Edit tour

Windows Analysis Report
55hj0aeSzk.exe

Overview

General Information

Sample name:	55hj0aeSzk.exe renamed because original name is a hash value
Original sample name:	c6ddc9c2852eddf30f945a50183e28d38f6b9b1bbad01aac52e9d9539482a433.exe
Analysis ID:	1615969
MD5:	1289a867fafe321b51a93aa47afaffc9
SHA1:	221d0cbd5c7a0c84bb86b4351c552f6efcd4f3b6
SHA256:	c6ddc9c2852eddf30f945a50183e28d38f6b9b1bbad01aac52e9d9539482a433
Tags:	exeuser-JAMESWT_MHT
Infos:

Detection

Score:	64
Range:	0 - 100
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Joe Sandbox ML detected suspicious sample

Uses the Telegram API (likely for C&C communication)

Contains functionality to call native functions

Contains functionality to communicate with device drivers

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Found large amount of non-executed APIs

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Uses Microsoft's Enhanced Cryptographic Provider

Classification

Process Tree

System is w10x64

55hj0aeSzk.exe (PID: 1948 cmdline: "C:\Users\user\Desktop\55hj0aeSzk.exe" MD5: 1289A867FAFE321B51A93AA47AFAFFC9)

conhost.exe (PID: 3500 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Suricata Signatures

Joe Security ANOMALY Telegram Send Message

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-15T19:31:30.715678+0100	1810007	1	Potentially Bad Traffic	192.168.2.6	49710	149.154.167.220	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 55hj0aeSzk.exe	Virustotal: Detection: 30%			Perma Link
Source: 55hj0aeSzk.exe	ReversingLabs: Detection: 32%

Joe Sandbox ML detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 94.2% probability

Source: C:\Users\user\Desktop\55hj0aeSzk.exe

Code function: 0_2_00007FF7FAD884D0 BCryptGenRandom,SystemFunction036,BCryptGenRandom,SystemFunction036,BCryptGenRandom,SystemFunction036,BCryptGenRandom,SystemFunction036,

0_2_00007FF7FAD884D0

Source: 55hj0aeSzk.exe, 00000000.00000002.3389644074.00007FF7FAE79000.00000002.00000001.01000000.00000003.sdmp

Binary or memory string: -----BEGIN PUBLIC KEY-----

memstr_561220ce-d

Source: unknown

HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:49710 version: TLS 1.2

Source: 55hj0aeSzk.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:

Binary string: encv2.pdb source: 55hj0aeSzk.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 1810007 - Severity 1 - Joe Security ANOMALY Telegram Send Message : 192.168.2.6:49710 -> 149.154.167.220:443

Uses the Telegram API (likely for C&C communication)

Source: unknown

DNS query: name: api.telegram.org

Source: global traffic

HTTP traffic detected: POST /bot8179978828:AAFZb_wnWRRevWh6sM7sqz9xb_wKE_G1Rzo/sendMessage HTTP/1.0Host: api.telegram.orgContent-Type: application/jsonContent-Length: 120

Source: Joe Sandbox View

IP Address: 149.154.167.220 149.154.167.220

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: api.telegram.org

Source: unknown

HTTP traffic detected: POST /bot8179978828:AAFZb_wnWRRevWh6sM7sqz9xb_wKE_G1Rzo/sendMessage HTTP/1.0Host: api.telegram.orgContent-Type: application/jsonContent-Length: 120

Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710

Source: unknown

HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:49710 version: TLS 1.2

Source: C:\Users\user\Desktop\55hj0aeSzk.exe	Code function: 0_2_00007FF7FAD735B0 WakeByAddressSingle,NtCancelIoFileEx,RtlNtStatusToDosError,NtDeviceIoControlFile,RtlNtStatusToDosError,WakeByAddressSingle,WakeByAddressSingle,WakeByAddressSingle,WakeByAddressSingle,		0_2_00007FF7FAD735B0
Source: C:\Users\user\Desktop\55hj0aeSzk.exe	Code function: 0_2_00007FF7FAD72BC0 NtCancelIoFileEx,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,RtlNtStatusToDosError,		0_2_00007FF7FAD72BC0

Source: C:\Users\user\Desktop\55hj0aeSzk.exe

Code function: 0_2_00007FF7FAD735B0: WakeByAddressSingle,NtCancelIoFileEx,RtlNtStatusToDosError,NtDeviceIoControlFile,RtlNtStatusToDosError,WakeByAddressSingle,WakeByAddressSingle,WakeByAddressSingle,WakeByAddressSingle,

0_2_00007FF7FAD735B0

Source: C:\Users\user\Desktop\55hj0aeSzk.exe	Code function: 0_2_00007FF7FAE57760	0_2_00007FF7FAE57760
Source: C:\Users\user\Desktop\55hj0aeSzk.exe	Code function: 0_2_00007FF7FAE55430	0_2_00007FF7FAE55430
Source: C:\Users\user\Desktop\55hj0aeSzk.exe	Code function: 0_2_00007FF7FAD735B0	0_2_00007FF7FAD735B0
Source: C:\Users\user\Desktop\55hj0aeSzk.exe	Code function: 0_2_00007FF7FAD81580	0_2_00007FF7FAD81580
Source: C:\Users\user\Desktop\55hj0aeSzk.exe	Code function: 0_2_00007FF7FAE4E580	0_2_00007FF7FAE4E580
Source: C:\Users\user\Desktop\55hj0aeSzk.exe	Code function: 0_2_00007FF7FAE48AF0	0_2_00007FF7FAE48AF0
Source: C:\Users\user\Desktop\55hj0aeSzk.exe	Code function: 0_2_00007FF7FAE59E40	0_2_00007FF7FAE59E40
Source: C:\Users\user\Desktop\55hj0aeSzk.exe	Code function: 0_2_00007FF7FADA9400	0_2_00007FF7FADA9400
Source: C:\Users\user\Desktop\55hj0aeSzk.exe	Code function: 0_2_00007FF7FAD8D410	0_2_00007FF7FAD8D410
Source: C:\Users\user\Desktop\55hj0aeSzk.exe	Code function: 0_2_00007FF7FACF1000	0_2_00007FF7FACF1000
Source: C:\Users\user\Desktop\55hj0aeSzk.exe	Code function: 0_2_00007FF7FAE3EBD0	0_2_00007FF7FAE3EBD0
Source: C:\Users\user\Desktop\55hj0aeSzk.exe	Code function: 0_2_00007FF7FAD893D0	0_2_00007FF7FAD893D0
Source: C:\Users\user\Desktop\55hj0aeSzk.exe	Code function: 0_2_00007FF7FAE717C0	0_2_00007FF7FAE717C0
Source: C:\Users\user\Desktop\55hj0aeSzk.exe	Code function: 0_2_00007FF7FAE477B0	0_2_00007FF7FAE477B0
Source: C:\Users\user\Desktop\55hj0aeSzk.exe	Code function: 0_2_00007FF7FACFE3CA	0_2_00007FF7FACFE3CA
Source: C:\Users\user\Desktop\55hj0aeSzk.exe	Code function: 0_2_00007FF7FAE3FF70	0_2_00007FF7FAE3FF70
Source: C:\Users\user\Desktop\55hj0aeSzk.exe	Code function: 0_2_00007FF7FAD3B760	0_2_00007FF7FAD3B760
Source: C:\Users\user\Desktop\55hj0aeSzk.exe	Code function: 0_2_00007FF7FACFDB80	0_2_00007FF7FACFDB80
Source: C:\Users\user\Desktop\55hj0aeSzk.exe	Code function: 0_2_00007FF7FAE34B60	0_2_00007FF7FAE34B60
Source: C:\Users\user\Desktop\55hj0aeSzk.exe	Code function: 0_2_00007FF7FADACB40	0_2_00007FF7FADACB40
Source: C:\Users\user\Desktop\55hj0aeSzk.exe	Code function: 0_2_00007FF7FACF2B50	0_2_00007FF7FACF2B50
Source: C:\Users\user\Desktop\55hj0aeSzk.exe	Code function: 0_2_00007FF7FAE47B30	0_2_00007FF7FAE47B30
Source: C:\Users\user\Desktop\55hj0aeSzk.exe	Code function: 0_2_00007FF7FACFC740	0_2_00007FF7FACFC740
Source: C:\Users\user\Desktop\55hj0aeSzk.exe	Code function: 0_2_00007FF7FAD6D730	0_2_00007FF7FAD6D730
Source: C:\Users\user\Desktop\55hj0aeSzk.exe	Code function: 0_2_00007FF7FAD018DB	0_2_00007FF7FAD018DB
Source: C:\Users\user\Desktop\55hj0aeSzk.exe	Code function: 0_2_00007FF7FADB30E0	0_2_00007FF7FADB30E0
Source: C:\Users\user\Desktop\55hj0aeSzk.exe	Code function: 0_2_00007FF7FAE730E0	0_2_00007FF7FAE730E0
Source: C:\Users\user\Desktop\55hj0aeSzk.exe	Code function: 0_2_00007FF7FAD004F7	0_2_00007FF7FAD004F7
Source: C:\Users\user\Desktop\55hj0aeSzk.exe	Code function: 0_2_00007FF7FAE5A4D0	0_2_00007FF7FAE5A4D0
Source: C:\Users\user\Desktop\55hj0aeSzk.exe	Code function: 0_2_00007FF7FAE720D0	0_2_00007FF7FAE720D0
Source: C:\Users\user\Desktop\55hj0aeSzk.exe	Code function: 0_2_00007FF7FAD6B4D0	0_2_00007FF7FAD6B4D0
Source: C:\Users\user\Desktop\55hj0aeSzk.exe	Code function: 0_2_00007FF7FAD6D4B0	0_2_00007FF7FAD6D4B0
Source: C:\Users\user\Desktop\55hj0aeSzk.exe	Code function: 0_2_00007FF7FAE70C90	0_2_00007FF7FAE70C90
Source: C:\Users\user\Desktop\55hj0aeSzk.exe	Code function: 0_2_00007FF7FAD8A060	0_2_00007FF7FAD8A060
Source: C:\Users\user\Desktop\55hj0aeSzk.exe	Code function: 0_2_00007FF7FAE78470	0_2_00007FF7FAE78470
Source: C:\Users\user\Desktop\55hj0aeSzk.exe	Code function: 0_2_00007FF7FACFA030	0_2_00007FF7FACFA030
Source: C:\Users\user\Desktop\55hj0aeSzk.exe	Code function: 0_2_00007FF7FAD6F450	0_2_00007FF7FAD6F450
Source: C:\Users\user\Desktop\55hj0aeSzk.exe	Code function: 0_2_00007FF7FAD87020	0_2_00007FF7FAD87020
Source: C:\Users\user\Desktop\55hj0aeSzk.exe	Code function: 0_2_00007FF7FAD3BC30	0_2_00007FF7FAD3BC30
Source: C:\Users\user\Desktop\55hj0aeSzk.exe	Code function: 0_2_00007FF7FAD85830	0_2_00007FF7FAD85830
Source: C:\Users\user\Desktop\55hj0aeSzk.exe	Code function: 0_2_00007FF7FADB35E0	0_2_00007FF7FADB35E0
Source: C:\Users\user\Desktop\55hj0aeSzk.exe	Code function: 0_2_00007FF7FACFCE00	0_2_00007FF7FACFCE00
Source: C:\Users\user\Desktop\55hj0aeSzk.exe	Code function: 0_2_00007FF7FAE735E0	0_2_00007FF7FAE735E0
Source: C:\Users\user\Desktop\55hj0aeSzk.exe	Code function: 0_2_00007FF7FAE3F970	0_2_00007FF7FAE3F970
Source: C:\Users\user\Desktop\55hj0aeSzk.exe	Code function: 0_2_00007FF7FAE5E130	0_2_00007FF7FAE5E130
Source: C:\Users\user\Desktop\55hj0aeSzk.exe	Code function: 0_2_00007FF7FAE71130	0_2_00007FF7FAE71130
Source: C:\Users\user\Desktop\55hj0aeSzk.exe	Code function: 0_2_00007FF7FAD016DF	0_2_00007FF7FAD016DF
Source: C:\Users\user\Desktop\55hj0aeSzk.exe	Code function: 0_2_00007FF7FAD3DB10	0_2_00007FF7FAD3DB10
Source: C:\Users\user\Desktop\55hj0aeSzk.exe	Code function: 0_2_00007FF7FAE72B00	0_2_00007FF7FAE72B00
Source: C:\Users\user\Desktop\55hj0aeSzk.exe	Code function: 0_2_00007FF7FAE77F00	0_2_00007FF7FAE77F00
Source: C:\Users\user\Desktop\55hj0aeSzk.exe	Code function: 0_2_00007FF7FAD8DEE0	0_2_00007FF7FAD8DEE0
Source: C:\Users\user\Desktop\55hj0aeSzk.exe	Code function: 0_2_00007FF7FAD3BEF0	0_2_00007FF7FAD3BEF0
Source: C:\Users\user\Desktop\55hj0aeSzk.exe	Code function: 0_2_00007FF7FAE586E0	0_2_00007FF7FAE586E0
Source: C:\Users\user\Desktop\55hj0aeSzk.exe	Code function: 0_2_00007FF7FACF22D0	0_2_00007FF7FACF22D0
Source: C:\Users\user\Desktop\55hj0aeSzk.exe	Code function: 0_2_00007FF7FAD82280	0_2_00007FF7FAD82280
Source: C:\Users\user\Desktop\55hj0aeSzk.exe	Code function: 0_2_00007FF7FAD3CA90	0_2_00007FF7FAD3CA90
Source: C:\Users\user\Desktop\55hj0aeSzk.exe	Code function: 0_2_00007FF7FAD2DA60	0_2_00007FF7FAD2DA60
Source: C:\Users\user\Desktop\55hj0aeSzk.exe	Code function: 0_2_00007FF7FAE4C670	0_2_00007FF7FAE4C670
Source: C:\Users\user\Desktop\55hj0aeSzk.exe	Code function: 0_2_00007FF7FAE3EE60	0_2_00007FF7FAE3EE60
Source: C:\Users\user\Desktop\55hj0aeSzk.exe	Code function: 0_2_00007FF7FAD87670	0_2_00007FF7FAD87670
Source: C:\Users\user\Desktop\55hj0aeSzk.exe	Code function: 0_2_00007FF7FAD03634	0_2_00007FF7FAD03634
Source: C:\Users\user\Desktop\55hj0aeSzk.exe	Code function: 0_2_00007FF7FACF4630	0_2_00007FF7FACF4630

Source: 55hj0aeSzk.exe	Binary string: \Device\Afd\Mio
Source: 55hj0aeSzk.exe	Binary string: Failed to open \Device\Afd\Mio:

Source: classification engine

Classification label: mal64.troj.winEXE@2/3@1/1

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3500:120:WilError_03

Source: 55hj0aeSzk.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\55hj0aeSzk.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 55hj0aeSzk.exe	Virustotal: Detection: 30%
Source: 55hj0aeSzk.exe	ReversingLabs: Detection: 32%

Source: unknown	Process created: C:\Users\user\Desktop\55hj0aeSzk.exe "C:\Users\user\Desktop\55hj0aeSzk.exe"
Source: C:\Users\user\Desktop\55hj0aeSzk.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Source: C:\Users\user\Desktop\55hj0aeSzk.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\55hj0aeSzk.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\55hj0aeSzk.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\55hj0aeSzk.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\55hj0aeSzk.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\55hj0aeSzk.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\55hj0aeSzk.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\55hj0aeSzk.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\55hj0aeSzk.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\55hj0aeSzk.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\55hj0aeSzk.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\55hj0aeSzk.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\55hj0aeSzk.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\55hj0aeSzk.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\55hj0aeSzk.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\55hj0aeSzk.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\55hj0aeSzk.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\55hj0aeSzk.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\55hj0aeSzk.exe	Section loaded: cryptnet.dll	Jump to behavior

Source: 55hj0aeSzk.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: 55hj0aeSzk.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: 55hj0aeSzk.exe

Static file information: File size 2170368 > 1048576

Source: 55hj0aeSzk.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x188000

Source: 55hj0aeSzk.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: 55hj0aeSzk.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:

Binary string: encv2.pdb source: 55hj0aeSzk.exe

Source: C:\Users\user\Desktop\55hj0aeSzk.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\55hj0aeSzk.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\55hj0aeSzk.exe

API coverage: 2.4 %

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: 55hj0aeSzk.exe, 00000000.00000002.3389244899.0000016F65363000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Users\user\Desktop\55hj0aeSzk.exe

Code function: 0_2_00007FF7FAE70790 GetProcessHeap,RtlReAllocateHeap,GetProcessHeap,HeapFree,

0_2_00007FF7FAE70790

Source: C:\Users\user\Desktop\55hj0aeSzk.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\55hj0aeSzk.exe	Queries volume information: C:\PE32-KEY\context.pe32c VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\55hj0aeSzk.exe	Queries volume information: C:\PE32-KEY VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\55hj0aeSzk.exe	Queries volume information: C:\PE32-KEY VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\55hj0aeSzk.exe	Queries volume information: C:\PE32-KEY\context.pe32c VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\55hj0aeSzk.exe	Queries volume information: C:\PE32-KEY\context.pe32c VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\55hj0aeSzk.exe	Queries volume information: C:\PE32-KEY VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\55hj0aeSzk.exe	Queries volume information: C:\PE32-KEY VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\55hj0aeSzk.exe	Queries volume information: C:\PE32-KEY\context.pe32c VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\55hj0aeSzk.exe	Queries volume information: C:\PE32-KEY VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\55hj0aeSzk.exe	Queries volume information: C:\PE32-KEY\context.pe32c VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\55hj0aeSzk.exe	Queries volume information: C:\PE32-KEY VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\55hj0aeSzk.exe

Code function: 0_2_00007FF7FAE5FEA4 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00007FF7FAE5FEA4

Source: C:\Users\user\Desktop\55hj0aeSzk.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\Desktop\55hj0aeSzk.exe

Code function: 0_2_00007FF7FAE46030 WSASocketW,WSAGetLastError,WSASocketW,SetHandleInformation,GetLastError,closesocket,bind,WSAGetLastError,closesocket,WSAGetLastError,

0_2_00007FF7FAE46030

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	1 Process Injection	1 Disable or Modify Tools	OS Credential Dumping	1 System Time Discovery	Remote Services	11 Archive Collected Data	1 Web Service	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Process Injection	LSASS Memory	1 Query Registry	Remote Desktop Protocol	Data from Removable Media	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 DLL Side-Loading	Security Account Manager	11 Security Software Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	13 System Information Discovery	Distributed Component Object Model	Input Capture	3 Application Layer Protocol	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report
55hj0aeSzk.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 55hj0aeSzk.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Windows Analysis Report
55hj0aeSzk.exe