Edit tour

Windows Analysis Report
MSI629D.exe

Overview

General Information

Sample name:	MSI629D.exe (renamed file extension from tmp to exe)
Original sample name:	MSI629D.tmp
Analysis ID:	1431740
MD5:	77fada8cefee7aa4f3a83f299b6bc550
SHA1:	7745ac4ffb86f9a8d6f42683f34b1656d9c03a48
SHA256:	c97c60f0aea64a0b7dc121c9d6889ee7350a25490a1062d1e4a5b3feb5427f9b
Infos:

Detection

Score:	52
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Found potential dummy code loops (likely to delay analysis)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found large amount of non-executed APIs

May sleep (evasive loops) to hinder dynamic analysis

Program does not show much activity (idle)

Sample execution stops while process was sleeping (likely an evasion)

Uses 32bit PE files

Classification

Process Tree

System is w10x64native

MSI629D.exe (PID: 1640 cmdline: "C:\Users\user\Desktop\MSI629D.exe" MD5: 77FADA8CEFEE7AA4F3A83F299B6BC550)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: MSI629D.exe	ReversingLabs: Detection: 13%
Source: MSI629D.exe	Virustotal: Detection: 15%			Perma Link

Source: MSI629D.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: MSI629D.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\MSI629D.exe

Code function: 1_2_00FD4AFA FindFirstFileExW,

1_2_00FD4AFA

Source: C:\Users\user\Desktop\MSI629D.exe

Code function: 1_2_00FDAF8D

1_2_00FDAF8D

Source: MSI629D.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: mal52.evad.winEXE@1/0@0/0

Source: MSI629D.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\MSI629D.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: MSI629D.exe	ReversingLabs: Detection: 13%
Source: MSI629D.exe	Virustotal: Detection: 15%

Source: C:\Users\user\Desktop\MSI629D.exe	Section loaded: apphelp.dll			Jump to behavior
Source: C:\Users\user\Desktop\MSI629D.exe	Section loaded: edgegdi.dll			Jump to behavior

Source: MSI629D.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: MSI629D.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: MSI629D.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: MSI629D.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: MSI629D.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: MSI629D.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: MSI629D.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: MSI629D.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: MSI629D.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: MSI629D.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: MSI629D.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: MSI629D.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: MSI629D.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\MSI629D.exe	Window / User API: threadDelayed 1028			Jump to behavior
Source: C:\Users\user\Desktop\MSI629D.exe	Window / User API: threadDelayed 8971			Jump to behavior

Source: C:\Users\user\Desktop\MSI629D.exe

API coverage: 3.5 %

Source: C:\Users\user\Desktop\MSI629D.exe TID: 6220	Thread sleep count: 1028 > 30	Jump to behavior
Source: C:\Users\user\Desktop\MSI629D.exe TID: 6220	Thread sleep time: -205600s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MSI629D.exe TID: 6220	Thread sleep count: 8971 > 30	Jump to behavior
Source: C:\Users\user\Desktop\MSI629D.exe TID: 6220	Thread sleep time: -1794200s >= -30000s	Jump to behavior

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\MSI629D.exe	Last function: Thread delayed
Source: C:\Users\user\Desktop\MSI629D.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\MSI629D.exe

Code function: 1_2_00FD4AFA FindFirstFileExW,

1_2_00FD4AFA

Anti Debugging

Found potential dummy code loops (likely to delay analysis)

Source: C:\Users\user\Desktop\MSI629D.exe

Process Stats: CPU usage > 5% for more than 60s

Source: C:\Users\user\Desktop\MSI629D.exe

Code function: 1_2_00FD4442 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

1_2_00FD4442

Source: C:\Users\user\Desktop\MSI629D.exe	Code function: 1_2_00FD34CF mov eax, dword ptr fs:[00000030h]		1_2_00FD34CF
Source: C:\Users\user\Desktop\MSI629D.exe	Code function: 1_2_00FD5C27 mov eax, dword ptr fs:[00000030h]		1_2_00FD5C27

Source: C:\Users\user\Desktop\MSI629D.exe

Code function: 1_2_00FD6D42 GetProcessHeap,

1_2_00FD6D42

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\MSI629D.exe	Code function: 1_2_00FD4442 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_00FD4442
Source: C:\Users\user\Desktop\MSI629D.exe	Code function: 1_2_00FD196E SetUnhandledExceptionFilter,	1_2_00FD196E
Source: C:\Users\user\Desktop\MSI629D.exe	Code function: 1_2_00FD17DA IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_00FD17DA
Source: C:\Users\user\Desktop\MSI629D.exe	Code function: 1_2_00FD134E SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_00FD134E

Source: C:\Users\user\Desktop\MSI629D.exe

Code function: 1_2_00FD1A75 cpuid

1_2_00FD1A75

Source: C:\Users\user\Desktop\MSI629D.exe

Code function: 1_2_00FD16C1 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

1_2_00FD16C1

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	111 Virtualization/Sandbox Evasion	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 DLL Side-Loading	LSASS Memory	12 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	111 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	12 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
MSI629D.exe	13%	ReversingLabs
MSI629D.exe	15%	Virustotal		Browse

Domains and IPs

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1431740
Start date and time:	2024-04-25 17:33:57 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 42s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit 20H2 Native physical Machine for testing VM-aware malware (Office 2019, Chrome 93, Firefox 91, Adobe Reader DC 21, Java 8 Update 301
Number of analysed new started processes analysed:	3
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	MSI629D.exe (renamed file extension from tmp to exe)
Original Sample Name:	MSI629D.tmp
Detection:	MAL
Classification:	mal52.evad.winEXE@1/0@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 1 Number of non-executed functions: 15
Cookbook Comments:	Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information.
Exclude process from analysis (whitelisted): dllhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): spclient.wg.spotify.com

Simulations

Behavior and APIs

Time	Type	Description
17:36:28	API Interceptor	5976234x Sleep call for process: MSI629D.exe modified

Joe Sandbox View / Context

Instruction
call 00007FC0546A3BAAh
jmp 00007FC0546A365Fh
push ebp
mov ebp, esp
push 00000000h
call dword ptr [0040C014h]
push dword ptr [ebp+08h]
call dword ptr [0040C010h]
push C0000409h
call dword ptr [0040C018h]
push eax
call dword ptr [0040C01Ch]
pop ebp
ret
push ebp
mov ebp, esp
sub esp, 00000324h
push 00000017h
call dword ptr [0040C020h]
test eax, eax
je 00007FC0546A37E7h
push 00000002h
pop ecx
int 29h
mov dword ptr [00412980h], eax
mov dword ptr [0041297Ch], ecx
mov dword ptr [00412978h], edx
mov dword ptr [00412974h], ebx
mov dword ptr [00412970h], esi
mov dword ptr [0041296Ch], edi
mov word ptr [00412998h], ss
mov word ptr [0041298Ch], cs
mov word ptr [00412968h], ds
mov word ptr [00412964h], es
mov word ptr [00412960h], fs
mov word ptr [0041295Ch], gs
pushfd
pop dword ptr [00412990h]
mov eax, dword ptr [ebp+00h]
mov dword ptr [00412984h], eax
mov eax, dword ptr [ebp+04h]
mov dword ptr [00412988h], eax
lea eax, dword ptr [ebp+08h]
mov dword ptr [00412994h], eax
mov eax, dword ptr [ebp-00000324h]
mov dword ptr [004128D0h], 00010001h

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x11414	0x3c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x14000	0x1e8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x15000	0xdb0	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x10c5c	0x38	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x10c98	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xc000	0x110	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xa788	0xa800	0213cb3fd44e32a1150e62f9dba3e4eb	False	0.6081891741071429	data	6.578346720442577	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0xc000	0x5a2e	0x5c00	bd26716b0743f4ebbbc366467ec46441	False	0.41193953804347827	data	4.768984935940302	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x12000	0x12ac	0xa00	8245e874002ffac1699edd3578be0b90	False	0.13671875	data	1.8066449089245316	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x14000	0x1e8	0x200	f3e56eddbe8fc87469d99b8983dd36f7	False	0.537109375	data	4.7644199514493595	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x15000	0xdb0	0xe00	134f12380b5ebfb5d5ab645cb78b0047	False	0.7731584821428571	data	6.440107108868493	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x14060	0x188	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5892857142857143

DLL	Import
KERNEL32.dll	Sleep, WriteConsoleW, CloseHandle, CreateFileW, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, TerminateProcess, IsProcessorFeaturePresent, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, GetStartupInfoW, GetModuleHandleW, RtlUnwind, GetLastError, SetLastError, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, FreeLibrary, GetProcAddress, LoadLibraryExW, RaiseException, GetStdHandle, WriteFile, GetModuleFileNameW, ExitProcess, GetModuleHandleExW, HeapAlloc, HeapFree, FindClose, FindFirstFileExW, FindNextFileW, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, GetCommandLineA, GetCommandLineW, MultiByteToWideChar, WideCharToMultiByte, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetStdHandle, GetFileType, GetStringTypeW, LCMapStringW, GetProcessHeap, HeapSize, HeapReAlloc, FlushFileBuffers, GetConsoleOutputCP, GetConsoleMode, SetFilePointerEx, DecodePointer
USER32.dll	FindWindowW, SetWindowPos

Sleep, WriteConsoleW, CloseHandle, CreateFileW, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, TerminateProcess, IsProcessorFeaturePresent, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, GetStartupInfoW, GetModuleHandleW, RtlUnwind, GetLastError, SetLastError, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, FreeLibrary, GetProcAddress, LoadLibraryExW, RaiseException, GetStdHandle, WriteFile, GetModuleFileNameW, ExitProcess, GetModuleHandleExW, HeapAlloc, HeapFree, FindClose, FindFirstFileExW, FindNextFileW, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, GetCommandLineA, GetCommandLineW, MultiByteToWideChar, WideCharToMultiByte, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetStdHandle, GetFileType, GetStringTypeW, LCMapStringW, GetProcessHeap, HeapSize, HeapReAlloc, FlushFileBuffers, GetConsoleOutputCP, GetConsoleMode, SetFilePointerEx, DecodePointer

USER32.dll

FindWindowW, SetWindowPos

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Target ID:	1
Start time:	17:35:57
Start date:	25/04/2024
Path:	C:\Users\user\Desktop\MSI629D.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\MSI629D.exe"
Imagebase:	0xfd0000
File size:	74'240 bytes
MD5 hash:	77FADA8CEFEE7AA4F3A83F299B6BC550
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	1.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	2.6%
Total number of Nodes:	1627
Total number of Limit Nodes:	3

Executed Functions

Function 00FD1000 Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 109
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindWindowW.USER32(00000000,DameWare Licensor), ref: 00FD1022
FindWindowW.USER32(00000000,DameWare Server Configuration Wizard), ref: 00FD102D
SetWindowPos.USER32(00000000,000000FF,00000000,00000000,00000000,00000000,00000003), ref: 00FD1048
SetWindowPos.USER32(00000000,000000FE,00000000,00000000,00000000,00000000,00000003), ref: 00FD1053
Sleep.KERNEL32(000000C8), ref: 00FD105E
SetWindowPos.USER32(00000000,000000FF,00000000,00000000,00000000,00000000,00000003), ref: 00FD107D
SetWindowPos.USER32(00000000,000000FE,00000000,00000000,00000000,00000000,00000003), ref: 00FD108C
Sleep.KERNELBASE(000000C8), ref: 00FD1097
SetWindowPos.USER32(00000000,000000FF,00000000,00000000,00000000,00000000,00000003), ref: 00FD10AF
SetWindowPos.USER32(00000000,000000FF,00000000,00000000,00000000,00000000,00000003), ref: 00FD10BE
Sleep.KERNEL32(000000C8), ref: 00FD10C5
SetWindowPos.USER32(00000000,000000FE,00000000,00000000,00000000,00000000,00000003), ref: 00FD10D8
SetWindowPos.USER32(00000000,000000FE,00000000,00000000,00000000,00000000,00000003), ref: 00FD10E7

Strings

DameWare Licensor, xrefs: 00FD101B
DameWare Server Configuration Wizard, xrefs: 00FD1024

Memory Dump Source

Source File: 00000001.00000002.52942187125.0000000000FD1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.52942158869.0000000000FD0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.52942223273.0000000000FDC000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.52942254388.0000000000FE2000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.52942278476.0000000000FE4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_MSI629D.jbxd

Similarity

API ID: Window$Sleep$Find
String ID: DameWare Licensor$DameWare Server Configuration Wizard
API String ID: 3962709634-922529585
Opcode ID: ecafc6324311c65fdb9b540e8cd0573e643f2ccd4c9e8a68bd2ca1fb84b17c88
Instruction ID: 488a54b0f73f58e409cc777b505bb0ff2b1bb6b9ed0899c531ca0563c3370efc
Opcode Fuzzy Hash: ecafc6324311c65fdb9b540e8cd0573e643f2ccd4c9e8a68bd2ca1fb84b17c88
Instruction Fuzzy Hash: B13192317CA3A975F631226A5C4FF5B6E1D9F82F30F354301F3247D2D189E46A44A2A9

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00FD17DA Relevance: 6.1, APIs: 4, Instructions: 73
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 00FD17E6
IsDebuggerPresent.KERNEL32 ref: 00FD18B2
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00FD18D2
UnhandledExceptionFilter.KERNEL32(?), ref: 00FD18DC

Memory Dump Source

Source File: 00000001.00000002.52942187125.0000000000FD1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.52942158869.0000000000FD0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.52942223273.0000000000FDC000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.52942254388.0000000000FE2000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.52942278476.0000000000FE4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_MSI629D.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: bfb75d94e71255e1913bdd6bfa7036af9d2e9d37c38721776ea86d121b8a539a
Instruction ID: 4d8171007115bdd971205ce41d1ef55cbeef65ba5342af767f6589f3bbd9abef
Opcode Fuzzy Hash: bfb75d94e71255e1913bdd6bfa7036af9d2e9d37c38721776ea86d121b8a539a
Instruction Fuzzy Hash: 78312975D0121DDBDB20DFA4D9497CDBBB8BF08304F1041AAE40CA7250EB749A84DF45

Uniqueness

Uniqueness Score: -1.00%

Function 00FD16C1 Relevance: 6.0, APIs: 4, Instructions: 25
timethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemTimeAsFileTime.KERNEL32(00000000), ref: 00FD16D3
GetCurrentThreadId.KERNEL32 ref: 00FD16E2
GetCurrentProcessId.KERNEL32 ref: 00FD16EB
QueryPerformanceCounter.KERNEL32(?), ref: 00FD16F8

Memory Dump Source

Source File: 00000001.00000002.52942187125.0000000000FD1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.52942158869.0000000000FD0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.52942223273.0000000000FDC000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.52942254388.0000000000FE2000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.52942278476.0000000000FE4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_MSI629D.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 138152a38e1144a3208f8ea41d175e9bb120d71fd9ecbf768657af34b94d43e2
Instruction ID: 281251279267e49a7a3e679825a86a482ea61f789a30b8971a6dbe0c64dd0a61
Opcode Fuzzy Hash: 138152a38e1144a3208f8ea41d175e9bb120d71fd9ecbf768657af34b94d43e2
Instruction Fuzzy Hash: C2F04D75C1120DEBCB00DBB4D949A9EBBF8EF18315F518496D412E6150D634AB04DB91

Uniqueness

Uniqueness Score: -1.00%

Function 00FD134E Relevance: 6.0, APIs: 4, Instructions: 12
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00FD1353
UnhandledExceptionFilter.KERNEL32(?), ref: 00FD135C
GetCurrentProcess.KERNEL32(C0000409), ref: 00FD1367
TerminateProcess.KERNEL32(00000000), ref: 00FD136E

Memory Dump Source

Source File: 00000001.00000002.52942187125.0000000000FD1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.52942158869.0000000000FD0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.52942223273.0000000000FDC000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.52942254388.0000000000FE2000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.52942278476.0000000000FE4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_MSI629D.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentTerminate
String ID:
API String ID: 3231755760-0
Opcode ID: 0fb33453e7241c167556250cd9ed7371b9343a5dab67221f32b336bbd9e878b5
Instruction ID: 39fcce165a91a80ce409373f1a743bfec0a41ed1b7dd63da7caafcdd781ee432
Opcode Fuzzy Hash: 0fb33453e7241c167556250cd9ed7371b9343a5dab67221f32b336bbd9e878b5
Instruction Fuzzy Hash: 58D0123300110DEBCB102BF0EC0CA48BF2AEB04A86F004402F309C1031CB314401FBE1

Uniqueness

Uniqueness Score: -1.00%

Function 00FD4442 Relevance: 4.6, APIs: 3, Instructions: 77
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 00FD453A
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 00FD4544
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?), ref: 00FD4551

Memory Dump Source

Source File: 00000001.00000002.52942187125.0000000000FD1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.52942158869.0000000000FD0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.52942223273.0000000000FDC000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.52942254388.0000000000FE2000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.52942278476.0000000000FE4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_MSI629D.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 06a4e6239a5e8dfce0987c48aa99ec5a1019aa524ca372e6784c3e20bbeede41
Instruction ID: 205b167e92d4d451657c30a6dfa295870e2b3877f79dd9eb892d0631a66fae11
Opcode Fuzzy Hash: 06a4e6239a5e8dfce0987c48aa99ec5a1019aa524ca372e6784c3e20bbeede41
Instruction Fuzzy Hash: 0131D27490122CABCB21DF64DC8978CBBB9BF08350F5441EAE40CA7290E7349F859F45

Uniqueness

Uniqueness Score: -1.00%

Function 00FD34CF Relevance: 4.5, APIs: 3, Instructions: 20
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(?,?,00FD34CE,?,?,?,?,?,00FD8FEE), ref: 00FD34F1
TerminateProcess.KERNEL32(00000000,?,00FD34CE,?,?,?,?,?,00FD8FEE), ref: 00FD34F8
ExitProcess.KERNEL32 ref: 00FD350A

Memory Dump Source

Source File: 00000001.00000002.52942187125.0000000000FD1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.52942158869.0000000000FD0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.52942223273.0000000000FDC000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.52942254388.0000000000FE2000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.52942278476.0000000000FE4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_MSI629D.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: b6457ae785191d2657333eacc6c9a2857173a93038684a3c9e7f4cfec99b2ea8
Instruction ID: 45ba2fe2722edadea06d8ba4d8e575b8885d41cf8cdf7abf171d6ff6cd47efb7
Opcode Fuzzy Hash: b6457ae785191d2657333eacc6c9a2857173a93038684a3c9e7f4cfec99b2ea8
Instruction Fuzzy Hash: 28E04632401109EBCF226B34DC4DA493B6BEB00B92B088512F904C6231CB39DE82FA91

Uniqueness

Uniqueness Score: -1.00%

Function 00FDAF8D Relevance: 1.8, APIs: 1, Instructions: 274COMMON

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,00FDAF88,?,?,00000008,?,?,00FDAC20,00000000), ref: 00FDB1BA

Memory Dump Source

Source File: 00000001.00000002.52942187125.0000000000FD1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.52942158869.0000000000FD0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.52942223273.0000000000FDC000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.52942254388.0000000000FE2000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.52942278476.0000000000FE4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_MSI629D.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 168df17ccec3fcfe331a0f288d4d8c6415759059e2936384f8abc1b7507e82a6
Instruction ID: f2a49daaaef79963c04ebfad182bf82fa2c83036ffbfa6d84a98a772d60ec6ad
Opcode Fuzzy Hash: 168df17ccec3fcfe331a0f288d4d8c6415759059e2936384f8abc1b7507e82a6
Instruction Fuzzy Hash: 9EB18032610604CFDB15CF28C48AB657BE1FF45365F2A8659E899CF3A1C336E981DB40

Uniqueness

Uniqueness Score: -1.00%

Function 00FD1A75 Relevance: 1.6, APIs: 1, Instructions: 144COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 00FD1A8B

Memory Dump Source

Source File: 00000001.00000002.52942187125.0000000000FD1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.52942158869.0000000000FD0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.52942223273.0000000000FDC000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.52942254388.0000000000FE2000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.52942278476.0000000000FE4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_MSI629D.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: 3811bf2ed86bfc82f9ad0b52d03716493608d8cb7b0271e4c34f57609ce058f9
Instruction ID: b8d7704942ad86540d03a4e52e8bdb409d08269ac40739dc16b9134a48fa043e
Opcode Fuzzy Hash: 3811bf2ed86bfc82f9ad0b52d03716493608d8cb7b0271e4c34f57609ce058f9
Instruction Fuzzy Hash: 26516EB1D152099FDB24CF54DC957AABBF6FB88320F18896BD445EB350E3B49A00EB50

Uniqueness

Uniqueness Score: -1.00%

Function 00FD4AFA Relevance: 1.6, APIs: 1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.52942187125.0000000000FD1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.52942158869.0000000000FD0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.52942223273.0000000000FDC000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.52942254388.0000000000FE2000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.52942278476.0000000000FE4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_MSI629D.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d73a0d2fdd0ad494dfa1f143080eea8e8b6201a89862874c6b029e59a7f40ba7
Instruction ID: c80801fe75d18fcb07689b42ef4925373ec960e31c0b5f10484a1abd307248f2
Opcode Fuzzy Hash: d73a0d2fdd0ad494dfa1f143080eea8e8b6201a89862874c6b029e59a7f40ba7
Instruction Fuzzy Hash: 2A419371C0421CAFDB20DF69CC89AAAB7BAEF45310F1842DAE41DD3341DA35AE849F50

Uniqueness

Uniqueness Score: -1.00%

Function 00FD196E Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_0000197A,00FD11BB), ref: 00FD1973

Memory Dump Source

Source File: 00000001.00000002.52942187125.0000000000FD1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.52942158869.0000000000FD0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.52942223273.0000000000FDC000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.52942254388.0000000000FE2000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.52942278476.0000000000FE4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_MSI629D.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 8c5159a4e451ffe4e5128e7723dfc8694932a169fe1c5e90c8dc00a2f7c32e5d
Instruction ID: bf6f29d2741c0c77a2c732cac6e616c726b3036ecc28a946c5c1f50bc726901f
Opcode Fuzzy Hash: 8c5159a4e451ffe4e5128e7723dfc8694932a169fe1c5e90c8dc00a2f7c32e5d
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 00FD6D42 Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00FD6D42

Memory Dump Source

Source File: 00000001.00000002.52942187125.0000000000FD1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.52942158869.0000000000FD0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.52942223273.0000000000FDC000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.52942254388.0000000000FE2000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.52942278476.0000000000FE4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_MSI629D.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 3a3dfd33a06af22ad57213dd2c58dbe5d6842b86c82f18f22ee5c6758b669840
Instruction ID: 8934615dae18010a14127e2d137db6bca5cd73caf1c920cf8e7113956d3e8696
Opcode Fuzzy Hash: 3a3dfd33a06af22ad57213dd2c58dbe5d6842b86c82f18f22ee5c6758b669840
Instruction Fuzzy Hash: 6AA01230201185DB43004F30694C308379966401D0300C0155001C6030D6204240B601

Uniqueness

Uniqueness Score: -1.00%

Function 00FD5C27 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.52942187125.0000000000FD1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.52942158869.0000000000FD0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.52942223273.0000000000FDC000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.52942254388.0000000000FE2000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.52942278476.0000000000FE4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_MSI629D.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 284f938f10376bfbf95834657a6d04f28244e4b62c26eaf15e5c7356afc3666f
Instruction ID: ffd020eb26270bf1079340ab10e5a416b1433238363f6f54208b964674e3518c
Opcode Fuzzy Hash: 284f938f10376bfbf95834657a6d04f28244e4b62c26eaf15e5c7356afc3666f
Instruction Fuzzy Hash: 8BE08C32921628EBCB15EFD8C90498AF3EDEB44F50B194497B501E3200C274DE00DBD0

Uniqueness

Uniqueness Score: -1.00%

Function 00FD68F3 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 77
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

api-ms-, xrefs: 00FD694A
ext-ms-, xrefs: 00FD695E

Memory Dump Source

Source File: 00000001.00000002.52942187125.0000000000FD1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.52942158869.0000000000FD0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.52942223273.0000000000FDC000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.52942254388.0000000000FE2000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.52942278476.0000000000FE4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_MSI629D.jbxd

Similarity

API ID:
String ID: api-ms-$ext-ms-
API String ID: 0-537541572
Opcode ID: b8e3be79327ef95765662b3d02a0e1f66ffb86a7e38fc68ab3c62887ec9a6a26
Instruction ID: ac521ca4dca901d3b2ee6155e5646fca629c4c5b92665711e0d7e6ac5222ab03
Opcode Fuzzy Hash: b8e3be79327ef95765662b3d02a0e1f66ffb86a7e38fc68ab3c62887ec9a6a26
Instruction Fuzzy Hash: 1221D572E02225EBDB218B349C95B1A776A9F517B0F1C0213E905E7390D630ED08F5D2

Uniqueness

Uniqueness Score: -1.00%

Function 00FD23E3 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(00000000,?,?,?,00FD24A4,?,?,00FE2C14,00000000,?,00FD25CF,00000004,InitializeCriticalSectionEx,00FDCC04,InitializeCriticalSectionEx,00000000), ref: 00FD2473

Strings

api-ms-, xrefs: 00FD2433

Memory Dump Source

Source File: 00000001.00000002.52942187125.0000000000FD1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.52942158869.0000000000FD0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.52942223273.0000000000FDC000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.52942254388.0000000000FE2000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.52942278476.0000000000FE4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_MSI629D.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-
API String ID: 3664257935-2084034818
Opcode ID: f3ec9fa5494d494a8c7eb208511e454c87a133bb1518a4f364d05cd6d3cd6ce1
Instruction ID: 12987a9def85cc19c51a685ad650ad190a5e6b661e330174b80018f06ec3a48a
Opcode Fuzzy Hash: f3ec9fa5494d494a8c7eb208511e454c87a133bb1518a4f364d05cd6d3cd6ce1
Instruction Fuzzy Hash: 0511C132E02625EBDB62CB28EC45B593396AB22771F190312ED54E7381D660ED00A6D1

Uniqueness

Uniqueness Score: -1.00%

Function 00FD3511 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 30
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,00FD3506,?,?,00FD34CE,?,?,?), ref: 00FD3526
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00FD3539
FreeLibrary.KERNEL32(00000000,?,?,00FD3506,?,?,00FD34CE,?,?,?), ref: 00FD355C

Strings

mscoree.dll, xrefs: 00FD351F
CorExitProcess, xrefs: 00FD3531

Memory Dump Source

Source File: 00000001.00000002.52942187125.0000000000FD1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.52942158869.0000000000FD0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.52942223273.0000000000FDC000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.52942254388.0000000000FE2000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.52942278476.0000000000FE4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_MSI629D.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 822e373f60996e4bfcd4553446ae599535c155ff5bc64071251543e45972a474
Instruction ID: 1b1cbe8fb2415023abd4d753874de7e1611411f33980f1b9f222ed10098f14ba
Opcode Fuzzy Hash: 822e373f60996e4bfcd4553446ae599535c155ff5bc64071251543e45972a474
Instruction Fuzzy Hash: 83F0823190111AFBCB119B65ED0DB9D7B76EB00755F084062E605E22A0CB708F00FBD1

Uniqueness

Uniqueness Score: -1.00%

Function 00FD86EC Relevance: 6.3, APIs: 4, Instructions: 317
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetConsoleOutputCP.KERNEL32(?,00000001,?), ref: 00FD8734
WriteFile.KERNEL32(?,00FD729A,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00FD897E
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00FD89BE
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 00FD8A66

Memory Dump Source

Source File: 00000001.00000002.52942187125.0000000000FD1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000001.00000002.52942158869.0000000000FD0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.52942223273.0000000000FDC000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.52942254388.0000000000FE2000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.52942278476.0000000000FE4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fd0000_MSI629D.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 0c0d85d71eef60c5491e0edd63cd70a3eef64864e5bf90084bd142b395f73ef0
Instruction ID: e93bce66397f85f645ef7ced52a87e3763e703cddbd793a282bf5742e06a7960
Opcode Fuzzy Hash: 0c0d85d71eef60c5491e0edd63cd70a3eef64864e5bf90084bd142b395f73ef0
Instruction Fuzzy Hash: B9C17E75D002989FCB15CFA8C8809EDBBB6EF08314F28416BE855FB345E6359E42DB60

Uniqueness

Uniqueness Score: -1.00%

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.2019867409486835
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	MSI629D.exe
File size:	74'240 bytes
MD5:	77fada8cefee7aa4f3a83f299b6bc550
SHA1:	7745ac4ffb86f9a8d6f42683f34b1656d9c03a48
SHA256:	c97c60f0aea64a0b7dc121c9d6889ee7350a25490a1062d1e4a5b3feb5427f9b
SHA512:	a01e49154922e6d181b788747802c0f9c7177d81c5b7ebbe91eaef373bc20087ebe9560e69d81e21910f62b9f0d0d4ec7338fa4e0ecc794f40faefff25bc9cbf
SSDEEP:	1536:5wbThllWpdKHbXw3u0Kln5DJrz9MEwyGdsZwsWIcdeFo52i:gT4pcHbX7n5DJrz9ME2sqeFo52i
TLSH:	69734B43B5E188B1E9771D352870CAA09E3FB9210E659EAB2344067E1F305C29E35F7B
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........X........................5...................................................z.......z.......z.......Rich...................

Entrypoint:	0x401344
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x64BA6E8F [Fri Jul 21 11:39:59 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	e05d62af8b1580a04c6c01f16ea1d0cb

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report MSI629D.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

System Summary

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Statistics

CPU Usage

Memory Usage

System Behavior

Analysis Process: MSI629D.exePID: 1640, Parent PID: 5376

General

Chronological Activities

Disassembly

Analysis Process: MSI629D.exePID: 1640, Parent PID: 5376COMMON

Execution Graph

Graph

Executed Functions

Function 00FD1000 Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 109sleepCOMMON

Control-flow Graph

Non-executed Functions

Function 00FD17DA Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Control-flow Graph

Function 00FD16C1 Relevance: 6.0, APIs: 4, Instructions: 25timethreadCOMMON

Windows Analysis Report
MSI629D.exe

Function 00FD1000 Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 109
sleepCOMMON

Function 00FD17DA Relevance: 6.1, APIs: 4, Instructions: 73
COMMON

Function 00FD16C1 Relevance: 6.0, APIs: 4, Instructions: 25
timethreadCOMMON

Function 00FD134E Relevance: 6.0, APIs: 4, Instructions: 12
COMMON

Function 00FD4442 Relevance: 4.6, APIs: 3, Instructions: 77
COMMON

Function 00FD34CF Relevance: 4.5, APIs: 3, Instructions: 20
COMMON

Function 00FD68F3 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 77
COMMON

Function 00FD23E3 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 62
COMMON

Function 00FD3511 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 30
libraryloaderCOMMON

Function 00FD86EC Relevance: 6.3, APIs: 4, Instructions: 317
fileCOMMON