Windows Analysis Report
Firefly.exe

ID:	1430582
Product:	CloudBasic
Start time:	22:31:08
Start date:	23.04.2024
Sample:	Firefly.exe
Cookbook:	default.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	c5ccf171be0afa6d9a1092bac9cb0b96
SHA1:	5a2fdbda3acb7a52152bc1472871f09d3624b2a1
SHA256:	70b933e76310295d4f74af8a60e3295561858d649366a3ae967c512e10427c73
Filetype:	Win64 Executable GUI Net Framework (217006/5) 49.88%

Name	Type	MD5	SHA1	SHA256
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Firefly.exe_23b78092aee8f5761b43cd79acb5af5c33440ff_b5f3949a_8fbd4526-73f1-4a57-b4f6-8587215b046e\Report.wer	Unicode text, UTF-16, little-endian text, with CRLF line terminators	98BEC0EDCDFC160D4AB543205A517C25	695ADF25DBA5B2FAFD6F104BBBD6B5A1492AF28F	0E37A742A15175B0ED09BE3EA8425E0422A05CE31041EA42FDD935EDC34D62C3
C:\ProgramData\Microsoft\Windows\WER\Temp\WER98EA.tmp.dmp	Mini DuMP crash report, 16 streams, Tue Apr 23 20:31:58 2024, 0x1205a4 type	134750D5C4DFD6E97B9605806D62424C	AF2D1CBAA565C0DBD1C3E1B1D53D02770324A3EB	B855C572D1EB0CD573C36787D9DBE375703C21F2BDEA6CDFC82B40CC59585821
C:\ProgramData\Microsoft\Windows\WER\Temp\WER9B3D.tmp.WERInternalMetadata.xml	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators	9171187B2311F55EACB2BE87FABDEE29	F63F0BCA742C7F8A0C59E08D801621AFA12A5C03	6024947F69DF3F185F2E208BEDAF7B75FA520C42992059638D7E6F45F164FB47
C:\ProgramData\Microsoft\Windows\WER\Temp\WER9B6D.tmp.xml	XML 1.0 document, ASCII text, with CRLF line terminators	B8606F6E8D592F8CB3137E3A1E8546DF	07B01CF00BFD6379042B7D83E537F023E32D9499	0AEE397C11971A2D86735F825391A4FE7BC0CBB7774E4C9095CEBB57083FB5A9
C:\Windows\appcompat\Programs\Amcache.hve	MS Windows registry file, NT/2000 or above	CA8A665575539AC6B6EFDA1A1406C28E	41A2E9428AD66D9E4E0AF6A10AF63FDF71A00689	6DC38CA5C64A66ED6414268CAA760063CB53F68A6396C539D5A29C770376D08B

Compliance

Source: Firefly.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: PresentationFramework.pdb source: Firefly.exe, 00000000.00000002.2140521915.000001EE80001000.00000004.00000800.00020000.00000000.sdmp, WER98EA.tmp.dmp.4.dr
Source:	Binary string: System.Xml.ni.pdb source: WER98EA.tmp.dmp.4.dr
Source:	Binary string: WindowsBase.ni.pdb source: WER98EA.tmp.dmp.4.dr
Source:	Binary string: System.ni.pdbRSDS source: WER98EA.tmp.dmp.4.dr
Source:	Binary string: WindowsBase.ni.pdbRSDS source: WER98EA.tmp.dmp.4.dr
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\PresentationFramework\v4.0_4.0.0.0__31bf3856ad364e35\PresentationFramework.pdb</prov source: Firefly.exe, 00000000.00000002.2140995378.000001EEF1D48000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: sBase.pdb32* source: Firefly.exe, 00000000.00000002.2142136364.000001EEF4110000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.pdb9u source: WER98EA.tmp.dmp.4.dr
Source:	Binary string: System.Configuration.ni.pdb source: WER98EA.tmp.dmp.4.dr
Source:	Binary string: mscorlib.ni.pdbRSDS7^3l source: WER98EA.tmp.dmp.4.dr
Source:	Binary string: System.Configuration.pdb source: WER98EA.tmp.dmp.4.dr
Source:	Binary string: System.Xml.pdb source: WER98EA.tmp.dmp.4.dr
Source:	Binary string: System.pdb source: WER98EA.tmp.dmp.4.dr
Source:	Binary string: System.Xml.ni.pdbRSDS# source: WER98EA.tmp.dmp.4.dr
Source:	Binary string: System.Core.ni.pdb source: WER98EA.tmp.dmp.4.dr
Source:	Binary string: PresentationFramework.ni.pdbRSDS source: WER98EA.tmp.dmp.4.dr
Source:	Binary string: System.Core.pdb0 source: WER98EA.tmp.dmp.4.dr
Source:	Binary string: PresentationCore.ni.pdbRSDS source: WER98EA.tmp.dmp.4.dr
Source:	Binary string: #cefsharp.browsersubprocess.core.pdb# source: Firefly.exe
Source:	Binary string: WindowsBase.pdb source: Firefly.exe, 00000000.00000002.2140521915.000001EE80001000.00000004.00000800.00020000.00000000.sdmp, WER98EA.tmp.dmp.4.dr
Source:	Binary string: System.Xaml.ni.pdb source: WER98EA.tmp.dmp.4.dr
Source:	Binary string: mscorlib.pdb source: Firefly.exe, 00000000.00000002.2140521915.000001EE80001000.00000004.00000800.00020000.00000000.sdmp, WER98EA.tmp.dmp.4.dr
Source:	Binary string: cefsharp.browsersubprocess.pdb source: Firefly.exe
Source:	Binary string: System.Xaml.ni.pdbRSDSDg{V source: WER98EA.tmp.dmp.4.dr
Source:	Binary string: PresentationCore.ni.pdb source: WER98EA.tmp.dmp.4.dr
Source:	Binary string: System.Xaml.pdb source: WER98EA.tmp.dmp.4.dr
Source:	Binary string: mscorlib.ni.pdb source: WER98EA.tmp.dmp.4.dr
Source:	Binary string: System.Core.pdb source: WER98EA.tmp.dmp.4.dr
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\PresentationFramework\v4.0_4.0.0.0__31bf3856ad364e35\PresentationFramework.pdb <tr\ source: Firefly.exe, 00000000.00000002.2140995378.000001EEF1D48000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Configuration.pdbH source: WER98EA.tmp.dmp.4.dr
Source:	Binary string: #cefsharp.browsersubprocess.core.pdb source: Firefly.exe
Source:	Binary string: mscorlib.pdb maxInvalidPasswordAttempts="5" source: Firefly.exe, 00000000.00000002.2140995378.000001EEF1D48000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: cefsharp.core.runtime.pdb source: Firefly.exe
Source:	Binary string: C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdbl source: Firefly.exe, 00000000.00000002.2140995378.000001EEF1D48000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Configuration.ni.pdbRSDScUN source: WER98EA.tmp.dmp.4.dr
Source:	Binary string: WindowsBase.pdbework.pdbLocalSqlServer" source: Firefly.exe, 00000000.00000002.2140995378.000001EEF1D48000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: PresentationFramework.ni.pdb source: WER98EA.tmp.dmp.4.dr
Source:	Binary string: PresentationCore.pdb source: WER98EA.tmp.dmp.4.dr
Source:	Binary string: System.ni.pdb source: WER98EA.tmp.dmp.4.dr
Source:	Binary string: System.Core.ni.pdbRSDS source: WER98EA.tmp.dmp.4.dr

Networking

Source: Amcache.hve.4.dr	String found in binary or memory: http://upx.sf.net
Source: Firefly.exe	String found in binary or memory: http://www.apple.com/This
Source: Firefly.exe	String found in binary or memory: https://ezgif.com/resizeX
Source: Firefly.exe	String found in binary or memory: https://getwave.gg7/Assets/Images/Ads/LVAd.jpgYhttps://publisher.linkvertise.com/ac/1138912?/Assets/
Source: Firefly.exe	String found in binary or memory: https://scriptblox.com/api/script/
Source: Firefly.exe	String found in binary or memory: https://scriptblox.com/api/script/fetch?page=whttps://scriptblox.com/api/script/search?filters=free&
Source: Firefly.exe	String found in binary or memory: https://scriptblox.comCwindow.updateOptions(
Source: Firefly.exe	String found in binary or memory: https://thumbnails.roblox.com/v1/users/avatar-headshot?userIds=1&size=48x48&format=Png&isCircular=tr

System Summary

Source: C:\Users\user\Desktop\Firefly.exe

Code function: 0_2_00007FF848F20F1A

0_2_00007FF848F20F1A

Source: C:\Users\user\Desktop\Firefly.exe

Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 2352 -s 1056

Source: Firefly.exe

Static PE information: No import functions for PE file found

Source: Firefly.exe

Binary or memory string: OriginalFilenameWave.exe* vs Firefly.exe

Source: classification engine

Classification label: clean4.winEXE@2/5@0/0

Source: C:\Users\user\Desktop\Firefly.exe	Mutant created: NULL
Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess2352

Source: C:\Windows\System32\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\a72f33de-5b93-4be0-bb37-d01191d3a98c

Jump to behavior

Source: Firefly.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: Firefly.exe

Static file information: TRID: Win64 Executable GUI Net Framework (217006/5) 49.88%

Source: C:\Users\user\Desktop\Firefly.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Firefly.exe

String found in binary or memory: -ADDDA-

Source: C:\Users\user\Desktop\Firefly.exe

File read: C:\Users\user\Desktop\Firefly.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Firefly.exe "C:\Users\user\Desktop\Firefly.exe"
Source: C:\Users\user\Desktop\Firefly.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 2352 -s 1056

Source: C:\Users\user\Desktop\Firefly.exe	Section loaded: mscoree.dll			Jump to behavior
Source: C:\Users\user\Desktop\Firefly.exe	Section loaded: apphelp.dll			Jump to behavior
Source: C:\Users\user\Desktop\Firefly.exe	Section loaded: kernel.appcore.dll			Jump to behavior
Source: C:\Users\user\Desktop\Firefly.exe	Section loaded: version.dll			Jump to behavior
Source: C:\Users\user\Desktop\Firefly.exe	Section loaded: vcruntime140_clr0400.dll			Jump to behavior
Source: C:\Users\user\Desktop\Firefly.exe	Section loaded: ucrtbase_clr0400.dll			Jump to behavior
Source: C:\Users\user\Desktop\Firefly.exe	Section loaded: ucrtbase_clr0400.dll			Jump to behavior
Source: C:\Users\user\Desktop\Firefly.exe	Section loaded: uxtheme.dll			Jump to behavior
Source: C:\Users\user\Desktop\Firefly.exe	Section loaded: cryptsp.dll			Jump to behavior
Source: C:\Users\user\Desktop\Firefly.exe	Section loaded: rsaenh.dll			Jump to behavior
Source: C:\Users\user\Desktop\Firefly.exe	Section loaded: cryptbase.dll			Jump to behavior
Source: C:\Users\user\Desktop\Firefly.exe	Section loaded: dwrite.dll			Jump to behavior
Source: C:\Users\user\Desktop\Firefly.exe	Section loaded: msvcp140_clr0400.dll			Jump to behavior
Source: C:\Users\user\Desktop\Firefly.exe	Section loaded: windows.storage.dll			Jump to behavior
Source: C:\Users\user\Desktop\Firefly.exe	Section loaded: wldp.dll			Jump to behavior
Source: C:\Users\user\Desktop\Firefly.exe	Section loaded: profapi.dll			Jump to behavior

Source: C:\Users\user\Desktop\Firefly.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\Firefly.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: Firefly.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: Firefly.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: Firefly.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: Firefly.exe

Static file information: File size 7502848 > 1048576

Source: Firefly.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x703000

Source: Firefly.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: Firefly.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: PresentationFramework.pdb source: Firefly.exe, 00000000.00000002.2140521915.000001EE80001000.00000004.00000800.00020000.00000000.sdmp, WER98EA.tmp.dmp.4.dr
Source:	Binary string: System.Xml.ni.pdb source: WER98EA.tmp.dmp.4.dr
Source:	Binary string: WindowsBase.ni.pdb source: WER98EA.tmp.dmp.4.dr
Source:	Binary string: System.ni.pdbRSDS source: WER98EA.tmp.dmp.4.dr
Source:	Binary string: WindowsBase.ni.pdbRSDS source: WER98EA.tmp.dmp.4.dr
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\PresentationFramework\v4.0_4.0.0.0__31bf3856ad364e35\PresentationFramework.pdb</prov source: Firefly.exe, 00000000.00000002.2140995378.000001EEF1D48000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: sBase.pdb32* source: Firefly.exe, 00000000.00000002.2142136364.000001EEF4110000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.pdb9u source: WER98EA.tmp.dmp.4.dr
Source:	Binary string: System.Configuration.ni.pdb source: WER98EA.tmp.dmp.4.dr
Source:	Binary string: mscorlib.ni.pdbRSDS7^3l source: WER98EA.tmp.dmp.4.dr
Source:	Binary string: System.Configuration.pdb source: WER98EA.tmp.dmp.4.dr
Source:	Binary string: System.Xml.pdb source: WER98EA.tmp.dmp.4.dr
Source:	Binary string: System.pdb source: WER98EA.tmp.dmp.4.dr
Source:	Binary string: System.Xml.ni.pdbRSDS# source: WER98EA.tmp.dmp.4.dr
Source:	Binary string: System.Core.ni.pdb source: WER98EA.tmp.dmp.4.dr
Source:	Binary string: PresentationFramework.ni.pdbRSDS source: WER98EA.tmp.dmp.4.dr
Source:	Binary string: System.Core.pdb0 source: WER98EA.tmp.dmp.4.dr
Source:	Binary string: PresentationCore.ni.pdbRSDS source: WER98EA.tmp.dmp.4.dr
Source:	Binary string: #cefsharp.browsersubprocess.core.pdb# source: Firefly.exe
Source:	Binary string: WindowsBase.pdb source: Firefly.exe, 00000000.00000002.2140521915.000001EE80001000.00000004.00000800.00020000.00000000.sdmp, WER98EA.tmp.dmp.4.dr
Source:	Binary string: System.Xaml.ni.pdb source: WER98EA.tmp.dmp.4.dr
Source:	Binary string: mscorlib.pdb source: Firefly.exe, 00000000.00000002.2140521915.000001EE80001000.00000004.00000800.00020000.00000000.sdmp, WER98EA.tmp.dmp.4.dr
Source:	Binary string: cefsharp.browsersubprocess.pdb source: Firefly.exe
Source:	Binary string: System.Xaml.ni.pdbRSDSDg{V source: WER98EA.tmp.dmp.4.dr
Source:	Binary string: PresentationCore.ni.pdb source: WER98EA.tmp.dmp.4.dr
Source:	Binary string: System.Xaml.pdb source: WER98EA.tmp.dmp.4.dr
Source:	Binary string: mscorlib.ni.pdb source: WER98EA.tmp.dmp.4.dr
Source:	Binary string: System.Core.pdb source: WER98EA.tmp.dmp.4.dr
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\PresentationFramework\v4.0_4.0.0.0__31bf3856ad364e35\PresentationFramework.pdb <tr\ source: Firefly.exe, 00000000.00000002.2140995378.000001EEF1D48000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Configuration.pdbH source: WER98EA.tmp.dmp.4.dr
Source:	Binary string: #cefsharp.browsersubprocess.core.pdb source: Firefly.exe
Source:	Binary string: mscorlib.pdb maxInvalidPasswordAttempts="5" source: Firefly.exe, 00000000.00000002.2140995378.000001EEF1D48000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: cefsharp.core.runtime.pdb source: Firefly.exe
Source:	Binary string: C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdbl source: Firefly.exe, 00000000.00000002.2140995378.000001EEF1D48000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Configuration.ni.pdbRSDScUN source: WER98EA.tmp.dmp.4.dr
Source:	Binary string: WindowsBase.pdbework.pdbLocalSqlServer" source: Firefly.exe, 00000000.00000002.2140995378.000001EEF1D48000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: PresentationFramework.ni.pdb source: WER98EA.tmp.dmp.4.dr
Source:	Binary string: PresentationCore.pdb source: WER98EA.tmp.dmp.4.dr
Source:	Binary string: System.ni.pdb source: WER98EA.tmp.dmp.4.dr
Source:	Binary string: System.Core.ni.pdbRSDS source: WER98EA.tmp.dmp.4.dr

Data Obfuscation

Source: Firefly.exe

Static PE information: 0xF5FD5E85 [Tue Oct 12 11:12:05 2100 UTC]

Hooking and other Techniques for Hiding and Protection

Source: C:\Users\user\Desktop\Firefly.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Firefly.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Firefly.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Firefly.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Firefly.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Firefly.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Firefly.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Firefly.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Firefly.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Firefly.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Firefly.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Firefly.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Firefly.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Firefly.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Firefly.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Firefly.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Firefly.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Firefly.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Firefly.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Firefly.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Firefly.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Firefly.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Firefly.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Firefly.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Firefly.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Firefly.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Firefly.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Firefly.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Firefly.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Firefly.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Firefly.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Firefly.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Firefly.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Firefly.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Firefly.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion

Source: C:\Users\user\Desktop\Firefly.exe	Memory allocated: 1EEF1F60000 memory reserve | memory write watch			Jump to behavior
Source: C:\Users\user\Desktop\Firefly.exe	Memory allocated: 1EEF3850000 memory reserve | memory write watch			Jump to behavior

Source: Amcache.hve.4.dr	Binary or memory string: VMware
Source: Amcache.hve.4.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.4.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.4.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.4.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.4.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.4.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.4.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.4.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.4.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.4.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.4.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.4.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.4.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.4.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.4.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.4.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.4.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.4.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.4.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.4.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.4.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.4.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.4.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.4.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Anti Debugging

Source: C:\Users\user\Desktop\Firefly.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\Firefly.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\Firefly.exe

Memory allocated: page read and write | page guard

Jump to behavior

Language, Device and Operating System Detection

Source: C:\Users\user\Desktop\Firefly.exe

Queries volume information: C:\Users\user\Desktop\Firefly.exe VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\Firefly.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Source: Amcache.hve.4.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.4.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.4.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.4.dr	Binary or memory string: MsMpEng.exe