Analysis Report PO.exe

AV Detection:

Antivirus / Scanner detection for submitted sample

Source: PO.exe

Avira: detected

Multi AV Scanner detection for submitted file

Source: PO.exe	Virustotal: Detection: 38%			Perma Link
Source: PO.exe	ReversingLabs: Detection: 10%

Yara detected FormBook

Source: Yara match	File source: 00000003.00000002.314545610.0000000001580000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.484649434.00000000031B0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.483269971.0000000002E50000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.313036443.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.314657268.00000000015B0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.483171472.0000000002DB0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 3.2.PO.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.PO.exe.400000.0.unpack, type: UNPACKEDPE

Machine Learning detection for sample

Source: PO.exe

Joe Sandbox ML: detected

Antivirus or Machine Learning detection for unpacked file

Source: 3.2.PO.exe.400000.0.unpack

Avira: Label: TR/Crypt.XPACK.Gen2

Networking:

Performs DNS lookups

Source: unknown

DNS traffic detected: queries for: www.novavitarealty.com

Urls found in memory or binary data

Source: explorer.exe, 00000006.00000000.299457272.000000000F5C0000.00000004.00000001.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: explorer.exe, 00000006.00000002.484389821.0000000001398000.00000004.00000020.sdmp	String found in binary or memory: http://crl.v
Source: explorer.exe, 00000006.00000000.288649915.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://fontfabrik.com
Source: explorer.exe, 00000006.00000000.288649915.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: explorer.exe, 00000006.00000000.288649915.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: explorer.exe, 00000006.00000000.288649915.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: explorer.exe, 00000006.00000000.288649915.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: explorer.exe, 00000006.00000000.288649915.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: explorer.exe, 00000006.00000000.288649915.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: explorer.exe, 00000006.00000000.288649915.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: explorer.exe, 00000006.00000000.288649915.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: explorer.exe, 00000006.00000000.288649915.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: explorer.exe, 00000006.00000000.288649915.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: explorer.exe, 00000006.00000000.288649915.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.fonts.com
Source: explorer.exe, 00000006.00000000.288649915.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: explorer.exe, 00000006.00000000.288649915.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: explorer.exe, 00000006.00000000.288649915.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: explorer.exe, 00000006.00000000.288649915.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: explorer.exe, 00000006.00000000.288649915.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: explorer.exe, 00000006.00000000.288649915.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: explorer.exe, 00000006.00000000.288649915.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: explorer.exe, 00000006.00000000.288649915.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: explorer.exe, 00000006.00000000.288649915.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.sakkal.com
Source: explorer.exe, 00000006.00000000.288649915.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: explorer.exe, 00000006.00000000.288649915.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.tiro.com
Source: explorer.exe, 00000006.00000000.288649915.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.typography.netD
Source: explorer.exe, 00000006.00000000.288649915.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: explorer.exe, 00000006.00000000.288649915.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: netsh.exe, 00000010.00000002.491969634.000000000432F000.00000004.00000001.sdmp	String found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/font-awesome.min.css

E-Banking Fraud:

Yara detected FormBook

Source: Yara match	File source: 00000003.00000002.314545610.0000000001580000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.484649434.00000000031B0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.483269971.0000000002E50000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.313036443.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.314657268.00000000015B0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.483171472.0000000002DB0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 3.2.PO.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.PO.exe.400000.0.unpack, type: UNPACKEDPE

System Summary:

Malicious sample detected (through community Yara rule)

Source: 00000003.00000002.314545610.0000000001580000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000003.00000002.314545610.0000000001580000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000010.00000002.484649434.00000000031B0000.00000004.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000010.00000002.484649434.00000000031B0000.00000004.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000010.00000002.483269971.0000000002E50000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000010.00000002.483269971.0000000002E50000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000003.00000002.313036443.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000003.00000002.313036443.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000003.00000002.314657268.00000000015B0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000003.00000002.314657268.00000000015B0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000010.00000002.483171472.0000000002DB0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000010.00000002.483171472.0000000002DB0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 3.2.PO.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 3.2.PO.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 3.2.PO.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 3.2.PO.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group

Contains functionality to call native functions

Source: C:\Users\user\Desktop\PO.exe	Code function: 3_2_0041A060 NtClose,		3_2_0041A060
Source: C:\Users\user\Desktop\PO.exe	Code function: 3_2_0041A110 NtAllocateVirtualMemory,		3_2_0041A110
Source: C:\Users\user\Desktop\PO.exe	Code function: 3_2_00419F30 NtCreateFile,		3_2_00419F30
Source: C:\Users\user\Desktop\PO.exe	Code function: 3_2_00419FE0 NtReadFile,		3_2_00419FE0
Source: C:\Users\user\Desktop\PO.exe	Code function: 3_2_0041A05B NtClose,		3_2_0041A05B
Source: C:\Users\user\Desktop\PO.exe	Code function: 3_2_0041A10A NtAllocateVirtualMemory,		3_2_0041A10A
Source: C:\Users\user\Desktop\PO.exe	Code function: 3_2_00419F2B NtCreateFile,		3_2_00419F2B
Source: C:\Users\user\Desktop\PO.exe	Code function: 3_2_00419FDA NtReadFile,		3_2_00419FDA
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_03709710 NtQueryInformationToken,LdrInitializeThunk,		16_2_03709710
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_03709FE0 NtCreateMutant,LdrInitializeThunk,		16_2_03709FE0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_03709780 NtMapViewOfSection,LdrInitializeThunk,		16_2_03709780
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_03709A50 NtCreateFile,LdrInitializeThunk,		16_2_03709A50
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_037096E0 NtFreeVirtualMemory,LdrInitializeThunk,		16_2_037096E0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_037096D0 NtCreateKey,LdrInitializeThunk,		16_2_037096D0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_03709540 NtReadFile,LdrInitializeThunk,		16_2_03709540
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_03709910 NtAdjustPrivilegesToken,LdrInitializeThunk,		16_2_03709910
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_037095D0 NtClose,LdrInitializeThunk,		16_2_037095D0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_037099A0 NtCreateSection,LdrInitializeThunk,		16_2_037099A0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_03709860 NtQuerySystemInformation,LdrInitializeThunk,		16_2_03709860
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_03709840 NtDelayExecution,LdrInitializeThunk,		16_2_03709840
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_03709770 NtSetInformationFile,		16_2_03709770
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_0370A770 NtOpenThread,		16_2_0370A770
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_03709760 NtOpenProcess,		16_2_03709760
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_03709730 NtQueryVirtualMemory,		16_2_03709730
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_0370A710 NtOpenProcessToken,		16_2_0370A710
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_03709B00 NtSetValueKey,		16_2_03709B00
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_0370A3B0 NtGetContextThread,		16_2_0370A3B0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_037097A0 NtUnmapViewOfSection,		16_2_037097A0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_03709670 NtQueryInformationProcess,		16_2_03709670
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_03709660 NtAllocateVirtualMemory,		16_2_03709660
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_03709650 NtQueryValueKey,		16_2_03709650
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_03709A20 NtResumeThread,		16_2_03709A20
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_03709610 NtEnumerateValueKey,		16_2_03709610
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_03709A10 NtQuerySection,		16_2_03709A10
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_03709A00 NtProtectVirtualMemory,		16_2_03709A00
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_03709A80 NtOpenDirectoryObject,		16_2_03709A80
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_03709560 NtWriteFile,		16_2_03709560
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_03709950 NtQueueApcThread,		16_2_03709950
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_0370AD30 NtSetContextThread,		16_2_0370AD30
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_03709520 NtWaitForSingleObject,		16_2_03709520
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_037095F0 NtQueryInformationFile,		16_2_037095F0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_037099D0 NtCreateProcessEx,		16_2_037099D0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_0370B040 NtSuspendThread,		16_2_0370B040
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_03709820 NtEnumerateKey,		16_2_03709820
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_037098F0 NtReadVirtualMemory,		16_2_037098F0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_037098A0 NtWriteVirtualMemory,		16_2_037098A0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_02DCA060 NtClose,		16_2_02DCA060
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_02DC9FE0 NtReadFile,		16_2_02DC9FE0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_02DC9F30 NtCreateFile,		16_2_02DC9F30
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_02DCA05B NtClose,		16_2_02DCA05B
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_02DC9FDA NtReadFile,		16_2_02DC9FDA
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_02DC9F2B NtCreateFile,		16_2_02DC9F2B

Detected potential crypto function

Source: C:\Users\user\Desktop\PO.exe	Code function: 3_2_00401030		3_2_00401030
Source: C:\Users\user\Desktop\PO.exe	Code function: 3_2_0041D173		3_2_0041D173
Source: C:\Users\user\Desktop\PO.exe	Code function: 3_2_0041DB48		3_2_0041DB48
Source: C:\Users\user\Desktop\PO.exe	Code function: 3_2_0041D4FF		3_2_0041D4FF
Source: C:\Users\user\Desktop\PO.exe	Code function: 3_2_0041DD04		3_2_0041DD04
Source: C:\Users\user\Desktop\PO.exe	Code function: 3_2_00402D88		3_2_00402D88
Source: C:\Users\user\Desktop\PO.exe	Code function: 3_2_00402D90		3_2_00402D90
Source: C:\Users\user\Desktop\PO.exe	Code function: 3_2_00409E40		3_2_00409E40
Source: C:\Users\user\Desktop\PO.exe	Code function: 3_2_0041E79E		3_2_0041E79E
Source: C:\Users\user\Desktop\PO.exe	Code function: 3_2_00402FB0		3_2_00402FB0
Source: C:\Users\user\Desktop\PO.exe	Code function: 3_2_00739116		3_2_00739116
Source: C:\Users\user\Desktop\PO.exe	Code function: 3_2_0068035A		3_2_0068035A
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_036FEBB0		16_2_036FEBB0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_036E6E30		16_2_036E6E30
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_03791D55		16_2_03791D55
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_036C0D20		16_2_036C0D20
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_036E4120		16_2_036E4120
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_036CF900		16_2_036CF900
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_036DD5E0		16_2_036DD5E0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_036F2581		16_2_036F2581
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_036D841F		16_2_036D841F
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_03781002		16_2_03781002
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_036F20A0		16_2_036F20A0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_036DB090		16_2_036DB090
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_02DB9E40		16_2_02DB9E40
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_02DCE79E		16_2_02DCE79E
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_02DB2FB0		16_2_02DB2FB0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_02DB2D90		16_2_02DB2D90
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_02DB2D88		16_2_02DB2D88

Found potential string decryption / allocating functions

Source: C:\Windows\SysWOW64\netsh.exe

Code function: String function: 036CB150 appears 35 times

One or more processes crash

Source: unknown

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 3064 -s 1204

Sample file is different than original file name gathered from version info

Source: PO.exe	Binary or memory string: OriginalFilename vs PO.exe
Source: PO.exe, 00000003.00000003.267458022.00000000011CF000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs PO.exe
Source: PO.exe, 00000003.00000002.316029296.0000000002F4C000.00000040.00000001.sdmp	Binary or memory string: OriginalFilenamenetsh.exej% vs PO.exe
Source: PO.exe, 00000003.00000002.313036443.0000000000400000.00000040.00000001.sdmp	Binary or memory string: OriginalFilenamecdcd aaa.exe2 vs PO.exe

Tries to load missing DLLs

Source: C:\Windows\SysWOW64\WerFault.exe	Section loaded: sfc.dll			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Section loaded: phoneinfo.dll			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Section loaded: ext-ms-win-xblauth-console-l1.dll			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Section loaded: ext-ms-win-xblauth-console-l1.dll			Jump to behavior

Yara signature match

Source: 00000003.00000002.314545610.0000000001580000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000003.00000002.314545610.0000000001580000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000010.00000002.484649434.00000000031B0000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000010.00000002.484649434.00000000031B0000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000010.00000002.483269971.0000000002E50000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000010.00000002.483269971.0000000002E50000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000003.00000002.313036443.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000003.00000002.313036443.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000003.00000002.314657268.00000000015B0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000003.00000002.314657268.00000000015B0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000010.00000002.483171472.0000000002DB0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000010.00000002.483171472.0000000002DB0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 3.2.PO.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 3.2.PO.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 3.2.PO.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 3.2.PO.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research

Classification label

Source: classification engine

Classification label: mal100.troj.evad.winEXE@8/4@2/1

Creates mutexes

Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess3064
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7060:120:WilError_01

Creates temporary files

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\WERD2F6.tmp

Jump to behavior

PE file has an executable .text section and no other executable section

Source: PO.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Parts of this applications are using the .NET runtime (Probably coded in C#)

Source: C:\Users\user\Desktop\PO.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll			Jump to behavior

Reads software policies

Source: C:\Users\user\Desktop\PO.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Reads the hosts file

Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Windows\explorer.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Windows\explorer.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Sample is known by Antivirus

Source: PO.exe	Virustotal: Detection: 38%
Source: PO.exe	ReversingLabs: Detection: 10%

Sample reads its own file content

Source: C:\Users\user\Desktop\PO.exe

File read: C:\Users\user\Desktop\PO.exe

Jump to behavior

Spawns processes

Source: unknown	Process created: C:\Users\user\Desktop\PO.exe 'C:\Users\user\Desktop\PO.exe'
Source: unknown	Process created: C:\Users\user\Desktop\PO.exe C:\Users\user\Desktop\PO.exe
Source: unknown	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 3064 -s 1204
Source: unknown	Process created: C:\Windows\SysWOW64\netsh.exe C:\Windows\SysWOW64\netsh.exe
Source: unknown	Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\PO.exe'
Source: unknown	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\PO.exe	Process created: C:\Users\user\Desktop\PO.exe C:\Users\user\Desktop\PO.exe			Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\PO.exe'			Jump to behavior

Uses an in-process (OLE) Automation server

Source: C:\Users\user\Desktop\PO.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32

Jump to behavior

Uses Microsoft Silverlight

Source: C:\Users\user\Desktop\PO.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

PE file contains a COM descriptor data directory

Source: PO.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

PE file has a big code size

Source: PO.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Submission file is bigger than most known malware samples

Source: PO.exe

Static file information: File size 2490880 > 1048576

PE file has a big raw section

Source: PO.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x25fe00

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: PO.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Binary contains paths to debug symbols

Source:	Binary string: System.Core.ni.pdbRSDSD source: WERD2F6.tmp.dmp.5.dr
Source:	Binary string: System.Xml.ni.pdb source: WERD2F6.tmp.dmp.5.dr
Source:	Binary string: wscui.pdbUGP source: explorer.exe, 00000006.00000000.297582675.000000000E6C0000.00000002.00000001.sdmp
Source:	Binary string: System.ni.pdbRSDS source: WERD2F6.tmp.dmp.5.dr
Source:	Binary string: wntdll.pdbUGP source: PO.exe, 00000003.00000003.267283620.00000000010B0000.00000004.00000001.sdmp, netsh.exe, 00000010.00000002.485583016.00000000036A0000.00000040.00000001.sdmp
Source:	Binary string: wntdll.pdb source: PO.exe, 00000003.00000003.267283620.00000000010B0000.00000004.00000001.sdmp, netsh.exe
Source:	Binary string: System.Configuration.ni.pdb source: WERD2F6.tmp.dmp.5.dr
Source:	Binary string: mscorlib.ni.pdbRSDS source: WERD2F6.tmp.dmp.5.dr
Source:	Binary string: System.Configuration.pdb source: WERD2F6.tmp.dmp.5.dr
Source:	Binary string: Microsoft.VisualBasic.pdb*p@# source: WERD2F6.tmp.dmp.5.dr
Source:	Binary string: System.Xml.pdb source: WERD2F6.tmp.dmp.5.dr
Source:	Binary string: System.pdb source: WERD2F6.tmp.dmp.5.dr
Source:	Binary string: wscui.pdb source: explorer.exe, 00000006.00000000.297582675.000000000E6C0000.00000002.00000001.sdmp
Source:	Binary string: System.Xml.pdbH'g source: WERD2F6.tmp.dmp.5.dr
Source:	Binary string: System.Core.ni.pdb source: WERD2F6.tmp.dmp.5.dr
Source:	Binary string: Microsoft.VisualBasic.pdb source: WERD2F6.tmp.dmp.5.dr
Source:	Binary string: System.Windows.Forms.pdb source: WERD2F6.tmp.dmp.5.dr
Source:	Binary string: mscorlib.pdb source: WERD2F6.tmp.dmp.5.dr
Source:	Binary string: System.Core.pdb9 source: WERD2F6.tmp.dmp.5.dr
Source:	Binary string: netsh.pdb source: PO.exe, 00000003.00000002.315870877.0000000002F30000.00000040.00000001.sdmp
Source:	Binary string: mscorlib.ni.pdb source: WERD2F6.tmp.dmp.5.dr
Source:	Binary string: netsh.pdbGCTL source: PO.exe, 00000003.00000002.315870877.0000000002F30000.00000040.00000001.sdmp
Source:	Binary string: System.Configuration.ni.pdbRSDSO* source: WERD2F6.tmp.dmp.5.dr
Source:	Binary string: System.Core.pdb source: WERD2F6.tmp.dmp.5.dr
Source:	Binary string: System.Xml.ni.pdbRSDS source: WERD2F6.tmp.dmp.5.dr
Source:	Binary string: System.ni.pdb source: WERD2F6.tmp.dmp.5.dr

Data Obfuscation:

Uses code obfuscation techniques (call, push, ret)

Source: C:\Users\user\Desktop\PO.exe	Code function: 3_2_0041D0D2 push eax; ret		3_2_0041D0D8
Source: C:\Users\user\Desktop\PO.exe	Code function: 3_2_0041D0DB push eax; ret		3_2_0041D142
Source: C:\Users\user\Desktop\PO.exe	Code function: 3_2_0040D8E6 push ecx; retf		3_2_0040D8EE
Source: C:\Users\user\Desktop\PO.exe	Code function: 3_2_0041D085 push eax; ret		3_2_0041D0D8
Source: C:\Users\user\Desktop\PO.exe	Code function: 3_2_0041D13C push eax; ret		3_2_0041D142
Source: C:\Users\user\Desktop\PO.exe	Code function: 3_2_0040EC2D push edx; iretd		3_2_0040EC2F
Source: C:\Users\user\Desktop\PO.exe	Code function: 3_2_006F0218 push AA20259Ch; retn 0000h		3_2_006F02C5
Source: C:\Users\user\Desktop\PO.exe	Code function: 3_2_006F02C8 push B120259Ch; retn 0000h		3_2_006F0313
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_0371D0D1 push ecx; ret		16_2_0371D0E4
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_02DCD0DB push eax; ret		16_2_02DCD142
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_02DCD0D2 push eax; ret		16_2_02DCD0D8
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_02DBD8E6 push ecx; retf		16_2_02DBD8EE
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_02DCD085 push eax; ret		16_2_02DCD0D8
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_02DCD13C push eax; ret		16_2_02DCD142
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_02DBEC2D push edx; iretd		16_2_02DBEC2F

Hooking and other Techniques for Hiding and Protection:

Modifies the prolog of user mode functions (user mode inline hooks)

Source: explorer.exe

User mode code has changed: module: user32.dll function: PeekMessageA new code: 0x48 0x8B 0xB8 0x80 0x0E 0xE7

Stores large binary data to the registry

Source: C:\Windows\SysWOW64\WerFault.exe

Key value created or modified: HKEY_CURRENT_USER\Software\Microsoft\IdentityCRL\Immersive\production\Token\{67082621-8D18-4333-9C64-10DE93676363} DeviceTicket

Jump to behavior

Disables application error messsages (SetErrorMode)

Source: C:\Users\user\Desktop\PO.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PO.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PO.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PO.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PO.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PO.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PO.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PO.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PO.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PO.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PO.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PO.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PO.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PO.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PO.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PO.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PO.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PO.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PO.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PO.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PO.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PO.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PO.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PO.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PO.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PO.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PO.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PO.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PO.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PO.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion:

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\PO.exe	RDTSC instruction interceptor: First address: 00000000004098E4 second address: 00000000004098EA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\PO.exe	RDTSC instruction interceptor: First address: 0000000000409B5E second address: 0000000000409B64 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\netsh.exe	RDTSC instruction interceptor: First address: 0000000002DB98E4 second address: 0000000002DB98EA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\netsh.exe	RDTSC instruction interceptor: First address: 0000000002DB9B5E second address: 0000000002DB9B64 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc

Contains functionality for execution timing, often used to detect debuggers

Source: C:\Users\user\Desktop\PO.exe

Code function: 3_2_00409A90 rdtsc

3_2_00409A90

May sleep (evasive loops) to hinder dynamic analysis

Source: C:\Windows\explorer.exe TID: 3596	Thread sleep time: -50000s >= -30000s			Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe TID: 1328	Thread sleep time: -36000s >= -30000s			Jump to behavior

Queries disk information (often used to detect virtual machines)

Source: C:\Windows\SysWOW64\WerFault.exe

File opened: PhysicalDrive0

Jump to behavior

Sample execution stops while process was sleeping (likely an evasion)

Source: C:\Windows\explorer.exe	Last function: Thread delayed
Source: C:\Windows\explorer.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\netsh.exe	Last function: Thread delayed

May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)

Source: explorer.exe, 00000006.00000000.286114617.000000000871F000.00000004.00000001.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000
Source: explorer.exe, 00000006.00000000.286114617.000000000871F000.00000004.00000001.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000:
Source: explorer.exe, 00000006.00000000.285548658.0000000008220000.00000002.00000001.sdmp	Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: explorer.exe, 00000006.00000000.285912938.0000000008640000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000006.00000000.280827283.00000000055D0000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}V*(E
Source: explorer.exe, 00000006.00000000.286114617.000000000871F000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}~
Source: explorer.exe, 00000006.00000000.286114617.000000000871F000.00000004.00000001.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000
Source: explorer.exe, 00000006.00000000.286194290.00000000087D1000.00000004.00000001.sdmp	Binary or memory string: VMware SATA CD00ices
Source: explorer.exe, 00000006.00000000.280856309.0000000005603000.00000004.00000001.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b},
Source: explorer.exe, 00000006.00000000.285548658.0000000008220000.00000002.00000001.sdmp	Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: explorer.exe, 00000006.00000000.285548658.0000000008220000.00000002.00000001.sdmp	Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: explorer.exe, 00000006.00000000.285548658.0000000008220000.00000002.00000001.sdmp	Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.

Queries a list of all running processes

Source: C:\Users\user\Desktop\PO.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging:

Hides threads from debuggers

Source: C:\Users\user\Desktop\PO.exe	Thread information set: HideFromDebugger			Jump to behavior
Source: C:\Users\user\Desktop\PO.exe	Thread information set: HideFromDebugger			Jump to behavior
Source: C:\Users\user\Desktop\PO.exe	Thread information set: HideFromDebugger			Jump to behavior
Source: C:\Users\user\Desktop\PO.exe	Thread information set: HideFromDebugger			Jump to behavior
Source: C:\Users\user\Desktop\PO.exe	Thread information set: HideFromDebugger			Jump to behavior
Source: C:\Users\user\Desktop\PO.exe	Thread information set: HideFromDebugger			Jump to behavior
Source: C:\Users\user\Desktop\PO.exe	Thread information set: HideFromDebugger			Jump to behavior
Source: C:\Users\user\Desktop\PO.exe	Thread information set: HideFromDebugger			Jump to behavior
Source: C:\Users\user\Desktop\PO.exe	Thread information set: HideFromDebugger			Jump to behavior

Checks if the current process is being debugged

Source: C:\Users\user\Desktop\PO.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\PO.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\PO.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process queried: DebugPort			Jump to behavior

Contains functionality for execution timing, often used to detect debuggers

Source: C:\Users\user\Desktop\PO.exe

Code function: 3_2_00409A90 rdtsc

3_2_00409A90

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Source: C:\Users\user\Desktop\PO.exe

Code function: 3_2_0040ACD0 LdrLoadDll,

3_2_0040ACD0

Contains functionality to read the PEB

Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_036CDB60 mov ecx, dword ptr fs:[00000030h]		16_2_036CDB60
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_036DFF60 mov eax, dword ptr fs:[00000030h]		16_2_036DFF60
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_03798F6A mov eax, dword ptr fs:[00000030h]		16_2_03798F6A
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_036F3B7A mov eax, dword ptr fs:[00000030h]		16_2_036F3B7A
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_036F3B7A mov eax, dword ptr fs:[00000030h]		16_2_036F3B7A
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_03798B58 mov eax, dword ptr fs:[00000030h]		16_2_03798B58
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_036CDB40 mov eax, dword ptr fs:[00000030h]		16_2_036CDB40
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_036DEF40 mov eax, dword ptr fs:[00000030h]		16_2_036DEF40
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_036CF358 mov eax, dword ptr fs:[00000030h]		16_2_036CF358
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_036C4F2E mov eax, dword ptr fs:[00000030h]		16_2_036C4F2E
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_036C4F2E mov eax, dword ptr fs:[00000030h]		16_2_036C4F2E
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_036FE730 mov eax, dword ptr fs:[00000030h]		16_2_036FE730
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_036FA70E mov eax, dword ptr fs:[00000030h]		16_2_036FA70E
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_036FA70E mov eax, dword ptr fs:[00000030h]		16_2_036FA70E
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_0378131B mov eax, dword ptr fs:[00000030h]		16_2_0378131B
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_0375FF10 mov eax, dword ptr fs:[00000030h]		16_2_0375FF10
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_0375FF10 mov eax, dword ptr fs:[00000030h]		16_2_0375FF10
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_0379070D mov eax, dword ptr fs:[00000030h]		16_2_0379070D
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_0379070D mov eax, dword ptr fs:[00000030h]		16_2_0379070D
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_036EF716 mov eax, dword ptr fs:[00000030h]		16_2_036EF716
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_037037F5 mov eax, dword ptr fs:[00000030h]		16_2_037037F5
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_036EDBE9 mov eax, dword ptr fs:[00000030h]		16_2_036EDBE9
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_036F03E2 mov eax, dword ptr fs:[00000030h]		16_2_036F03E2
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_036F03E2 mov eax, dword ptr fs:[00000030h]		16_2_036F03E2
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_036F03E2 mov eax, dword ptr fs:[00000030h]		16_2_036F03E2
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_036F03E2 mov eax, dword ptr fs:[00000030h]		16_2_036F03E2
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_036F03E2 mov eax, dword ptr fs:[00000030h]		16_2_036F03E2
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_036F03E2 mov eax, dword ptr fs:[00000030h]		16_2_036F03E2
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_037453CA mov eax, dword ptr fs:[00000030h]		16_2_037453CA
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_037453CA mov eax, dword ptr fs:[00000030h]		16_2_037453CA
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_036F4BAD mov eax, dword ptr fs:[00000030h]		16_2_036F4BAD
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_036F4BAD mov eax, dword ptr fs:[00000030h]		16_2_036F4BAD
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_036F4BAD mov eax, dword ptr fs:[00000030h]		16_2_036F4BAD
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_03795BA5 mov eax, dword ptr fs:[00000030h]		16_2_03795BA5
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_03747794 mov eax, dword ptr fs:[00000030h]		16_2_03747794
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_03747794 mov eax, dword ptr fs:[00000030h]		16_2_03747794
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_03747794 mov eax, dword ptr fs:[00000030h]		16_2_03747794
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_036D1B8F mov eax, dword ptr fs:[00000030h]		16_2_036D1B8F
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_036D1B8F mov eax, dword ptr fs:[00000030h]		16_2_036D1B8F
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_0378138A mov eax, dword ptr fs:[00000030h]		16_2_0378138A
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_0377D380 mov ecx, dword ptr fs:[00000030h]		16_2_0377D380
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_036F2397 mov eax, dword ptr fs:[00000030h]		16_2_036F2397
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_036D8794 mov eax, dword ptr fs:[00000030h]		16_2_036D8794
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_036FB390 mov eax, dword ptr fs:[00000030h]		16_2_036FB390
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_036D766D mov eax, dword ptr fs:[00000030h]		16_2_036D766D
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_0370927A mov eax, dword ptr fs:[00000030h]		16_2_0370927A
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_0377B260 mov eax, dword ptr fs:[00000030h]		16_2_0377B260
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_0377B260 mov eax, dword ptr fs:[00000030h]		16_2_0377B260
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_03798A62 mov eax, dword ptr fs:[00000030h]		16_2_03798A62
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_036EAE73 mov eax, dword ptr fs:[00000030h]		16_2_036EAE73
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_036EAE73 mov eax, dword ptr fs:[00000030h]		16_2_036EAE73
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_036EAE73 mov eax, dword ptr fs:[00000030h]		16_2_036EAE73
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_036EAE73 mov eax, dword ptr fs:[00000030h]		16_2_036EAE73
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_036EAE73 mov eax, dword ptr fs:[00000030h]		16_2_036EAE73
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_03754257 mov eax, dword ptr fs:[00000030h]		16_2_03754257
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_036C9240 mov eax, dword ptr fs:[00000030h]		16_2_036C9240
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_036C9240 mov eax, dword ptr fs:[00000030h]		16_2_036C9240
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_036C9240 mov eax, dword ptr fs:[00000030h]		16_2_036C9240
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_036C9240 mov eax, dword ptr fs:[00000030h]		16_2_036C9240
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_036D7E41 mov eax, dword ptr fs:[00000030h]		16_2_036D7E41
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_036D7E41 mov eax, dword ptr fs:[00000030h]		16_2_036D7E41
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_036D7E41 mov eax, dword ptr fs:[00000030h]		16_2_036D7E41
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_036D7E41 mov eax, dword ptr fs:[00000030h]		16_2_036D7E41
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_036D7E41 mov eax, dword ptr fs:[00000030h]		16_2_036D7E41
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_036D7E41 mov eax, dword ptr fs:[00000030h]		16_2_036D7E41
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_0377FE3F mov eax, dword ptr fs:[00000030h]		16_2_0377FE3F
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_036CE620 mov eax, dword ptr fs:[00000030h]		16_2_036CE620
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_03704A2C mov eax, dword ptr fs:[00000030h]		16_2_03704A2C
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_03704A2C mov eax, dword ptr fs:[00000030h]		16_2_03704A2C
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_036D8A0A mov eax, dword ptr fs:[00000030h]		16_2_036D8A0A
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_036CC600 mov eax, dword ptr fs:[00000030h]		16_2_036CC600
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_036CC600 mov eax, dword ptr fs:[00000030h]		16_2_036CC600
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_036CC600 mov eax, dword ptr fs:[00000030h]		16_2_036CC600
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_036F8E00 mov eax, dword ptr fs:[00000030h]		16_2_036F8E00
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_03781608 mov eax, dword ptr fs:[00000030h]		16_2_03781608
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_036E3A1C mov eax, dword ptr fs:[00000030h]		16_2_036E3A1C
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_036FA61C mov eax, dword ptr fs:[00000030h]		16_2_036FA61C
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_036FA61C mov eax, dword ptr fs:[00000030h]		16_2_036FA61C
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_036CAA16 mov eax, dword ptr fs:[00000030h]		16_2_036CAA16
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_036CAA16 mov eax, dword ptr fs:[00000030h]		16_2_036CAA16
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_036C5210 mov eax, dword ptr fs:[00000030h]		16_2_036C5210
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_036C5210 mov ecx, dword ptr fs:[00000030h]		16_2_036C5210
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_036C5210 mov eax, dword ptr fs:[00000030h]		16_2_036C5210
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_036C5210 mov eax, dword ptr fs:[00000030h]		16_2_036C5210
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_036F2AE4 mov eax, dword ptr fs:[00000030h]		16_2_036F2AE4
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_036F16E0 mov ecx, dword ptr fs:[00000030h]		16_2_036F16E0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_036D76E2 mov eax, dword ptr fs:[00000030h]		16_2_036D76E2
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_036F36CC mov eax, dword ptr fs:[00000030h]		16_2_036F36CC
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_036F2ACB mov eax, dword ptr fs:[00000030h]		16_2_036F2ACB
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_03798ED6 mov eax, dword ptr fs:[00000030h]		16_2_03798ED6
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_0377FEC0 mov eax, dword ptr fs:[00000030h]		16_2_0377FEC0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_03708EC7 mov eax, dword ptr fs:[00000030h]		16_2_03708EC7
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_036C52A5 mov eax, dword ptr fs:[00000030h]		16_2_036C52A5
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_036C52A5 mov eax, dword ptr fs:[00000030h]		16_2_036C52A5
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_036C52A5 mov eax, dword ptr fs:[00000030h]		16_2_036C52A5
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_036C52A5 mov eax, dword ptr fs:[00000030h]		16_2_036C52A5
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_036C52A5 mov eax, dword ptr fs:[00000030h]		16_2_036C52A5
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_037446A7 mov eax, dword ptr fs:[00000030h]		16_2_037446A7
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_03790EA5 mov eax, dword ptr fs:[00000030h]		16_2_03790EA5
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_03790EA5 mov eax, dword ptr fs:[00000030h]		16_2_03790EA5
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_03790EA5 mov eax, dword ptr fs:[00000030h]		16_2_03790EA5
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_036DAAB0 mov eax, dword ptr fs:[00000030h]		16_2_036DAAB0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_036DAAB0 mov eax, dword ptr fs:[00000030h]		16_2_036DAAB0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_036FFAB0 mov eax, dword ptr fs:[00000030h]		16_2_036FFAB0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_0375FE87 mov eax, dword ptr fs:[00000030h]		16_2_0375FE87
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_036FD294 mov eax, dword ptr fs:[00000030h]		16_2_036FD294
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_036FD294 mov eax, dword ptr fs:[00000030h]		16_2_036FD294
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_036CC962 mov eax, dword ptr fs:[00000030h]		16_2_036CC962
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_036EC577 mov eax, dword ptr fs:[00000030h]		16_2_036EC577
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_036EC577 mov eax, dword ptr fs:[00000030h]		16_2_036EC577
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_036CB171 mov eax, dword ptr fs:[00000030h]		16_2_036CB171
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_036CB171 mov eax, dword ptr fs:[00000030h]		16_2_036CB171
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_036EB944 mov eax, dword ptr fs:[00000030h]		16_2_036EB944
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_036EB944 mov eax, dword ptr fs:[00000030h]		16_2_036EB944
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_03703D43 mov eax, dword ptr fs:[00000030h]		16_2_03703D43
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_03743540 mov eax, dword ptr fs:[00000030h]		16_2_03743540
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_036E7D50 mov eax, dword ptr fs:[00000030h]		16_2_036E7D50
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_0374A537 mov eax, dword ptr fs:[00000030h]		16_2_0374A537
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_03798D34 mov eax, dword ptr fs:[00000030h]		16_2_03798D34
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_036E4120 mov eax, dword ptr fs:[00000030h]		16_2_036E4120
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_036E4120 mov eax, dword ptr fs:[00000030h]		16_2_036E4120
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_036E4120 mov eax, dword ptr fs:[00000030h]		16_2_036E4120
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_036E4120 mov eax, dword ptr fs:[00000030h]		16_2_036E4120
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_036E4120 mov ecx, dword ptr fs:[00000030h]		16_2_036E4120
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_036F4D3B mov eax, dword ptr fs:[00000030h]		16_2_036F4D3B
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_036F4D3B mov eax, dword ptr fs:[00000030h]		16_2_036F4D3B
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_036F4D3B mov eax, dword ptr fs:[00000030h]		16_2_036F4D3B
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_036F513A mov eax, dword ptr fs:[00000030h]		16_2_036F513A
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_036F513A mov eax, dword ptr fs:[00000030h]		16_2_036F513A
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_036D3D34 mov eax, dword ptr fs:[00000030h]		16_2_036D3D34
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_036D3D34 mov eax, dword ptr fs:[00000030h]		16_2_036D3D34
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_036D3D34 mov eax, dword ptr fs:[00000030h]		16_2_036D3D34
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_036D3D34 mov eax, dword ptr fs:[00000030h]		16_2_036D3D34
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_036D3D34 mov eax, dword ptr fs:[00000030h]		16_2_036D3D34
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_036D3D34 mov eax, dword ptr fs:[00000030h]		16_2_036D3D34
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_036D3D34 mov eax, dword ptr fs:[00000030h]		16_2_036D3D34
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_036D3D34 mov eax, dword ptr fs:[00000030h]		16_2_036D3D34
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_036D3D34 mov eax, dword ptr fs:[00000030h]		16_2_036D3D34
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_036D3D34 mov eax, dword ptr fs:[00000030h]		16_2_036D3D34
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_036D3D34 mov eax, dword ptr fs:[00000030h]		16_2_036D3D34
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_036D3D34 mov eax, dword ptr fs:[00000030h]		16_2_036D3D34
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_036D3D34 mov eax, dword ptr fs:[00000030h]		16_2_036D3D34
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_036CAD30 mov eax, dword ptr fs:[00000030h]		16_2_036CAD30
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_036C9100 mov eax, dword ptr fs:[00000030h]		16_2_036C9100
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_036C9100 mov eax, dword ptr fs:[00000030h]		16_2_036C9100
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_036C9100 mov eax, dword ptr fs:[00000030h]		16_2_036C9100
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_03778DF1 mov eax, dword ptr fs:[00000030h]		16_2_03778DF1
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_036CB1E1 mov eax, dword ptr fs:[00000030h]		16_2_036CB1E1
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_036CB1E1 mov eax, dword ptr fs:[00000030h]		16_2_036CB1E1
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_036CB1E1 mov eax, dword ptr fs:[00000030h]		16_2_036CB1E1
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_036DD5E0 mov eax, dword ptr fs:[00000030h]		16_2_036DD5E0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_036DD5E0 mov eax, dword ptr fs:[00000030h]		16_2_036DD5E0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_037541E8 mov eax, dword ptr fs:[00000030h]		16_2_037541E8
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_03746DC9 mov eax, dword ptr fs:[00000030h]		16_2_03746DC9
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_03746DC9 mov eax, dword ptr fs:[00000030h]		16_2_03746DC9
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_03746DC9 mov eax, dword ptr fs:[00000030h]		16_2_03746DC9
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_03746DC9 mov ecx, dword ptr fs:[00000030h]		16_2_03746DC9
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_03746DC9 mov eax, dword ptr fs:[00000030h]		16_2_03746DC9
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_03746DC9 mov eax, dword ptr fs:[00000030h]		16_2_03746DC9
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_037451BE mov eax, dword ptr fs:[00000030h]		16_2_037451BE
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_037451BE mov eax, dword ptr fs:[00000030h]		16_2_037451BE
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_037451BE mov eax, dword ptr fs:[00000030h]		16_2_037451BE
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_037451BE mov eax, dword ptr fs:[00000030h]		16_2_037451BE
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_036F35A1 mov eax, dword ptr fs:[00000030h]		16_2_036F35A1
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_036F61A0 mov eax, dword ptr fs:[00000030h]		16_2_036F61A0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_036F61A0 mov eax, dword ptr fs:[00000030h]		16_2_036F61A0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_037469A6 mov eax, dword ptr fs:[00000030h]		16_2_037469A6
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_037905AC mov eax, dword ptr fs:[00000030h]		16_2_037905AC
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_037905AC mov eax, dword ptr fs:[00000030h]		16_2_037905AC
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_036F1DB5 mov eax, dword ptr fs:[00000030h]		16_2_036F1DB5
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_036F1DB5 mov eax, dword ptr fs:[00000030h]		16_2_036F1DB5
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_036F1DB5 mov eax, dword ptr fs:[00000030h]		16_2_036F1DB5
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_036C2D8A mov eax, dword ptr fs:[00000030h]		16_2_036C2D8A
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_036C2D8A mov eax, dword ptr fs:[00000030h]		16_2_036C2D8A
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_036C2D8A mov eax, dword ptr fs:[00000030h]		16_2_036C2D8A
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_036C2D8A mov eax, dword ptr fs:[00000030h]		16_2_036C2D8A
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_036C2D8A mov eax, dword ptr fs:[00000030h]		16_2_036C2D8A
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_036FA185 mov eax, dword ptr fs:[00000030h]		16_2_036FA185
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_036EC182 mov eax, dword ptr fs:[00000030h]		16_2_036EC182
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_036F2581 mov eax, dword ptr fs:[00000030h]		16_2_036F2581
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_036F2581 mov eax, dword ptr fs:[00000030h]		16_2_036F2581
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_036F2581 mov eax, dword ptr fs:[00000030h]		16_2_036F2581
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_036F2581 mov eax, dword ptr fs:[00000030h]		16_2_036F2581
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_036FFD9B mov eax, dword ptr fs:[00000030h]		16_2_036FFD9B
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_036FFD9B mov eax, dword ptr fs:[00000030h]		16_2_036FFD9B
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_036F2990 mov eax, dword ptr fs:[00000030h]		16_2_036F2990
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_036E746D mov eax, dword ptr fs:[00000030h]		16_2_036E746D
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_03782073 mov eax, dword ptr fs:[00000030h]		16_2_03782073
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_03791074 mov eax, dword ptr fs:[00000030h]		16_2_03791074
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_036FA44B mov eax, dword ptr fs:[00000030h]		16_2_036FA44B
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_0375C450 mov eax, dword ptr fs:[00000030h]		16_2_0375C450
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_0375C450 mov eax, dword ptr fs:[00000030h]		16_2_0375C450
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_036E0050 mov eax, dword ptr fs:[00000030h]		16_2_036E0050
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_036E0050 mov eax, dword ptr fs:[00000030h]		16_2_036E0050
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_036F002D mov eax, dword ptr fs:[00000030h]		16_2_036F002D
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_036F002D mov eax, dword ptr fs:[00000030h]		16_2_036F002D
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_036F002D mov eax, dword ptr fs:[00000030h]		16_2_036F002D
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_036F002D mov eax, dword ptr fs:[00000030h]		16_2_036F002D
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_036F002D mov eax, dword ptr fs:[00000030h]		16_2_036F002D
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_036FBC2C mov eax, dword ptr fs:[00000030h]		16_2_036FBC2C
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_036DB02A mov eax, dword ptr fs:[00000030h]		16_2_036DB02A
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_036DB02A mov eax, dword ptr fs:[00000030h]		16_2_036DB02A
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_036DB02A mov eax, dword ptr fs:[00000030h]		16_2_036DB02A
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_036DB02A mov eax, dword ptr fs:[00000030h]		16_2_036DB02A
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_03747016 mov eax, dword ptr fs:[00000030h]		16_2_03747016
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_03747016 mov eax, dword ptr fs:[00000030h]		16_2_03747016
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_03747016 mov eax, dword ptr fs:[00000030h]		16_2_03747016
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_03794015 mov eax, dword ptr fs:[00000030h]		16_2_03794015
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_03794015 mov eax, dword ptr fs:[00000030h]		16_2_03794015
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_0379740D mov eax, dword ptr fs:[00000030h]		16_2_0379740D
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_0379740D mov eax, dword ptr fs:[00000030h]		16_2_0379740D
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_0379740D mov eax, dword ptr fs:[00000030h]		16_2_0379740D
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_03781C06 mov eax, dword ptr fs:[00000030h]		16_2_03781C06
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_03781C06 mov eax, dword ptr fs:[00000030h]		16_2_03781C06
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_03781C06 mov eax, dword ptr fs:[00000030h]		16_2_03781C06
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_03781C06 mov eax, dword ptr fs:[00000030h]		16_2_03781C06
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_03781C06 mov eax, dword ptr fs:[00000030h]		16_2_03781C06
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_03781C06 mov eax, dword ptr fs:[00000030h]		16_2_03781C06
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_03781C06 mov eax, dword ptr fs:[00000030h]		16_2_03781C06
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_03781C06 mov eax, dword ptr fs:[00000030h]		16_2_03781C06
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_03781C06 mov eax, dword ptr fs:[00000030h]		16_2_03781C06
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_03781C06 mov eax, dword ptr fs:[00000030h]		16_2_03781C06
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_03781C06 mov eax, dword ptr fs:[00000030h]		16_2_03781C06
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_03781C06 mov eax, dword ptr fs:[00000030h]		16_2_03781C06
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_03781C06 mov eax, dword ptr fs:[00000030h]		16_2_03781C06
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_03781C06 mov eax, dword ptr fs:[00000030h]		16_2_03781C06
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_03746C0A mov eax, dword ptr fs:[00000030h]		16_2_03746C0A
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_03746C0A mov eax, dword ptr fs:[00000030h]		16_2_03746C0A
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_03746C0A mov eax, dword ptr fs:[00000030h]		16_2_03746C0A
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_03746C0A mov eax, dword ptr fs:[00000030h]		16_2_03746C0A
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_036C58EC mov eax, dword ptr fs:[00000030h]		16_2_036C58EC
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_037814FB mov eax, dword ptr fs:[00000030h]		16_2_037814FB
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_03746CF0 mov eax, dword ptr fs:[00000030h]		16_2_03746CF0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_03746CF0 mov eax, dword ptr fs:[00000030h]		16_2_03746CF0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_03746CF0 mov eax, dword ptr fs:[00000030h]		16_2_03746CF0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_0375B8D0 mov eax, dword ptr fs:[00000030h]		16_2_0375B8D0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_0375B8D0 mov ecx, dword ptr fs:[00000030h]		16_2_0375B8D0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_0375B8D0 mov eax, dword ptr fs:[00000030h]		16_2_0375B8D0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_0375B8D0 mov eax, dword ptr fs:[00000030h]		16_2_0375B8D0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_0375B8D0 mov eax, dword ptr fs:[00000030h]		16_2_0375B8D0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_0375B8D0 mov eax, dword ptr fs:[00000030h]		16_2_0375B8D0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_03798CD6 mov eax, dword ptr fs:[00000030h]		16_2_03798CD6
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_036F20A0 mov eax, dword ptr fs:[00000030h]		16_2_036F20A0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_036F20A0 mov eax, dword ptr fs:[00000030h]		16_2_036F20A0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_036F20A0 mov eax, dword ptr fs:[00000030h]		16_2_036F20A0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_036F20A0 mov eax, dword ptr fs:[00000030h]		16_2_036F20A0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_036F20A0 mov eax, dword ptr fs:[00000030h]		16_2_036F20A0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_036F20A0 mov eax, dword ptr fs:[00000030h]		16_2_036F20A0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_036FF0BF mov ecx, dword ptr fs:[00000030h]		16_2_036FF0BF
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_036FF0BF mov eax, dword ptr fs:[00000030h]		16_2_036FF0BF
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_036FF0BF mov eax, dword ptr fs:[00000030h]		16_2_036FF0BF
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_037090AF mov eax, dword ptr fs:[00000030h]		16_2_037090AF
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_036C9080 mov eax, dword ptr fs:[00000030h]		16_2_036C9080
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_03743884 mov eax, dword ptr fs:[00000030h]		16_2_03743884
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_03743884 mov eax, dword ptr fs:[00000030h]		16_2_03743884
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_036D849B mov eax, dword ptr fs:[00000030h]		16_2_036D849B

Enables debug privileges

Source: C:\Users\user\Desktop\PO.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Users\user\Desktop\PO.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process token adjusted: Debug			Jump to behavior

Creates guard pages, often used to prevent reverse engineering and debugging

Source: C:\Users\user\Desktop\PO.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\PO.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write			Jump to behavior
Source: C:\Users\user\Desktop\PO.exe	Section loaded: unknown target: C:\Windows\SysWOW64\netsh.exe protection: execute and read and write			Jump to behavior
Source: C:\Users\user\Desktop\PO.exe	Section loaded: unknown target: C:\Windows\SysWOW64\netsh.exe protection: execute and read and write			Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write			Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write			Jump to behavior

Modifies the context of a thread in another process (thread injection)

Source: C:\Users\user\Desktop\PO.exe	Thread register set: target process: 3388			Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Thread register set: target process: 3388			Jump to behavior

Queues an APC in another process (thread injection)

Source: C:\Users\user\Desktop\PO.exe

Thread APC queued: target process: C:\Windows\explorer.exe

Jump to behavior

Sample uses process hollowing technique

Source: C:\Users\user\Desktop\PO.exe

Section unmapped: C:\Windows\SysWOW64\netsh.exe base address: D90000

Jump to behavior

Creates a process in suspended mode (likely to inject code)

Source: C:\Users\user\Desktop\PO.exe	Process created: C:\Users\user\Desktop\PO.exe C:\Users\user\Desktop\PO.exe			Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\PO.exe'			Jump to behavior

May try to detect the Windows Explorer process (often used for injection)

Source: explorer.exe, 00000006.00000002.484389821.0000000001398000.00000004.00000020.sdmp	Binary or memory string: ProgmanamF
Source: explorer.exe, 00000006.00000000.271617096.0000000001980000.00000002.00000001.sdmp, netsh.exe, 00000010.00000002.492076136.0000000004EA0000.00000002.00000001.sdmp	Binary or memory string: Program Manager
Source: explorer.exe, 00000006.00000000.271617096.0000000001980000.00000002.00000001.sdmp, netsh.exe, 00000010.00000002.492076136.0000000004EA0000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000006.00000000.271617096.0000000001980000.00000002.00000001.sdmp, netsh.exe, 00000010.00000002.492076136.0000000004EA0000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: explorer.exe, 00000006.00000000.271617096.0000000001980000.00000002.00000001.sdmp, netsh.exe, 00000010.00000002.492076136.0000000004EA0000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Language, Device and Operating System Detection:

Queries the volume information (name, serial number etc) of a device

Source: C:\Users\user\Desktop\PO.exe	Queries volume information: C:\Users\user\Desktop\PO.exe VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation			Jump to behavior

Queries the cryptographic machine GUID

Source: C:\Users\user\Desktop\PO.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings:

Uses netsh to modify the Windows network and firewall settings

Source: unknown

Process created: C:\Windows\SysWOW64\netsh.exe C:\Windows\SysWOW64\netsh.exe

Stealing of Sensitive Information:

Yara detected FormBook

Source: Yara match	File source: 00000003.00000002.314545610.0000000001580000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.484649434.00000000031B0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.483269971.0000000002E50000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.313036443.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.314657268.00000000015B0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.483171472.0000000002DB0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 3.2.PO.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.PO.exe.400000.0.unpack, type: UNPACKEDPE

Remote Access Functionality:

Yara detected FormBook

Source: Yara match	File source: 00000003.00000002.314545610.0000000001580000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.484649434.00000000031B0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.483269971.0000000002E50000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.313036443.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.314657268.00000000015B0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.483171472.0000000002DB0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 3.2.PO.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.PO.exe.400000.0.unpack, type: UNPACKEDPE