Edit tour

Windows Analysis Report
jp.exe

Overview

General Information

Sample name:	jp.exe
Analysis ID:	1429061
MD5:	1938a3545517650824657fd09ce4ee16
SHA1:	25a3bb6c1d11fac492825178e5a4ca7c5a8c4910
SHA256:	602dbcf4008c585582d5e5d5c8ddb1932fdee07a14308e9cbf937904f31df1f7
Tags:	APT44exeJUICYPOTATONG
Infos:

Detection

Score:	48
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Found evasive API chain checking for process token information

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

PE file contains sections with non-standard names

Program does not show much activity (idle)

Sample execution stops while process was sleeping (likely an evasion)

Uses Microsoft's Enhanced Cryptographic Provider

Classification

Process Tree

System is w10x64

jp.exe (PID: 4984 cmdline: "C:\Users\user\Desktop\jp.exe" MD5: 1938A3545517650824657FD09CE4EE16)

conhost.exe (PID: 5160 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Code function: 0_2_00007FF601382670 CoTaskMemAlloc,CoTaskMemAlloc,LoadLibraryW,GetProcAddress,GetCurrentProcess,CoInitialize,CoInitializeSecurity,CreateObjrefMoniker,CreateBindCtx,CryptStringToBinaryW,RpcServerUseProtseqEpW,RpcServerRegisterAuthInfoW,CreateILockBytesOnHGlobal,StgCreateDocfileOnILockBytes,CLSIDFromString,CoGetInstanceFromIStorage,WaitForSingleObject,CoTaskMemFree,CoTaskMemFree,CoUninitialize,GetLastError,AcceptSecurityContext,SetEvent,QuerySecurityContextToken,GetTokenInformation,GetTokenInformation,GetLengthSid,CopySid,LookupAccountSidW,GetTokenInformation,DuplicateTokenEx,SetEvent,

0_2_00007FF601382670

Source: jp.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\jp.exe

Code function: 0_2_00007FF60138FAC0 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,FindClose,

0_2_00007FF60138FAC0

Source: C:\Users\user\Desktop\jp.exe

Code function: 0_2_00007FF6013821C0 GetCurrentProcess,OpenProcessToken,ImpersonateLoggedOnUser,CloseHandle,GetProcessHeap,HeapAlloc,GetCurrentProcessId,ProcessIdToSessionId,SetTokenInformation,CreateProcessAsUserW,GetLastError,CreateProcessWithTokenW,GetLastError,WaitForSingleObject,CloseHandle,CloseHandle,RevertToSelf,GetProcessHeap,HeapFree,

0_2_00007FF6013821C0

Source: C:\Users\user\Desktop\jp.exe	Code function: 0_2_00007FF601382670	0_2_00007FF601382670
Source: C:\Users\user\Desktop\jp.exe	Code function: 0_2_00007FF60138FAC0	0_2_00007FF60138FAC0
Source: C:\Users\user\Desktop\jp.exe	Code function: 0_2_00007FF601392D8C	0_2_00007FF601392D8C
Source: C:\Users\user\Desktop\jp.exe	Code function: 0_2_00007FF601392960	0_2_00007FF601392960
Source: C:\Users\user\Desktop\jp.exe	Code function: 0_2_00007FF60138CE14	0_2_00007FF60138CE14
Source: C:\Users\user\Desktop\jp.exe	Code function: 0_2_00007FF60138F220	0_2_00007FF60138F220
Source: C:\Users\user\Desktop\jp.exe	Code function: 0_2_00007FF60138ADC4	0_2_00007FF60138ADC4
Source: C:\Users\user\Desktop\jp.exe	Code function: 0_2_00007FF6013965B8	0_2_00007FF6013965B8
Source: C:\Users\user\Desktop\jp.exe	Code function: 0_2_00007FF6013885DC	0_2_00007FF6013885DC
Source: C:\Users\user\Desktop\jp.exe	Code function: 0_2_00007FF601381130	0_2_00007FF601381130
Source: C:\Users\user\Desktop\jp.exe	Code function: 0_2_00007FF601388358	0_2_00007FF601388358
Source: C:\Users\user\Desktop\jp.exe	Code function: 0_2_00007FF60138E814	0_2_00007FF60138E814

Source: C:\Users\user\Desktop\jp.exe

Code function: String function: 00007FF601381010 appears 54 times

Source: classification engine

Classification label: mal48.winEXE@2/1@0/0

Source: C:\Users\user\Desktop\jp.exe

Code function: 0_2_00007FF601382090 LookupPrivilegeValueW,GetLastError,AdjustTokenPrivileges,GetLastError,PrivilegeCheck,GetLastError,

0_2_00007FF601382090

Source: C:\Users\user\Desktop\jp.exe

Code function: 0_2_00007FF601381B20 CoInitialize,CoCreateInstance,CoUninitialize,CreateEventW,CreateEventW,InitSecurityInterfaceW,LogonUserW,ImpersonateLoggedOnUser,RevertToSelf,WaitForSingleObject,WaitForSingleObject,WaitForSingleObject,WaitForSingleObject,CloseHandle,CloseHandle,CloseHandle,CloseHandle,GetLastError,

0_2_00007FF601381B20

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5160:120:WilError_03

Source: jp.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\jp.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: jp.exe	ReversingLabs: Detection: 65%
Source: jp.exe	Virustotal: Detection: 69%

Source: unknown	Process created: C:\Users\user\Desktop\jp.exe "C:\Users\user\Desktop\jp.exe"
Source: C:\Users\user\Desktop\jp.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Source: C:\Users\user\Desktop\jp.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\jp.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\jp.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\jp.exe	Section loaded: kernel.appcore.dll	Jump to behavior

Source: jp.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: jp.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: jp.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: jp.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: jp.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: jp.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: jp.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: jp.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: jp.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: jp.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: jp.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: jp.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: jp.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: jp.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\jp.exe

0_2_00007FF601382670

Source: jp.exe

Static PE information: section name: _RDATA

Source: C:\Users\user\Desktop\jp.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_0-9543

Source: C:\Users\user\Desktop\jp.exe

API coverage: 4.5 %

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\jp.exe

Code function: 0_2_00007FF60138FAC0 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,FindClose,

0_2_00007FF60138FAC0

Source: C:\Users\user\Desktop\jp.exe

Code function: 0_2_00007FF60138BE8C RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00007FF60138BE8C

Source: C:\Users\user\Desktop\jp.exe

0_2_00007FF601382670

Source: C:\Users\user\Desktop\jp.exe

0_2_00007FF6013821C0

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\jp.exe	Code function: 0_2_00007FF60138BE8C RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF60138BE8C
Source: C:\Users\user\Desktop\jp.exe	Code function: 0_2_00007FF601383720 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF601383720
Source: C:\Users\user\Desktop\jp.exe	Code function: 0_2_00007FF601382DB4 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00007FF601382DB4
Source: C:\Users\user\Desktop\jp.exe	Code function: 0_2_00007FF6013838C8 SetUnhandledExceptionFilter,	0_2_00007FF6013838C8

Source: C:\Users\user\Desktop\jp.exe

0_2_00007FF601381B20

Source: C:\Users\user\Desktop\jp.exe

Code function: 0_2_00007FF601396400 cpuid

0_2_00007FF601396400

Source: C:\Users\user\Desktop\jp.exe

Code function: 0_2_00007FF601383604 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00007FF601383604

Source: C:\Users\user\Desktop\jp.exe

0_2_00007FF601382670

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	2 Valid Accounts	2 Native API	2 Valid Accounts	2 Valid Accounts	2 Valid Accounts	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	21 Access Token Manipulation	21 Access Token Manipulation	LSASS Memory	2 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Process Injection	1 Process Injection	Security Account Manager	1 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	NTDS	12 System Information Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Obfuscated Files or Information	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
jp.exe	66%	ReversingLabs	Win64.Trojan.CobaltStrike
jp.exe	69%	Virustotal		Browse

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1429061
Start date and time:	2024-04-20 13:34:05 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 1m 54s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	3
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	jp.exe
Detection:	MAL
Classification:	mal48.winEXE@2/1@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 97% Number of executed functions: 13 Number of non-executed functions: 35
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): dllhost.exe
Not all processes where analyzed, report is missing behavior information

Process:	C:\Users\user\Desktop\jp.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	724
Entropy (8bit):	5.262038391161656
Encrypted:	false
SSDEEP:	12:IwZdPyZdPpOpqW8nY8GP/1mmCFZ1fTUcEaXg84EU8/aId4h2wpVY0AE2+z1jHi:H82kLB4mm8NNwWFb2We2UpHi
MD5:	A980C5C269329585F5CF31F38DD0C3CD
SHA1:	06EF2044D9A45A9B02C8B4414BD5EAA264673196
SHA-256:	87CEA0250D7E3FAA1E5169DA5ECE6CEDFD40859C30C73F64F0DE660AA82767A1
SHA-512:	47AB33CA5FA7EF773327F4371FC75DF307A4F5067562F357FD810D101C389D3585B1D36795DB189F6E31B3418B16C657D8F36E2800AAAAF31D8EE8C597B0A9C4
Malicious:	false
Reputation:	low
Preview:	..... JuicyPotatoNG... by decoder_it & splinter_code......... JuicyPotatoNG... by decoder_it & splinter_code......Mandatory args: ..-t createprocess call: <t> CreateProcessWithTokenW, <u> CreateProcessAsUser, <*> try both..-p <program>: program to launch......Optional args: ..-l <port>: COM server listen port (Default 10247)..-a <argument>: command line argument to pass to program (default NULL)..-c <CLSID>: (Default {854A20FB-2D44-457D-992F-EF13785D2B51})..-i : Interactive Console (valid only with CreateProcessAsUser)......Additional modes: ..-b : Bruteforce all CLSIDs. !ALERT: USE ONLY FOR TESTING. About 1000 processes will be spawned!..-s : Seek for a suitable COM port not filtered by Windows Defender Firewall..

Static File Info

General

File type:	PE32+ executable (console) x86-64, for MS Windows
Entropy (8bit):	6.155325734871083
TrID:	Win64 Executable Console (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	jp.exe
File size:	153'600 bytes
MD5:	1938a3545517650824657fd09ce4ee16
SHA1:	25a3bb6c1d11fac492825178e5a4ca7c5a8c4910
SHA256:	602dbcf4008c585582d5e5d5c8ddb1932fdee07a14308e9cbf937904f31df1f7
SHA512:	8dcf8ba85b19e57074fba677bfa2aed646d531d7ebb0376cdecdb2a4247b2ea5a0188873f618033faedab764100c7e5db7001f8443136e5fb814ab39da5b6c26
SSDEEP:	1536:bcmdSR7NBuNA124hAsuDBajpQZfCT4DbAkfe9j5w35GKQTgtxjsWCtd7p9dlw2Qn:4mQD0Ar7pyPA8e9u35GKckxStXlp4Il
TLSH:	BBE35B0773A531F9E1778238C9A64906F776787207619BAF0364477A2F233D0AD3AB61
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........[\E.5.E.5.E.5.Q.6.@.5.Q.0...5...0.m.5...1.U.5...6.L.5.Q.1.K.5.Q.4.H.5.E.4...5...<.C.5.....D.5...7.D.5.RichE.5.........PE..d..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x140003200
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x633DBF34 [Wed Oct 5 17:30:28 2022 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	f9a28c458284584a93b14216308d31bd

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007F8054876C00h
dec eax
add esp, 28h
jmp 00007F8054876677h
int3
int3
inc eax
push ebx
dec eax
sub esp, 20h
dec eax
mov ebx, ecx
dec eax
mov eax, edx
dec eax
lea ecx, dword ptr [000152E1h]
xorps xmm0, xmm0
dec eax
mov dword ptr [ebx], ecx
dec eax
lea edx, dword ptr [ebx+08h]
dec eax
lea ecx, dword ptr [eax+08h]
movups dqword ptr [edx], xmm0
call 00007F8054877A44h
dec eax
lea eax, dword ptr [000152F4h]
dec eax
mov dword ptr [ebx], eax
dec eax
mov eax, ebx
dec eax
add esp, 20h
pop ebx
ret
dec eax
and dword ptr [ecx+10h], 00000000h
dec eax
lea eax, dword ptr [000152ECh]
dec eax
mov dword ptr [ecx+08h], eax
dec eax
lea eax, dword ptr [000152D1h]
dec eax
mov dword ptr [ecx], eax
dec eax
mov eax, ecx
ret
int3
int3
inc eax
push ebx
dec eax
sub esp, 20h
dec eax
mov ebx, ecx
dec eax
mov eax, edx
dec eax
lea ecx, dword ptr [00015285h]
xorps xmm0, xmm0
dec eax
mov dword ptr [ebx], ecx
dec eax
lea edx, dword ptr [ebx+08h]
dec eax
lea ecx, dword ptr [eax+08h]
movups dqword ptr [edx], xmm0
call 00007F80548779E8h
dec eax
lea eax, dword ptr [000152C0h]
dec eax
mov dword ptr [ebx], eax
dec eax
mov eax, ebx
dec eax
add esp, 20h
pop ebx
ret
dec eax
and dword ptr [ecx+10h], 00000000h
dec eax
lea eax, dword ptr [000152B8h]
dec eax
mov dword ptr [ecx+08h], eax
dec eax
lea eax, dword ptr [0001529Dh]
dec eax
mov dword ptr [ecx], eax
dec eax

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x23394	0x8c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x2a000	0x1e0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x27000	0x14a0	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x2b000	0x6dc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x2164c	0x38	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x21690	0x138	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x18000	0x3d8	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x162d0	0x16400	3809af1bd6599925c1f0c774abbec7a9	False	0.5888671875	data	6.475221223167762	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x18000	0xc11c	0xc200	a4781a429e1dd6769d8fcb0e6bbf7f86	False	0.4429768041237113	data	4.967175998304241	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x25000	0x1f20	0xc00	652a912811bc0d72e0c06afce264a2c3	False	0.16634114583333334	data	2.344185145643017	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x27000	0x14a0	0x1600	269f98767d4e10bd7f0694814a5a4559	False	0.45667613636363635	PEX Binary Archive	4.903861388939426	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
_RDATA	0x29000	0xfc	0x200	c24443e17523c001def60fbb9673bc9e	False	0.30859375	data	1.9968912851420892	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x2a000	0x1e0	0x200	0d7b54bda9ebee77bed1dbf8d90561e3	False	0.53125	data	4.7176788329467545	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x2b000	0x6dc	0x800	2ea5f13eea7586a1b187fa11ca9fd36a	False	0.54052734375	data	5.076358963025443	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x2a060	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL	Import
KERNEL32.dll	SetEvent, WriteConsoleW, GetProcAddress, LoadLibraryW, GetCurrentProcessId, GetLastError, ProcessIdToSessionId, CreateEventW, GetCurrentProcess, AllocConsole, GetConsoleWindow, CreateProcessW, GetProcessHeap, SetStdHandle, HeapAlloc, FreeConsole, CloseHandle, TerminateThread, CreateFileW, WaitForSingleObject, GetModuleFileNameW, TerminateProcess, HeapReAlloc, HeapSize, GetFileSizeEx, SetFilePointerEx, GetStringTypeW, SetEnvironmentVariableW, FreeEnvironmentStringsW, GetEnvironmentStringsW, MultiByteToWideChar, GetCPInfo, GetStdHandle, HeapFree, GetOEMCP, GetACP, IsValidCodePage, FindNextFileW, FindFirstFileExW, FindClose, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsProcessorFeaturePresent, QueryPerformanceCounter, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, GetStartupInfoW, GetModuleHandleW, RtlUnwindEx, RtlPcToFileHeader, RaiseException, SetLastError, EncodePointer, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, FreeLibrary, LoadLibraryExW, ExitProcess, GetModuleHandleExW, WriteFile, GetCommandLineA, GetCommandLineW, CompareStringW, LCMapStringW, GetFileType, FlushFileBuffers, GetConsoleOutputCP, GetConsoleMode, WideCharToMultiByte
ADVAPI32.dll	OpenProcessToken, RegOpenKeyExW, RegEnumKeyW, CopySid, GetLengthSid, DuplicateTokenEx, LookupAccountSidW, GetTokenInformation, LookupPrivilegeValueW, AdjustTokenPrivileges, RevertToSelf, PrivilegeCheck, SetTokenInformation, CreateProcessWithTokenW, ImpersonateLoggedOnUser, LogonUserW, RegCloseKey, CreateProcessAsUserW, RegGetValueW
ole32.dll	CreateObjrefMoniker, CoInitializeSecurity, CoGetInstanceFromIStorage, StgCreateDocfileOnILockBytes, CoTaskMemFree, CreateBindCtx, CoCreateInstance, CoUninitialize, CoInitialize, CLSIDFromString, CoTaskMemAlloc, CreateILockBytesOnHGlobal
CRYPT32.dll	CryptStringToBinaryW
RPCRT4.dll	RpcServerRegisterAuthInfoW, RpcServerUseProtseqEpW
Secur32.dll	InitSecurityInterfaceW, QuerySecurityContextToken, AcceptSecurityContext

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Target ID:	0
Start time:	13:34:48
Start date:	20/04/2024
Path:	C:\Users\user\Desktop\jp.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\jp.exe"
Imagebase:	0x7ff601380000
File size:	153'600 bytes
MD5 hash:	1938A3545517650824657FD09CE4EE16
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	13:34:48
Start date:	20/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	4.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	16.4%
Total number of Nodes:	1835
Total number of Limit Nodes:	17

Executed Functions

Function 00007FF601381B20 Relevance: 56.3, APIs: 18, Strings: 14, Instructions: 264
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitialize.OLE32 ref: 00007FF601381CD5
CoCreateInstance.OLE32 ref: 00007FF601381CF9
CoUninitialize.OLE32 ref: 00007FF601381DD4
GetLastError.KERNEL32 ref: 00007FF601381FF0

Strings

JuicyPotatoNG, xrefs: 00007FF601381C97
[-] The privileged process failed to communicate with our COM Server :( Try a different COM port in the -l flag. , xrefs: 00007FF601381ED9
[*] Windows Defender Firewall not enabled. Every COM port will work., xrefs: 00007FF601381D33
Wrong Argument: %S, xrefs: 00007FF601381FD4
JuicyPotatoNG, xrefs: 00007FF601381E69, 00007FF601381E84
[+] Exploit successful! , xrefs: 00007FF601381F2B
[-] Cannot capture a valid SYSTEM token, exiting... , xrefs: 00007FF601381F09
[-] Exploit failed! , xrefs: 00007FF601381F36
by decoder_it & splinter_code, xrefs: 00007FF601381CA3
System, xrefs: 00007FF601381D70
[+] Found non filtered port: %d , xrefs: 00007FF601381D93
[!] LogonUser failed with error code %d , xrefs: 00007FF601381FF8
[*] Testing CLSID %S - COM server port %S , xrefs: 00007FF601381DF8
[*] Finding suitable port not filtered by Windows Defender Firewall to be used in our local COM Server port., xrefs: 00007FF601381CC7

Memory Dump Source

Source File: 00000000.00000002.1970646581.00007FF601381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF601380000, based on PE: true

Associated: 00000000.00000002.1970630855.00007FF601380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1970668741.00007FF601398000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1970688114.00007FF6013A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1970710648.00007FF6013A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff601380000_jp.jbxd

Similarity

API ID: CreateErrorInitializeInstanceLastUninitialize
String ID: by decoder_it & splinter_code$ JuicyPotatoNG$JuicyPotatoNG$System$Wrong Argument: %S$[!] LogonUser failed with error code %d $[*] Finding suitable port not filtered by Windows Defender Firewall to be used in our local COM Server port.$[*] Testing CLSID %S - COM server port %S $[*] Windows Defender Firewall not enabled. Every COM port will work.$[+] Exploit successful! $[+] Found non filtered port: %d $[-] Cannot capture a valid SYSTEM token, exiting... $[-] Exploit failed! $[-] The privileged process failed to communicate with our COM Server :( Try a different COM port in the -l flag.
API String ID: 2713231385-3068781511
Opcode ID: 8623f890c42f5774dbe4108a2965b0c365eb254fb4121cadfa99a65d1e27bae9
Instruction ID: cfad11eec378aed627b9baacd2236e1ed664c58895e287b774e62c92d5758f74
Opcode Fuzzy Hash: 8623f890c42f5774dbe4108a2965b0c365eb254fb4121cadfa99a65d1e27bae9
Instruction Fuzzy Hash: 9CD15F76A08B428AEB58DF25E8552B933A1FF85B84F700132DA4DC36A5DF7CE54AC300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF60138D77C Relevance: 7.7, APIs: 5, Instructions: 202
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF60138D7BE
GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF60138D73B,?,?,?,00007FF60139413A), ref: 00007FF60138D87C
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF60138D73B,?,?,?,00007FF60139413A), ref: 00007FF60138D906

Memory Dump Source

Source File: 00000000.00000002.1970646581.00007FF601381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF601380000, based on PE: true

Associated: 00000000.00000002.1970630855.00007FF601380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1970668741.00007FF601398000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1970688114.00007FF6013A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1970710648.00007FF6013A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff601380000_jp.jbxd

Similarity

API ID: ConsoleErrorLastMode_invalid_parameter_noinfo
String ID:
API String ID: 2210144848-0
Opcode ID: 06bd3b9f3b53cefc93cbda7b6efa79f7bef2a22d73242619d6c2412d4d2ed7a8
Instruction ID: 98e81ae6bb0e3bb6df65dae2de0c401a22369ed6d8aa37c937c2663223c5bae7
Opcode Fuzzy Hash: 06bd3b9f3b53cefc93cbda7b6efa79f7bef2a22d73242619d6c2412d4d2ed7a8
Instruction Fuzzy Hash: 1881E122E187528AFB189FA598406BD67A1FB84B84F640135EE0ED3BD6DF7CE445C320

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF601383084 Relevance: 6.1, APIs: 4, Instructions: 94
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_initialize_crt.LIBCMT ref: 00007FF601383098

Part of subcall function 00007FF6013833F0: __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF601383412

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF6013830AD
__scrt_release_startup_lock.LIBCMT ref: 00007FF60138311B
__scrt_is_managed_app.LIBCMT ref: 00007FF601383192

Memory Dump Source

Source File: 00000000.00000002.1970646581.00007FF601381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF601380000, based on PE: true

Associated: 00000000.00000002.1970630855.00007FF601380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1970668741.00007FF601398000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1970688114.00007FF6013A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1970710648.00007FF6013A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff601380000_jp.jbxd

Similarity

API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_initialize_crt__scrt_is_managed_app__scrt_release_startup_lock
String ID:
API String ID: 1321466686-0
Opcode ID: d93d4fe4c3147f8dd75fb8b499ad6044582861b0e5602ca9cc7bd7aba8b86e09
Instruction ID: 8746ec01d5029fa552c935ab8a25f3941c0643c62520a754593cca60f80b2b5c
Opcode Fuzzy Hash: d93d4fe4c3147f8dd75fb8b499ad6044582861b0e5602ca9cc7bd7aba8b86e09
Instruction Fuzzy Hash: 0C310721A0C34283FB1CBB6594523BA62A1BF85F84F644439EA4EC73D3DEADE4058351

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF601381FC4 Relevance: 4.5, APIs: 1, Strings: 2, Instructions: 28
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32 ref: 00007FF601381FF0

Strings

Wrong Argument: %S, xrefs: 00007FF601381FD4
[!] LogonUser failed with error code %d , xrefs: 00007FF601381FF8

Memory Dump Source

Source File: 00000000.00000002.1970646581.00007FF601381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF601380000, based on PE: true

Associated: 00000000.00000002.1970630855.00007FF601380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1970668741.00007FF601398000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1970688114.00007FF6013A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1970710648.00007FF6013A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff601380000_jp.jbxd

Similarity

API ID: ErrorLast
String ID: Wrong Argument: %S$[!] LogonUser failed with error code %d
API String ID: 1452528299-21614459
Opcode ID: 2aa21fa98bf69ebc61caf7d39c19fd3e2e0c52c9a463352acd9cb6b77a162fe5
Instruction ID: 8b4e65aa0e753c0f5f307b49a55953f87fd7d2d882f06386fb26dc8f54d756c7
Opcode Fuzzy Hash: 2aa21fa98bf69ebc61caf7d39c19fd3e2e0c52c9a463352acd9cb6b77a162fe5
Instruction Fuzzy Hash: F1F03462E0C6820BE74C3B70486A0BA27519F92B29F340A35F27EC22D3CD9E64099350

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF601389E8C Relevance: 4.5, APIs: 3, Instructions: 19
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(?,?,?,00007FF601389E8B), ref: 00007FF601389EB5
TerminateProcess.KERNEL32(?,?,?,00007FF601389E8B), ref: 00007FF601389EC0
ExitProcess.KERNEL32 ref: 00007FF601389ECF

Memory Dump Source

Source File: 00000000.00000002.1970646581.00007FF601381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF601380000, based on PE: true

Associated: 00000000.00000002.1970630855.00007FF601380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1970668741.00007FF601398000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1970688114.00007FF6013A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1970710648.00007FF6013A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff601380000_jp.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 323592aa12851e5ac18051ca5554eaaed32e18d467f3b4d26a4a4014d45106ce
Instruction ID: d1a01cd396d06c233241ea144afdbc8e6030f77e6cb2732b6b2abe8ab3c5fb90
Opcode Fuzzy Hash: 323592aa12851e5ac18051ca5554eaaed32e18d467f3b4d26a4a4014d45106ce
Instruction Fuzzy Hash: 44E0B620B1870A83EB5C6B3598A537A2652EFC9B45F305878D84EC23A2DE7DF8488301

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF60138C470 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 19
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

try_get_function.LIBVCRUNTIME ref: 00007FF60138C493

Strings

AppPolicyGetProcessTerminationMethod, xrefs: 00007FF60138C479, 00007FF60138C48C

Memory Dump Source

Source File: 00000000.00000002.1970646581.00007FF601381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF601380000, based on PE: true

Associated: 00000000.00000002.1970630855.00007FF601380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1970668741.00007FF601398000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1970688114.00007FF6013A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1970710648.00007FF6013A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff601380000_jp.jbxd

Similarity

API ID: try_get_function
String ID: AppPolicyGetProcessTerminationMethod
API String ID: 2742660187-2031265017
Opcode ID: 920e7f13ba4e9001cf1f39833cb0f67c0cde2827661895c9c35d481b79d854d3
Instruction ID: 892fed821913533a32c0dbb420ffd862dec000bcae07d0e3c64650abdc073532
Opcode Fuzzy Hash: 920e7f13ba4e9001cf1f39833cb0f67c0cde2827661895c9c35d481b79d854d3
Instruction Fuzzy Hash: A1E04691E09A0A92FF0E4792A8601F02255EF49770E685372D93C8B3E0DE6CA9948340

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF60138D300 Relevance: 3.1, APIs: 2, Instructions: 74
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE ref: 00007FF60138D3B3
GetLastError.KERNEL32 ref: 00007FF60138D3CF

Memory Dump Source

Source File: 00000000.00000002.1970646581.00007FF601381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF601380000, based on PE: true

Associated: 00000000.00000002.1970630855.00007FF601380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1970668741.00007FF601398000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1970688114.00007FF6013A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1970710648.00007FF6013A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff601380000_jp.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID:
API String ID: 442123175-0
Opcode ID: 4a0a031187a5340eb5846340a3a1e11f3483513388330991c6c6d31e4ed8205c
Instruction ID: 6e5c777a626bc36dfa3ab6d918da3387bfa156e15ec3c12ce238be0ca76ebb17
Opcode Fuzzy Hash: 4a0a031187a5340eb5846340a3a1e11f3483513388330991c6c6d31e4ed8205c
Instruction Fuzzy Hash: 2531E472A19B819BDB149F25E4802E977A0FB58780F644432EB4EC3B55EFBCD555CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF60138CAB4 Relevance: 3.1, APIs: 2, Instructions: 73
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStdHandle.KERNEL32 ref: 00007FF60138CB2D
GetFileType.KERNELBASE ref: 00007FF60138CB43

Memory Dump Source

Source File: 00000000.00000002.1970646581.00007FF601381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF601380000, based on PE: true

Associated: 00000000.00000002.1970630855.00007FF601380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1970668741.00007FF601398000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1970688114.00007FF6013A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1970710648.00007FF6013A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff601380000_jp.jbxd

Similarity

API ID: FileHandleType
String ID:
API String ID: 3000768030-0
Opcode ID: 5bde3b8c39105ece3a600a50b8adc799804401ba0c9168840c2ac90ca72e6f2b
Instruction ID: 8dd6688ddf6fd32d3b86a172ba53bc4d23fa3f8e2639e157b8531df74b5f4436
Opcode Fuzzy Hash: 5bde3b8c39105ece3a600a50b8adc799804401ba0c9168840c2ac90ca72e6f2b
Instruction Fuzzy Hash: 7A318821A18F4682EB698B2595901B86650FB45BB0F782339DB6EC73E0DF78E461E350

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF60138D690 Relevance: 1.6, APIs: 1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1970646581.00007FF601381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF601380000, based on PE: true

Associated: 00000000.00000002.1970630855.00007FF601380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1970668741.00007FF601398000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1970688114.00007FF6013A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1970710648.00007FF6013A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff601380000_jp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 302d10155a5b37d2c781d5e53b402121bff655f63c53ec9a03da3f6f8573ca67
Instruction ID: 3790bc6ffef67cc26ccfac3d0d021b91cabefb848fc1e8220ddfefc4aeb9dbad
Opcode Fuzzy Hash: 302d10155a5b37d2c781d5e53b402121bff655f63c53ec9a03da3f6f8573ca67
Instruction Fuzzy Hash: BA216D62E1838647F70A6F65A88137D2650AF84BB0FB55635F91DC73D2DEBCE8418710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF601389DD0 Relevance: 1.6, APIs: 1, Instructions: 53COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF601389DEF

Part of subcall function 00007FF601389ED8: GetModuleHandleExW.KERNEL32 ref: 00007FF601389EF4
Part of subcall function 00007FF601389ED8: GetProcAddress.KERNEL32 ref: 00007FF601389F0A
Part of subcall function 00007FF601389ED8: FreeLibrary.KERNEL32 ref: 00007FF601389F27

Memory Dump Source

Source File: 00000000.00000002.1970646581.00007FF601381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF601380000, based on PE: true

Associated: 00000000.00000002.1970630855.00007FF601380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1970668741.00007FF601398000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1970688114.00007FF6013A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1970710648.00007FF6013A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff601380000_jp.jbxd

Similarity

API ID: HandleModule$AddressFreeLibraryProc
String ID:
API String ID: 3947729631-0
Opcode ID: 133c9d9f6119be43d44b1e3cba4acfd8d3e042a2e17dae3c1b50912ef4b6e89f
Instruction ID: c04c7c80e5630e0fef7bd6b7b4a596f515ac3db125891ea663359c938f5ce985
Opcode Fuzzy Hash: 133c9d9f6119be43d44b1e3cba4acfd8d3e042a2e17dae3c1b50912ef4b6e89f
Instruction Fuzzy Hash: 8A214C32A05B418EEB598F64C4843FC3BA0EB8870CF64553AD64D82AC5DF79E585CB80

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF601391090 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6013910BB

Memory Dump Source

Source File: 00000000.00000002.1970646581.00007FF601381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF601380000, based on PE: true

Associated: 00000000.00000002.1970630855.00007FF601380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1970668741.00007FF601398000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1970688114.00007FF6013A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1970710648.00007FF6013A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff601380000_jp.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 353f843d42cbf16aea8264e817aa79ed7a7f7c5f6c4975a9abdcb0a0aea5788a
Instruction ID: 81051625f159afbd949b108209514cddb8721393b1a97d4909070668eec5f073
Opcode Fuzzy Hash: 353f843d42cbf16aea8264e817aa79ed7a7f7c5f6c4975a9abdcb0a0aea5788a
Instruction Fuzzy Hash: 43119EB6A1874382F7189F15E46117AA3A4FB80750FB90535E65DE7B92DF7CE8118B00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF60138984C Relevance: 1.5, APIs: 1, Instructions: 38COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF60138987D

Memory Dump Source

Source File: 00000000.00000002.1970646581.00007FF601381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF601380000, based on PE: true

Associated: 00000000.00000002.1970630855.00007FF601380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1970668741.00007FF601398000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1970688114.00007FF6013A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1970710648.00007FF6013A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff601380000_jp.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 39d00d41c76ab373e85fd7b1f863c64934216b58732dd38827ee0c47210fdf71
Instruction ID: 6a590bd69c5959933a47996bb8bb814a8e35f3514499545f1af124b4b197ddca
Opcode Fuzzy Hash: 39d00d41c76ab373e85fd7b1f863c64934216b58732dd38827ee0c47210fdf71
Instruction Fuzzy Hash: C011C272A10F569DEB14CFA0E8811EC37B8FB1835CB601626EA4D92B59EF74C1A5C390

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF60138C1E0 Relevance: 1.5, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,?,00000000,00007FF60138E6DD,?,?,?,00007FF60138C1C9,?,?,?,?,00007FF601389877), ref: 00007FF60138C235

Memory Dump Source

Source File: 00000000.00000002.1970646581.00007FF601381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF601380000, based on PE: true

Associated: 00000000.00000002.1970630855.00007FF601380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1970668741.00007FF601398000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1970688114.00007FF6013A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1970710648.00007FF6013A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff601380000_jp.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 71e694d1dc55d9fed12203a0ccba9e2d87d9437edea17dc52dc7f6b62d93b18c
Instruction ID: 9745521d03489c58deff312c3b22077335fa60dad5682b71f9d88e6b396ac625
Opcode Fuzzy Hash: 71e694d1dc55d9fed12203a0ccba9e2d87d9437edea17dc52dc7f6b62d93b18c
Instruction Fuzzy Hash: F3F03A65B1930783FF5C9BEA99512F552916F89B80F7C6431CD0EC63D2EEACE5808234

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00007FF601382670 Relevance: 86.2, APIs: 32, Strings: 17, Instructions: 402memorylibraryencryptionCOMMON

Download Yara Rule

APIs

CoTaskMemAlloc.OLE32 ref: 00007FF6013826B2
CoTaskMemAlloc.OLE32 ref: 00007FF6013826C2
LoadLibraryW.KERNEL32 ref: 00007FF6013826FE
GetProcAddress.KERNEL32 ref: 00007FF60138270E
GetCurrentProcess.KERNEL32 ref: 00007FF601382717
CoInitialize.OLE32 ref: 00007FF601382779
CoInitializeSecurity.OLE32 ref: 00007FF6013827BE
CreateObjrefMoniker.OLE32 ref: 00007FF601382806
CreateBindCtx.OLE32 ref: 00007FF60138281B
CryptStringToBinaryW.CRYPT32 ref: 00007FF60138287E
RpcServerUseProtseqEpW.RPCRT4 ref: 00007FF6013828BF
RpcServerRegisterAuthInfoW.RPCRT4 ref: 00007FF6013828D8
CreateILockBytesOnHGlobal.OLE32 ref: 00007FF6013828F4
StgCreateDocfileOnILockBytes.OLE32 ref: 00007FF60138290C
CLSIDFromString.OLE32 ref: 00007FF60138295A
CoGetInstanceFromIStorage.OLE32 ref: 00007FF601382997
WaitForSingleObject.KERNEL32 ref: 00007FF6013829B1
CoTaskMemFree.OLE32 ref: 00007FF6013829DE
CoTaskMemFree.OLE32 ref: 00007FF6013829E7
CoUninitialize.OLE32 ref: 00007FF6013829ED
GetLastError.KERNEL32 ref: 00007FF601382A50

Strings

@, xrefs: 00007FF601382791
Delegation, xrefs: 00007FF601382C6E
[-] authresult failed %S;%S\%S;%S, xrefs: 00007FF601382D15
Identification, xrefs: 00007FF601382C80
NtQueryInformationProcess, xrefs: 00007FF601382707
SYSTEM, xrefs: 00007FF601382C90
ntdll.dll, xrefs: 00007FF6013826D0
[+] authresult success %S;%S\%S;%S, xrefs: 00007FF601382CBD
Impersonation, xrefs: 00007FF601382C77
?, xrefs: 00007FF601382C06
[!] CreateObjrefMoniker failed with HRESULT %d, xrefs: 00007FF601382A39
[!] RpcServerUseProtseqEp failed with rpc status code %d, xrefs: 00007FF601382A71
[!] CryptStringToBinaryW failed with error code %d, xrefs: 00007FF601382A58
[!] CLSID %S not found. Error Bad path to object. Exiting..., xrefs: 00007FF601382A20
?, xrefs: 00007FF601382BEF
Anonymous, xrefs: 00007FF601382C89
ncacn_ip_tcp, xrefs: 00007FF601382890

Memory Dump Source

Source File: 00000000.00000002.1970646581.00007FF601381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF601380000, based on PE: true

Associated: 00000000.00000002.1970630855.00007FF601380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1970668741.00007FF601398000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1970688114.00007FF6013A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1970710648.00007FF6013A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff601380000_jp.jbxd

Similarity

API ID: CreateTask$AllocBytesFreeFromInitializeLockServerString$AddressAuthBinaryBindCryptCurrentDocfileErrorGlobalInfoInstanceLastLibraryLoadMonikerObjectObjrefProcProcessProtseqRegisterSecuritySingleStorageUninitializeWait
String ID: ?$?$@$Anonymous$Delegation$Identification$Impersonation$NtQueryInformationProcess$SYSTEM$[!] CLSID %S not found. Error Bad path to object. Exiting...$[!] CreateObjrefMoniker failed with HRESULT %d$[!] CryptStringToBinaryW failed with error code %d$[!] RpcServerUseProtseqEp failed with rpc status code %d$[+] authresult success %S;%S\%S;%S$[-] authresult failed %S;%S\%S;%S$ncacn_ip_tcp$ntdll.dll
API String ID: 1070488198-2328110959
Opcode ID: cc7fb8e97b43def2173aa63e5b6f755fcd6a8ede11205693eb8deddf1c75a17f
Instruction ID: 0961c2f9db9803606884c5baa5e6f08ce99eb2f89796d39b3f5d438bd0bc0270
Opcode Fuzzy Hash: cc7fb8e97b43def2173aa63e5b6f755fcd6a8ede11205693eb8deddf1c75a17f
Instruction Fuzzy Hash: 4F127336A08B4686EB18CF65E8546AE77B0FB89B94F604135EE4D83B68DF7CD149C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF601381130 Relevance: 51.0, APIs: 25, Strings: 4, Instructions: 219memoryregistryprocessCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF601381191
HeapAlloc.KERNEL32 ref: 00007FF6013811A5
RegOpenKeyExW.ADVAPI32 ref: 00007FF6013811E6
RegEnumKeyW.ADVAPI32 ref: 00007FF601381202
RegGetValueW.ADVAPI32 ref: 00007FF601381250
RegCloseKey.ADVAPI32 ref: 00007FF6013812AE
GetStdHandle.KERNEL32 ref: 00007FF6013812CC
GetStdHandle.KERNEL32 ref: 00007FF6013812DA
GetConsoleWindow.KERNEL32 ref: 00007FF6013812E3
AllocConsole.KERNEL32 ref: 00007FF6013812EE
CreateFileW.KERNEL32 ref: 00007FF60138132D
SetStdHandle.KERNEL32 ref: 00007FF60138133E
SetStdHandle.KERNEL32 ref: 00007FF60138134C
GetModuleFileNameW.KERNEL32 ref: 00007FF6013813C5
CreateProcessW.KERNEL32 ref: 00007FF601381431
WaitForSingleObject.KERNEL32 ref: 00007FF601381441
TerminateThread.KERNEL32 ref: 00007FF601381458
TerminateProcess.KERNEL32 ref: 00007FF601381468
CloseHandle.KERNEL32 ref: 00007FF601381473
CloseHandle.KERNEL32 ref: 00007FF60138147E
SetStdHandle.KERNEL32 ref: 00007FF6013814C8
SetStdHandle.KERNEL32 ref: 00007FF6013814D6
FreeConsole.KERNEL32 ref: 00007FF6013814E6
GetProcessHeap.KERNEL32 ref: 00007FF6013814EC
HeapFree.KERNEL32 ref: 00007FF6013814FA

Strings

CLSID, xrefs: 00007FF6013811C0
CONOUT$, xrefs: 00007FF601381304
APPID, xrefs: 00007FF60138122A
[*] Bruteforcing %d CLSIDs... , xrefs: 00007FF6013812B7

Memory Dump Source

Source File: 00000000.00000002.1970646581.00007FF601381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF601380000, based on PE: true

Associated: 00000000.00000002.1970630855.00007FF601380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1970668741.00007FF601398000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1970688114.00007FF6013A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1970710648.00007FF6013A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff601380000_jp.jbxd

Similarity

API ID: Handle$HeapProcess$CloseConsole$AllocCreateFileFreeTerminate$EnumModuleNameObjectOpenSingleThreadValueWaitWindow
String ID: APPID$CLSID$CONOUT$$[*] Bruteforcing %d CLSIDs...
API String ID: 1374119132-3864066700
Opcode ID: 2566dd8f1384f2182b110ec117b80e7d2390633f8172438f9a36fc2d90d3a13d
Instruction ID: 3bada247ae88a45e623a22a5caba6acc4dcb910c7ed2fd6d374e5da604f2080f
Opcode Fuzzy Hash: 2566dd8f1384f2182b110ec117b80e7d2390633f8172438f9a36fc2d90d3a13d
Instruction Fuzzy Hash: AEB1B472A18B8686E714CF35E8542AA33A0FB89798F604335EA5D83BA8DF7CD145C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6013821C0 Relevance: 47.5, APIs: 18, Strings: 9, Instructions: 266memoryprocesssynchronizationCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF601382216
OpenProcessToken.ADVAPI32 ref: 00007FF601382229

Part of subcall function 00007FF601382090: LookupPrivilegeValueW.ADVAPI32 ref: 00007FF6013820AF
Part of subcall function 00007FF601382090: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00007FF601382240), ref: 00007FF6013820B9

Part of subcall function 00007FF601382090: AdjustTokenPrivileges.ADVAPI32 ref: 00007FF60138211E
Part of subcall function 00007FF601382090: GetLastError.KERNEL32 ref: 00007FF601382128

Part of subcall function 00007FF601382090: PrivilegeCheck.ADVAPI32 ref: 00007FF60138216F
Part of subcall function 00007FF601382090: GetLastError.KERNEL32 ref: 00007FF601382179

ImpersonateLoggedOnUser.ADVAPI32 ref: 00007FF601382288
CloseHandle.KERNEL32 ref: 00007FF601382297
GetProcessHeap.KERNEL32 ref: 00007FF6013822A6
HeapAlloc.KERNEL32 ref: 00007FF6013822BA
GetCurrentProcessId.KERNEL32 ref: 00007FF6013823E3
ProcessIdToSessionId.KERNEL32 ref: 00007FF6013823EF
SetTokenInformation.ADVAPI32 ref: 00007FF60138240A
CreateProcessAsUserW.ADVAPI32 ref: 00007FF601382451
GetLastError.KERNEL32 ref: 00007FF60138245F
CreateProcessWithTokenW.ADVAPI32 ref: 00007FF6013824F1
GetLastError.KERNEL32 ref: 00007FF6013824FB
WaitForSingleObject.KERNEL32 ref: 00007FF601382564
CloseHandle.KERNEL32 ref: 00007FF60138256F
CloseHandle.KERNEL32 ref: 00007FF60138257A
RevertToSelf.ADVAPI32 ref: 00007FF60138258A
HeapFree.KERNEL32 ref: 00007FF6013825A1

Strings

[*] Process output:, xrefs: 00007FF60138254E
[+] CreateProcessAsUser OK, xrefs: 00007FF60138253D
SeTcbPrivilege, xrefs: 00007FF601382275
SeImpersonatePrivilege, xrefs: 00007FF601382234, 00007FF60138224F
[!] Current process doesn't have SeImpersonate or SeAssignPrimaryToken privileges, exiting... , xrefs: 00007FF6013825E2
[+] CreateProcessWithTokenW OK, xrefs: 00007FF60138252F
[-] CreateProcessAsUser Failed to create proc: %d, xrefs: 00007FF601382467
[-] CreateProcessWithTokenW Failed to create proc: %d, xrefs: 00007FF601382503
SeAssignPrimaryTokenPrivilege, xrefs: 00007FF601382262, 00007FF601382516

Memory Dump Source

Source File: 00000000.00000002.1970646581.00007FF601381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF601380000, based on PE: true

Associated: 00000000.00000002.1970630855.00007FF601380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1970668741.00007FF601398000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1970688114.00007FF6013A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1970710648.00007FF6013A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff601380000_jp.jbxd

Similarity

API ID: Process$ErrorLast$Token$CloseHandleHeap$CreateCurrentPrivilegeUser$AdjustAllocCheckFreeImpersonateInformationLoggedLookupObjectOpenPrivilegesRevertSelfSessionSingleValueWaitWith
String ID: SeAssignPrimaryTokenPrivilege$SeImpersonatePrivilege$SeTcbPrivilege$[!] Current process doesn't have SeImpersonate or SeAssignPrimaryToken privileges, exiting... $[*] Process output:$[+] CreateProcessAsUser OK$[+] CreateProcessWithTokenW OK$[-] CreateProcessAsUser Failed to create proc: %d$[-] CreateProcessWithTokenW Failed to create proc: %d
API String ID: 515620200-4034436330
Opcode ID: 40e8886b10da4b8089e19aef245874f7363ead7714efd4b4c7fef4e519746e68
Instruction ID: b8eac94d68efd9527449cefd26fac1ad698db7c2eecf4750e830a36369402c43
Opcode Fuzzy Hash: 40e8886b10da4b8089e19aef245874f7363ead7714efd4b4c7fef4e519746e68
Instruction Fuzzy Hash: 6BC19072E18B8286EB489F61E8502BA73A0FF99784F644135DE4DD3669EF7CE585C300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF601392D8C Relevance: 24.0, APIs: 9, Strings: 4, Instructions: 1209COMMON

Download Yara Rule

APIs

fegetenv.LIBCMT ref: 00007FF601392DD1
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6013933D1
_invalid_parameter_noinfo.LIBCMT ref: 00007FF601393588
_invalid_parameter_noinfo.LIBCMT ref: 00007FF60139379C
_invalid_parameter_noinfo.LIBCMT ref: 00007FF601393A45
_invalid_parameter_noinfo.LIBCMT ref: 00007FF601393C42
memcpy_s.LIBCPMT ref: 00007FF601393D2D
memcpy_s.LIBCPMT ref: 00007FF601393DD8
memcpy_s.LIBCPMT ref: 00007FF601393E9E

Strings

1#SNAN, xrefs: 00007FF601393F50
1#IND, xrefs: 00007FF601393F44
1#QNAN, xrefs: 00007FF601393F5C
1#INF, xrefs: 00007FF601393F6F

Memory Dump Source

Source File: 00000000.00000002.1970646581.00007FF601381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF601380000, based on PE: true

Associated: 00000000.00000002.1970630855.00007FF601380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1970668741.00007FF601398000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1970688114.00007FF6013A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1970710648.00007FF6013A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff601380000_jp.jbxd

Similarity

API ID: _invalid_parameter_noinfo$memcpy_s$fegetenv
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 808467561-2761157908
Opcode ID: 2d070930f9244a49dda9650929d875ad854bb43130611f76e714999ac97ff3ae
Instruction ID: 2e5d675a98e49fb40312352a83dc3c851e46604f33236aec51c9d3337064d3ea
Opcode Fuzzy Hash: 2d070930f9244a49dda9650929d875ad854bb43130611f76e714999ac97ff3ae
Instruction Fuzzy Hash: CAB2C1B2E182928BE7698F78D4607FD77A1FB44788F605135DA0ED7A84DF38A905CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF601382090 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 70COMMON

Download Yara Rule

APIs

LookupPrivilegeValueW.ADVAPI32 ref: 00007FF6013820AF
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00007FF601382240), ref: 00007FF6013820B9
AdjustTokenPrivileges.ADVAPI32 ref: 00007FF60138211E
GetLastError.KERNEL32 ref: 00007FF601382128

Strings

AdjustTokenPrivileges() failed, error %u, xrefs: 00007FF601382130
PrivilegeCheck() failed, error %u, xrefs: 00007FF601382181
LookupPrivilegeValue() failed, error %u, xrefs: 00007FF6013820C1

Memory Dump Source

Source File: 00000000.00000002.1970646581.00007FF601381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF601380000, based on PE: true

Associated: 00000000.00000002.1970630855.00007FF601380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1970668741.00007FF601398000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1970688114.00007FF6013A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1970710648.00007FF6013A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff601380000_jp.jbxd

Similarity

API ID: ErrorLast$AdjustLookupPrivilegePrivilegesTokenValue
String ID: AdjustTokenPrivileges() failed, error %u$LookupPrivilegeValue() failed, error %u$PrivilegeCheck() failed, error %u
API String ID: 3530718616-622133527
Opcode ID: 1c010e990fd707af817244d41b762582d40b43fe0a61ec7152c7b9dad956403a
Instruction ID: c78ffb9f8abddc4b52761c53be3cf559e4fd63f6953c2a53cd5a5fd85edc5365
Opcode Fuzzy Hash: 1c010e990fd707af817244d41b762582d40b43fe0a61ec7152c7b9dad956403a
Instruction Fuzzy Hash: E631257260878297E7589F21F85126BB7A0FB84784F704435EA8EC2759DFBCD449CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF601383720 Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF60138373C
RtlCaptureContext.KERNEL32 ref: 00007FF601383769
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF601383783
RtlVirtualUnwind.KERNEL32 ref: 00007FF6013837C4
IsDebuggerPresent.KERNEL32 ref: 00007FF601383818
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF601383839
UnhandledExceptionFilter.KERNEL32 ref: 00007FF601383844

Memory Dump Source

Source File: 00000000.00000002.1970646581.00007FF601381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF601380000, based on PE: true

Associated: 00000000.00000002.1970630855.00007FF601380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1970668741.00007FF601398000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1970688114.00007FF6013A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1970710648.00007FF6013A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff601380000_jp.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 7a496e64cc19f582afdba0dbec828cc9c30aecf5bf0ce59aaf7a9c4e527c2c11
Instruction ID: ab2e82555c4960b11df7f9771f515a79cb82319b0bea41582196d0c0e91af187
Opcode Fuzzy Hash: 7a496e64cc19f582afdba0dbec828cc9c30aecf5bf0ce59aaf7a9c4e527c2c11
Instruction Fuzzy Hash: A4318472609B8186EB649F60E8503ED7364FB85748F54403ADA8DC7B94DF7CD548C710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF60138FAC0 Relevance: 9.3, APIs: 6, Instructions: 269COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF60138FB09

Memory Dump Source

Source File: 00000000.00000002.1970646581.00007FF601381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF601380000, based on PE: true

Associated: 00000000.00000002.1970630855.00007FF601380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1970668741.00007FF601398000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1970688114.00007FF6013A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1970710648.00007FF6013A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff601380000_jp.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 1ee37b5fb91d7eca71b44fe795b3e55fbb91e8be7abb16ef4c51e5f64ad71a75
Instruction ID: 77dafd659cb5865df3774c726ff3ad9f2b1dfcf09659f622df3b13dd66bc5143
Opcode Fuzzy Hash: 1ee37b5fb91d7eca71b44fe795b3e55fbb91e8be7abb16ef4c51e5f64ad71a75
Instruction Fuzzy Hash: 8AA1F862B1878642EF28DF2694102BA63A4FB84BD4F605536EE5DC7BC5DFBCE5458300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF60138BE8C Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF60138BF05
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF60138BF1D
RtlVirtualUnwind.KERNEL32 ref: 00007FF60138BF58
IsDebuggerPresent.KERNEL32 ref: 00007FF60138BF91
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF60138BF9B
UnhandledExceptionFilter.KERNEL32 ref: 00007FF60138BFA6

Memory Dump Source

Source File: 00000000.00000002.1970646581.00007FF601381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF601380000, based on PE: true

Associated: 00000000.00000002.1970630855.00007FF601380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1970668741.00007FF601398000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1970688114.00007FF6013A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1970710648.00007FF6013A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff601380000_jp.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 016805c7f9c284b35b6f7a8407c5926cd9f8f65b24be927f38edf8100e704f21
Instruction ID: 76da788948b735d7e10743618df5f6f6e0b0fce768828c768093937b6666c624
Opcode Fuzzy Hash: 016805c7f9c284b35b6f7a8407c5926cd9f8f65b24be927f38edf8100e704f21
Instruction Fuzzy Hash: E5317332608F8296DB64CF25E8502AE73A4FB85758F600135EA9D83B99DF7CD145CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF60138CE14 Relevance: 7.8, APIs: 5, Instructions: 328fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00007FF60138CE83
WriteFile.KERNEL32 ref: 00007FF60138D13A
WriteFile.KERNEL32 ref: 00007FF60138D18C
GetLastError.KERNEL32 ref: 00007FF60138D28E
GetLastError.KERNEL32 ref: 00007FF60138D2EE

Memory Dump Source

Source File: 00000000.00000002.1970646581.00007FF601381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF601380000, based on PE: true

Associated: 00000000.00000002.1970630855.00007FF601380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1970668741.00007FF601398000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1970688114.00007FF6013A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1970710648.00007FF6013A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff601380000_jp.jbxd

Similarity

API ID: ErrorFileLastWrite$ConsoleOutput
String ID:
API String ID: 1443284424-0
Opcode ID: e4383e1d85c52f3ec7148e1c92ce68f735ecf849bc4c7098577a73fe005e72e0
Instruction ID: c7343c5e061d4a5ddb7b26a46213993847a90ce639ad956aa45c3be8905443a9
Opcode Fuzzy Hash: e4383e1d85c52f3ec7148e1c92ce68f735ecf849bc4c7098577a73fe005e72e0
Instruction Fuzzy Hash: 04E1EE72B18B819AE708CFA4D4401AD7BB1FB85798F608136DE4ED7B99DE78D41AC700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF601392960 Relevance: 4.8, APIs: 3, Instructions: 317COMMON

Download Yara Rule

APIs

memcpy_s.LIBCPMT ref: 00007FF6013929C6
memcpy_s.LIBCPMT ref: 00007FF6013929F1

Memory Dump Source

Source File: 00000000.00000002.1970646581.00007FF601381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF601380000, based on PE: true

Associated: 00000000.00000002.1970630855.00007FF601380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1970668741.00007FF601398000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1970688114.00007FF6013A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1970710648.00007FF6013A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff601380000_jp.jbxd

Similarity

API ID: memcpy_s
String ID:
API String ID: 1502251526-0
Opcode ID: 61c8d48a73c74d7b2b5693099c23eccbf95a4682f3061de545b2f75f73c9d44c
Instruction ID: 44e9c409db51d06b4f24b6d985b519c56dd5e44c6185dd742dc5e63a200d2925
Opcode Fuzzy Hash: 61c8d48a73c74d7b2b5693099c23eccbf95a4682f3061de545b2f75f73c9d44c
Instruction Fuzzy Hash: 8BC1E372B18A8697EB28CF59E154A6BB791F798784F248135DB4A83744DF3CE801CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF60138E814 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 251COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF60138E878

Strings

gfffffff, xrefs: 00007FF60138EB29

Memory Dump Source

Source File: 00000000.00000002.1970646581.00007FF601381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF601380000, based on PE: true

Associated: 00000000.00000002.1970630855.00007FF601380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1970668741.00007FF601398000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1970688114.00007FF6013A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1970710648.00007FF6013A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff601380000_jp.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: gfffffff
API String ID: 3215553584-1523873471
Opcode ID: 9113f52f8b6c296da0ca0e0bebe2f9d1301076a3c183c9c2c472c132cc5a97a4
Instruction ID: ac7b25e182827a2e02601b3afb13e9c2b483219d3f628649d3cd3304d323f3c1
Opcode Fuzzy Hash: 9113f52f8b6c296da0ca0e0bebe2f9d1301076a3c183c9c2c472c132cc5a97a4
Instruction Fuzzy Hash: 62912463B093C687EB1ACB2994107B9AB95EB91BC4F298032CE5DC7785DEBDE501C701

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF60138F220 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 220COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF60138F256

Part of subcall function 00007FF60138C0C0: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF60138C09D), ref: 00007FF60138C0C9
Part of subcall function 00007FF60138C0C0: GetCurrentProcess.KERNEL32(?,?,?,?,00007FF60138C09D), ref: 00007FF60138C0EE

Strings

-, xrefs: 00007FF60138F448

Memory Dump Source

Source File: 00000000.00000002.1970646581.00007FF601381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF601380000, based on PE: true

Associated: 00000000.00000002.1970630855.00007FF601380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1970668741.00007FF601398000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1970688114.00007FF6013A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1970710648.00007FF6013A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff601380000_jp.jbxd

Similarity

API ID: CurrentFeaturePresentProcessProcessor_invalid_parameter_noinfo
String ID: -
API String ID: 4036615347-2547889144
Opcode ID: e06f06fbfd26bc8929f6ad922c49e22dca0861f240b40954d143c0ab0bb30415
Instruction ID: 3f1f8551d6833c3f6ffa9feee6b186658efe469171c5eae6ff6b32bfbe6f12a0
Opcode Fuzzy Hash: e06f06fbfd26bc8929f6ad922c49e22dca0861f240b40954d143c0ab0bb30415
Instruction Fuzzy Hash: 00910332A0878587EB78CF25950076AB795FB99BD0F644235EA9DC3B99DFBCD5008B00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6013965B8 Relevance: 3.2, APIs: 2, Instructions: 232COMMONLIBRARYCODE

Download Yara Rule

APIs

_clrfp.LIBCMT ref: 00007FF601396807
RaiseException.KERNEL32 ref: 00007FF601396818

Memory Dump Source

Source File: 00000000.00000002.1970646581.00007FF601381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF601380000, based on PE: true

Associated: 00000000.00000002.1970630855.00007FF601380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1970668741.00007FF601398000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1970688114.00007FF6013A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1970710648.00007FF6013A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff601380000_jp.jbxd

Similarity

API ID: ExceptionRaise_clrfp
String ID:
API String ID: 15204871-0
Opcode ID: 4f3d86407dd9789fcda393b78ce5ac7fd63888f80a1eb3623365494ce4a13953
Instruction ID: 0a811d4e8adb248091c5b2aac8cfcc0c5933df64d782124321c15afb82a0c3f7
Opcode Fuzzy Hash: 4f3d86407dd9789fcda393b78ce5ac7fd63888f80a1eb3623365494ce4a13953
Instruction Fuzzy Hash: F9B16EB7605B858BEB19CF29C85636C3BA0F784B58F248925DB5D877A4CF39D851C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6013885DC Relevance: 1.5, Strings: 1, Instructions: 209COMMON

Download Yara Rule

Strings

0, xrefs: 00007FF6013887AB

Memory Dump Source

Source File: 00000000.00000002.1970646581.00007FF601381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF601380000, based on PE: true

Associated: 00000000.00000002.1970630855.00007FF601380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1970668741.00007FF601398000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1970688114.00007FF6013A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1970710648.00007FF6013A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff601380000_jp.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: 0
API String ID: 3215553584-4108050209
Opcode ID: 2154855ced0343e2c7fd59c1889aee84958660fc752f0122978344f6df11f586
Instruction ID: 9b18817ace209e1900f69a7173ef9f2226f0a4aa47c179b5281acfd01af34ee7
Opcode Fuzzy Hash: 2154855ced0343e2c7fd59c1889aee84958660fc752f0122978344f6df11f586
Instruction Fuzzy Hash: EF71E525A1830343FBACAB1990006BA26A1EF40748FF45071EE4DD76D9CFBDE8538705

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF601388358 Relevance: 1.5, Strings: 1, Instructions: 206COMMON

Download Yara Rule

Strings

0, xrefs: 00007FF6013884F1

Memory Dump Source

Source File: 00000000.00000002.1970646581.00007FF601381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF601380000, based on PE: true

Associated: 00000000.00000002.1970630855.00007FF601380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1970668741.00007FF601398000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1970688114.00007FF6013A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1970710648.00007FF6013A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff601380000_jp.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: 0
API String ID: 3215553584-4108050209
Opcode ID: d9ddcf06a8dc7956618ca082febf4e567d619336a2977e1d90f614f9fb80cf84
Instruction ID: 578dbef85f7031439e85678a5217a5687bc191e18c697111898c801b74fd3b05
Opcode Fuzzy Hash: d9ddcf06a8dc7956618ca082febf4e567d619336a2977e1d90f614f9fb80cf84
Instruction Fuzzy Hash: CA71D312A0C74687FB6C8B2D90003BA6792AF41748FF405B9DD49E77DACEADE8478711

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF60138ADC4 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1970646581.00007FF601381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF601380000, based on PE: true

Associated: 00000000.00000002.1970630855.00007FF601380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1970668741.00007FF601398000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1970688114.00007FF6013A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1970710648.00007FF6013A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff601380000_jp.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: cb0247f97effa28143f1740f16645046826ae83636bc2f36bfa0056b57b7d8ac
Instruction ID: d7747ce5c883682646597454ab9106bccb22ed86511c6ae945006e39c4be1df8
Opcode Fuzzy Hash: cb0247f97effa28143f1740f16645046826ae83636bc2f36bfa0056b57b7d8ac
Instruction Fuzzy Hash: BA41F122714A5582EF08CF2AD9241AAB3A1FB48FD4B599037EE4DD7B98DF7CD0468340

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF601396400 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1970646581.00007FF601381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF601380000, based on PE: true

Associated: 00000000.00000002.1970630855.00007FF601380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1970668741.00007FF601398000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1970688114.00007FF6013A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1970710648.00007FF6013A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff601380000_jp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60d28e950f0d693c75d42953ea3d9e7bc6db12269998f177f14b0a4367596d0f
Instruction ID: c0e6b6a497db935263933165c0a989afec0b2a952f886fe89ccffd2525b340c9
Opcode Fuzzy Hash: 60d28e950f0d693c75d42953ea3d9e7bc6db12269998f177f14b0a4367596d0f
Instruction Fuzzy Hash: B2F068B27182958EDF988F2CE843A2A77D0E718380FA48039D68DC3B04DE7C90508F04

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6013838C8 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1970646581.00007FF601381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF601380000, based on PE: true

Associated: 00000000.00000002.1970630855.00007FF601380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1970668741.00007FF601398000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1970688114.00007FF6013A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1970710648.00007FF6013A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff601380000_jp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87c72dc06805ad1d356ef763087d2c59a490b139fd2c26088d0c368b4dcef39b
Instruction ID: b992590c33cf972115c76b091884c335e11de5f5126e94ff4a51e76d7310edf6
Opcode Fuzzy Hash: 87c72dc06805ad1d356ef763087d2c59a490b139fd2c26088d0c368b4dcef39b
Instruction Fuzzy Hash: C4A00226A5CD46E1E70C8B00E8600312770FB91700B7004B1C05DC25609F7CE444C300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF601384E08 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 312COMMONLIBRARYCODE

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00007FF601384E64

Part of subcall function 00007FF601385CBC: _GetEstablisherFrame.LIBVCRUNTIME ref: 00007FF601385CF1
Part of subcall function 00007FF601385CBC: __GetUnwindTryBlock.LIBCMT ref: 00007FF601385CFF
Part of subcall function 00007FF601385CBC: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00007FF601385D24

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF601384F3C
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00007FF601385182
_GetEstablisherFrame.LIBVCRUNTIME ref: 00007FF6013851D4
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF60138528E

Strings

csm, xrefs: 00007FF601384F5F
csm, xrefs: 00007FF601384EE5
csm, xrefs: 00007FF601384E7E

Memory Dump Source

Source File: 00000000.00000002.1970646581.00007FF601381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF601380000, based on PE: true

Associated: 00000000.00000002.1970630855.00007FF601380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1970668741.00007FF601398000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1970688114.00007FF6013A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1970710648.00007FF6013A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff601380000_jp.jbxd

Similarity

API ID: Frame$BlockEstablisherHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 3606184308-393685449
Opcode ID: c222d5eb7d5ad78cc2310b0e2f3ea1a59d9ef57525a57029e21c0cd443b46712
Instruction ID: a51bea0833b55b3d89f5362574f0c5fb7e9cf66e7e458054a2c86f1e64f54163
Opcode Fuzzy Hash: c222d5eb7d5ad78cc2310b0e2f3ea1a59d9ef57525a57029e21c0cd443b46712
Instruction Fuzzy Hash: C0D1A132A087428BEB289F65E4403AD7BA0FB45798F200135EE4DD7B9ADF78E595C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF601385FD8 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 86libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,00007FF601386286,?,?,?,00007FF601385F84,?,?,?,?,00007FF6013845DD), ref: 00007FF60138605B
GetLastError.KERNEL32(?,?,?,00007FF601386286,?,?,?,00007FF601385F84,?,?,?,?,00007FF6013845DD), ref: 00007FF601386069
LoadLibraryExW.KERNEL32(?,?,?,00007FF601386286,?,?,?,00007FF601385F84,?,?,?,?,00007FF6013845DD), ref: 00007FF601386093
FreeLibrary.KERNEL32(?,?,?,00007FF601386286,?,?,?,00007FF601385F84,?,?,?,?,00007FF6013845DD), ref: 00007FF6013860D9
GetProcAddress.KERNEL32(?,?,?,00007FF601386286,?,?,?,00007FF601385F84,?,?,?,?,00007FF6013845DD), ref: 00007FF6013860E5

Strings

api-ms-, xrefs: 00007FF60138607B

Memory Dump Source

Source File: 00000000.00000002.1970646581.00007FF601381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF601380000, based on PE: true

Associated: 00000000.00000002.1970630855.00007FF601380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1970668741.00007FF601398000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1970688114.00007FF6013A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1970710648.00007FF6013A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff601380000_jp.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 6248718b182fb735672f6f1c14d4396476f09d08c01a1ff2e1023132875d6909
Instruction ID: 729dd4ae1143b9166a2fa58b4b9f330530d9109dca10bc058add69fcc719f088
Opcode Fuzzy Hash: 6248718b182fb735672f6f1c14d4396476f09d08c01a1ff2e1023132875d6909
Instruction Fuzzy Hash: 1B31C6A1B0EB4292EF19DB02A81157523A4FF44BA4F394635DD1DCB391DF7DE4468304

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6013951A0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00007FF6013951D1
GetLastError.KERNEL32 ref: 00007FF6013951DD
CloseHandle.KERNEL32 ref: 00007FF6013951F5
CreateFileW.KERNEL32 ref: 00007FF601395220
WriteConsoleW.KERNEL32 ref: 00007FF60139523F

Strings

CONOUT$, xrefs: 00007FF601395201

Memory Dump Source

Source File: 00000000.00000002.1970646581.00007FF601381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF601380000, based on PE: true

Associated: 00000000.00000002.1970630855.00007FF601380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1970668741.00007FF601398000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1970688114.00007FF6013A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1970710648.00007FF6013A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff601380000_jp.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: 0c8d402cb0fc983fce876c4bd52032b6e5a711ef767058fd45171144aa971e07
Instruction ID: a675a6dc3096d0c3174f983607658e599c291a6201d1cf69ebb175d9966d4a2f
Opcode Fuzzy Hash: 0c8d402cb0fc983fce876c4bd52032b6e5a711ef767058fd45171144aa971e07
Instruction Fuzzy Hash: 5311B232B18B4182F7588B56E86532973A0FB89FE4F640234EA5EC7BA4DF3CD4548740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF601385628 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 162COMMONLIBRARYCODE

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF601385650
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00007FF601385738
__std_exception_copy.LIBVCRUNTIME ref: 00007FF601385884

Strings

csm, xrefs: 00007FF601385672
csm, xrefs: 00007FF60138578A

Memory Dump Source

Source File: 00000000.00000002.1970646581.00007FF601381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF601380000, based on PE: true

Associated: 00000000.00000002.1970630855.00007FF601380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1970668741.00007FF601398000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1970688114.00007FF6013A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1970710648.00007FF6013A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff601380000_jp.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record__std_exception_copy
String ID: csm$csm
API String ID: 851805269-3733052814
Opcode ID: a0353fa51b9b3bfcb4650b69ce46101569b788fc43b9615068fc1c8f38ee74c2
Instruction ID: 76e859ef446aa711911735cb13666cbef6ec77e1d5ef0fb2bd5a6bd1e0699da2
Opcode Fuzzy Hash: a0353fa51b9b3bfcb4650b69ce46101569b788fc43b9615068fc1c8f38ee74c2
Instruction Fuzzy Hash: 44618432A18742C7EB288F21D4543697790FB54B94F649136DA9DC7B95CFBCE451C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF601389ED8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 24libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF601389EF4
GetProcAddress.KERNEL32 ref: 00007FF601389F0A
FreeLibrary.KERNEL32 ref: 00007FF601389F27

Strings

mscoree.dll, xrefs: 00007FF601389EEB
CorExitProcess, xrefs: 00007FF601389F03

Memory Dump Source

Source File: 00000000.00000002.1970646581.00007FF601381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF601380000, based on PE: true

Associated: 00000000.00000002.1970630855.00007FF601380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1970668741.00007FF601398000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1970688114.00007FF6013A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1970710648.00007FF6013A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff601380000_jp.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: eb8e71c68aa0309a8f03d19f4ca3d157c42346ccdbc656e49594ebda2ddadee0
Instruction ID: b8276f3a3c353430c1b51130c08782b31d8385039a80aca4e35d8613717b0dcd
Opcode Fuzzy Hash: eb8e71c68aa0309a8f03d19f4ca3d157c42346ccdbc656e49594ebda2ddadee0
Instruction Fuzzy Hash: 03F05861B19B4682EB4C8B61E8A43792360EFC8B49F641079E44FC66A4CF7CE488C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF601396200 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF601396228
_set_statfp.LIBCMT ref: 00007FF601396243
_set_statfp.LIBCMT ref: 00007FF60139625F
_set_statfp.LIBCMT ref: 00007FF60139629B

Memory Dump Source

Source File: 00000000.00000002.1970646581.00007FF601381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF601380000, based on PE: true

Associated: 00000000.00000002.1970630855.00007FF601380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1970668741.00007FF601398000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1970688114.00007FF6013A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1970710648.00007FF6013A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff601380000_jp.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: bce21d2362216a5e504affcf34f2858e363de54600403cac3d1eeb36cb2ab404
Instruction ID: 3a9a76ebf5fcf087f2b9742710b47f6bee4ad8936009e8538336d91a6caee09c
Opcode Fuzzy Hash: bce21d2362216a5e504affcf34f2858e363de54600403cac3d1eeb36cb2ab404
Instruction Fuzzy Hash: 4B1186E2E1EA0341F79C1368E9773751040EF557B1F381A79EBEECA2D68E5CA8414205

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6013852D0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FF60138531C
_CallSETranslator.LIBVCRUNTIME ref: 00007FF60138536B

Strings

MOC, xrefs: 00007FF601385330
RCC, xrefs: 00007FF601385339

Memory Dump Source

Source File: 00000000.00000002.1970646581.00007FF601381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF601380000, based on PE: true

Associated: 00000000.00000002.1970630855.00007FF601380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1970668741.00007FF601398000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1970688114.00007FF6013A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1970710648.00007FF6013A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff601380000_jp.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: f377a43d4aacb8187967a8d91e14db74d4b784d72bf3f5b6e9284500e3677208
Instruction ID: 5b2761d595379990c7944e25c1e9c9ad6e9c5fa7a2536e5acef1107e19178f70
Opcode Fuzzy Hash: f377a43d4aacb8187967a8d91e14db74d4b784d72bf3f5b6e9284500e3677208
Instruction Fuzzy Hash: 82516C73A08B858AEB28CF65D0403AD77A0F744B88F244125EF4D97B59DFB8E445C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF601387AC0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 149COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF601387AED
_invalid_parameter_noinfo.LIBCMT ref: 00007FF601387B20

Strings

, xrefs: 00007FF601387C6E

Memory Dump Source

Source File: 00000000.00000002.1970646581.00007FF601381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF601380000, based on PE: true

Associated: 00000000.00000002.1970630855.00007FF601380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1970668741.00007FF601398000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1970688114.00007FF6013A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1970710648.00007FF6013A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff601380000_jp.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-3916222277
Opcode ID: d5e711334f13a56f3bce066493cfc39ac13ce7c1a45b643f735f1bc8ce95b9c0
Instruction ID: eb3ab5aa5901c1a897fb47732824b42d89dac073d7fe065f1a24c53ab9ae772a
Opcode Fuzzy Hash: d5e711334f13a56f3bce066493cfc39ac13ce7c1a45b643f735f1bc8ce95b9c0
Instruction Fuzzy Hash: 1B615B729187028BEBAC8F28809537C37B7EB05B59F342135DA4AC72D9CFA8E585D601

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF60138EC84 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 134COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF60138ECC7

Strings

gfff, xrefs: 00007FF60138EDE9
e+000, xrefs: 00007FF60138ED6C

Memory Dump Source

Source File: 00000000.00000002.1970646581.00007FF601381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF601380000, based on PE: true

Associated: 00000000.00000002.1970630855.00007FF601380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1970668741.00007FF601398000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1970688114.00007FF6013A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1970710648.00007FF6013A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff601380000_jp.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: e+000$gfff
API String ID: 3215553584-3030954782
Opcode ID: 55ca19833a6fd6218bb938f6e641c575bda540d0017eb9575132e8505d627e63
Instruction ID: 8abc33b800b8a0c9915e52a775f1ebde20e42e457a58677dea6724edbcf85441
Opcode Fuzzy Hash: 55ca19833a6fd6218bb938f6e641c575bda540d0017eb9575132e8505d627e63
Instruction Fuzzy Hash: 0D511962B187C28BE7688F39D8413697B91E781B90F589231D79CC7BD6CE6CE444C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6013902EC Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 124COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32 ref: 00007FF60139032E

Strings

, xrefs: 00007FF60139048D
, xrefs: 00007FF601390371

Memory Dump Source

Source File: 00000000.00000002.1970646581.00007FF601381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF601380000, based on PE: true

Associated: 00000000.00000002.1970630855.00007FF601380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1970668741.00007FF601398000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1970688114.00007FF6013A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1970710648.00007FF6013A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff601380000_jp.jbxd

Similarity

API ID: Info
String ID: $
API String ID: 1807457897-227171996
Opcode ID: 851294b9fab3b5bd46c816aba98e4e7b2e7255f1dd443f51c24bfdf84b05199a
Instruction ID: ccef35846627e1022dc4424443f9f42bef878bd3ed84986cc0b624db109078f7
Opcode Fuzzy Hash: 851294b9fab3b5bd46c816aba98e4e7b2e7255f1dd443f51c24bfdf84b05199a
Instruction Fuzzy Hash: 45519332A1C6C18AE769CF24D0943AE7BA4F745B48F644136EA8D87A89CF7CD545CB80

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF60138A5E0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF60138A612

Part of subcall function 00007FF60138C258: HeapFree.KERNEL32(?,?,?,00007FF60139148C,?,?,?,00007FF6013914CF,?,?,?,00007FF6013919C8,?,?,?,00007FF6013918FB), ref: 00007FF60138C26E
Part of subcall function 00007FF60138C258: GetLastError.KERNEL32(?,?,?,00007FF60139148C,?,?,?,00007FF6013914CF,?,?,?,00007FF6013919C8,?,?,?,00007FF6013918FB), ref: 00007FF60138C280

GetModuleFileNameW.KERNEL32(?,?,?,?,?,00007FF601382FF5), ref: 00007FF60138A630

Strings

C:\Users\user\Desktop\jp.exe, xrefs: 00007FF60138A61E

Memory Dump Source

Source File: 00000000.00000002.1970646581.00007FF601381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF601380000, based on PE: true

Associated: 00000000.00000002.1970630855.00007FF601380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1970668741.00007FF601398000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1970688114.00007FF6013A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1970710648.00007FF6013A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff601380000_jp.jbxd

Similarity

API ID: ErrorFileFreeHeapLastModuleName_invalid_parameter_noinfo
String ID: C:\Users\user\Desktop\jp.exe
API String ID: 3580290477-398078364
Opcode ID: 6ecc3baf7dcdd53eebd94849cac9422497cdacd348962e1bdd54d312288b466c
Instruction ID: 093aa9d0e8669ad0d4556ba73638dc42b54abc8b0e9fde09fcd6c606a1ffa568
Opcode Fuzzy Hash: 6ecc3baf7dcdd53eebd94849cac9422497cdacd348962e1bdd54d312288b466c
Instruction Fuzzy Hash: 7C418276A08B1287EB5CEF6198410BD37A4EF85BD4B745036E94EC3B85DEBCE4818340

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF60138D520 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00007FF60138D637
GetLastError.KERNEL32 ref: 00007FF60138D659

Strings

U, xrefs: 00007FF60138D5E3

Memory Dump Source

Source File: 00000000.00000002.1970646581.00007FF601381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF601380000, based on PE: true

Associated: 00000000.00000002.1970630855.00007FF601380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1970668741.00007FF601398000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1970688114.00007FF6013A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1970710648.00007FF6013A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff601380000_jp.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: e60cb4c14ddf63d2c3d71138226656ebadd48b39d4aa2c8d261ab259d099c3f7
Instruction ID: ffaaa323d12383f42b22fe3be23443e7ee0cae23cff90f46e687fb0feccaf234
Opcode Fuzzy Hash: e60cb4c14ddf63d2c3d71138226656ebadd48b39d4aa2c8d261ab259d099c3f7
Instruction Fuzzy Hash: 4241B062A18B4582DB24CF65E4443AA67A0FB98794FA04032EE4DC7798EF7CD441C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF60138C72C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00007FF60138C765
LCMapStringW.KERNEL32 ref: 00007FF60138C7ED

Strings

LCMapStringEx, xrefs: 00007FF60138C748, 00007FF60138C759

Memory Dump Source

Source File: 00000000.00000002.1970646581.00007FF601381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF601380000, based on PE: true

Associated: 00000000.00000002.1970630855.00007FF601380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1970668741.00007FF601398000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1970688114.00007FF6013A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1970710648.00007FF6013A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff601380000_jp.jbxd

Similarity

API ID: Stringtry_get_function
String ID: LCMapStringEx
API String ID: 2588686239-3893581201
Opcode ID: 6b8871f541bf05813f0f77d86235b8ecd3febe95c4eda710b5ade56597c0c338
Instruction ID: a81aafb02aaf88435c212c3be9670b75f65f52f1d9167f6c3804e937190303c9
Opcode Fuzzy Hash: 6b8871f541bf05813f0f77d86235b8ecd3febe95c4eda710b5ade56597c0c338
Instruction Fuzzy Hash: C2111A36A0CB8186D764CB56F4902AAB7A4FBC9B80F644136EECD83B59DF3CD5448B00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF60138C4C0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00007FF60138C4F9
CompareStringW.KERNEL32 ref: 00007FF60138C581

Strings

CompareStringEx, xrefs: 00007FF60138C4DC, 00007FF60138C4ED

Memory Dump Source

Source File: 00000000.00000002.1970646581.00007FF601381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF601380000, based on PE: true

Associated: 00000000.00000002.1970630855.00007FF601380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1970668741.00007FF601398000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1970688114.00007FF6013A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1970710648.00007FF6013A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff601380000_jp.jbxd

Similarity

API ID: CompareStringtry_get_function
String ID: CompareStringEx
API String ID: 3328479835-2590796910
Opcode ID: 2f9ee97b485376b236bd900e4d9173567bd49cd48387b0961c440226c6f46f60
Instruction ID: b38e1ad021c328ecd2d09c1863bfda34aaf2948df2a2ceee884cde1732e03d2b
Opcode Fuzzy Hash: 2f9ee97b485376b236bd900e4d9173567bd49cd48387b0961c440226c6f46f60
Instruction Fuzzy Hash: D2112E36A0CB8186D764CB56F4502AAB7A4FBC9B90F644136EECD83B59CF3CD4448B40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF601384534 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF601383397), ref: 00007FF601384578
RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF601383397), ref: 00007FF6013845BE

Strings

csm, xrefs: 00007FF6013845AB

Memory Dump Source

Source File: 00000000.00000002.1970646581.00007FF601381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF601380000, based on PE: true

Associated: 00000000.00000002.1970630855.00007FF601380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1970668741.00007FF601398000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1970688114.00007FF6013A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1970710648.00007FF6013A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff601380000_jp.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: c765308a0d805787d404dd0d0eabdd8135d35f791424f6d293b35c1aee34c8e4
Instruction ID: 930606aec2aff90440410145261cd3d3089d7cc03d00d0b79fe0efd9ad775afe
Opcode Fuzzy Hash: c765308a0d805787d404dd0d0eabdd8135d35f791424f6d293b35c1aee34c8e4
Instruction Fuzzy Hash: 4E113D32A08B4582EB148F15F54026D7BA0FB88B94F284271DF8D87B64DF7CD551C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF60138C6C8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 25COMMON

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00007FF60138C6F9
InitializeCriticalSectionAndSpinCount.KERNEL32(?,?,00000003,00007FF601386B29), ref: 00007FF60138C713

Strings

InitializeCriticalSectionEx, xrefs: 00007FF60138C6ED

Memory Dump Source

Source File: 00000000.00000002.1970646581.00007FF601381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF601380000, based on PE: true

Associated: 00000000.00000002.1970630855.00007FF601380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1970668741.00007FF601398000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1970688114.00007FF6013A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1970710648.00007FF6013A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff601380000_jp.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpintry_get_function
String ID: InitializeCriticalSectionEx
API String ID: 539475747-3084827643
Opcode ID: e5c157d1541df5f71df01b68207be9144324416f0c20e490a60ec8cf403c77c9
Instruction ID: e816c5b9d93dfe5a0413bcb58c5add14cf9163daf38a7ef7cfa3e092498d8550
Opcode Fuzzy Hash: e5c157d1541df5f71df01b68207be9144324416f0c20e490a60ec8cf403c77c9
Instruction Fuzzy Hash: 49F0BE25A08B51C2FB089B51F0500A92320EF88BC0F685276EA4D83B54CF7CE9858300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF60138C674 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMONLIBRARYCODE

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00007FF60138C69D
TlsSetValue.KERNEL32(?,?,?,00007FF60138E6CA,?,?,?,00007FF60138C1C9,?,?,?,?,00007FF601389877), ref: 00007FF60138C6B4

Strings

FlsSetValue, xrefs: 00007FF60138C68A

Memory Dump Source

Source File: 00000000.00000002.1970646581.00007FF601381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF601380000, based on PE: true

Associated: 00000000.00000002.1970630855.00007FF601380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1970668741.00007FF601398000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1970688114.00007FF6013A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1970710648.00007FF6013A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff601380000_jp.jbxd

Similarity

API ID: Valuetry_get_function
String ID: FlsSetValue
API String ID: 738293619-3750699315
Opcode ID: 79fb1157ef4b4d7799115a42e867b27a2c81edb4728978485350c9684c16d774
Instruction ID: ddb0274e31393370c4a410c823efa32c0ce951a5e388d11c14dee51448045e92
Opcode Fuzzy Hash: 79fb1157ef4b4d7799115a42e867b27a2c81edb4728978485350c9684c16d774
Instruction Fuzzy Hash: 69E06D61A0C74282EB0C5B55F4504F93322FF88784F686276D95DC62A5CE3CE849C710

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report jp.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

System Summary

Data Obfuscation

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

\Device\ConDrv

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Statistics

CPU Usage

Memory Usage

Behavior

System Behavior

Analysis Process: jp.exePID: 4984, Parent PID: 1028

General

Chronological Activities

Analysis Process: conhost.exePID: 5160, Parent PID: 4984

General

Chronological Activities

Disassembly

Analysis Process: jp.exePID: 4984, Parent PID: 1028COMMON

Windows Analysis Report
jp.exe

Function 00007FF601381B20 Relevance: 56.3, APIs: 18, Strings: 14, Instructions: 264
comCOMMON

Function 00007FF60138D77C Relevance: 7.7, APIs: 5, Instructions: 202
COMMON

Function 00007FF601383084 Relevance: 6.1, APIs: 4, Instructions: 94
COMMON

Function 00007FF601381FC4 Relevance: 4.5, APIs: 1, Strings: 2, Instructions: 28
COMMON

Function 00007FF601389E8C Relevance: 4.5, APIs: 3, Instructions: 19
COMMON

Function 00007FF60138C470 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 19
COMMON

Function 00007FF60138D300 Relevance: 3.1, APIs: 2, Instructions: 74
fileCOMMON

Function 00007FF60138CAB4 Relevance: 3.1, APIs: 2, Instructions: 73
COMMON