Edit tour

Windows Analysis Report
h4QtFUlwIz.exe

Overview

General Information

Sample name:	h4QtFUlwIz.exe (renamed file extension from none to exe, renamed because original name is a hash value)
Original sample name:	feef88d2312370e6b654f759d6853247ffc81337dc2e18ffb2f0f8b9335cd079
Analysis ID:	1432122
MD5:	c1e6995e3a405d018ad7a69d2a0f075b
SHA1:	14a2add2815925174eabb86b510f5c2743930ba1
SHA256:	feef88d2312370e6b654f759d6853247ffc81337dc2e18ffb2f0f8b9335cd079
Infos:

Detection

Score:	2
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

Detected potential crypto function

PE file contains executable resources (Code or Archives)

Sample file is different than original file name gathered from version info

Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification

Uses 32bit PE files

Classification

Process Tree

System is w10x64

h4QtFUlwIz.exe (PID: 2672 cmdline: "C:\Users\user\Desktop\h4QtFUlwIz.exe" MD5: C1E6995E3A405D018AD7A69D2A0F075B)

msiexec.exe (PID: 3868 cmdline: msiexec /p VC234PATCH01.msp REINSTALL=ALL REINSTALLMODE=amus /qf MD5: 9D09DC1EDA745A5F87553048E57620CF)

rundll32.exe (PID: 6536 cmdline: "C:\Windows\system32\rundll32.exe" C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\user\AppData\Local\Temp\IXP000.TMP\" MD5: EF3179D498793BF4234F708D3BE28633)

cleanup

Sigma Signatures

Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: rundll32.exe C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\user\AppData\Local\Temp\IXP000.TMP\", EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\h4QtFUlwIz.exe, ProcessId: 2672, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: h4QtFUlwIz.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: h4QtFUlwIz.exe

Static PE information: certificate valid

Source:	Binary string: wextract.pdb source: h4QtFUlwIz.exe
Source:	Binary string: C:\agent\_work\66\s\build\ship\x86\scaexec.pdb source: h4QtFUlwIz.exe, 00000000.00000003.1999194712.0000000003C5B000.00000004.00000020.00020000.00000000.sdmp, VC234PATCH01.msp.0.dr
Source:	Binary string: C:\build\work\eca3d12b\wix3\build\ship\x86\SfxCA.pdb source: h4QtFUlwIz.exe, 00000000.00000003.1999194712.0000000003C51000.00000004.00000020.00020000.00000000.sdmp, h4QtFUlwIz.exe, 00000000.00000003.1999194712.0000000003C15000.00000004.00000020.00020000.00000000.sdmp, h4QtFUlwIz.exe, 00000000.00000003.1999194712.0000000003D9A000.00000004.00000020.00020000.00000000.sdmp, VC234PATCH01.msp.0.dr
Source:	Binary string: C:\agent\_work\66\s\build\ship\x86\scasched.pdb source: h4QtFUlwIz.exe, 00000000.00000003.1999194712.0000000003C5B000.00000004.00000020.00020000.00000000.sdmp, VC234PATCH01.msp.0.dr

Source: h4QtFUlwIz.exe, 00000000.00000003.1999194712.0000000003C5B000.00000004.00000020.00020000.00000000.sdmp, VC234PATCH01.msp.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: h4QtFUlwIz.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: h4QtFUlwIz.exe, 00000000.00000003.1999194712.0000000003C5B000.00000004.00000020.00020000.00000000.sdmp, VC234PATCH01.msp.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: h4QtFUlwIz.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: h4QtFUlwIz.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: h4QtFUlwIz.exe, 00000000.00000003.1999194712.0000000003C5B000.00000004.00000020.00020000.00000000.sdmp, VC234PATCH01.msp.0.dr	String found in binary or memory: http://cacerts.digicert.com/NETFoundationProjectsCodeSigningCA.crt0
Source: h4QtFUlwIz.exe	String found in binary or memory: http://crl.globalsign.com/codesigningrootr45.crl0U
Source: h4QtFUlwIz.exe	String found in binary or memory: http://crl.globalsign.com/gsgccr45evcodesignca2020.crl0
Source: h4QtFUlwIz.exe	String found in binary or memory: http://crl.globalsign.com/root-r3.crl0G
Source: h4QtFUlwIz.exe	String found in binary or memory: http://crl.globalsign.com/root.crl0G
Source: h4QtFUlwIz.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: h4QtFUlwIz.exe, 00000000.00000003.1999194712.0000000003C5B000.00000004.00000020.00020000.00000000.sdmp, VC234PATCH01.msp.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: h4QtFUlwIz.exe, 00000000.00000003.1999194712.0000000003C5B000.00000004.00000020.00020000.00000000.sdmp, VC234PATCH01.msp.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0=
Source: h4QtFUlwIz.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: h4QtFUlwIz.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: h4QtFUlwIz.exe, 00000000.00000003.1999194712.0000000003C5B000.00000004.00000020.00020000.00000000.sdmp, VC234PATCH01.msp.0.dr	String found in binary or memory: http://crl3.digicert.com/NETFoundationProjectsCodeSigningCA.crl0E
Source: h4QtFUlwIz.exe, 00000000.00000003.1999194712.0000000003C5B000.00000004.00000020.00020000.00000000.sdmp, VC234PATCH01.msp.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: h4QtFUlwIz.exe, 00000000.00000003.1999194712.0000000003C5B000.00000004.00000020.00020000.00000000.sdmp, VC234PATCH01.msp.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: h4QtFUlwIz.exe, 00000000.00000003.1999194712.0000000003C5B000.00000004.00000020.00020000.00000000.sdmp, VC234PATCH01.msp.0.dr	String found in binary or memory: http://crl4.digicert.com/NETFoundationProjectsCodeSigningCA.crl0L
Source: h4QtFUlwIz.exe, 00000000.00000003.1999194712.0000000003C5B000.00000004.00000020.00020000.00000000.sdmp, VC234PATCH01.msp.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: h4QtFUlwIz.exe	String found in binary or memory: http://ocsp.digicert.com0A
Source: h4QtFUlwIz.exe, VC234PATCH01.msp.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: h4QtFUlwIz.exe, 00000000.00000003.1999194712.0000000003C5B000.00000004.00000020.00020000.00000000.sdmp, VC234PATCH01.msp.0.dr	String found in binary or memory: http://ocsp.digicert.com0K
Source: h4QtFUlwIz.exe, 00000000.00000003.1999194712.0000000003C5B000.00000004.00000020.00020000.00000000.sdmp, VC234PATCH01.msp.0.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: h4QtFUlwIz.exe, 00000000.00000003.1999194712.0000000003C5B000.00000004.00000020.00020000.00000000.sdmp, VC234PATCH01.msp.0.dr	String found in binary or memory: http://ocsp.digicert.com0O
Source: h4QtFUlwIz.exe	String found in binary or memory: http://ocsp.digicert.com0X
Source: h4QtFUlwIz.exe	String found in binary or memory: http://ocsp.globalsign.com/codesigningrootr450F
Source: h4QtFUlwIz.exe	String found in binary or memory: http://ocsp.globalsign.com/gsgccr45evcodesignca20200U
Source: h4QtFUlwIz.exe	String found in binary or memory: http://ocsp.globalsign.com/rootr103
Source: h4QtFUlwIz.exe	String found in binary or memory: http://ocsp.globalsign.com/rootr30;
Source: h4QtFUlwIz.exe	String found in binary or memory: http://secure.globalsign.com/cacert/codesigningrootr45.crt0A
Source: h4QtFUlwIz.exe	String found in binary or memory: http://secure.globalsign.com/cacert/gsgccr45evcodesignca2020.crt0?
Source: h4QtFUlwIz.exe	String found in binary or memory: http://secure.globalsign.com/cacert/root-r3.crt06
Source: h4QtFUlwIz.exe, 00000000.00000003.1999194712.0000000003C5B000.00000004.00000020.00020000.00000000.sdmp, VC234PATCH01.msp.0.dr	String found in binary or memory: http://wixtoolset.org
Source: VC234PATCH01.msp.0.dr	String found in binary or memory: http://www.opentext.com/2/global/services-home/services-support-contact.htmMoreInfoURLOptimizedInsta
Source: h4QtFUlwIz.exe, 00000000.00000003.1999194712.0000000003C5B000.00000004.00000020.00020000.00000000.sdmp, VC234PATCH01.msp.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: h4QtFUlwIz.exe	String found in binary or memory: https://www.globalsign.com/repository/0
Source: h4QtFUlwIz.exe	String found in binary or memory: https://www.opentext.com0

Source: C:\Users\user\Desktop\h4QtFUlwIz.exe	Code function: 0_2_0100871A	0_2_0100871A
Source: C:\Users\user\Desktop\h4QtFUlwIz.exe	Code function: 0_2_01009A1F	0_2_01009A1F
Source: C:\Users\user\Desktop\h4QtFUlwIz.exe	Code function: 0_2_01008DBD	0_2_01008DBD
Source: C:\Users\user\Desktop\h4QtFUlwIz.exe	Code function: 0_2_01008A3E	0_2_01008A3E
Source: C:\Users\user\Desktop\h4QtFUlwIz.exe	Code function: 0_2_010095E5	0_2_010095E5
Source: C:\Users\user\Desktop\h4QtFUlwIz.exe	Code function: 0_2_01009175	0_2_01009175

Source: h4QtFUlwIz.exe

Static PE information: Resource name: RT_RCDATA type: Microsoft Cabinet archive data, Windows 2000/XP setup, 16117495 bytes, 1 file, at 0x2c +A "VC234PATCH01.msp", ID 1153, number 1, 533 datablocks, 0x1503 compression

Source: h4QtFUlwIz.exe, 00000000.00000003.1999194712.0000000003BE3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCopySAPConnector.dlll% vs h4QtFUlwIz.exe
Source: h4QtFUlwIz.exe, 00000000.00000003.1999194712.0000000003BE3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSfxCA.dll\ vs h4QtFUlwIz.exe
Source: h4QtFUlwIz.exe, 00000000.00000003.1999194712.0000000003C5B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameGACnetCheck.dlll% vs h4QtFUlwIz.exe
Source: h4QtFUlwIz.exe, 00000000.00000003.1999194712.0000000003C5B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSfxCA.dll\ vs h4QtFUlwIz.exe
Source: h4QtFUlwIz.exe, 00000000.00000003.1999194712.0000000003C5B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamescasched.dll\ vs h4QtFUlwIz.exe
Source: h4QtFUlwIz.exe, 00000000.00000003.1999194712.0000000003C5B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamescaexec.dll\ vs h4QtFUlwIz.exe
Source: h4QtFUlwIz.exe, 00000000.00000003.1999194712.0000000003C1F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCopySAPConnector.dlll% vs h4QtFUlwIz.exe
Source: h4QtFUlwIz.exe, 00000000.00000003.1999194712.0000000003C1F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSfxCA.dll\ vs h4QtFUlwIz.exe
Source: h4QtFUlwIz.exe, 00000000.00000003.1999194712.0000000003DA4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSetDefaultDatabaseConnection.dlll% vs h4QtFUlwIz.exe
Source: h4QtFUlwIz.exe, 00000000.00000003.1999194712.0000000003DA4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSfxCA.dll\ vs h4QtFUlwIz.exe
Source: h4QtFUlwIz.exe	Binary or memory string: OriginalFilenameWEXTRACT.EXE h# vs h4QtFUlwIz.exe

Source: h4QtFUlwIz.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: classification engine

Classification label: clean2.winEXE@4/1@0/0

Source: C:\Users\user\Desktop\h4QtFUlwIz.exe

Code function: 0_2_01005190 GetDlgItem,GetDlgItem,ShowWindow,ShowWindow,GetDlgItem,ShowWindow,FreeResource,SendMessageA,

0_2_01005190

Source: C:\Users\user\Desktop\h4QtFUlwIz.exe

File created: C:\Users\user\AppData\Local\Temp\IXP000.TMP

Jump to behavior

Source: h4QtFUlwIz.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\h4QtFUlwIz.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown

Process created: C:\Windows\System32\rundll32.exe "C:\Windows\system32\rundll32.exe" C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\user\AppData\Local\Temp\IXP000.TMP\"

Source: unknown	Process created: C:\Users\user\Desktop\h4QtFUlwIz.exe "C:\Users\user\Desktop\h4QtFUlwIz.exe"
Source: C:\Users\user\Desktop\h4QtFUlwIz.exe	Process created: C:\Windows\SysWOW64\msiexec.exe msiexec /p VC234PATCH01.msp REINSTALL=ALL REINSTALLMODE=amus /qf
Source: unknown	Process created: C:\Windows\System32\rundll32.exe "C:\Windows\system32\rundll32.exe" C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\user\AppData\Local\Temp\IXP000.TMP\"
Source: C:\Users\user\Desktop\h4QtFUlwIz.exe	Process created: C:\Windows\SysWOW64\msiexec.exe msiexec /p VC234PATCH01.msp REINSTALL=ALL REINSTALLMODE=amus /qf	Jump to behavior

Source: C:\Users\user\Desktop\h4QtFUlwIz.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\h4QtFUlwIz.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Users\user\Desktop\h4QtFUlwIz.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\h4QtFUlwIz.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\Desktop\h4QtFUlwIz.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\Desktop\h4QtFUlwIz.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\h4QtFUlwIz.exe	Section loaded: feclient.dll	Jump to behavior
Source: C:\Users\user\Desktop\h4QtFUlwIz.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\h4QtFUlwIz.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\h4QtFUlwIz.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\h4QtFUlwIz.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\h4QtFUlwIz.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\h4QtFUlwIz.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\h4QtFUlwIz.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\h4QtFUlwIz.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\h4QtFUlwIz.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\h4QtFUlwIz.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\h4QtFUlwIz.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\h4QtFUlwIz.exe	Section loaded: advpack.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: srpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior

Source: h4QtFUlwIz.exe

Static PE information: certificate valid

Source: h4QtFUlwIz.exe

Static file information: File size 16199144 > 1048576

Source: h4QtFUlwIz.exe

Static PE information: Raw size of .rsrc is bigger than: 0x100000 < 0xf65800

Source: h4QtFUlwIz.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: wextract.pdb source: h4QtFUlwIz.exe
Source:	Binary string: C:\agent\_work\66\s\build\ship\x86\scaexec.pdb source: h4QtFUlwIz.exe, 00000000.00000003.1999194712.0000000003C5B000.00000004.00000020.00020000.00000000.sdmp, VC234PATCH01.msp.0.dr
Source:	Binary string: C:\build\work\eca3d12b\wix3\build\ship\x86\SfxCA.pdb source: h4QtFUlwIz.exe, 00000000.00000003.1999194712.0000000003C51000.00000004.00000020.00020000.00000000.sdmp, h4QtFUlwIz.exe, 00000000.00000003.1999194712.0000000003C15000.00000004.00000020.00020000.00000000.sdmp, h4QtFUlwIz.exe, 00000000.00000003.1999194712.0000000003D9A000.00000004.00000020.00020000.00000000.sdmp, VC234PATCH01.msp.0.dr
Source:	Binary string: C:\agent\_work\66\s\build\ship\x86\scasched.pdb source: h4QtFUlwIz.exe, 00000000.00000003.1999194712.0000000003C5B000.00000004.00000020.00020000.00000000.sdmp, VC234PATCH01.msp.0.dr

Source: C:\Users\user\Desktop\h4QtFUlwIz.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce wextract_cleanup0	Jump to behavior
Source: C:\Users\user\Desktop\h4QtFUlwIz.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce wextract_cleanup0	Jump to behavior
Source: C:\Users\user\Desktop\h4QtFUlwIz.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce wextract_cleanup0	Jump to behavior
Source: C:\Users\user\Desktop\h4QtFUlwIz.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce wextract_cleanup0	Jump to behavior

Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\h4QtFUlwIz.exe

Code function: 0_2_0100646B GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

0_2_0100646B

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	1 Process Injection	1 Rundll32	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Registry Run Keys / Startup Folder	1 DLL Side-Loading	1 Process Injection	LSASS Memory	2 System Information Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Registry Run Keys / Startup Folder	1 DLL Side-Loading	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
h4QtFUlwIz.exe	0%	ReversingLabs
h4QtFUlwIz.exe	0%	Virustotal		Browse

Source	Detection	Scanner	Label	Link
https://www.opentext.com0	0%	Avira URL Cloud	safe

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.opentext.com/2/global/services-home/services-support-contact.htmMoreInfoURLOptimizedInsta	VC234PATCH01.msp.0.dr	false		high
http://wixtoolset.org	h4QtFUlwIz.exe, 00000000.00000003.1999194712.0000000003C5B000.00000004.00000020.00020000.00000000.sdmp, VC234PATCH01.msp.0.dr	false		high
https://www.opentext.com0	h4QtFUlwIz.exe	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1432122
Start date and time:	2024-04-26 14:27:14 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 36s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	h4QtFUlwIz.exe (renamed file extension from none to exe, renamed because original name is a hash value)
Original Sample Name:	feef88d2312370e6b654f759d6853247ffc81337dc2e18ffb2f0f8b9335cd079
Detection:	CLEAN
Classification:	clean2.winEXE@4/1@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com

Process:	C:\Users\user\Desktop\h4QtFUlwIz.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, Code page: 1252, Title: Installation Database, Subject: OpenText Validation for SAP Solutions, Author: Open Text Corporation, Keywords: Installer, Comments: OpenText Validation for SAP Solutions., Create Time/Date: Thu Jan 11 08:48:30 2024, Name of Creating Application: Windows Installer XML Toolset (3.10.2.2516), Security: 2, Template: Intel;1033, Last Saved By: Intel;1033, Revision Number: {349BB8AD-FD04-4468-91BD-DD9127ED2725}23.4.3;{349BB8AD-FD04-4468-91BD-DD9127ED2725}23.4.3.1;{3CD97D22-E660-4547-96DF-E91D3EE910AA}, Number of Pages: 301, Number of Characters: 153223191
Category:	dropped
Size (bytes):	17440768
Entropy (8bit):	7.941416811574007
Encrypted:	false
SSDEEP:	393216:cL1dc3aZf1HP+Lkg89+ZyQj6ezYXJeWq4W3OmMV78hRjs:EDGajaY+Zyq6eUwWg3OmMN8hRjs
MD5:	56746DB2FDFD175332A1A0B3DA711540
SHA1:	B55E5A9D6FB5F92EE490C3BBDAEE9639060FFF46
SHA-256:	E0DF18EE403A08ED1CAFED31592110B56C6B6BADF1D06EDB1A848ADE260118AE
SHA-512:	5230EDEA62CD9A72D1F114BE7DB351AC5F881711F79A38EF627649C84881F1A04BC25F39C24647490D2870CAD8E78A6B19343C715FBF6A3F626AD7889ACB0565
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.9994159862293115
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	h4QtFUlwIz.exe
File size:	16'199'144 bytes
MD5:	c1e6995e3a405d018ad7a69d2a0f075b
SHA1:	14a2add2815925174eabb86b510f5c2743930ba1
SHA256:	feef88d2312370e6b654f759d6853247ffc81337dc2e18ffb2f0f8b9335cd079
SHA512:	f340c958d814a0546598c8f35ba817b4325afab52ecfeb44a3205565cf74deec1e450ddf5c803ccb626ae7af5e3af8b332e6d549c6733474c12a3711b9ebab9d
SSDEEP:	393216:VAjlvgUQ+OiPb3cDJo81WQe5gIy59JAlGkdTZKIp9o:6xvgCSJo81Wp/O96lhdTZzp2
TLSH:	5BF633B25EE44B8EFA471272E42F36B584393D939ACB932E171068C24C226394D7F757
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............C...C...Cu..C...C...C0..Cu..C...Cu..C...Cu..C...CRich...C................PE..L....Q.H.....................\......\d.....

File Icon


Icon Hash:	878fd7f3b9353593

Static PE Info

General

Entrypoint:	0x100645c
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x1000000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x480251CD [Sun Apr 13 18:32:45 2008 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	0ebb3c09b06b1666d307952e824c8697

Authenticode Signature

Signature Valid:	true
Signature Issuer:	CN=GlobalSign GCC R45 EV CodeSigning CA 2020, O=GlobalSign nv-sa, C=BE
Signature Validation Error:	The operation completed successfully
Error Number:	0
Not Before, Not After	15/06/2023 18:01:26 15/06/2026 18:01:26
Subject Chain	E=adakhqan@opentext.com, CN=Open Text Corporation, O=Open Text Corporation, STREET=275 Frank Tompa Drive, L=Waterloo, S=Ontario, C=CA, OID.1.3.6.1.4.1.311.60.2.1.2=Ontario, OID.1.3.6.1.4.1.311.60.2.1.3=CA, SERIALNUMBER=1083604-4, OID.2.5.4.15=Private Organization
Version:	3
Thumbprint MD5:	F955674D7B422BAC69C5B420C3B0C5DC
Thumbprint SHA-1:	FD17AEE5AC3FDA7ED84C0FA7ECAC5BFDA17A66A3
Thumbprint SHA-256:	0FEA432F23CB44DA6EDB5004ABF49887ED03C510AFC9D02CC22E62F36090A9AE
Serial:	4AA7DB0E66C0135E684BA4E5

Entrypoint Preview

Instruction
call 00007F9FE120231Fh
jmp 00007F9FE120228Fh
int3
int3
int3
int3
int3
mov edi, edi
push ebp
mov ebp, esp
sub esp, 10h
mov eax, dword ptr [0100B2D0h]
test eax, eax
je 00007F9FE1202319h
cmp eax, 0000BB40h
jne 00007F9FE120235Fh
push esi
lea eax, dword ptr [ebp-08h]
push eax
call dword ptr [01001170h]
mov esi, dword ptr [ebp-04h]
xor esi, dword ptr [ebp-08h]
call dword ptr [0100116Ch]
xor esi, eax
call dword ptr [01001168h]
xor esi, eax
call dword ptr [01001164h]
xor esi, eax
lea eax, dword ptr [ebp-10h]
push eax
call dword ptr [01001160h]
mov eax, dword ptr [ebp-0Ch]
xor eax, dword ptr [ebp-10h]
xor eax, esi
and eax, 0000FFFFh
pop esi
jne 00007F9FE1202317h
mov eax, 0000BB40h
mov dword ptr [0100B2D0h], eax
not eax
mov dword ptr [0100B2CCh], eax
leave
ret
int3
int3
int3
int3
int3
cmp ecx, dword ptr [0100B2D0h]
jne 00007F9FE120231Bh
test ecx, FFFF0000h
jne 00007F9FE1202313h
ret
jmp 00007F9FE120231Ah
int3
int3
int3
int3
int3
mov edi, edi
push ebp
mov ebp, esp
sub esp, 00000330h
push edi
mov dword ptr [ebp-00000228h], eax
mov dword ptr [ebp-0000022Ch], ecx
mov dword ptr [ebp-00000230h], edx
mov dword ptr [ebp-00000234h], ebx
mov dword ptr [ebp-00000238h], esi

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x9d80	0x8c	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xd000	0xf65764	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0xf6fa00	0x33e8	.rsrc
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x1230	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1000	0x230	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x99c8	0x9a00	87fe10d9dbd6b4e42fc70a9a4ecaa575	False	0.5805854301948052	data	6.579209426291961	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0xb000	0x1be4	0x400	99858e86526942a66950c7139f78a725	False	0.330078125	data	4.247999525438142	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xd000	0xf66000	0xf65800	2fbc1adeae9069c61439b8ff9233e5f2	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
AVI	0xd7a0	0x2e1a	RIFF (little-endian) data, AVI, 272 x 60, 10.00 fps, video: RLE 8bpp	German	Germany	0.2713099474665311
RT_ICON	0x105bc	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 512	German	Germany	0.3709677419354839
RT_ICON	0x108a4	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128	German	Germany	0.6081081081081081
RT_DIALOG	0x109cc	0x354	data	German	Germany	0.4518779342723005
RT_DIALOG	0x10d20	0x1f0	data	German	Germany	0.5342741935483871
RT_DIALOG	0x10f10	0x180	data	German	Germany	0.53125
RT_DIALOG	0x11090	0x1e0	data	German	Germany	0.5604166666666667
RT_DIALOG	0x11270	0x150	data	German	Germany	0.5833333333333334
RT_DIALOG	0x113c0	0x138	data	German	Germany	0.5961538461538461
RT_STRING	0x114f8	0xd0	Matlab v4 mat-file (little endian) \344, numeric, rows 0, columns 0	German	Germany	0.5721153846153846
RT_STRING	0x115c8	0x6f4	data	German	Germany	0.34775280898876404
RT_STRING	0x11cbc	0x744	data	German	Germany	0.3387096774193548
RT_STRING	0x12400	0x678	data	German	Germany	0.338768115942029
RT_STRING	0x12a78	0x4b0	data	German	Germany	0.4225
RT_STRING	0x12f28	0x428	data	German	Germany	0.35150375939849626
RT_RCDATA	0x13350	0x7	ASCII text, with no line terminators	English	United States	2.142857142857143
RT_RCDATA	0x13358	0xf5eef7	Microsoft Cabinet archive data, Windows 2000/XP setup, 16117495 bytes, 1 file, at 0x2c +A "VC234PATCH01.msp", ID 1153, number 1, 533 datablocks, 0x1503 compression	English	United States	0.9980459213256836
RT_RCDATA	0xf72250	0x4	data	English	United States	3.0
RT_RCDATA	0xf72254	0x24	data	English	United States	0.7222222222222222
RT_RCDATA	0xf72278	0x7	ASCII text, with no line terminators	English	United States	2.142857142857143
RT_RCDATA	0xf72280	0x7	ASCII text, with no line terminators	English	United States	2.142857142857143
RT_RCDATA	0xf72288	0x4	data	English	United States	3.0
RT_RCDATA	0xf7228c	0x7	ASCII text, with no line terminators	English	United States	2.142857142857143
RT_RCDATA	0xf72294	0x4	data	English	United States	3.0
RT_RCDATA	0xf72298	0x41	ASCII text, with no line terminators	English	United States	0.9692307692307692
RT_RCDATA	0xf722dc	0x4	data	English	United States	3.0
RT_RCDATA	0xf722e0	0x1d	ASCII text, with no line terminators	English	United States	1.2758620689655173
RT_RCDATA	0xf72300	0x7	ASCII text, with no line terminators	English	United States	2.142857142857143
RT_RCDATA	0xf72308	0x7	ASCII text, with no line terminators	English	United States	2.142857142857143
RT_GROUP_ICON	0xf72310	0x22	data	German	Germany	1.0
RT_VERSION	0xf72334	0x430	data	German	Germany	0.42350746268656714

Imports

DLL	Import
ADVAPI32.dll	FreeSid, AllocateAndInitializeSid, EqualSid, GetTokenInformation, OpenProcessToken, AdjustTokenPrivileges, LookupPrivilegeValueA, RegCloseKey, RegDeleteValueA, RegOpenKeyExA, RegSetValueExA, RegQueryValueExA, RegCreateKeyExA, RegQueryInfoKeyA
KERNEL32.dll	LocalFree, LocalAlloc, GetLastError, GetCurrentProcess, lstrlenA, GetModuleFileNameA, GetSystemDirectoryA, _lclose, _llseek, _lopen, WritePrivateProfileStringA, GetWindowsDirectoryA, CreateDirectoryA, GetFileAttributesA, ExpandEnvironmentStringsA, lstrcpyA, GlobalFree, GlobalUnlock, GlobalLock, GlobalAlloc, IsDBCSLeadByte, GetShortPathNameA, GetPrivateProfileStringA, GetPrivateProfileIntA, lstrcmpiA, RemoveDirectoryA, FindClose, FindNextFileA, DeleteFileA, SetFileAttributesA, lstrcmpA, FindFirstFileA, FreeResource, GetProcAddress, LoadResource, SizeofResource, FindResourceA, lstrcatA, CloseHandle, WriteFile, SetFilePointer, SetFileTime, LocalFileTimeToFileTime, DosDateTimeToFileTime, SetCurrentDirectoryA, GetTempFileNameA, ExitProcess, CreateFileA, LoadLibraryExA, lstrcpynA, GetVolumeInformationA, FormatMessageA, GetCurrentDirectoryA, GetVersionExA, GetExitCodeProcess, WaitForSingleObject, CreateProcessA, GetTempPathA, GetSystemInfo, CreateMutexA, SetEvent, CreateEventA, CreateThread, ResetEvent, TerminateThread, GetDriveTypeA, GetModuleHandleA, GetStartupInfoA, GetCommandLineA, QueryPerformanceCounter, GetTickCount, GetCurrentThreadId, GetCurrentProcessId, GetSystemTimeAsFileTime, TerminateProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, ReadFile, LoadLibraryA, GetDiskFreeSpaceA, MulDiv, EnumResourceLanguagesA, FreeLibrary, LockResource
GDI32.dll	GetDeviceCaps
USER32.dll	ExitWindowsEx, wsprintfA, CharNextA, CharUpperA, CharPrevA, SetWindowLongA, GetWindowLongA, CallWindowProcA, DispatchMessageA, MsgWaitForMultipleObjects, PeekMessageA, SendMessageA, SetWindowPos, ReleaseDC, GetDC, GetWindowRect, SendDlgItemMessageA, GetDlgItem, SetForegroundWindow, SetWindowTextA, MessageBoxA, DialogBoxIndirectParamA, ShowWindow, EnableWindow, GetDlgItemTextA, EndDialog, GetDesktopWindow, MessageBeep, SetDlgItemTextA, LoadStringA, GetSystemMetrics
COMCTL32.dll
VERSION.dll	GetFileVersionInfoA, VerQueryValueA, GetFileVersionInfoSizeA

Possible Origin

Language of compilation system	Country where language is spoken	Map
German	Germany
English	United States

Target ID:	0
Start time:	14:27:59
Start date:	26/04/2024
Path:	C:\Users\user\Desktop\h4QtFUlwIz.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\h4QtFUlwIz.exe"
Imagebase:	0x1000000
File size:	16'199'144 bytes
MD5 hash:	C1E6995E3A405D018AD7A69D2A0F075B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	14:28:00
Start date:	26/04/2024
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	msiexec /p VC234PATCH01.msp REINSTALL=ALL REINSTALLMODE=amus /qf
Imagebase:	0xf00000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	14:28:12
Start date:	26/04/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\rundll32.exe" C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\user\AppData\Local\Temp\IXP000.TMP\"
Imagebase:	0x7ff65d040000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	21.8%
Dynamic/Decrypted Code Coverage:	58.3%
Signature Coverage:	29.2%
Total number of Nodes:	48
Total number of Limit Nodes:	1

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 01005190 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 107
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 010032FF: FindResourceA.KERNEL32(00000000,CABINET,0000000A), ref: 0100331B
Part of subcall function 010032FF: LoadResource.KERNEL32(00000000,00000000,?,01005195), ref: 01003324
Part of subcall function 010032FF: LockResource.KERNEL32(00000000,?,01005195), ref: 0100332B

GetDlgItem.USER32(00020476,00000842), ref: 010051B5
ShowWindow.USER32(00000000), ref: 010051BE
GetDlgItem.USER32(00000841,00000005), ref: 010051CD
ShowWindow.USER32(00000000), ref: 010051D0
FreeResource.KERNEL32(00000000,-00000514,00000000,00000000,00000010,00000000), ref: 0100527C
SendMessageA.USER32(00000FA1,00000000,00000000,-00000514), ref: 010052C3

Strings

*MEMCAB, xrefs: 01005236

Memory Dump Source

Source File: 00000000.00000002.2048262048.0000000001001000.00000020.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.2048246332.0000000001000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2048277968.000000000100B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2048295877.000000000100D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2048295877.0000000001A0D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_h4QtFUlwIz.jbxd

Similarity

API ID: Resource$ItemShowWindow$FindFreeLoadLockMessageSend
String ID: *MEMCAB
API String ID: 3694369891-3211172518
Opcode ID: db05329e52dd5ee1d8b23c1b6cf70e12f657115257108f69590474f878c27e53
Instruction ID: 2bc75931ab46805ef586b25582dda227c40a14ab93dc7bc1b63351d76fe4d624
Opcode Fuzzy Hash: db05329e52dd5ee1d8b23c1b6cf70e12f657115257108f69590474f878c27e53
Instruction Fuzzy Hash: B931B9757823157BFA3363669C4AFDB7E9CEF46B61F400054F6C4A90C5D6FA84808BA1

Uniqueness

Uniqueness Score: -1.00%

Function 0100645C Relevance: 6.0, APIs: 4, Instructions: 34
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0100646B: GetSystemTimeAsFileTime.KERNEL32(?), ref: 01006488
Part of subcall function 0100646B: GetCurrentProcessId.KERNEL32 ref: 01006494
Part of subcall function 0100646B: GetCurrentThreadId.KERNEL32 ref: 0100649C
Part of subcall function 0100646B: GetTickCount.KERNEL32 ref: 010064A4
Part of subcall function 0100646B: QueryPerformanceCounter.KERNEL32(?), ref: 010064B0

GetCommandLineA.KERNEL32 ref: 010063E9

Memory Dump Source

Source File: 00000000.00000002.2048262048.0000000001001000.00000020.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.2048246332.0000000001000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2048277968.000000000100B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2048295877.000000000100D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2048295877.0000000001A0D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_h4QtFUlwIz.jbxd

Similarity

API ID: CurrentTime$CommandCountCounterFileLinePerformanceProcessQuerySystemThreadTick
String ID:
API String ID: 4193432215-0
Opcode ID: 3ee3686978cb94449a485867cdbe4ff339c0d595a3f89fb2b492943d71a9f968
Instruction ID: c5a1862b985673df9dcaa7a20706b7fcb4bdebc4bc52080bc5b72109ef5ee6e2
Opcode Fuzzy Hash: 3ee3686978cb94449a485867cdbe4ff339c0d595a3f89fb2b492943d71a9f968
Instruction Fuzzy Hash: 5FF0E2714403889AFB736FA8884DBFE3FAB9B12304F550044E9C0D22C5CA7684E287E2

Uniqueness

Uniqueness Score: -1.00%

Function 0100412E Relevance: 3.1, APIs: 2, Instructions: 64
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(00000180,80000000,00000000,00000000,00008000,00000080,00000000,00000000,00000000,00000000,?,?,0100427B,00000180,00008000,?), ref: 010041A8
CreateFileA.KERNEL32(00000180,80000000,00000000,00000000,00000003,00000080,00000000,00000180,?,?,0100427B,00000180,00008000,?), ref: 010041CA

Memory Dump Source

Source File: 00000000.00000002.2048262048.0000000001001000.00000020.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.2048246332.0000000001000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2048277968.000000000100B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2048295877.000000000100D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2048295877.0000000001A0D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_h4QtFUlwIz.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: b69cf7712ea0dd325566fc773e9ea564160eeb22ca95d34820805d5e9552cd5a
Instruction ID: ad9754ded69d89190427acfe716f1ac8fe926d72f3e8cb2752d49aa3ea161600
Opcode Fuzzy Hash: b69cf7712ea0dd325566fc773e9ea564160eeb22ca95d34820805d5e9552cd5a
Instruction Fuzzy Hash: 661173B265410CBAFB124E69CC44FEA7BA8EB613A8F148225FB64D61D0C379CD41DB54

Uniqueness

Uniqueness Score: -1.00%

Function 010041D8 Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 60
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcmpA.KERNEL32(00000180,*MEMCAB,00000000,?,?,01004303,*MEMCAB,00008000,00000180,00000000), ref: 01004221

Strings

*MEMCAB, xrefs: 01004219

Memory Dump Source

Source File: 00000000.00000002.2048262048.0000000001001000.00000020.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.2048246332.0000000001000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2048277968.000000000100B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2048295877.000000000100D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2048295877.0000000001A0D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_h4QtFUlwIz.jbxd

Similarity

API ID: lstrcmp
String ID: *MEMCAB
API String ID: 1534048567-3211172518
Opcode ID: 8d1886825cf7cf1b7fca3806ded3f6736f8ae30cbe39c047e8d4af6a682cd926
Instruction ID: 92061fbbc721102d292826fa71bb98d8294175fcbeac33c2f5b1cd223c837d31
Opcode Fuzzy Hash: 8d1886825cf7cf1b7fca3806ded3f6736f8ae30cbe39c047e8d4af6a682cd926
Instruction Fuzzy Hash: C11175716412049FF7639F18C984AB57B94FB00358F4643E9F6D9CA1E6CBB1C8458B54

Uniqueness

Uniqueness Score: -1.00%

Function 01003108 Relevance: 1.5, APIs: 1, Instructions: 30
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindCloseChangeNotification.KERNELBASE(?,00000000,00000000,?,0100433C,00000000,?,?,?,?,?,00000000), ref: 01003145

Memory Dump Source

Source File: 00000000.00000002.2048262048.0000000001001000.00000020.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.2048246332.0000000001000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2048277968.000000000100B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2048295877.000000000100D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2048295877.0000000001A0D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_h4QtFUlwIz.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: ddf299c9d854a60029591bd0d9130fc256d7a927763a6f5153bdca3c177d8727
Instruction ID: ddcf91d87cb97e1f61d19a99827c2554d1a57a890e9a07dc5fc143585956e2ac
Opcode Fuzzy Hash: ddf299c9d854a60029591bd0d9130fc256d7a927763a6f5153bdca3c177d8727
Instruction Fuzzy Hash: 78F03632501B11EEA3A38F1995405EA7BE5FA84350B110669D5EEC6250DB30E4018B50

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0100646B Relevance: 7.5, APIs: 5, Instructions: 36timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 01006488
GetCurrentProcessId.KERNEL32 ref: 01006494
GetCurrentThreadId.KERNEL32 ref: 0100649C
GetTickCount.KERNEL32 ref: 010064A4
QueryPerformanceCounter.KERNEL32(?), ref: 010064B0

Memory Dump Source

Source File: 00000000.00000002.2048262048.0000000001001000.00000020.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.2048246332.0000000001000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2048277968.000000000100B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2048295877.000000000100D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2048295877.0000000001A0D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_h4QtFUlwIz.jbxd

Similarity

API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
String ID:
API String ID: 1445889803-0
Opcode ID: 1c9a6aecb8a7c21b59f0650fcfd769be0ce501fac9dd4907ed4c08a4f18fdedf
Instruction ID: 54730ea4cddf6389e8530bc477ef8a499c223e9ef8984b798b14dd8bf7ea62bb
Opcode Fuzzy Hash: 1c9a6aecb8a7c21b59f0650fcfd769be0ce501fac9dd4907ed4c08a4f18fdedf
Instruction Fuzzy Hash: 76F0EC76D002189BDB22ABB4D44859FBBF5FF08350F420561E481E7145DB3AE9008B80

Uniqueness

Uniqueness Score: -1.00%

Function 01008DBD Relevance: .3, Instructions: 299COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2048262048.0000000001001000.00000020.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.2048246332.0000000001000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2048277968.000000000100B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2048295877.000000000100D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2048295877.0000000001A0D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_h4QtFUlwIz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ab33120750a6cf8d1db9ab5d913f5b74d9f381fdd4bd0252d22a429b75f835f
Instruction ID: 2a4e20d8dd08869bc59d0f7a9c7b9ccb62a101cbb563704953a2602d9f9330db
Opcode Fuzzy Hash: 7ab33120750a6cf8d1db9ab5d913f5b74d9f381fdd4bd0252d22a429b75f835f
Instruction Fuzzy Hash: 10C16431A09695DFDB17CF68C4942EDBBB0BF05314F1981AED9CA5B683C7709A85C780

Uniqueness

Uniqueness Score: -1.00%

Function 01009175 Relevance: .3, Instructions: 299COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2048262048.0000000001001000.00000020.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.2048246332.0000000001000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2048277968.000000000100B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2048295877.000000000100D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2048295877.0000000001A0D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_h4QtFUlwIz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 951f3fe9c36bf399cea3b5daee7726a970067545f8f814873e799029eb7aa681
Instruction ID: a7c859f818a1c5d7f83a952ccff987e1bf8c78757954649e346333d07fc465ac
Opcode Fuzzy Hash: 951f3fe9c36bf399cea3b5daee7726a970067545f8f814873e799029eb7aa681
Instruction Fuzzy Hash: 98C179319082959FDB1BCF68C4946EDBBF0BF05318F1985E9D8D96B283C7749A85CB80

Uniqueness

Uniqueness Score: -1.00%

Function 0100871A Relevance: .3, Instructions: 258COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2048262048.0000000001001000.00000020.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.2048246332.0000000001000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2048277968.000000000100B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2048295877.000000000100D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2048295877.0000000001A0D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_h4QtFUlwIz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44e1ba9ebfd45170cdbc9c9433d3231e241977a48afbef868eb8f0aea8853ba0
Instruction ID: 5fc93633ee571ff39a8677e382d59af8c1c0cea3ee91adbd583a6aeae41621e5
Opcode Fuzzy Hash: 44e1ba9ebfd45170cdbc9c9433d3231e241977a48afbef868eb8f0aea8853ba0
Instruction Fuzzy Hash: 3BB18031D082959FEB1ACF58C0942EDFBB1BF45314F19C2EED5966B282C7749A85CB80

Uniqueness

Uniqueness Score: -1.00%

Function 01008A3E Relevance: .3, Instructions: 257COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2048262048.0000000001001000.00000020.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.2048246332.0000000001000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2048277968.000000000100B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2048295877.000000000100D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2048295877.0000000001A0D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_h4QtFUlwIz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c71b5dec91b09520fdc65a5692a70fade92800ff2ceada316785ebfa9eb4593
Instruction ID: f8ae5dd48e3debf24b6725d3ddbfc9255f3a3dfa18b0ea0a8bf8b6824d7edd24
Opcode Fuzzy Hash: 1c71b5dec91b09520fdc65a5692a70fade92800ff2ceada316785ebfa9eb4593
Instruction Fuzzy Hash: BEB188759086999FDB07CF18C4906EEBBB1FF45310F18C6AFD8965B282C7709685CB90

Uniqueness

Uniqueness Score: -1.00%

Function 010095E5 Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2048262048.0000000001001000.00000020.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.2048246332.0000000001000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2048277968.000000000100B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2048295877.000000000100D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2048295877.0000000001A0D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_h4QtFUlwIz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc9e27de92532d430281cbbbf616aa24eb1d9968cc58c166f414955b503d17a5
Instruction ID: d6403490cd5a063b4169a535978f95eea43d4b920502812e922906ff9b75bb89
Opcode Fuzzy Hash: cc9e27de92532d430281cbbbf616aa24eb1d9968cc58c166f414955b503d17a5
Instruction Fuzzy Hash: AC91F631A04696DEEB179F59C8887FDB7B0FB04708F5081AAD58DA62C2D7749A81CF90

Uniqueness

Uniqueness Score: -1.00%

Function 01009A1F Relevance: .2, Instructions: 203COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2048262048.0000000001001000.00000020.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.2048246332.0000000001000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2048277968.000000000100B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2048295877.000000000100D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2048295877.0000000001A0D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_h4QtFUlwIz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: adc727b130d8a70c901193652c7c29f7f7098ede988ec518b009589487b1a216
Instruction ID: 70227f3721590e3e4a8072faacb14836a54763ddc1fb9a3c1eeaf4a681808555
Opcode Fuzzy Hash: adc727b130d8a70c901193652c7c29f7f7098ede988ec518b009589487b1a216
Instruction Fuzzy Hash: 7061F431A0055E8BEF1ACF6CC4905BE77E2EBC9354F548469D9E6D7382DA309992CB80

Uniqueness

Uniqueness Score: -1.00%

Function 01002E55 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 52COMMON

Download Yara Rule

APIs

FindResourceA.KERNEL32(00000000,00000000,0000000A), ref: 01002E6B
SizeofResource.KERNEL32(00000000,00000000,?,0100546E,TITLE,Business Center Capture 23.4,0000007F,?,00000000), ref: 01002E6F
FindResourceA.KERNEL32(00000000,00000000,0000000A), ref: 01002E8B
LoadResource.KERNEL32(00000000,00000000,?,0100546E,TITLE,Business Center Capture 23.4,0000007F,?,00000000), ref: 01002E8F
LockResource.KERNEL32(00000000,?,0100546E,TITLE,Business Center Capture 23.4,0000007F,?,00000000), ref: 01002E96
FreeResource.KERNEL32(00000000,?,0100546E,TITLE,Business Center Capture 23.4,0000007F,?,00000000), ref: 01002EBA

Strings

Business Center Capture 23.4, xrefs: 01002E5B

Memory Dump Source

Source File: 00000000.00000002.2048262048.0000000001001000.00000020.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.2048246332.0000000001000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2048277968.000000000100B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2048295877.000000000100D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2048295877.0000000001A0D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_h4QtFUlwIz.jbxd

Similarity

API ID: Resource$Find$FreeLoadLockSizeof
String ID: Business Center Capture 23.4
API String ID: 468261009-1304987528
Opcode ID: 7090d6fbcbd5b277e53ff8aa31aa3d5f4a0baf2b3be01dcc482b1e99473e37a0
Instruction ID: c58e523c2e5cc4a020a6dc9083853665ab900ca59998c1429a4b95f367ba78fb
Opcode Fuzzy Hash: 7090d6fbcbd5b277e53ff8aa31aa3d5f4a0baf2b3be01dcc482b1e99473e37a0
Instruction Fuzzy Hash: 8F01F231300188BBEB239BA5EC88C7F7BAAEBC5761F144019FA85C3280C6768C01DB61

Uniqueness

Uniqueness Score: -1.00%

Function 010032FF Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 24COMMON

Download Yara Rule

APIs

Part of subcall function 01002E55: FindResourceA.KERNEL32(00000000,00000000,0000000A), ref: 01002E6B
Part of subcall function 01002E55: SizeofResource.KERNEL32(00000000,00000000,?,0100546E,TITLE,Business Center Capture 23.4,0000007F,?,00000000), ref: 01002E6F
Part of subcall function 01002E55: FindResourceA.KERNEL32(00000000,00000000,0000000A), ref: 01002E8B
Part of subcall function 01002E55: LoadResource.KERNEL32(00000000,00000000,?,0100546E,TITLE,Business Center Capture 23.4,0000007F,?,00000000), ref: 01002E8F
Part of subcall function 01002E55: LockResource.KERNEL32(00000000,?,0100546E,TITLE,Business Center Capture 23.4,0000007F,?,00000000), ref: 01002E96

FindResourceA.KERNEL32(00000000,CABINET,0000000A), ref: 0100331B
LoadResource.KERNEL32(00000000,00000000,?,01005195), ref: 01003324
LockResource.KERNEL32(00000000,?,01005195), ref: 0100332B

Strings

CABINET, xrefs: 01003306, 0100330B, 01003313

Memory Dump Source

Source File: 00000000.00000002.2048262048.0000000001001000.00000020.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.2048246332.0000000001000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2048277968.000000000100B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2048295877.000000000100D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2048295877.0000000001A0D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_h4QtFUlwIz.jbxd

Similarity

API ID: Resource$Find$LoadLock$Sizeof
String ID: CABINET
API String ID: 1933721802-1940454314
Opcode ID: 1692d02a55cbc160416827321246fe4b7eec14d249b88bc8613a2a7260353126
Instruction ID: cc1630d2f2e1415729ed085009dd32ef9f31af51343d2801e4429469f1343b9d
Opcode Fuzzy Hash: 1692d02a55cbc160416827321246fe4b7eec14d249b88bc8613a2a7260353126
Instruction Fuzzy Hash: 89E08675B417506BF33267B16C1DF873E5C9B05711F040015F386DA1C4C6F98400C751

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: `rundll32.exe {DLLname, DLLfunction}` ).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report h4QtFUlwIz.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

Compliance

Networking

System Summary

Boot Survival

Hooking and other Techniques for Hiding and Protection

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\IXP000.TMP\VC234PATCH01.msp

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

Behavior

System Behavior

Analysis Process: h4QtFUlwIz.exePID: 2672, Parent PID: 1028

General

Chronological Activities

Analysis Process: msiexec.exePID: 3868, Parent PID: 2672

General

Chronological Activities

Analysis Process: rundll32.exePID: 6536, Parent PID: 1028

General

Windows Analysis Report
h4QtFUlwIz.exe

Function 01005190 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 107
windowCOMMON

Function 0100645C Relevance: 6.0, APIs: 4, Instructions: 34
COMMON

Function 0100412E Relevance: 3.1, APIs: 2, Instructions: 64
fileCOMMON

Function 010041D8 Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 60
stringCOMMON

Function 01003108 Relevance: 1.5, APIs: 1, Instructions: 30
COMMON