthCalStatusBarActiveXLinkCustomPriorityInterruptNoTimersCloseWaitCloseStyleExStyleShowDropDownHideDropDownTabLeftTabRightEditPasteCheckedFindStringChoiceListLineCountCurrentLineCurrentColSelectedEjectLockUnlockLabelFileSystemFSSetLabel:SerialTypeStatusSt
Source: Haims_ESC.exe, 00000002.00000002.2975355981.00000000004C0000.00000040.00000001.01000000.00000007.sdmp Binary or memory string: "%-1.300s"The maximum number of MsgBoxes has been reached.IsHungAppWindowDwmGetWindowAttributedwmapi.dllahk_idpidgroup%s%uProgram ManagerProgmanWorkerWError text not found (please report)Q\E{0,DEFINEUTF16)UCP)NO_START_OPT)CR)LF)CRLF)ANY)ANYCRLF)BSR_ANYCRLF)BSR_UNICODE)argument is not a compiled regular expressionargument is compiled in 8 bit modeinternal error: opcode not recognizedinternal error: missing capturing bracketfailed to get memory
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe Code function: 0_2_0044E100 __wcsicoll,GetTickCount,GetLocalTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf, 0_2_0044E100
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe Code function: 0_2_0044F3D0 GetComputerNameW,GetUserNameW, 0_2_0044F3D0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe Code function: 0_2_0041A04E RtlGetVersion,__snwprintf, 0_2_0041A04E
OS version to string mapping found (often used in BOTs)
Source: Haims_ESC.exe Binary or memory string: WIN_XP
Source: Haims_ESC.exe, 00000002.00000002.2976720110.000000000301B000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: ((A_OSVersion="WIN_XP" || A_OSVersion="WIN_7" || A_OSVersion="WIN_2000" || A_OSVersion="WIN_2003") && flags=2)
Source: Haims_ESC.exe, 00000002.00000002.2975355981.0000000000401000.00000040.00000001.01000000.00000007.sdmp Binary or memory string: ?*A Goto/Gosub must not jump into a block that doesn't enclose it.ddddddd%02d%dmsSlowLogoffSingleWIN32_NTWIN_8.1WIN_8WIN_7WIN_VISTAWIN_XPWIN_2003WIN_2000%04hX0x%Ix*pPIntStrPtrShortInt64DoubleAStrWStrgdi32comctl32kernel32W-3-4CDecl-2This DllCall requires a prior VarSetCapacity.Pos%sLen%sPos%dLen%dLenMarkCountarraypcre_calloutCompile error %d at offset %d: %hs-+0 #diouxXeEfgGaAcCpULlTt%0.*fCallbackCcFfSelectVisCenterUniDescLogicalNoSortAutoHdrFirstBoldExpandGDI+JoyJoyXJoyYJoyZJoyRJoyUJoyVJoyPOVJoyNameJoyButtonsJoyAxesJoyInfoGetProcessImageFileNameWpsapi
Source: Haims_ESC.exe Binary or memory string: hdc, Flags:=2) { If ((A_OSVersion="WIN_XP" || A_OSVersion="WIN_7" || A_OSVersion="WIN_2000" || A_OSVersion="WIN_2003") && flags=2) flags := 0 return DllCall("PrintWindow", "UPtr", hwnd, "UPtr", hdc, "uint", Flags) } DestroyIcon(hIcon) { return DllCall("Destroy
Source: Haims_ESC.exe Binary or memory string: WIN_VISTA
Source: Haims_ESC.exe Binary or memory string: WIN_7
Source: Haims_ESC.exe, 00000002.00000002.2977100207.0000000003150000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: ADWIN_XPWIN_7WIN_2000WIN_20032
Source: Haims_ESC.exe Binary or memory string: WIN_8
Source: Haims_ESC.exe, 00000002.00000002.2975355981.00000000004E3000.00000040.00000001.01000000.00000007.sdmp Binary or memory string: If ((A_OSVersion="WIN_XP" || A_OSVersion="WIN_7" || A_OSVersion="WIN_2000" || A_OSVersion="WIN_2003") && flags=2)
Source: Haims_ESC.exe Binary or memory string: WIN_8.1
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe Code function: 0_2_0041D920 Shell_NotifyIconW,DeleteObject,IsWindow,DestroyWindow,DeleteObject,DeleteObject,DeleteObject,DestroyCursor,DeleteObject,DestroyCursor,IsWindow,DestroyWindow,DeleteObject,DeleteObject,DeleteObject,DeleteObject,DestroyCursor,DestroyCursor,IsWindow,DestroyWindow,DeleteObject,RemoveClipboardFormatListener,ChangeClipboardChain,mciSendStringW,mciSendStringW,mciSendStringW,RtlDeleteCriticalSection,OleUninitialize,_free,_free,_free, 0_2_0041D920
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe Code function: 0_2_0041E370 AddClipboardFormatListener,PostMessageW,SetClipboardViewer,RemoveClipboardFormatListener,ChangeClipboardChain, 0_2_0041E370
Source: C:\Users\user\Desktop\Haims_ESC.exe Code function: 2_2_0041E370 AddClipboardFormatListener,PostMessageW,SetClipboardViewer,RemoveClipboardFormatListener,ChangeClipboardChain, 2_2_0041E370
Source: C:\Users\user\Desktop\Haims_ESC.exe Code function: 2_2_0041D920 Shell_NotifyIconW,DeleteObject,IsWindow,DestroyWindow,DeleteObject,DeleteObject,DeleteObject,DestroyCursor,DeleteObject,DestroyCursor,IsWindow,DestroyWindow,DeleteObject,DeleteObject,DeleteObject,DeleteObject,DestroyCursor,DestroyCursor,IsWindow,DestroyWindow,DeleteObject,RemoveClipboardFormatListener,ChangeClipboardChain,mciSendStringW,mciSendStringW,mciSendStringW,RtlDeleteCriticalSection,OleUninitialize,_free,_free,_free, 2_2_0041D920
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1428965 Sample: SecuriteInfo.com.Win32.Malw... Startdate: 19/04/2024 Architecture: WINDOWS Score: 60 29 runuo.kr 2->29 41 Multi AV Scanner detection for submitted file 2->41 43 Machine Learning detection for sample 2->43 9 SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe 7 2->9         started        14 iexplore.exe 46 67 2->14         started        signatures3 process4 dnsIp5 31 runuo.kr 112.175.184.42, 443, 49730, 49731 KIXS-AS-KRKoreaTelecomKR Korea Republic of 9->31 27 C:\Users\user\Desktop\Haims_ESC.exe, MS-DOS 9->27 dropped 45 Detected unpacking (changes PE section rights) 9->45 47 Contains functionality to register a low level keyboard hook 9->47 49 Sample or dropped binary is a compiled AutoHotkey binary 9->49 16 Haims_ESC.exe 23 9->16         started        19 iexplore.exe 27 14->19         started        file6 signatures7 process8 signatures9 33 Multi AV Scanner detection for dropped file 16->33 35 Detected unpacking (changes PE section rights) 16->35 37 Installs a global keyboard hook 16->37 39 Sample or dropped binary is a compiled AutoHotkey binary 16->39 21 taskkill.exe 1 16->21         started        23 ssvagent.exe 501 19->23         started        process10 process11 25 conhost.exe 21->25         started       
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
112.175.184.42
 runuo.kr Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false

Contacted Domains

Name IP Active
runuo.kr 112.175.184.42 true

Contacted URLs

Name Malicious Antivirus Detection Reputation
https://runuo.kr/haims_esc/nosearch/Haims_CompanyCode_check.php?CompanyCode=0 false
    		unknown
    https://runuo.kr/haims_esc/Haims_ESC.exe false
      		unknown
      https://runuo.kr/wlog/piwik.php?action_name=&idsite=1&rec=1&r=643131&h=23&m=25&s=22&url=https%3A%2F%2Frunuo.kr%2Fhaims_esc%2Fhaims_localconnect.php&_id=1aa1c3094c7d4b5f&_idts=1713561923&_idvc=1&_idn=1&_refts=0&_viewts=1713561923&cs=windows-1252&java=1&cookie=1&res=1280x1024&gt_ms=0 false
        		unknown
        https://runuo.kr/haims_esc/ver.txt false
          		unknown
          https://runuo.kr/wlog/piwik.js false
            		unknown
            https://runuo.kr/favicon.ico false
              		unknown
              https://runuo.kr/haims_esc/notice.txt false
                		unknown
                https://runuo.kr/haims_esc/haims_localconnect.php false
                  		unknown