Windows Analysis Report
SecuriteInfo.com.suspected.of.Win32.PhishingPE.Heur.10337.17085.exe

Overview

General Information

Sample name: SecuriteInfo.com.suspected.of.Win32.PhishingPE.Heur.10337.17085.exe
Analysis ID: 1430577
MD5: a3bd864b819f0dc53482b5e06ffef509
SHA1: 9a2594c8af8a053d698c1d96bf828286846cc066
SHA256: a7b222438781b93d33725b049c45112df2f76e267af62406098613e635dc3c31
Tags: exe
Infos:

Detection

Score: 6
Range: 0 - 100
Whitelisted: false
Confidence: 20%

Compliance

Score: 47
Range: 0 - 100

Signatures

Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to dynamically determine API calls
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query CPU information (cpuid)
Contains functionality to query locales information (e.g. system language)
Contains functionality to retrieve information about pressed keystrokes
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Detected potential crypto function
Drops PE files
Found dropped PE file which has not been started or loaded
Found potential string decryption / allocating functions
PE file does not import any functions
Queries the volume information (name, serial number etc) of a device
Stores files to the Windows start menu directory
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)

Classification

Compliance
barindex
Uses 32bit PE files
Source: SecuriteInfo.com.suspected.of.Win32.PhishingPE.Heur.10337.17085.exe Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe File created: C:\Program Files (x86)\ZOC5\license.txt Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe File created: C:\Program Files (x86)\ZOC5\Readme.txt Jump to behavior
Source: SecuriteInfo.com.suspected.of.Win32.PhishingPE.Heur.10337.17085.exe Static PE information: certificate valid
Source: Binary string: X:\zoc\v5\showem\showem.pdb source: showem.dll.2.dr
Source: Binary string: X:\zoc\v5\devmodem\devmodem.pdb source: devmodem.dll.2.dr
Source: Binary string: X:\zoc\v5\devssh\sshdll\sshdll.pdb source: sshdll.dll.2.dr
Source: Binary string: X:\zoc\v5\devtlnet\devtlnet.pdb source: devtlnet.dll.2.dr
Source: Binary string: X:\zoc\v5\devrcmd\devrcmd.pdb source: devrcmd.dll.2.dr
Source: Binary string: w:\setup\sfxmake\Release\sfxmakeheader.pdb source: SecuriteInfo.com.suspected.of.Win32.PhishingPE.Heur.10337.17085.exe
Source: Binary string: X:\zoc\v5\devisdn2\devisdn2.pdb source: devisdn2.dll.2.dr
Source: Binary string: X:\zoc\v5\emuqnx\emuqnx.pdb source: emuqnx.dll.2.dr
Source: Binary string: X:\ZOC\V5\zocdll.pdb source: setup.exe, 00000002.00000002.3263855967.000000000048D000.00000004.00000001.01000000.00000006.sdmp, zocdll.dll.2.dr
Source: Binary string: X:\ZOC\V5\zocdll.pdb3 source: setup.exe, 00000002.00000002.3263855967.000000000048D000.00000004.00000001.01000000.00000006.sdmp
Source: Binary string: X:\zoc\v5\devnpipe\devnpipe.pdb source: devnpipe.dll.2.dr
Source: Binary string: X:\ZOC\V5\phimport\phimport.pdb source: phimport.dll.2.dr
Source: Binary string: X:\zoc\v5\emuansi\emuansi.pdb source: emuansi.dll.2.dr
Source: Binary string: X:\zoc\v5\emuvt\emuvt.pdb source: emuvt.dll.2.dr
Source: Binary string: X:\zoc\v5\xfrsealink\xfrsealink.pdb source: xfrsealink.dll.2.dr
Source: Binary string: w:\setup\release\setup.pdb source: setup.exe
Source: Binary string: X:\zoc\v5\emu5250\emu5250.pdb source: emu5250.dll.2.dr
Source: Binary string: X:\zoc\v5\emu3270\emu3270.pdb source: emu3270.dll.2.dr
Source: Binary string: X:\zoc\v5\xfrxyz\xfrxyz.pdb source: xfrxyz.dll.2.dr
Source: Binary string: X:\zoc\v5\xfrkerm\xfrkerm.pdb source: xfrkerm.dll.2.dr
Source: Binary string: X:\zoc\v5\emutty\emutty.pdb source: emutty.dll.2.dr
Source: Binary string: X:\zoc\v5\devssh\devssh.pdb source: devssh.dll.2.dr
Source: Binary string: X:\zoc\v5\osys\osyswin.pdb source: osyswin.dll.2.dr
Source: Binary string: X:\zoc\v5\emuwyse\emuwyse.pdb source: emuwyse.dll.2.dr
Source: Binary string: w:\setup\Release\order.pdb source: order.exe.2.dr
Source: Binary string: X:\zoc\v5\devtapi\devtapi.pdb source: devtapi.dll.2.dr
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Code function: 2_2_004381D7 __getdrive,FindFirstFileA,_strlen,_IsRootUNCName,GetDriveTypeA,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FindClose,___dtoxmode,GetLastError,__dosmaperr,FindClose, 2_2_004381D7
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Code function: 2_2_004311A5 _malloc,_strlen,_malloc,_strcat,FindFirstFileA,_strcat, 2_2_004311A5
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Code function: 2_2_00436D80 __getdrive,FindFirstFileA,_strlen,_IsRootUNCName,GetDriveTypeA,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FindClose,___dtoxmode,GetLastError,__dosmaperr,FindClose, 2_2_00436D80
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Code function: 2_2_00411C5B __EH_prolog3,_calloc,FindFirstFileA, 2_2_00411C5B
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Code function: 2_2_00421CF7 recv, 2_2_00421CF7
Source: setup.exe String found in binary or memory: http://crl.thawte.com/ThawteCodeSigningCA.crl0
Source: setup.exe String found in binary or memory: http://crl.thawte.com/ThawtePremiumServerCA.crl0
Source: setup.exe String found in binary or memory: http://ocsp.thawte.com0
Source: The REXX Language (3rd Party Tutorial).url.2.dr String found in binary or memory: http://www.borg.com/~jglatt/rexx/scripts/language/language.htm
Source: Introduction to REXX.PDF.2.dr String found in binary or memory: http://www.borg.com/~jglatt/rexx/scripts/language/language.htm.)
Source: setup.cfg, setup.exe, setupenglish.dll String found in binary or memory: http://www.emtec.com
Source: setup.exe, 00000002.00000003.2307631408.00000000047E0000.00000004.00000800.00020000.00000000.sdmp, Homepage EmTec.URL.2.dr String found in binary or memory: http://www.emtec.com/
Source: Readme.txt.2.dr String found in binary or memory: http://www.emtec.com/common/contact.html
Source: order.exe.2.dr String found in binary or memory: http://www.emtec.com/common/order.htm
Source: order.exe.2.dr String found in binary or memory: http://www.emtec.com/common/order.html
Source: order.exe.2.dr String found in binary or memory: http://www.emtec.com/common/order.htmlhttp://www.emtec.com/common/order.htm
Source: Readme.txt.2.dr String found in binary or memory: http://www.emtec.com/common/support.html
Source: advertise_pyrotrans.cfg String found in binary or memory: http://www.emtec.com/pyrotrans/index.htm
Source: setup.exe, 00000002.00000002.3264393540.0000000001FB5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.emtec.com/pyrotrans/index.htmS
Source: advertise_pyrotrans.cfg String found in binary or memory: http://www.emtec.com/pyrotrans/index.html
Source: setup.exe, 00000002.00000002.3264059138.000000000066B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.emtec.com/pyrotrans/index.html.1
Source: setup.exe, 00000002.00000002.3264059138.000000000066B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.emtec.com/pyrotrans/index.htmlV
Source: setup.exe, 00000002.00000002.3264474052.0000000002350000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.emtec.com/pyrotrans/index.htmlnn
Source: setup.exe, 00000002.00000002.3264059138.000000000066B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.emtec.com/pyrotrans/index.htmls
Source: setup.cfg String found in binary or memory: http://www.emtec.com/zoc/index.htm
Source: setup.cfg String found in binary or memory: http://www.emtec.com/zoc/index.html
Source: Register.txt.2.dr String found in binary or memory: http://www.emtec.com/zoc/order.html
Source: setup.exe String found in binary or memory: http://www.emtec.comPublisherEmTec
Source: zocdll.dll.2.dr String found in binary or memory: http://www.emtec.comStandbyvalue
Source: Another Rexx Tutorial.url.2.dr String found in binary or memory: http://www.kilowattsoftware.com/tutorial/rexx/
Source: sshdll.dll.2.dr, zocdll.dll.2.dr String found in binary or memory: http://www.openssl.org/support/faq.html
Source: zocdll.dll.2.dr String found in binary or memory: http://www.openssl.org/support/faq.html....................
Source: Introduction to REXX.PDF.2.dr String found in binary or memory: http://www.pdfpdf.com)
Source: setup.exe String found in binary or memory: https://http://;setup.exe:1;setup.exe;-remove
Contains functionality to retrieve information about pressed keystrokes
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Code function: 2_2_0041493A GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,Beep,Beep,Sleep,Sleep,Beep,Sleep,Beep,Sleep,Beep,Sleep,Beep,Beep,Beep,Sleep,Sleep,Beep,Sleep,Beep,Beep,Sleep,Sleep,Beep,Sleep,Beep,Sleep,Beep,Sleep,Beep,Beep,Sleep,Sleep,Beep,Sleep,Beep,Beep,Sleep,Sleep,Beep,Sleep,Beep, 2_2_0041493A
Detected potential crypto function
Source: C:\Users\user\Desktop\SecuriteInfo.com.suspected.of.Win32.PhishingPE.Heur.10337.17085.exe Code function: 0_2_00402C68 0_2_00402C68
Source: C:\Users\user\Desktop\SecuriteInfo.com.suspected.of.Win32.PhishingPE.Heur.10337.17085.exe Code function: 0_2_00405AF0 0_2_00405AF0
Source: C:\Users\user\Desktop\SecuriteInfo.com.suspected.of.Win32.PhishingPE.Heur.10337.17085.exe Code function: 0_2_00402A88 0_2_00402A88
Source: C:\Users\user\Desktop\SecuriteInfo.com.suspected.of.Win32.PhishingPE.Heur.10337.17085.exe Code function: 0_2_00407547 0_2_00407547
Source: C:\Users\user\Desktop\SecuriteInfo.com.suspected.of.Win32.PhishingPE.Heur.10337.17085.exe Code function: 0_2_0040411E 0_2_0040411E
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Code function: 2_3_02356731 2_3_02356731
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Code function: 2_2_0043E237 2_2_0043E237
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Code function: 2_2_00432BAB 2_2_00432BAB
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Code function: 2_2_00434279 2_2_00434279
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Code function: 2_2_004422D1 2_2_004422D1
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Code function: 2_2_004493F8 2_2_004493F8
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Code function: 2_2_0041056C 2_2_0041056C
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Code function: 2_2_004395C1 2_2_004395C1
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Code function: 2_2_004326FB 2_2_004326FB
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Code function: 2_2_00434791 2_2_00434791
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Code function: 2_2_00433876 2_2_00433876
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Code function: 2_2_00436820 2_2_00436820
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Code function: 2_2_0042A8DE 2_2_0042A8DE
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Code function: 2_2_0044993A 2_2_0044993A
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Code function: 2_2_0041FA67 2_2_0041FA67
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Code function: 2_2_0044CADB 2_2_0044CADB
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Code function: 2_2_0043AB2A 2_2_0043AB2A
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Code function: 2_2_00440BD8 2_2_00440BD8
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Code function: 2_2_0044BC05 2_2_0044BC05
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Code function: 2_2_00434C05 2_2_00434C05
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Code function: 2_2_00433D61 2_2_00433D61
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Code function: 2_2_00448EB6 2_2_00448EB6
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Code function: 2_2_00442FE0 2_2_00442FE0
Found potential string decryption / allocating functions
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Code function: String function: 004433AC appears 33 times
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Code function: String function: 0043B677 appears 79 times
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Code function: String function: 00435A4F appears 53 times
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Code function: String function: 0041B378 appears 185 times
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Code function: String function: 0041B3FE appears 129 times
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Code function: String function: 00419640 appears 69 times
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Code function: String function: 0041B3A0 appears 60 times
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Code function: String function: 00435791 appears 147 times
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Code function: String function: 00401071 appears 56 times
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Code function: String function: 00411530 appears 41 times
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Code function: String function: 00413C7C appears 38 times
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Code function: String function: 00442F7C appears 67 times
PE file does not import any functions
Source: setupenglish.dll.0.dr Static PE information: No import functions for PE file found
Source: SetupGerman.Dll.2.dr Static PE information: No import functions for PE file found
Source: setupgerman.dll.0.dr Static PE information: No import functions for PE file found
Source: SetupEnglish.Dll.2.dr Static PE information: No import functions for PE file found
Uses 32bit PE files
Source: SecuriteInfo.com.suspected.of.Win32.PhishingPE.Heur.10337.17085.exe Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: classification engine Classification label: clean6.winEXE@3/174@0/0
Source: Introduction to REXX.PDF.2.dr Initial sample: http://www.borg.com/~jglatt/rexx/scripts/language/language.htm.
Source: Introduction to REXX.PDF.2.dr Initial sample: http://www.pdfpdf.com
Source: C:\Users\user\Desktop\SecuriteInfo.com.suspected.of.Win32.PhishingPE.Heur.10337.17085.exe Code function: 0_2_00401039 ReadFile,GetLastError,SetFilePointer,GetLastError,GetLastError,FormatMessageA,wsprintfA,MessageBoxA, 0_2_00401039
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Code function: 2_2_0040459C __EH_prolog3,CoInitialize,_memset,LoadLibraryA,GetModuleFileNameA,FreeLibrary,CoCreateInstance,_sprintf,MultiByteToWideChar,CoCreateInstance,_sprintf,MultiByteToWideChar,CoUninitialize, 2_2_0040459C
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe File created: C:\Program Files (x86)\ZOC5 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ZOC Terminal 5.1 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Mutant created: NULL
Source: C:\Users\user\Desktop\SecuriteInfo.com.suspected.of.Win32.PhishingPE.Heur.10337.17085.exe File created: C:\Users\user\AppData\Local\Temp\FEA0B4.tmp Jump to behavior
Source: SecuriteInfo.com.suspected.of.Win32.PhishingPE.Heur.10337.17085.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe File read: C:\Users\user\AppData\Local\Temp\~emtec~354033\commandline.ini Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.suspected.of.Win32.PhishingPE.Heur.10337.17085.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: setup.exe String found in binary or memory: /STOP
Source: setup.exe String found in binary or memory: /STOP
Source: setup.exe String found in binary or memory: /STOP
Source: setup.exe String found in binary or memory: /STOP
Source: setup.exe String found in binary or memory: /STOPEmtec Service-Controlservice.exeUninstallDesktopFilesUninstallStartmenuFiles%s\%s.URLProgramgroup entry or desktop icon%s\%s.LNKSUCCEEDED(hres)*#%PATH%\:https://http://;setup.exe:1;setup.exe;-remove StartmenuUninstallUninstallStartmenu;#DesktopIconStartmenuOpts\pcinstall.ini"openNoFinalPopupDeleteAfterExtractEmTecIdBmpInstallPathffffff
Source: setup.exe String found in binary or memory: /STOPEmtec Service-Controlservice.exeUninstallDesktopFilesUninstallStartmenuFiles%s\%s.URLProgramgroup entry or desktop icon%s\%s.LNKSUCCEEDED(hres)*#%PATH%\:https://http://;setup.exe:1;setup.exe;-remove StartmenuUninstallUninstallStartmenu;#DesktopIconStartmenuOpts\pcinstall.ini"openNoFinalPopupDeleteAfterExtractEmTecIdBmpInstallPathffffff
Source: C:\Users\user\Desktop\SecuriteInfo.com.suspected.of.Win32.PhishingPE.Heur.10337.17085.exe File read: C:\Users\user\Desktop\SecuriteInfo.com.suspected.of.Win32.PhishingPE.Heur.10337.17085.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\SecuriteInfo.com.suspected.of.Win32.PhishingPE.Heur.10337.17085.exe "C:\Users\user\Desktop\SecuriteInfo.com.suspected.of.Win32.PhishingPE.Heur.10337.17085.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.suspected.of.Win32.PhishingPE.Heur.10337.17085.exe Process created: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe .\setup.exe
Source: C:\Users\user\Desktop\SecuriteInfo.com.suspected.of.Win32.PhishingPE.Heur.10337.17085.exe Process created: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe .\setup.exe Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.suspected.of.Win32.PhishingPE.Heur.10337.17085.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.suspected.of.Win32.PhishingPE.Heur.10337.17085.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.suspected.of.Win32.PhishingPE.Heur.10337.17085.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.suspected.of.Win32.PhishingPE.Heur.10337.17085.exe Section loaded: textinputframework.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.suspected.of.Win32.PhishingPE.Heur.10337.17085.exe Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.suspected.of.Win32.PhishingPE.Heur.10337.17085.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.suspected.of.Win32.PhishingPE.Heur.10337.17085.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.suspected.of.Win32.PhishingPE.Heur.10337.17085.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.suspected.of.Win32.PhishingPE.Heur.10337.17085.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.suspected.of.Win32.PhishingPE.Heur.10337.17085.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.suspected.of.Win32.PhishingPE.Heur.10337.17085.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.suspected.of.Win32.PhishingPE.Heur.10337.17085.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Section loaded: acgenral.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Section loaded: samcli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Section loaded: msacm32.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Section loaded: dwmapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Section loaded: winmmbase.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Section loaded: winmmbase.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Section loaded: setuphook.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Section loaded: textinputframework.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Section loaded: linkinfo.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Section loaded: ntshrui.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Section loaded: cscapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Section loaded: ieframe.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Section loaded: msiso.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00021401-0000-0000-C000-000000000046}\InProcServer32 Jump to behavior
Source: ZOC V5.LNK.2.dr LNK file: ..\..\..\..\..\..\..\..\..\Program Files (x86)\ZOC5\zoc.exe
Source: Readme.LNK.2.dr LNK file: ..\..\..\..\..\..\..\..\..\Program Files (x86)\ZOC5\Readme.txt
Source: Order ZOC.LNK.2.dr LNK file: ..\..\..\..\..\..\..\..\..\Program Files (x86)\ZOC5\order.exe
Source: Feature List.LNK.2.dr LNK file: ..\..\..\..\..\..\..\..\..\Program Files (x86)\ZOC5\Features.txt
Source: Order Info.LNK.2.dr LNK file: ..\..\..\..\..\..\..\..\..\Program Files (x86)\ZOC5\Register.txt
Source: Developers Readme.LNK.2.dr LNK file: ..\..\..\..\..\..\..\..\..\Program Files (x86)\ZOC5\Develop.txt
Source: Version History.LNK.2.dr LNK file: ..\..\..\..\..\..\..\..\..\Program Files (x86)\ZOC5\Versions.txt
Source: ZOC Help File.LNK.2.dr LNK file: ..\..\..\..\..\..\..\..\..\Windows\System32\hh.exe
Source: ZOC Command Line Parameters.LNK.2.dr LNK file: ..\..\..\..\..\..\..\..\..\Windows\System32\hh.exe
Source: ZOC Quick Start Guides.LNK.2.dr LNK file: ..\..\..\..\..\..\..\..\..\Windows\System32\hh.exe
Source: Uninstall ZOC.LNK.2.dr LNK file: ..\..\..\..\..\..\..\..\..\Program Files (x86)\ZOC5\Setup.exe
Source: C:\Users\user\Desktop\SecuriteInfo.com.suspected.of.Win32.PhishingPE.Heur.10337.17085.exe File written: C:\Users\user\AppData\Local\Temp\~emtec~354033\commandline.ini Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Automated click: Accept end user license agreement
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Automated click: Next >
Source: SecuriteInfo.com.suspected.of.Win32.PhishingPE.Heur.10337.17085.exe Static PE information: certificate valid
Source: SecuriteInfo.com.suspected.of.Win32.PhishingPE.Heur.10337.17085.exe Static file information: File size 3113216 > 1048576
Source: SecuriteInfo.com.suspected.of.Win32.PhishingPE.Heur.10337.17085.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: X:\zoc\v5\showem\showem.pdb source: showem.dll.2.dr
Source: Binary string: X:\zoc\v5\devmodem\devmodem.pdb source: devmodem.dll.2.dr
Source: Binary string: X:\zoc\v5\devssh\sshdll\sshdll.pdb source: sshdll.dll.2.dr
Source: Binary string: X:\zoc\v5\devtlnet\devtlnet.pdb source: devtlnet.dll.2.dr
Source: Binary string: X:\zoc\v5\devrcmd\devrcmd.pdb source: devrcmd.dll.2.dr
Source: Binary string: w:\setup\sfxmake\Release\sfxmakeheader.pdb source: SecuriteInfo.com.suspected.of.Win32.PhishingPE.Heur.10337.17085.exe
Source: Binary string: X:\zoc\v5\devisdn2\devisdn2.pdb source: devisdn2.dll.2.dr
Source: Binary string: X:\zoc\v5\emuqnx\emuqnx.pdb source: emuqnx.dll.2.dr
Source: Binary string: X:\ZOC\V5\zocdll.pdb source: setup.exe, 00000002.00000002.3263855967.000000000048D000.00000004.00000001.01000000.00000006.sdmp, zocdll.dll.2.dr
Source: Binary string: X:\ZOC\V5\zocdll.pdb3 source: setup.exe, 00000002.00000002.3263855967.000000000048D000.00000004.00000001.01000000.00000006.sdmp
Source: Binary string: X:\zoc\v5\devnpipe\devnpipe.pdb source: devnpipe.dll.2.dr
Source: Binary string: X:\ZOC\V5\phimport\phimport.pdb source: phimport.dll.2.dr
Source: Binary string: X:\zoc\v5\emuansi\emuansi.pdb source: emuansi.dll.2.dr
Source: Binary string: X:\zoc\v5\emuvt\emuvt.pdb source: emuvt.dll.2.dr
Source: Binary string: X:\zoc\v5\xfrsealink\xfrsealink.pdb source: xfrsealink.dll.2.dr
Source: Binary string: w:\setup\release\setup.pdb source: setup.exe
Source: Binary string: X:\zoc\v5\emu5250\emu5250.pdb source: emu5250.dll.2.dr
Source: Binary string: X:\zoc\v5\emu3270\emu3270.pdb source: emu3270.dll.2.dr
Source: Binary string: X:\zoc\v5\xfrxyz\xfrxyz.pdb source: xfrxyz.dll.2.dr
Source: Binary string: X:\zoc\v5\xfrkerm\xfrkerm.pdb source: xfrkerm.dll.2.dr
Source: Binary string: X:\zoc\v5\emutty\emutty.pdb source: emutty.dll.2.dr
Source: Binary string: X:\zoc\v5\devssh\devssh.pdb source: devssh.dll.2.dr
Source: Binary string: X:\zoc\v5\osys\osyswin.pdb source: osyswin.dll.2.dr
Source: Binary string: X:\zoc\v5\emuwyse\emuwyse.pdb source: emuwyse.dll.2.dr
Source: Binary string: w:\setup\Release\order.pdb source: order.exe.2.dr
Source: Binary string: X:\zoc\v5\devtapi\devtapi.pdb source: devtapi.dll.2.dr
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\SecuriteInfo.com.suspected.of.Win32.PhishingPE.Heur.10337.17085.exe Code function: 0_2_0040A2BD LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,__invoke_watson,GetProcAddress,GetProcAddress,__invoke_watson, 0_2_0040A2BD
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\SecuriteInfo.com.suspected.of.Win32.PhishingPE.Heur.10337.17085.exe Code function: 0_2_00405AD5 push ecx; ret 0_2_00405AE8
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Code function: 2_2_004271D9 push ss; iretd 2_2_004271DA
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Code function: 2_2_004455E7 push 33000001h; retf 2_2_004455EC
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Code function: 2_2_004456E9 push ebp; ret 2_2_004456EA
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Code function: 2_2_00435830 push ecx; ret 2_2_00435843
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Code function: 2_2_00442FC1 push ecx; ret 2_2_00442FD4
Drops PE files
Source: C:\Users\user\Desktop\SecuriteInfo.com.suspected.of.Win32.PhishingPE.Heur.10337.17085.exe File created: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe File created: C:\Program Files (x86)\ZOC5\devssh.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe File created: C:\Program Files (x86)\ZOC5\devmodem.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe File created: C:\Program Files (x86)\ZOC5\emuansi.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe File created: C:\Program Files (x86)\ZOC5\order.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe File created: C:\Program Files (x86)\ZOC5\sshdll.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe File created: C:\Program Files (x86)\ZOC5\phimport.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe File created: C:\Program Files (x86)\ZOC5\SetupEnglish.Dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe File created: C:\Program Files (x86)\ZOC5\emuvt.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe File created: C:\Program Files (x86)\ZOC5\devisdn2.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe File created: C:\Program Files (x86)\ZOC5\emu5250.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe File created: C:\Program Files (x86)\ZOC5\devtapi.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe File created: C:\Program Files (x86)\ZOC5\devrcmd.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe File created: C:\Program Files (x86)\ZOC5\devnpipe.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe File created: C:\Program Files (x86)\ZOC5\xfrsealink.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.suspected.of.Win32.PhishingPE.Heur.10337.17085.exe File created: C:\Users\user\AppData\Local\Temp\~emtec~354033\setupgerman.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe File created: C:\Program Files (x86)\ZOC5\SetupGerman.Dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe File created: C:\Program Files (x86)\ZOC5\osyswin.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe File created: C:\Program Files (x86)\ZOC5\xfrxyz.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe File created: C:\Program Files (x86)\ZOC5\xfrkerm.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe File created: C:\Program Files (x86)\ZOC5\zoc.exe Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.suspected.of.Win32.PhishingPE.Heur.10337.17085.exe File created: C:\Users\user\AppData\Local\Temp\~emtec~354033\setupenglish.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe File created: C:\Program Files (x86)\ZOC5\devtlnet.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe File created: C:\Program Files (x86)\ZOC5\emtecrt.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe File created: C:\Program Files (x86)\ZOC5\emuqnx.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe File created: C:\Program Files (x86)\ZOC5\emutty.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe File created: C:\Program Files (x86)\ZOC5\shellicons.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe File created: C:\Program Files (x86)\ZOC5\showem.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe File created: C:\Program Files (x86)\ZOC5\RxREXX.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe File created: C:\Program Files (x86)\ZOC5\ssh.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe File created: C:\Program Files (x86)\ZOC5\emuwyse.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe File created: C:\Program Files (x86)\ZOC5\telnet.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe File created: C:\Program Files (x86)\ZOC5\zocdll.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe File created: C:\Program Files (x86)\ZOC5\emu3270.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe File created: C:\Program Files (x86)\ZOC5\zaphoddll.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe File created: C:\Program Files (x86)\ZOC5\Setup.exe Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.suspected.of.Win32.PhishingPE.Heur.10337.17085.exe Code function: 0_2_00401E6C _memset,_memset,_memset,lstrlenA,GetTempPathA,GetCurrentDirectoryA,GetCurrentProcess,GetModuleFileNameA,CreateFileA,SetFilePointer,SetFilePointer,ReadFile,SetFilePointer,ReadFile,SetFilePointer,ReadFile,SetFilePointer,VirtualAlloc,ReadFile,GetTempPathA,GetTempFileNameA,CreateFileA,WriteFile,CloseHandle,GetPrivateProfileIntA,GetPrivateProfileIntA,GetPrivateProfileIntA,GetPrivateProfileIntA,GetPrivateProfileIntA,GetPrivateProfileStringA,GetPrivateProfileStringA,GetPrivateProfileStringA,GetPrivateProfileStringA,GetPrivateProfileStringA,GetPrivateProfileStringA,GetPrivateProfileStringA,GetPrivateProfileStringA,GetPrivateProfileStringA,lstrlenA,lstrcpyA,lstrcpyA,lstrcpyA,lstrcpyA,lstrcpyA,lstrcpyA,lstrcpyA,VirtualFree,DeleteFileA, 0_2_00401E6C
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe File created: C:\Program Files (x86)\ZOC5\license.txt Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe File created: C:\Program Files (x86)\ZOC5\Readme.txt Jump to behavior
Stores files to the Windows start menu directory
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ZOC Terminal 5.1 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ZOC Terminal 5.1\ZOC V5.LNK Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ZOC Terminal 5.1\Readme.LNK Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ZOC Terminal 5.1\Order ZOC.LNK Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ZOC Terminal 5.1\Feature List.LNK Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ZOC Terminal 5.1\Order Info.LNK Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ZOC Terminal 5.1\Developers Readme.LNK Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ZOC Terminal 5.1\Version History.LNK Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ZOC Terminal 5.1\ZOC Help File.LNK Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ZOC Terminal 5.1\Homepage ZOC.URL Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ZOC Terminal 5.1\Homepage EmTec.URL Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ZOC Terminal 5.1\ZOC Command Line Parameters.LNK Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ZOC Terminal 5.1\ZOC Quick Start Guides.LNK Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ZOC Terminal 5.1\Uninstall ZOC.LNK Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.suspected.of.Win32.PhishingPE.Heur.10337.17085.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Found dropped PE file which has not been started or loaded
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Dropped PE file which has not been started: C:\Program Files (x86)\ZOC5\devssh.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Dropped PE file which has not been started: C:\Program Files (x86)\ZOC5\devmodem.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Dropped PE file which has not been started: C:\Program Files (x86)\ZOC5\emuansi.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Dropped PE file which has not been started: C:\Program Files (x86)\ZOC5\order.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Dropped PE file which has not been started: C:\Program Files (x86)\ZOC5\sshdll.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Dropped PE file which has not been started: C:\Program Files (x86)\ZOC5\SetupEnglish.Dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Dropped PE file which has not been started: C:\Program Files (x86)\ZOC5\phimport.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Dropped PE file which has not been started: C:\Program Files (x86)\ZOC5\emuvt.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Dropped PE file which has not been started: C:\Program Files (x86)\ZOC5\devisdn2.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Dropped PE file which has not been started: C:\Program Files (x86)\ZOC5\emu5250.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Dropped PE file which has not been started: C:\Program Files (x86)\ZOC5\devtapi.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Dropped PE file which has not been started: C:\Program Files (x86)\ZOC5\devrcmd.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Dropped PE file which has not been started: C:\Program Files (x86)\ZOC5\devnpipe.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Dropped PE file which has not been started: C:\Program Files (x86)\ZOC5\xfrsealink.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.suspected.of.Win32.PhishingPE.Heur.10337.17085.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\~emtec~354033\setupgerman.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Dropped PE file which has not been started: C:\Program Files (x86)\ZOC5\SetupGerman.Dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Dropped PE file which has not been started: C:\Program Files (x86)\ZOC5\xfrxyz.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Dropped PE file which has not been started: C:\Program Files (x86)\ZOC5\osyswin.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Dropped PE file which has not been started: C:\Program Files (x86)\ZOC5\xfrkerm.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Dropped PE file which has not been started: C:\Program Files (x86)\ZOC5\zoc.exe Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.suspected.of.Win32.PhishingPE.Heur.10337.17085.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\~emtec~354033\setupenglish.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Dropped PE file which has not been started: C:\Program Files (x86)\ZOC5\emtecrt.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Dropped PE file which has not been started: C:\Program Files (x86)\ZOC5\devtlnet.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Dropped PE file which has not been started: C:\Program Files (x86)\ZOC5\emuqnx.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Dropped PE file which has not been started: C:\Program Files (x86)\ZOC5\emutty.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Dropped PE file which has not been started: C:\Program Files (x86)\ZOC5\shellicons.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Dropped PE file which has not been started: C:\Program Files (x86)\ZOC5\showem.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Dropped PE file which has not been started: C:\Program Files (x86)\ZOC5\ssh.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Dropped PE file which has not been started: C:\Program Files (x86)\ZOC5\RxREXX.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Dropped PE file which has not been started: C:\Program Files (x86)\ZOC5\emuwyse.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Dropped PE file which has not been started: C:\Program Files (x86)\ZOC5\telnet.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Dropped PE file which has not been started: C:\Program Files (x86)\ZOC5\zocdll.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Dropped PE file which has not been started: C:\Program Files (x86)\ZOC5\emu3270.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Dropped PE file which has not been started: C:\Program Files (x86)\ZOC5\zaphoddll.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Code function: 2_2_004381D7 __getdrive,FindFirstFileA,_strlen,_IsRootUNCName,GetDriveTypeA,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FindClose,___dtoxmode,GetLastError,__dosmaperr,FindClose, 2_2_004381D7
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Code function: 2_2_004311A5 _malloc,_strlen,_malloc,_strcat,FindFirstFileA,_strcat, 2_2_004311A5
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Code function: 2_2_00436D80 __getdrive,FindFirstFileA,_strlen,_IsRootUNCName,GetDriveTypeA,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FindClose,___dtoxmode,GetLastError,__dosmaperr,FindClose, 2_2_00436D80
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Code function: 2_2_00411C5B __EH_prolog3,_calloc,FindFirstFileA, 2_2_00411C5B
Source: C:\Users\user\Desktop\SecuriteInfo.com.suspected.of.Win32.PhishingPE.Heur.10337.17085.exe API call chain: ExitProcess graph end node
Source: C:\Users\user\Desktop\SecuriteInfo.com.suspected.of.Win32.PhishingPE.Heur.10337.17085.exe API call chain: ExitProcess graph end node
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Source: C:\Users\user\Desktop\SecuriteInfo.com.suspected.of.Win32.PhishingPE.Heur.10337.17085.exe Code function: 0_2_004058C2 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 0_2_004058C2
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\SecuriteInfo.com.suspected.of.Win32.PhishingPE.Heur.10337.17085.exe Code function: 0_2_0040A2BD LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,__invoke_watson,GetProcAddress,GetProcAddress,__invoke_watson, 0_2_0040A2BD
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Code function: 2_2_004364AA GetStartupInfoA,GetProcessHeap,GetProcessHeap,HeapAlloc,_fast_error_exit,GetVersionExA,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,_fast_error_exit,_fast_error_exit,__RTC_Initialize,__amsg_exit,GetCommandLineA,___crtGetEnvironmentStringsA,__setargv,__amsg_exit,__setenvp,__amsg_exit,__cinit,__amsg_exit,__wincmdln, 2_2_004364AA
Source: C:\Users\user\Desktop\SecuriteInfo.com.suspected.of.Win32.PhishingPE.Heur.10337.17085.exe Code function: 0_2_0040A4C0 _raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 0_2_0040A4C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.suspected.of.Win32.PhishingPE.Heur.10337.17085.exe Code function: 0_2_004058C2 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 0_2_004058C2
Source: C:\Users\user\Desktop\SecuriteInfo.com.suspected.of.Win32.PhishingPE.Heur.10337.17085.exe Code function: 0_2_0040A75A SetUnhandledExceptionFilter, 0_2_0040A75A
Source: C:\Users\user\Desktop\SecuriteInfo.com.suspected.of.Win32.PhishingPE.Heur.10337.17085.exe Code function: 0_2_00405320 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 0_2_00405320
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Code function: 2_2_0044731E _raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 2_2_0044731E
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Code function: 2_2_00415521 _malloc,SetUnhandledExceptionFilter, 2_2_00415521
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Code function: 2_2_00443676 SetUnhandledExceptionFilter, 2_2_00443676
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Code function: 2_2_00435782 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 2_2_00435782
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Code function: 2_2_00440AB8 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 2_2_00440AB8
Contains functionality to query CPU information (cpuid)
Source: C:\Users\user\Desktop\SecuriteInfo.com.suspected.of.Win32.PhishingPE.Heur.10337.17085.exe Code function: 0_2_00406662 cpuid 0_2_00406662
Contains functionality to query locales information (e.g. system language)
Source: C:\Users\user\Desktop\SecuriteInfo.com.suspected.of.Win32.PhishingPE.Heur.10337.17085.exe Code function: GetLocaleInfoA, 0_2_0040A7B4
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Code function: GetLocaleInfoA, 2_2_0044B5B9
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Code function: GetLocalTime,_memset,GetLocaleInfoA,GetTimeFormatA, 2_2_00412BBC
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Code function: 2_2_0043A1AD GetSystemTimeAsFileTime,__aulldiv, 2_2_0043A1AD
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Code function: 2_2_00412278 __EH_prolog3,GetUserNameA, 2_2_00412278
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Code function: 2_2_00446706 __lock,__invoke_watson,__invoke_watson,__invoke_watson,____lc_codepage_func,_strlen,__malloc_crt,_strlen,_strcpy_s,__invoke_watson,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,WideCharToMultiByte,__invoke_watson,SetOaNoCache,__invoke_watson, 2_2_00446706
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Code function: 2_2_004364AA GetStartupInfoA,GetProcessHeap,GetProcessHeap,HeapAlloc,_fast_error_exit,GetVersionExA,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,_fast_error_exit,_fast_error_exit,__RTC_Initialize,__amsg_exit,GetCommandLineA,___crtGetEnvironmentStringsA,__setargv,__amsg_exit,__setenvp,__amsg_exit,__cinit,__amsg_exit,__wincmdln, 2_2_004364AA
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Code function: 2_2_0042394D __EH_prolog3,_memset,_memset,_strcat,_strcat,_strlen,_strlen,_memset,htons,inet_ntoa,bind,getsockname,htons, 2_2_0042394D
Source: C:\Users\user\AppData\Local\Temp\~emtec~354033\setup.exe Code function: 2_2_00423BF8 __EH_prolog3,socket,listen, 2_2_00423BF8
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 process2 2 Behavior Graph ID: 1430577 Sample: SecuriteInfo.com.suspected.... Startdate: 23/04/2024 Architecture: WINDOWS Score: 6 5 SecuriteInfo.com.suspected.of.Win32.PhishingPE.Heur.10337.17085.exe 10 2->5         started        file3 11 C:\Users\user\AppData\...\setupgerman.dll, PE32 5->11 dropped 13 C:\Users\user\AppData\...\setupenglish.dll, PE32 5->13 dropped 15 C:\Users\user\AppData\Local\...\setup.exe, PE32 5->15 dropped 8 setup.exe 57 185 5->8         started        process4 file5 17 C:\Program Files (x86)\ZOC5\zocdll.dll, PE32 8->17 dropped 19 C:\Program Files (x86)\ZOC5\zoc.exe, PE32 8->19 dropped 21 C:\Program Files (x86)\ZOC5\zaphoddll.dll, PE32 8->21 dropped 23 30 other files (none is malicious) 8->23 dropped
⊘No contacted IP infos