Edit tour

Windows Analysis Report
9uWGaRcOv8.exe

Overview

General Information

Sample name:	9uWGaRcOv8.exe
Analysis ID:	1626837
MD5:	99f551d75bf6a5f0ee99bceb78093f84
SHA1:	c2f253a1ec4e5e9c355c2783ea073f6a40fce335
SHA256:	782cbe7f5999e817a6e3b4cf87a30bf31b9fb0fd8ce4552c6f4edd7f89eef2ca
Tags:	exeSocks5Systemzuser-aachum
Infos:

Detection

Socks5Systemz

Score:	84
Range:	0 - 100
Confidence:	100%

Signatures

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Multi AV Scanner detection for submitted file

Yara detected Socks5Systemz

Contains functionality to infect the boot sector

Joe Sandbox ML detected suspicious sample

PE file has a writeable .text section

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to launch a program with higher privileges

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to query network adapater information

Contains functionality to shutdown / reboot the system

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found evasive API chain (date check)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains executable resources (Code or Archives)

PE file contains more sections than normal

PE file contains sections with non-standard names

Queries disk information (often used to detect virtual machines)

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

9uWGaRcOv8.exe (PID: 5296 cmdline: "C:\Users\user\Desktop\9uWGaRcOv8.exe" MD5: 99F551D75BF6A5F0EE99BCEB78093F84)

9uWGaRcOv8.tmp (PID: 5576 cmdline: "C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp" /SL5="$40624,3802515,56832,C:\Users\user\Desktop\9uWGaRcOv8.exe" MD5: 076BF04D950585580F2528A35682570A)

diskfilefinder87.exe (PID: 2140 cmdline: "C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\diskfilefinder87.exe" -i MD5: 465AE51B717D2C468E1FE25941A3DF87)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000002.00000002.3539980364.0000000000931000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Socks5Systemz	Yara detected Socks5Systemz	Joe Security
00000002.00000002.3540467207.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Socks5Systemz	Yara detected Socks5Systemz	Joe Security
Process Memory Space: diskfilefinder87.exe PID: 2140	JoeSecurity_Socks5Systemz	Yara detected Socks5Systemz	Joe Security

Suricata Signatures

ET JA3 Hash - [Abuse.ch] Possible Dridex

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-28T23:27:21.743267+0100	2028765	3	Unknown Traffic	192.168.2.4	50031	176.113.115.96	443	TCP

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-28T23:27:22.372742+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	50031	176.113.115.96	443	TCP

HTTP traffic detected: GET /ai/?key=8f3f2b3ab14e166f251de6a5231678fbb38f926d19fe6595cd66946851e91fcd85241ab258d81329326be8ef43a8f51f8a95b5c0212a91f953c588fb52d6db9f51a9a0a29d5954cad713479a672918d4348cd3da95584fc1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)Host: 176.113.115.96

Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.96
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.96
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.96
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.96
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.96
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.96
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.96
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.96
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.96
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.96

Source: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\diskfilefinder87.exe

Code function: 2_2_00932B95 WSASetLastError,WSARecv,WSASetLastError,select,

2_2_00932B95

Source: global traffic

Source: is-KD5MG.tmp.1.dr, is-02PLV.tmp.1.dr	String found in binary or memory: http://icu-project.org
Source: is-Q9KN2.tmp.1.dr	String found in binary or memory: http://www.extend-partition.com/buynow.html
Source: diskfilefinder87.exe, 00000002.00000000.1706328900.0000000000640000.00000002.00000001.01000000.00000009.sdmp, diskfilefinder87.exe, 00000002.00000003.1706915825.000000000264D000.00000004.00000020.00020000.00000000.sdmp, diskfilefinder87.exe.1.dr, DiskFileFinder.exe.2.dr, is-Q9KN2.tmp.1.dr	String found in binary or memory: http://www.extend-partition.com/pa-extend-partition.html
Source: diskfilefinder87.exe, 00000002.00000000.1706328900.0000000000640000.00000002.00000001.01000000.00000009.sdmp, diskfilefinder87.exe, 00000002.00000003.1706915825.000000000264D000.00000004.00000020.00020000.00000000.sdmp, diskfilefinder87.exe.1.dr, DiskFileFinder.exe.2.dr, is-Q9KN2.tmp.1.dr	String found in binary or memory: http://www.extend-partition.com/pa-extend-partition.html.KFailed
Source: diskfilefinder87.exe, 00000002.00000000.1706328900.0000000000640000.00000002.00000001.01000000.00000009.sdmp, diskfilefinder87.exe, 00000002.00000003.1706915825.000000000264D000.00000004.00000020.00020000.00000000.sdmp, diskfilefinder87.exe.1.dr, DiskFileFinder.exe.2.dr, is-Q9KN2.tmp.1.dr	String found in binary or memory: http://www.extend-partition.com/pa-extend-partition.html.bPaging
Source: 9uWGaRcOv8.tmp, 9uWGaRcOv8.tmp, 00000001.00000000.1694185607.0000000000401000.00000020.00000001.01000000.00000004.sdmp, 9uWGaRcOv8.tmp.0.dr, is-QT0ES.tmp.1.dr	String found in binary or memory: http://www.innosetup.com/
Source: 9uWGaRcOv8.exe	String found in binary or memory: http://www.jrsoftware.org/ishelp/index.php?topic=setupcmdline
Source: 9uWGaRcOv8.exe	String found in binary or memory: http://www.jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU
Source: 9uWGaRcOv8.exe, 00000000.00000003.1693748856.00000000020D8000.00000004.00001000.00020000.00000000.sdmp, 9uWGaRcOv8.exe, 00000000.00000003.1693601720.0000000002300000.00000004.00001000.00020000.00000000.sdmp, 9uWGaRcOv8.tmp, 9uWGaRcOv8.tmp, 00000001.00000000.1694185607.0000000000401000.00000020.00000001.01000000.00000004.sdmp, 9uWGaRcOv8.tmp.0.dr, is-QT0ES.tmp.1.dr	String found in binary or memory: http://www.remobjects.com/ps
Source: 9uWGaRcOv8.exe, 00000000.00000003.1693748856.00000000020D8000.00000004.00001000.00020000.00000000.sdmp, 9uWGaRcOv8.exe, 00000000.00000003.1693601720.0000000002300000.00000004.00001000.00020000.00000000.sdmp, 9uWGaRcOv8.tmp, 00000001.00000000.1694185607.0000000000401000.00000020.00000001.01000000.00000004.sdmp, 9uWGaRcOv8.tmp.0.dr, is-QT0ES.tmp.1.dr	String found in binary or memory: http://www.remobjects.com/psU
Source: diskfilefinder87.exe, 00000002.00000002.3539697554.00000000007FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://176.113.115.96/
Source: diskfilefinder87.exe, 00000002.00000002.3539697554.00000000007FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://176.113.115.96/E7
Source: diskfilefinder87.exe, 00000002.00000002.3539697554.0000000000810000.00000004.00000020.00020000.00000000.sdmp, diskfilefinder87.exe, 00000002.00000002.3539697554.0000000000728000.00000004.00000020.00020000.00000000.sdmp, diskfilefinder87.exe, 00000002.00000002.3539697554.00000000007DD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://176.113.115.96/ai/?key=8f3f2b3ab14e166f251de6a5231678fbb38f926d19fe6595cd66946851e91fcd85241
Source: 9uWGaRcOv8.exe, 00000000.00000003.1693258075.0000000002300000.00000004.00001000.00020000.00000000.sdmp, 9uWGaRcOv8.exe, 00000000.00000003.1693330139.00000000020D1000.00000004.00001000.00020000.00000000.sdmp, 9uWGaRcOv8.exe, 00000000.00000002.3539711181.00000000020D1000.00000004.00001000.00020000.00000000.sdmp, 9uWGaRcOv8.tmp, 00000001.00000002.3540078571.0000000002208000.00000004.00001000.00020000.00000000.sdmp, 9uWGaRcOv8.tmp, 00000001.00000003.1694952014.0000000002208000.00000004.00001000.00020000.00000000.sdmp, 9uWGaRcOv8.tmp, 00000001.00000002.3539699200.00000000006A0000.00000004.00000020.00020000.00000000.sdmp, 9uWGaRcOv8.tmp, 00000001.00000003.1694881244.00000000030F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.easycutstudio.com/support.html

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50031
Source: unknown	Network traffic detected: HTTP traffic on port 50031 -> 443

Source: unknown

HTTPS traffic detected: 176.113.115.96:443 -> 192.168.2.4:50031 version: TLS 1.2

System Summary

PE file has a writeable .text section

Source: diskfilefinder87.exe.1.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: DiskFileFinder.exe.2.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp	Code function: 1_2_0042F594 NtdllDefWindowProc_A,	1_2_0042F594
Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp	Code function: 1_2_00423B94 NtdllDefWindowProc_A,	1_2_00423B94
Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp	Code function: 1_2_004125E8 NtdllDefWindowProc_A,	1_2_004125E8
Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp	Code function: 1_2_00479380 NtdllDefWindowProc_A,	1_2_00479380
Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp	Code function: 1_2_0045763C PostMessageA,PostMessageA,SetForegroundWindow,NtdllDefWindowProc_A,	1_2_0045763C

Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp

Code function: 1_2_0042E944: CreateFileA,DeviceIoControl,GetLastError,CloseHandle,SetLastError,

1_2_0042E944

Source: C:\Users\user\Desktop\9uWGaRcOv8.exe	Code function: 0_2_00409448 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,		0_2_00409448
Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp	Code function: 1_2_0045568C GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,		1_2_0045568C

Source: C:\Users\user\Desktop\9uWGaRcOv8.exe	Code function: 0_2_0040840C	0_2_0040840C
Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp	Code function: 1_2_00470C74	1_2_00470C74
Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp	Code function: 1_2_0043533C	1_2_0043533C
Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp	Code function: 1_2_004813C4	1_2_004813C4
Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp	Code function: 1_2_00467848	1_2_00467848
Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp	Code function: 1_2_004303D0	1_2_004303D0
Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp	Code function: 1_2_0044453C	1_2_0044453C
Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp	Code function: 1_2_004885E0	1_2_004885E0
Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp	Code function: 1_2_00434638	1_2_00434638
Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp	Code function: 1_2_00444AE4	1_2_00444AE4
Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp	Code function: 1_2_0048ED0C	1_2_0048ED0C
Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp	Code function: 1_2_00430F5C	1_2_00430F5C
Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp	Code function: 1_2_0045F16C	1_2_0045F16C
Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp	Code function: 1_2_004451DC	1_2_004451DC
Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp	Code function: 1_2_0045B21C	1_2_0045B21C
Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp	Code function: 1_2_004455E8	1_2_004455E8
Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp	Code function: 1_2_00487680	1_2_00487680
Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp	Code function: 1_2_0046989C	1_2_0046989C
Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp	Code function: 1_2_00451A30	1_2_00451A30
Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp	Code function: 1_2_0043DDC4	1_2_0043DDC4
Source: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\diskfilefinder87.exe	Code function: 2_2_00401000	2_2_00401000
Source: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\diskfilefinder87.exe	Code function: 2_2_004067B7	2_2_004067B7
Source: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\diskfilefinder87.exe	Code function: 2_2_609660FA	2_2_609660FA
Source: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\diskfilefinder87.exe	Code function: 2_2_6092114F	2_2_6092114F
Source: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\diskfilefinder87.exe	Code function: 2_2_6091F2C9	2_2_6091F2C9
Source: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\diskfilefinder87.exe	Code function: 2_2_6096923E	2_2_6096923E
Source: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\diskfilefinder87.exe	Code function: 2_2_6093323D	2_2_6093323D
Source: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\diskfilefinder87.exe	Code function: 2_2_6095C314	2_2_6095C314
Source: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\diskfilefinder87.exe	Code function: 2_2_60950312	2_2_60950312
Source: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\diskfilefinder87.exe	Code function: 2_2_6094D33B	2_2_6094D33B
Source: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\diskfilefinder87.exe	Code function: 2_2_6093B368	2_2_6093B368
Source: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\diskfilefinder87.exe	Code function: 2_2_6096748C	2_2_6096748C
Source: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\diskfilefinder87.exe	Code function: 2_2_6093F42E	2_2_6093F42E
Source: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\diskfilefinder87.exe	Code function: 2_2_60954470	2_2_60954470
Source: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\diskfilefinder87.exe	Code function: 2_2_609615FA	2_2_609615FA
Source: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\diskfilefinder87.exe	Code function: 2_2_6096A5EE	2_2_6096A5EE
Source: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\diskfilefinder87.exe	Code function: 2_2_6096D6A4	2_2_6096D6A4
Source: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\diskfilefinder87.exe	Code function: 2_2_609606A8	2_2_609606A8
Source: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\diskfilefinder87.exe	Code function: 2_2_60932654	2_2_60932654
Source: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\diskfilefinder87.exe	Code function: 2_2_60955665	2_2_60955665
Source: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\diskfilefinder87.exe	Code function: 2_2_6094B7DB	2_2_6094B7DB
Source: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\diskfilefinder87.exe	Code function: 2_2_6092F74D	2_2_6092F74D
Source: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\diskfilefinder87.exe	Code function: 2_2_60964807	2_2_60964807
Source: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\diskfilefinder87.exe	Code function: 2_2_6094E9BC	2_2_6094E9BC
Source: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\diskfilefinder87.exe	Code function: 2_2_60937929	2_2_60937929
Source: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\diskfilefinder87.exe	Code function: 2_2_6093FAD6	2_2_6093FAD6
Source: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\diskfilefinder87.exe	Code function: 2_2_6096DAE8	2_2_6096DAE8
Source: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\diskfilefinder87.exe	Code function: 2_2_6094DA3A	2_2_6094DA3A
Source: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\diskfilefinder87.exe	Code function: 2_2_60936B27	2_2_60936B27
Source: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\diskfilefinder87.exe	Code function: 2_2_60954CF6	2_2_60954CF6
Source: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\diskfilefinder87.exe	Code function: 2_2_60950C6B	2_2_60950C6B
Source: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\diskfilefinder87.exe	Code function: 2_2_60966DF1	2_2_60966DF1
Source: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\diskfilefinder87.exe	Code function: 2_2_60963D35	2_2_60963D35
Source: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\diskfilefinder87.exe	Code function: 2_2_60909E9C	2_2_60909E9C
Source: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\diskfilefinder87.exe	Code function: 2_2_60951E86	2_2_60951E86
Source: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\diskfilefinder87.exe	Code function: 2_2_60912E0B	2_2_60912E0B
Source: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\diskfilefinder87.exe	Code function: 2_2_60954FF8	2_2_60954FF8
Source: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\diskfilefinder87.exe	Code function: 2_2_0093E094	2_2_0093E094
Source: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\diskfilefinder87.exe	Code function: 2_2_009470D0	2_2_009470D0
Source: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\diskfilefinder87.exe	Code function: 2_2_0094BB0D	2_2_0094BB0D
Source: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\diskfilefinder87.exe	Code function: 2_2_0094D33F	2_2_0094D33F
Source: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\diskfilefinder87.exe	Code function: 2_2_00950DC4	2_2_00950DC4
Source: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\diskfilefinder87.exe	Code function: 2_2_0095268D	2_2_0095268D
Source: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\diskfilefinder87.exe	Code function: 2_2_0094B619	2_2_0094B619
Source: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\diskfilefinder87.exe	Code function: 2_2_0094BF25	2_2_0094BF25
Source: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\diskfilefinder87.exe	Code function: 2_2_0094875A	2_2_0094875A

Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp	Code function: String function: 00408C1C appears 45 times
Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp	Code function: String function: 00406AD4 appears 45 times
Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp	Code function: String function: 0040596C appears 117 times
Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp	Code function: String function: 00407904 appears 43 times
Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp	Code function: String function: 00403400 appears 60 times
Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp	Code function: String function: 00445E48 appears 45 times
Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp	Code function: String function: 00457FC4 appears 77 times
Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp	Code function: String function: 00457DB8 appears 102 times
Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp	Code function: String function: 00434550 appears 32 times
Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp	Code function: String function: 00403494 appears 85 times
Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp	Code function: String function: 004533B8 appears 98 times
Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp	Code function: String function: 00446118 appears 58 times
Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp	Code function: String function: 00403684 appears 229 times
Source: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\diskfilefinder87.exe	Code function: String function: 00952A20 appears 135 times
Source: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\diskfilefinder87.exe	Code function: String function: 00947770 appears 32 times

Source: 9uWGaRcOv8.tmp.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: 9uWGaRcOv8.tmp.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Source: 9uWGaRcOv8.tmp.0.dr	Static PE information: Resource name: RT_VERSION type: 370 sysV pure executable not stripped
Source: is-QT0ES.tmp.1.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: is-QT0ES.tmp.1.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Source: is-QT0ES.tmp.1.dr	Static PE information: Resource name: RT_VERSION type: 370 sysV pure executable not stripped

Source: is-F4NO0.tmp.1.dr	Static PE information: Number of sections : 19 > 10
Source: sqlite3.dll.2.dr	Static PE information: Number of sections : 19 > 10

Source: 9uWGaRcOv8.exe, 00000000.00000003.1693748856.00000000020D8000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameshfolder.dll~/ vs 9uWGaRcOv8.exe
Source: 9uWGaRcOv8.exe, 00000000.00000003.1693601720.0000000002300000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameshfolder.dll~/ vs 9uWGaRcOv8.exe

Source: 9uWGaRcOv8.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: classification engine

Classification label: mal84.troj.evad.winEXE@5/32@0/1

Source: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\diskfilefinder87.exe

Code function: 2_2_0093F8E0 FormatMessageA,GetLastError,FormatMessageA,GetLastError,

2_2_0093F8E0

Source: C:\Users\user\Desktop\9uWGaRcOv8.exe	Code function: 0_2_00409448 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,		0_2_00409448
Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp	Code function: 1_2_0045568C GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,		1_2_0045568C

Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp

Code function: 1_2_00455EB4 GetModuleHandleA,GetProcAddress,GetDiskFreeSpaceA,

1_2_00455EB4

Source: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\diskfilefinder87.exe

Code function: CreateServiceA,CloseServiceHandle,

2_2_004016E3

Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp

Code function: 1_2_0046E5B8 GetVersion,CoCreateInstance,

1_2_0046E5B8

Source: C:\Users\user\Desktop\9uWGaRcOv8.exe

Code function: 0_2_00409C34 FindResourceA,SizeofResource,LoadResource,LockResource,

0_2_00409C34

Source: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\diskfilefinder87.exe

Code function: 2_2_0040D35A StartServiceCtrlDispatcherA,

2_2_0040D35A

Source: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\diskfilefinder87.exe	Code function: 2_2_0040D35A StartServiceCtrlDispatcherA,		2_2_0040D35A
Source: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\diskfilefinder87.exe	Code function: 2_2_0040D372 StartServiceCtrlDispatcherA,		2_2_0040D372

Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp

File created: C:\Users\user\AppData\Local\Programs

Jump to behavior

Source: C:\Users\user\Desktop\9uWGaRcOv8.exe

File created: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp

File read: C:\Windows\win.ini

Jump to behavior

Source: C:\Users\user\Desktop\9uWGaRcOv8.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOrganization

Jump to behavior

Source: diskfilefinder87.exe, diskfilefinder87.exe, 00000002.00000003.1707521464.000000000073A000.00000004.00000020.00020000.00000000.sdmp, diskfilefinder87.exe, 00000002.00000002.3540849155.000000006096F000.00000002.00000001.01000000.0000000A.sdmp, sqlite3.dll.2.dr, is-F4NO0.tmp.1.dr	Binary or memory string: SELECT 'INSERT INTO vacuum_db.' \|\| quote(name) \|\| ' SELECT * FROM main.' \|\| quote(name) \|\| ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';
Source: diskfilefinder87.exe, 00000002.00000003.1707521464.000000000073A000.00000004.00000020.00020000.00000000.sdmp, diskfilefinder87.exe, 00000002.00000002.3540849155.000000006096F000.00000002.00000001.01000000.0000000A.sdmp, sqlite3.dll.2.dr, is-F4NO0.tmp.1.dr	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: diskfilefinder87.exe, diskfilefinder87.exe, 00000002.00000003.1707521464.000000000073A000.00000004.00000020.00020000.00000000.sdmp, diskfilefinder87.exe, 00000002.00000002.3540849155.000000006096F000.00000002.00000001.01000000.0000000A.sdmp, sqlite3.dll.2.dr, is-F4NO0.tmp.1.dr	Binary or memory string: SELECT 'INSERT INTO vacuum_db.' \|\| quote(name) \|\| ' SELECT * FROM main.' \|\| quote(name) \|\| ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND coalesce(rootpage,1)>0
Source: diskfilefinder87.exe, 00000002.00000003.1707521464.000000000073A000.00000004.00000020.00020000.00000000.sdmp, diskfilefinder87.exe, 00000002.00000002.3540849155.000000006096F000.00000002.00000001.01000000.0000000A.sdmp, sqlite3.dll.2.dr, is-F4NO0.tmp.1.dr	Binary or memory string: CREATE TABLE "%w"."%w_node"(nodeno INTEGER PRIMARY KEY, data BLOB);CREATE TABLE "%w"."%w_rowid"(rowid INTEGER PRIMARY KEY, nodeno INTEGER);CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY, parentnode INTEGER);INSERT INTO '%q'.'%q_node' VALUES(1, zeroblob(%d))
Source: diskfilefinder87.exe, 00000002.00000003.1707521464.000000000073A000.00000004.00000020.00020000.00000000.sdmp, diskfilefinder87.exe, 00000002.00000002.3540849155.000000006096F000.00000002.00000001.01000000.0000000A.sdmp, sqlite3.dll.2.dr, is-F4NO0.tmp.1.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: diskfilefinder87.exe, 00000002.00000003.1707521464.000000000073A000.00000004.00000020.00020000.00000000.sdmp, diskfilefinder87.exe, 00000002.00000002.3540849155.000000006096F000.00000002.00000001.01000000.0000000A.sdmp, sqlite3.dll.2.dr, is-F4NO0.tmp.1.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: diskfilefinder87.exe, 00000002.00000003.1707521464.000000000073A000.00000004.00000020.00020000.00000000.sdmp, diskfilefinder87.exe, 00000002.00000002.3540849155.000000006096F000.00000002.00000001.01000000.0000000A.sdmp, sqlite3.dll.2.dr, is-F4NO0.tmp.1.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: diskfilefinder87.exe, 00000002.00000003.1707521464.000000000073A000.00000004.00000020.00020000.00000000.sdmp, diskfilefinder87.exe, 00000002.00000002.3540849155.000000006096F000.00000002.00000001.01000000.0000000A.sdmp, sqlite3.dll.2.dr, is-F4NO0.tmp.1.dr	Binary or memory string: UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
Source: diskfilefinder87.exe, 00000002.00000003.1707521464.000000000073A000.00000004.00000020.00020000.00000000.sdmp, diskfilefinder87.exe, 00000002.00000002.3540849155.000000006096F000.00000002.00000001.01000000.0000000A.sdmp, sqlite3.dll.2.dr, is-F4NO0.tmp.1.dr	Binary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
Source: diskfilefinder87.exe, 00000002.00000003.1707521464.000000000073A000.00000004.00000020.00020000.00000000.sdmp, diskfilefinder87.exe, 00000002.00000002.3540849155.000000006096F000.00000002.00000001.01000000.0000000A.sdmp, sqlite3.dll.2.dr, is-F4NO0.tmp.1.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: diskfilefinder87.exe, 00000002.00000003.1707521464.000000000073A000.00000004.00000020.00020000.00000000.sdmp, diskfilefinder87.exe, 00000002.00000002.3540849155.000000006096F000.00000002.00000001.01000000.0000000A.sdmp, sqlite3.dll.2.dr, is-F4NO0.tmp.1.dr	Binary or memory string: UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: diskfilefinder87.exe, diskfilefinder87.exe, 00000002.00000003.1707521464.000000000073A000.00000004.00000020.00020000.00000000.sdmp, diskfilefinder87.exe, 00000002.00000002.3540849155.000000006096F000.00000002.00000001.01000000.0000000A.sdmp, sqlite3.dll.2.dr, is-F4NO0.tmp.1.dr	Binary or memory string: SELECT 'DELETE FROM vacuum_db.' \|\| quote(name) \|\| ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'

Source: 9uWGaRcOv8.exe

Virustotal: Detection: 15%

Source: 9uWGaRcOv8.exe	String found in binary or memory: need to be updated. /RESTARTAPPLICATIONS Instructs Setup to restart applications. /NORESTARTAPPLICATIONS Prevents Setup from restarting applications. /LOADINF="filename" Instructs Setup to load the settings from the specified file after having checked t
Source: 9uWGaRcOv8.exe	String found in binary or memory: /LOADINF="filename"

Source: C:\Users\user\Desktop\9uWGaRcOv8.exe

File read: C:\Users\user\Desktop\9uWGaRcOv8.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\9uWGaRcOv8.exe "C:\Users\user\Desktop\9uWGaRcOv8.exe"
Source: C:\Users\user\Desktop\9uWGaRcOv8.exe	Process created: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp "C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp" /SL5="$40624,3802515,56832,C:\Users\user\Desktop\9uWGaRcOv8.exe"
Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp	Process created: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\diskfilefinder87.exe "C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\diskfilefinder87.exe" -i
Source: C:\Users\user\Desktop\9uWGaRcOv8.exe	Process created: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp "C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp" /SL5="$40624,3802515,56832,C:\Users\user\Desktop\9uWGaRcOv8.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp	Process created: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\diskfilefinder87.exe "C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\diskfilefinder87.exe" -i	Jump to behavior

Source: C:\Users\user\Desktop\9uWGaRcOv8.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\9uWGaRcOv8.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\diskfilefinder87.exe	Section loaded: sqlite3.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\diskfilefinder87.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\diskfilefinder87.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\diskfilefinder87.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\diskfilefinder87.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\diskfilefinder87.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\diskfilefinder87.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\diskfilefinder87.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\diskfilefinder87.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\diskfilefinder87.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\diskfilefinder87.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\diskfilefinder87.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\diskfilefinder87.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\diskfilefinder87.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\diskfilefinder87.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\diskfilefinder87.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\diskfilefinder87.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\diskfilefinder87.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\diskfilefinder87.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\diskfilefinder87.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\diskfilefinder87.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\diskfilefinder87.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\diskfilefinder87.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\diskfilefinder87.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\diskfilefinder87.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\diskfilefinder87.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\diskfilefinder87.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\diskfilefinder87.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\diskfilefinder87.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\diskfilefinder87.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\diskfilefinder87.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\diskfilefinder87.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\diskfilefinder87.exe	Section loaded: ncryptsslp.dll	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\InProcServer32

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOwner

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp

Window found: window name: TMainForm

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp

Registry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Disk File Finder_is1

Jump to behavior

Source: 9uWGaRcOv8.exe

Static file information: File size 4053219 > 1048576

Source: 9uWGaRcOv8.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: msvcr100.i386.pdb source: is-AH6EL.tmp.1.dr
Source:	Binary string: msvcp100.i386.pdb source: is-ISKBL.tmp.1.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\diskfilefinder87.exe

Unpacked PE file: 2.2.diskfilefinder87.exe.400000.0.unpack .text:EW;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.vmp0:ER;.rsrc:R;

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\diskfilefinder87.exe

Unpacked PE file: 2.2.diskfilefinder87.exe.400000.0.unpack

Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp

Code function: 1_2_00450334 GetVersion,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

1_2_00450334

Source: is-F4NO0.tmp.1.dr	Static PE information: section name: /4
Source: is-F4NO0.tmp.1.dr	Static PE information: section name: /19
Source: is-F4NO0.tmp.1.dr	Static PE information: section name: /35
Source: is-F4NO0.tmp.1.dr	Static PE information: section name: /51
Source: is-F4NO0.tmp.1.dr	Static PE information: section name: /63
Source: is-F4NO0.tmp.1.dr	Static PE information: section name: /77
Source: is-F4NO0.tmp.1.dr	Static PE information: section name: /89
Source: is-F4NO0.tmp.1.dr	Static PE information: section name: /102
Source: is-F4NO0.tmp.1.dr	Static PE information: section name: /113
Source: is-F4NO0.tmp.1.dr	Static PE information: section name: /124
Source: sqlite3.dll.2.dr	Static PE information: section name: /4
Source: sqlite3.dll.2.dr	Static PE information: section name: /19
Source: sqlite3.dll.2.dr	Static PE information: section name: /35
Source: sqlite3.dll.2.dr	Static PE information: section name: /51
Source: sqlite3.dll.2.dr	Static PE information: section name: /63
Source: sqlite3.dll.2.dr	Static PE information: section name: /77
Source: sqlite3.dll.2.dr	Static PE information: section name: /89
Source: sqlite3.dll.2.dr	Static PE information: section name: /102
Source: sqlite3.dll.2.dr	Static PE information: section name: /113
Source: sqlite3.dll.2.dr	Static PE information: section name: /124

Source: C:\Users\user\Desktop\9uWGaRcOv8.exe	Code function: 0_2_004065C8 push 00406605h; ret	0_2_004065FD
Source: C:\Users\user\Desktop\9uWGaRcOv8.exe	Code function: 0_2_004040B5 push eax; ret	0_2_004040F1
Source: C:\Users\user\Desktop\9uWGaRcOv8.exe	Code function: 0_2_00408104 push ecx; mov dword ptr [esp], eax	0_2_00408109
Source: C:\Users\user\Desktop\9uWGaRcOv8.exe	Code function: 0_2_00404185 push 00404391h; ret	0_2_00404389
Source: C:\Users\user\Desktop\9uWGaRcOv8.exe	Code function: 0_2_00404206 push 00404391h; ret	0_2_00404389
Source: C:\Users\user\Desktop\9uWGaRcOv8.exe	Code function: 0_2_0040C218 push eax; ret	0_2_0040C219
Source: C:\Users\user\Desktop\9uWGaRcOv8.exe	Code function: 0_2_004042E8 push 00404391h; ret	0_2_00404389
Source: C:\Users\user\Desktop\9uWGaRcOv8.exe	Code function: 0_2_00404283 push 00404391h; ret	0_2_00404389
Source: C:\Users\user\Desktop\9uWGaRcOv8.exe	Code function: 0_2_00408F38 push 00408F6Bh; ret	0_2_00408F63
Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp	Code function: 1_2_004849F4 push 00484B02h; ret	1_2_00484AFA
Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp	Code function: 1_2_0040995C push 00409999h; ret	1_2_00409991
Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp	Code function: 1_2_00458060 push 00458098h; ret	1_2_00458090
Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp	Code function: 1_2_004860E4 push ecx; mov dword ptr [esp], ecx	1_2_004860E9
Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp	Code function: 1_2_004062C4 push ecx; mov dword ptr [esp], eax	1_2_004062C5
Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp	Code function: 1_2_004783C8 push ecx; mov dword ptr [esp], edx	1_2_004783C9
Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp	Code function: 1_2_004104F0 push ecx; mov dword ptr [esp], edx	1_2_004104F5
Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp	Code function: 1_2_00412938 push 0041299Bh; ret	1_2_00412993
Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp	Code function: 1_2_0049AD44 pushad ; retf	1_2_0049AD53
Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp	Code function: 1_2_0040CE48 push ecx; mov dword ptr [esp], edx	1_2_0040CE4A
Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp	Code function: 1_2_00459378 push 004593BCh; ret	1_2_004593B4
Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp	Code function: 1_2_0040F3A8 push ecx; mov dword ptr [esp], edx	1_2_0040F3AA
Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp	Code function: 1_2_0040546D push eax; ret	1_2_004054A9
Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp	Code function: 1_2_004434B4 push ecx; mov dword ptr [esp], ecx	1_2_004434B8
Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp	Code function: 1_2_0040553D push 00405749h; ret	1_2_00405741
Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp	Code function: 1_2_004055BE push 00405749h; ret	1_2_00405741
Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp	Code function: 1_2_0040563B push 00405749h; ret	1_2_00405741
Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp	Code function: 1_2_004056A0 push 00405749h; ret	1_2_00405741
Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp	Code function: 1_2_0045186C push 0045189Fh; ret	1_2_00451897
Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp	Code function: 1_2_00451A30 push ecx; mov dword ptr [esp], eax	1_2_00451A35
Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp	Code function: 1_2_00495BE4 push ecx; mov dword ptr [esp], ecx	1_2_00495BE9
Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp	Code function: 1_2_00419C38 push ecx; mov dword ptr [esp], ecx	1_2_00419C3D

Source: is-AH6EL.tmp.1.dr

Static PE information: section name: .text entropy: 6.90903234258047

Persistence and Installation Behavior

Contains functionality to infect the boot sector

Source: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\diskfilefinder87.exe

Code function: CreateFileA,DeviceIoControl,GetLastError,CloseHandle, \\.\PhysicalDrive0

2_2_0093E8BD

Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp	File created: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\sqlite3.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp	File created: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\is-KD5MG.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp	File created: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\libEGL.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp	File created: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\is-J7RIG.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp	File created: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\is-3889U.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp	File created: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\is-U86HG.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp	File created: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\uninstall\is-QT0ES.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\diskfilefinder87.exe	File created: C:\ProgramData\DiskFileFinder\DiskFileFinder.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp	File created: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\is-F4NO0.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp	File created: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\is-ISKBL.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp	File created: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\is-AH6EL.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp	File created: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\icuuc51.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp	File created: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\uninstall\unins000.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp	File created: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\icuin51.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp	File created: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\msvcp100.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp	File created: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\libGLESv2.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp	File created: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\is-02PLV.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp	File created: C:\Users\user\AppData\Local\Temp\is-B9ABP.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\9uWGaRcOv8.exe	File created: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp	File created: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\Qt5Concurrent.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp	File created: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\diskfilefinder87.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp	File created: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\is-AE5JU.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp	File created: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\Qt5PrintSupport.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp	File created: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\msvcr100.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp	File created: C:\Users\user\AppData\Local\Temp\is-B9ABP.tmp\_isetup\_shfoldr.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\diskfilefinder87.exe	File created: C:\ProgramData\DiskFileFinder\sqlite3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp	File created: C:\Users\user\AppData\Local\Temp\is-B9ABP.tmp\_isetup\_iscrypt.dll	Jump to dropped file

Source: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\diskfilefinder87.exe	File created: C:\ProgramData\DiskFileFinder\DiskFileFinder.exe			Jump to dropped file
Source: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\diskfilefinder87.exe	File created: C:\ProgramData\DiskFileFinder\sqlite3.dll			Jump to dropped file

Boot Survival

Contains functionality to infect the boot sector

Source: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\diskfilefinder87.exe

Code function: CreateFileA,DeviceIoControl,GetLastError,CloseHandle, \\.\PhysicalDrive0

2_2_0093E8BD

Source: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\diskfilefinder87.exe

Code function: 2_2_0040D35A StartServiceCtrlDispatcherA,

2_2_0040D35A

Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp	Code function: 1_2_00423C1C IsIconic,PostMessageA,PostMessageA,PostMessageA,SendMessageA,IsWindowEnabled,IsWindowEnabled,IsWindowVisible,GetFocus,SetFocus,SetFocus,IsIconic,GetFocus,SetFocus,	1_2_00423C1C
Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp	Code function: 1_2_00423C1C IsIconic,PostMessageA,PostMessageA,PostMessageA,SendMessageA,IsWindowEnabled,IsWindowEnabled,IsWindowVisible,GetFocus,SetFocus,SetFocus,IsIconic,GetFocus,SetFocus,	1_2_00423C1C
Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp	Code function: 1_2_004241EC IsIconic,SetActiveWindow,SetFocus,	1_2_004241EC
Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp	Code function: 1_2_004241A4 IsIconic,SetActiveWindow,	1_2_004241A4
Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp	Code function: 1_2_00418394 IsIconic,GetWindowPlacement,GetWindowRect,GetWindowLongA,GetWindowLongA,ScreenToClient,ScreenToClient,	1_2_00418394
Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp	Code function: 1_2_004843A8 IsIconic,GetWindowLongA,ShowWindow,ShowWindow,	1_2_004843A8
Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp	Code function: 1_2_0042286C SendMessageA,ShowWindow,ShowWindow,CallWindowProcA,SendMessageA,ShowWindow,SetWindowPos,GetActiveWindow,IsIconic,SetWindowPos,SetActiveWindow,ShowWindow,	1_2_0042286C
Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp	Code function: 1_2_0042F2F0 IsIconic,GetWindowLongA,GetWindowLongA,GetActiveWindow,MessageBoxA,SetActiveWindow,GetActiveWindow,MessageBoxA,SetActiveWindow,	1_2_0042F2F0
Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp	Code function: 1_2_004175A8 IsIconic,GetCapture,	1_2_004175A8
Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp	Code function: 1_2_00417CDE IsIconic,SetWindowPos,	1_2_00417CDE
Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp	Code function: 1_2_00417CE0 IsIconic,SetWindowPos,GetWindowPlacement,SetWindowPlacement,	1_2_00417CE0

Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp

Code function: 1_2_0041F128 GetVersion,SetErrorMode,LoadLibraryA,SetErrorMode,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,

1_2_0041F128

Source: C:\Users\user\Desktop\9uWGaRcOv8.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\diskfilefinder87.exe

Code function: 2_2_60920C91 rdtsc

2_2_60920C91

Source: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\diskfilefinder87.exe

Code function: LoadLibraryA,GetProcAddress,GetAdaptersInfo,FreeLibrary,

2_2_0093E9C1

Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\is-AH6EL.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\icuuc51.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\is-KD5MG.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\icuin51.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\uninstall\unins000.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\msvcp100.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\libGLESv2.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\is-02PLV.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\libEGL.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-B9ABP.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\Qt5Concurrent.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\is-J7RIG.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\is-3889U.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\is-U86HG.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\uninstall\is-QT0ES.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\is-AE5JU.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\Qt5PrintSupport.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\is-F4NO0.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\msvcr100.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-B9ABP.tmp\_isetup\_shfoldr.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-B9ABP.tmp\_isetup\_iscrypt.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\is-ISKBL.tmp	Jump to dropped file

Source: C:\Users\user\Desktop\9uWGaRcOv8.exe

Evasive API call chain: GetSystemTime,DecisionNodes

graph_0-5965

Source: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\diskfilefinder87.exe

API coverage: 3.0 %

Source: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\diskfilefinder87.exe TID: 5224	Thread sleep count: 81 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\diskfilefinder87.exe TID: 5224	Thread sleep time: -162000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\diskfilefinder87.exe TID: 6388	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\diskfilefinder87.exe TID: 6388	Thread sleep time: -60000s >= -30000s	Jump to behavior

Source: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\diskfilefinder87.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\diskfilefinder87.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\diskfilefinder87.exe	Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp	Code function: 1_2_00452AD4 FindFirstFileA,GetLastError,	1_2_00452AD4
Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp	Code function: 1_2_00475798 FindFirstFileA,FindNextFileA,FindClose,	1_2_00475798
Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp	Code function: 1_2_0046417C SetErrorMode,FindFirstFileA,FindNextFileA,FindClose,SetErrorMode,	1_2_0046417C
Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp	Code function: 1_2_004645F8 SetErrorMode,FindFirstFileA,FindNextFileA,FindClose,SetErrorMode,	1_2_004645F8
Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp	Code function: 1_2_00462BF0 FindFirstFileA,FindNextFileA,FindClose,	1_2_00462BF0
Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp	Code function: 1_2_00498FDC FindFirstFileA,SetFileAttributesA,FindNextFileA,FindClose,	1_2_00498FDC

Source: C:\Users\user\Desktop\9uWGaRcOv8.exe

Code function: 0_2_00409B78 GetSystemInfo,VirtualQuery,VirtualProtect,VirtualProtect,VirtualQuery,

0_2_00409B78

Source: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\diskfilefinder87.exe	Thread delayed: delay time: 60000			Jump to behavior
Source: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\diskfilefinder87.exe	Thread delayed: delay time: 60000			Jump to behavior

Source: diskfilefinder87.exe, 00000002.00000002.3540618703.00000000032A2000.00000004.00000020.00020000.00000000.sdmp, diskfilefinder87.exe, 00000002.00000002.3539697554.0000000000810000.00000004.00000020.00020000.00000000.sdmp, diskfilefinder87.exe, 00000002.00000002.3539697554.0000000000728000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Users\user\Desktop\9uWGaRcOv8.exe

API call chain: ExitProcess graph end node

graph_0-6762

Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\diskfilefinder87.exe

Code function: 2_2_60920C91 rdtsc

2_2_60920C91

Source: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\diskfilefinder87.exe

Code function: 2_2_00948111 IsDebuggerPresent,

2_2_00948111

Source: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\diskfilefinder87.exe

Code function: 2_2_0094E6CE RtlEncodePointer,RtlEncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,RtlEncodePointer,GetProcAddress,RtlEncodePointer,GetProcAddress,RtlEncodePointer,GetProcAddress,RtlEncodePointer,GetProcAddress,RtlEncodePointer,IsDebuggerPresent,OutputDebugStringW,RtlDecodePointer,RtlDecodePointer,RtlDecodePointer,RtlDecodePointer,RtlDecodePointer,RtlDecodePointer,RtlDecodePointer,

2_2_0094E6CE

Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp

Code function: 1_2_00450334 GetVersion,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

1_2_00450334

Source: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\diskfilefinder87.exe

Code function: 2_2_00935E60 RtlInitializeCriticalSection,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetModuleHandleA,GetProcAddress,GetTickCount,GetVersionExA,_malloc,_malloc,_malloc,_malloc,_malloc,_malloc,_malloc,_malloc,GetProcessHeap,GetProcessHeap,RtlAllocateHeap,RtlAllocateHeap,GetProcessHeap,RtlAllocateHeap,GetProcessHeap,RtlAllocateHeap,RtlEnterCriticalSection,RtlLeaveCriticalSection,_malloc,_malloc,_malloc,_malloc,QueryPerformanceCounter,Sleep,_malloc,_malloc,Sleep,RtlEnterCriticalSection,RtlLeaveCriticalSection,

2_2_00935E60

Source: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\diskfilefinder87.exe

Code function: 2_2_009480FB SetUnhandledExceptionFilter,UnhandledExceptionFilter,

2_2_009480FB

Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp

Code function: 1_2_00478DC4 ShellExecuteEx,GetLastError,MsgWaitForMultipleObjects,GetExitCodeProcess,CloseHandle,

1_2_00478DC4

Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp

Code function: 1_2_0042EE28 InitializeSecurityDescriptor,SetSecurityDescriptorDacl,CreateMutexA,

1_2_0042EE28

Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp

Code function: 1_2_0042E0AC AllocateAndInitializeSid,GetVersion,GetModuleHandleA,GetProcAddress,CheckTokenMembership,GetCurrentThread,OpenThreadToken,GetLastError,GetCurrentProcess,OpenProcessToken,GetTokenInformation,GetLastError,GetTokenInformation,EqualSid,CloseHandle,FreeSid,

1_2_0042E0AC

Source: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\diskfilefinder87.exe

Code function: 2_2_0093E875 cpuid

2_2_0093E875

Source: C:\Users\user\Desktop\9uWGaRcOv8.exe	Code function: GetLocaleInfoA,	0_2_0040520C
Source: C:\Users\user\Desktop\9uWGaRcOv8.exe	Code function: GetLocaleInfoA,	0_2_00405258
Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp	Code function: GetLocaleInfoA,	1_2_00408578
Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp	Code function: GetLocaleInfoA,	1_2_004085C4

Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp

Code function: 1_2_00458670 GetTickCount,QueryPerformanceCounter,GetSystemTimeAsFileTime,GetCurrentProcessId,CreateNamedPipeA,GetLastError,CreateFileA,SetNamedPipeHandleState,CreateProcessA,CloseHandle,CloseHandle,

1_2_00458670

Source: C:\Users\user\Desktop\9uWGaRcOv8.exe

Code function: 0_2_004026C4 GetSystemTime,

0_2_004026C4

Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp

Code function: 1_2_00455644 GetUserNameA,

1_2_00455644

Source: C:\Users\user\Desktop\9uWGaRcOv8.exe

Code function: 0_2_00405CF4 GetVersionExA,

0_2_00405CF4

Stealing of Sensitive Information

Yara detected Socks5Systemz

Source: Yara match	File source: 00000002.00000002.3539980364.0000000000931000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.3540467207.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: diskfilefinder87.exe PID: 2140, type: MEMORYSTR

Remote Access Functionality

Yara detected Socks5Systemz

Source: Yara match	File source: 00000002.00000002.3539980364.0000000000931000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.3540467207.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: diskfilefinder87.exe PID: 2140, type: MEMORYSTR

Source: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\diskfilefinder87.exe	Code function: 2_2_609660FA sqlite3_finalize,sqlite3_free,sqlite3_value_numeric_type,sqlite3_value_numeric_type,sqlite3_value_text,sqlite3_value_int,memcmp,sqlite3_free,sqlite3_free,sqlite3_free,sqlite3_strnicmp,sqlite3_mprintf,sqlite3_mprintf,sqlite3_malloc,sqlite3_free,sqlite3_mprintf,sqlite3_prepare_v2,sqlite3_free,sqlite3_bind_value,	2_2_609660FA
Source: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\diskfilefinder87.exe	Code function: 2_2_6090C1D6 sqlite3_clear_bindings,sqlite3_mutex_enter,sqlite3_mutex_leave,	2_2_6090C1D6
Source: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\diskfilefinder87.exe	Code function: 2_2_60963143 sqlite3_stricmp,sqlite3_bind_int64,sqlite3_mutex_leave,	2_2_60963143
Source: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\diskfilefinder87.exe	Code function: 2_2_6096A2BD sqlite3_bind_int64,sqlite3_step,sqlite3_column_int,sqlite3_reset,	2_2_6096A2BD
Source: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\diskfilefinder87.exe	Code function: 2_2_6096923E sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_step,sqlite3_column_int64,sqlite3_reset,sqlite3_malloc,sqlite3_malloc,sqlite3_step,sqlite3_column_int64,sqlite3_reset,sqlite3_realloc,sqlite3_realloc,sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_free,sqlite3_free,sqlite3_free,	2_2_6096923E
Source: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\diskfilefinder87.exe	Code function: 2_2_6096A38C sqlite3_bind_int,sqlite3_column_int,sqlite3_step,sqlite3_reset,	2_2_6096A38C
Source: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\diskfilefinder87.exe	Code function: 2_2_6096748C sqlite3_malloc,sqlite3_bind_int,sqlite3_step,sqlite3_column_blob,sqlite3_column_bytes,sqlite3_reset,sqlite3_bind_int,sqlite3_step,sqlite3_column_int64,sqlite3_reset,sqlite3_malloc,sqlite3_bind_int64,sqlite3_column_bytes,sqlite3_column_blob,sqlite3_column_int64,sqlite3_column_int64,sqlite3_column_int64,sqlite3_step,sqlite3_reset,sqlite3_bind_int64,sqlite3_step,sqlite3_column_int,sqlite3_reset,sqlite3_bind_int64,sqlite3_bind_int,sqlite3_step,sqlite3_column_int64,sqlite3_column_int64,sqlite3_column_int64,sqlite3_column_bytes,sqlite3_column_blob,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_reset,memcmp,sqlite3_free,sqlite3_free,sqlite3_free,sqlite3_free,sqlite3_reset,sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_step,sqlite3_column_int,sqlite3_reset,sqlite3_step,sqlite3_column_int64,sqlite3_reset,sqlite3_bind_int64,sqlite3_realloc,sqlite3_column_int,sqlite3_step,sqlite3_reset,sqlite3_bind_int64,sqlite3_bind_int,sqlite3_bind_int,sqlite3_step,sqlite3_reset,sqlite3_free,sqlite3_free,sqlite3_free,sqlite3_free,sqlite3_free,sqlite3_free,sqlite3_free,sqlite3_bind_int,sqlite3_bind_blob,sqlite3_step,sqlite3_reset,sqlite3_free,sqlite3_free,	2_2_6096748C
Source: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\diskfilefinder87.exe	Code function: 2_2_609254B1 sqlite3_bind_zeroblob,sqlite3_mutex_leave,	2_2_609254B1
Source: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\diskfilefinder87.exe	Code function: 2_2_6094B407 sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,	2_2_6094B407
Source: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\diskfilefinder87.exe	Code function: 2_2_6090F435 sqlite3_bind_parameter_index,	2_2_6090F435
Source: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\diskfilefinder87.exe	Code function: 2_2_609255D4 sqlite3_mutex_leave,sqlite3_bind_text16,	2_2_609255D4
Source: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\diskfilefinder87.exe	Code function: 2_2_609255FF sqlite3_bind_text,	2_2_609255FF
Source: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\diskfilefinder87.exe	Code function: 2_2_6096A5EE sqlite3_value_text,sqlite3_value_bytes,sqlite3_strnicmp,sqlite3_strnicmp,sqlite3_mprintf,sqlite3_prepare_v2,sqlite3_free,sqlite3_malloc,sqlite3_column_int,sqlite3_column_int64,sqlite3_column_text,sqlite3_column_bytes,sqlite3_finalize,sqlite3_step,sqlite3_free,sqlite3_finalize,sqlite3_strnicmp,sqlite3_bind_int,sqlite3_column_int,sqlite3_step,sqlite3_reset,sqlite3_mprintf,sqlite3_prepare_v2,sqlite3_free,sqlite3_column_int64,sqlite3_column_int,sqlite3_column_text,sqlite3_column_bytes,sqlite3_step,sqlite3_finalize,sqlite3_strnicmp,sqlite3_strnicmp,sqlite3_bind_int,sqlite3_bind_int,sqlite3_step,sqlite3_reset,sqlite3_value_int,sqlite3_malloc,sqlite3_bind_null,sqlite3_step,sqlite3_reset,sqlite3_value_int,sqlite3_value_text,sqlite3_value_bytes,sqlite3_free,	2_2_6096A5EE
Source: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\diskfilefinder87.exe	Code function: 2_2_6094B54C sqlite3_bind_int64,sqlite3_step,sqlite3_column_int64,sqlite3_reset,memmove,	2_2_6094B54C
Source: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\diskfilefinder87.exe	Code function: 2_2_60925686 sqlite3_bind_int64,sqlite3_mutex_leave,	2_2_60925686
Source: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\diskfilefinder87.exe	Code function: 2_2_6094A6C5 sqlite3_bind_int64,sqlite3_step,sqlite3_column_blob,sqlite3_column_bytes,sqlite3_malloc,sqlite3_reset,sqlite3_free,	2_2_6094A6C5
Source: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\diskfilefinder87.exe	Code function: 2_2_609256E5 sqlite3_bind_int,sqlite3_bind_int64,	2_2_609256E5
Source: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\diskfilefinder87.exe	Code function: 2_2_6094B6ED sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_step,	2_2_6094B6ED
Source: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\diskfilefinder87.exe	Code function: 2_2_6092562A sqlite3_bind_blob,	2_2_6092562A
Source: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\diskfilefinder87.exe	Code function: 2_2_60925655 sqlite3_bind_null,sqlite3_mutex_leave,	2_2_60925655
Source: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\diskfilefinder87.exe	Code function: 2_2_6094C64A sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_free,	2_2_6094C64A
Source: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\diskfilefinder87.exe	Code function: 2_2_609687A7 sqlite3_bind_int64,sqlite3_bind_int,sqlite3_step,sqlite3_reset,sqlite3_bind_int64,sqlite3_bind_int,sqlite3_step,sqlite3_column_blob,sqlite3_column_bytes,sqlite3_column_int64,sqlite3_reset,sqlite3_free,sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_bind_int64,sqlite3_bind_blob,sqlite3_bind_int64,sqlite3_bind_int,sqlite3_step,sqlite3_reset,sqlite3_free,sqlite3_free,	2_2_609687A7
Source: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\diskfilefinder87.exe	Code function: 2_2_6095F7F7 sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,	2_2_6095F7F7
Source: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\diskfilefinder87.exe	Code function: 2_2_6092570B sqlite3_bind_double,sqlite3_mutex_leave,	2_2_6092570B
Source: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\diskfilefinder87.exe	Code function: 2_2_6095F772 sqlite3_bind_int64,sqlite3_bind_blob,sqlite3_step,sqlite3_reset,	2_2_6095F772
Source: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\diskfilefinder87.exe	Code function: 2_2_60925778 sqlite3_bind_value,sqlite3_bind_int64,sqlite3_bind_double,sqlite3_bind_blob,	2_2_60925778
Source: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\diskfilefinder87.exe	Code function: 2_2_6090577D sqlite3_bind_parameter_name,	2_2_6090577D
Source: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\diskfilefinder87.exe	Code function: 2_2_6094B764 sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_step,	2_2_6094B764
Source: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\diskfilefinder87.exe	Code function: 2_2_6090576B sqlite3_bind_parameter_count,	2_2_6090576B
Source: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\diskfilefinder87.exe	Code function: 2_2_6094A894 sqlite3_bind_int64,sqlite3_step,sqlite3_column_int64,sqlite3_reset,	2_2_6094A894
Source: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\diskfilefinder87.exe	Code function: 2_2_6095F883 sqlite3_bind_int64,sqlite3_bind_int,sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_bind_blob,sqlite3_step,sqlite3_reset,	2_2_6095F883
Source: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\diskfilefinder87.exe	Code function: 2_2_6094C8C2 sqlite3_value_int,sqlite3_value_int,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_bind_null,sqlite3_bind_null,sqlite3_step,sqlite3_reset,	2_2_6094C8C2
Source: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\diskfilefinder87.exe	Code function: 2_2_6096281E sqlite3_mprintf,sqlite3_vtab_config,sqlite3_malloc,sqlite3_mprintf,sqlite3_mprintf,sqlite3_errmsg,sqlite3_mprintf,sqlite3_free,sqlite3_mprintf,sqlite3_exec,sqlite3_free,sqlite3_prepare_v2,sqlite3_bind_text,sqlite3_step,sqlite3_column_int64,sqlite3_finalize,sqlite3_mprintf,sqlite3_prepare_v2,sqlite3_free,sqlite3_errmsg,sqlite3_mprintf,sqlite3_mprintf,sqlite3_mprintf,sqlite3_free,sqlite3_mprintf,sqlite3_free,sqlite3_declare_vtab,sqlite3_errmsg,sqlite3_mprintf,sqlite3_free,	2_2_6096281E
Source: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\diskfilefinder87.exe	Code function: 2_2_6096583A memcmp,sqlite3_realloc,qsort,sqlite3_malloc,sqlite3_free,sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_column_int64,sqlite3_column_int64,sqlite3_column_int64,sqlite3_column_bytes,sqlite3_column_blob,sqlite3_step,sqlite3_reset,	2_2_6096583A
Source: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\diskfilefinder87.exe	Code function: 2_2_6095F9AD sqlite3_bind_int,sqlite3_step,sqlite3_column_type,sqlite3_reset,	2_2_6095F9AD
Source: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\diskfilefinder87.exe	Code function: 2_2_6094A92B sqlite3_bind_int64,sqlite3_bind_null,sqlite3_bind_blob,sqlite3_step,sqlite3_reset,	2_2_6094A92B
Source: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\diskfilefinder87.exe	Code function: 2_2_6090EAE5 sqlite3_transfer_bindings,	2_2_6090EAE5
Source: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\diskfilefinder87.exe	Code function: 2_2_6095FB98 sqlite3_value_int,sqlite3_bind_int,sqlite3_bind_value,sqlite3_step,sqlite3_reset,	2_2_6095FB98
Source: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\diskfilefinder87.exe	Code function: 2_2_6095ECA6 sqlite3_mprintf,sqlite3_mprintf,sqlite3_mprintf,sqlite3_prepare_v2,sqlite3_free,sqlite3_bind_value,	2_2_6095ECA6
Source: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\diskfilefinder87.exe	Code function: 2_2_6095FCCE sqlite3_malloc,sqlite3_free,sqlite3_bind_int64,sqlite3_bind_blob,sqlite3_step,sqlite3_reset,	2_2_6095FCCE
Source: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\diskfilefinder87.exe	Code function: 2_2_6095FDAE sqlite3_malloc,sqlite3_bind_int,sqlite3_step,sqlite3_column_bytes,sqlite3_column_blob,sqlite3_reset,sqlite3_free,sqlite3_free,sqlite3_bind_int,sqlite3_bind_blob,sqlite3_step,sqlite3_reset,sqlite3_free,	2_2_6095FDAE
Source: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\diskfilefinder87.exe	Code function: 2_2_60966DF1 sqlite3_value_text,sqlite3_mprintf,sqlite3_free,strcmp,sqlite3_free,sqlite3_malloc,sqlite3_bind_int64,sqlite3_step,sqlite3_column_type,sqlite3_reset,sqlite3_column_blob,sqlite3_reset,sqlite3_malloc,sqlite3_free,sqlite3_reset,sqlite3_result_error_code,sqlite3_result_blob,	2_2_60966DF1
Source: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\diskfilefinder87.exe	Code function: 2_2_60969D75 sqlite3_bind_int,sqlite3_step,sqlite3_column_int,sqlite3_reset,	2_2_60969D75
Source: C:\Users\user\AppData\Local\Disk File Finder 1.0.5.987\diskfilefinder87.exe	Code function: 2_2_6095FFB2 sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_result_error_code,	2_2_6095FFB2

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Native API	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	1 Deobfuscate/Decode Files or Information	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	5 Windows Service	1 DLL Side-Loading	3 Obfuscated Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	Data from Removable Media	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Service Execution	1 Bootkit	1 Access Token Manipulation	21 Software Packing	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	5 Windows Service	1 DLL Side-Loading	NTDS	35 System Information Discovery	Distributed Component Object Model	Input Capture	12 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	2 Process Injection	1 Masquerading	LSA Secrets	51 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	21 Virtualization/Sandbox Evasion	Cached Domain Credentials	1 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Access Token Manipulation	DCSync	21 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	2 Process Injection	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Bootkit	/etc/passwd and /etc/shadow	3 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	Dynamic API Resolution	Network Sniffing	1 System Network Configuration Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp	Code function: 1_2_0045D230 GetProcAddress,GetProcAddress,GetProcAddress,ISCryptGetVersion,	1_2_0045D230
Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp	Code function: 1_2_0045D2E4 ArcFourCrypt,	1_2_0045D2E4
Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp	Code function: 1_2_0045D2FC ArcFourCrypt,	1_2_0045D2FC
Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp	Code function: 1_2_10001000 ISCryptGetVersion,	1_2_10001000
Source: C:\Users\user\AppData\Local\Temp\is-2N79K.tmp\9uWGaRcOv8.tmp	Code function: 1_2_10001130 ArcFourCrypt,	1_2_10001130

Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:50031 -> 176.113.115.96:443
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:50031 -> 176.113.115.96:443

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report
9uWGaRcOv8.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 9uWGaRcOv8.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Windows Analysis Report
9uWGaRcOv8.exe