Play interactive tour

Edit tour

Analysis Report PO-75013.scr

Overview

General Information

Sample Name:	PO-75013.scr (renamed file extension from scr to exe)
Analysis ID:	338942
MD5:	e7e6ee6ef97ff797562c91e0ff401ac4
SHA1:	d1ec737c87a9c0a91456f1019106b77ee2e03980
SHA256:	7eb2de2bfd05ee1e83980aa914486789d2e8f3fb3cc6e166f140302fdaf40cd9
Tags:	scr
Most interesting Screenshot:

Detection

Snake Keylogger

Score:	88
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected MultiObfuscated

Yara detected Snake Keylogger

Allocates memory in foreign processes

Drops PE files to the user root directory

Hides that the sample has been downloaded from the Internet (zone.identifier)

Injects a PE file into a foreign processes

May check the online IP address of the machine

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file access)

Writes to foreign memory regions

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains capabilities to detect virtual machines

Contains long sleeps (>= 3 min)

Creates a DirectInput object (often for capturing keystrokes)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the user directory

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE / OLE file has an invalid certificate

PE file contains strange resources

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Tries to load missing DLLs

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Uses reg.exe to modify the Windows registry

Classification

Startup

System is w10x64

PO-75013.exe (PID: 6904 cmdline: 'C:\Users\user\Desktop\PO-75013.exe' MD5: E7E6EE6EF97FF797562C91E0FF401AC4)

cmd.exe (PID: 6992 cmdline: 'cmd.exe' /c REG ADD 'HKCU\Software\Microsoft\Windows\CurrentVersion\Run' /f /v 'explore' /t REG_SZ /d 'C:\Users\user\explore.exe' MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 7000 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

reg.exe (PID: 7048 cmdline: REG ADD 'HKCU\Software\Microsoft\Windows\CurrentVersion\Run' /f /v 'explore' /t REG_SZ /d 'C:\Users\user\explore.exe' MD5: CEE2A7E57DF2A159A065A34913A055C2)

MpCmdRun.exe (PID: 7104 cmdline: 'C:\Program Files\Windows Defender\mpcmdrun.exe' -wdenable MD5: A267555174BFA53844371226F482B86B)

conhost.exe (PID: 5948 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

explore.exe (PID: 6200 cmdline: 'C:\Users\user\explore.exe' MD5: E7E6EE6EF97FF797562C91E0FF401AC4)

explore.exe (PID: 2152 cmdline: 'C:\Users\user\explore.exe' MD5: E7E6EE6EF97FF797562C91E0FF401AC4)

explore.exe (PID: 6968 cmdline: 'C:\Users\user\explore.exe' MD5: E7E6EE6EF97FF797562C91E0FF401AC4)

InstallUtil.exe (PID: 6316 cmdline: C:\Users\user~1\AppData\Local\Temp\InstallUtil.exe MD5: EFEC8C379D165E3F33B536739AEE26A3)

cleanup

Malware Configuration

No configs have been found

Yara Overview

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.277366713.0000000003C9C000.00000004.00000001.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000000.00000002.276366606.0000000003AB1000.00000004.00000001.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
Process Memory Space: PO-75013.exe PID: 6904	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
Process Memory Space: PO-75013.exe PID: 6904	JoeSecurity_MultiObfuscated	Yara detected MultiObfuscated	Joe Security

Sigma Overview

No Sigma rule has matched

Signature Overview

Click to jump to signature section

Show All Signature Results

Source: PO-75013.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: unknown

HTTPS traffic detected: 104.28.4.151:443 -> 192.168.2.7:49744 version: TLS 1.0

Source: PO-75013.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT, HIGH_ENTROPY_VA

Source:	Binary string: InstallUtil.pdb\rvr hr_CorExeMainmscoree.dll source: InstallUtil.exe, 00000011.00000000.318356080.00000000003E2000.00000002.00020000.sdmp, InstallUtil.exe.0.dr
Source:	Binary string: InstallUtil.pdb source: InstallUtil.exe, 00000011.00000000.318356080.00000000003E2000.00000002.00020000.sdmp, InstallUtil.exe.0.dr

Source: C:\Users\user\Desktop\PO-75013.exe	Code function: 4x nop then jmp 00C2F626h	0_2_00C2EE1A
Source: C:\Users\user\Desktop\PO-75013.exe	Code function: 4x nop then jmp 00C2F626h	0_2_00C2EE50
Source: C:\Users\user\Desktop\PO-75013.exe	Code function: 4x nop then mov esp, ebp	0_2_04EAC6A0
Source: C:\Users\user\Desktop\PO-75013.exe	Code function: 4x nop then lea esp, dword ptr [ebp-08h]	0_2_04EADAA9
Source: C:\Users\user\Desktop\PO-75013.exe	Code function: 4x nop then push dword ptr [ebp-20h]	0_2_04EA46AB
Source: C:\Users\user\Desktop\PO-75013.exe	Code function: 4x nop then mov dword ptr [ebp-1Ch], 7FFFFFFFh	0_2_04EA46AB
Source: C:\Users\user\Desktop\PO-75013.exe	Code function: 4x nop then push dword ptr [ebp-20h]	0_2_04EA46B0
Source: C:\Users\user\Desktop\PO-75013.exe	Code function: 4x nop then mov dword ptr [ebp-1Ch], 7FFFFFFFh	0_2_04EA46B0
Source: C:\Users\user\Desktop\PO-75013.exe	Code function: 4x nop then mov dword ptr [ebp-1Ch], 00000000h	0_2_04EA41D7
Source: C:\Users\user\Desktop\PO-75013.exe	Code function: 4x nop then mov dword ptr [ebp-1Ch], 00000000h	0_2_04EA5C68
Source: C:\Users\user\Desktop\PO-75013.exe	Code function: 4x nop then mov dword ptr [ebp-1Ch], 00000000h	0_2_04EA3C14
Source: C:\Users\user\Desktop\PO-75013.exe	Code function: 4x nop then mov dword ptr [ebp-18h], 00000000h	0_2_04EAAF50
Source: C:\Users\user\Desktop\PO-75013.exe	Code function: 4x nop then xor edx, edx	0_2_04EA48FD
Source: C:\Users\user\Desktop\PO-75013.exe	Code function: 4x nop then push dword ptr [ebp-24h]	0_2_04EA49C4
Source: C:\Users\user\Desktop\PO-75013.exe	Code function: 4x nop then mov dword ptr [ebp-1Ch], 7FFFFFFFh	0_2_04EA49C4
Source: C:\Users\user\Desktop\PO-75013.exe	Code function: 4x nop then push dword ptr [ebp-24h]	0_2_04EA49D0
Source: C:\Users\user\Desktop\PO-75013.exe	Code function: 4x nop then mov dword ptr [ebp-1Ch], 7FFFFFFFh	0_2_04EA49D0
Source: C:\Users\user\Desktop\PO-75013.exe	Code function: 4x nop then xor edx, edx	0_2_04EA4908

Networking:

May check the online IP address of the machine

Show sources

Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: checkip.dyndns.org

Source: Joe Sandbox View	IP Address: 162.88.193.70 162.88.193.70
Source: Joe Sandbox View	IP Address: 104.28.4.151 104.28.4.151

Source: Joe Sandbox View

JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org

Source: unknown

HTTPS traffic detected: 104.28.4.151:443 -> 192.168.2.7:49744 version: TLS 1.0

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org

Source: unknown

DNS traffic detected: queries for: checkip.dyndns.org

Source: PO-75013.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDCA-1.crt0
Source: PO-75013.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: PO-75013.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertEVCodeSigningCA-SHA2.crt0
Source: PO-75013.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDCA-1.crl08
Source: PO-75013.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: PO-75013.exe	String found in binary or memory: http://crl3.digicert.com/EVCodeSigningSHA2-g1.crl07
Source: PO-75013.exe	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDCA-1.crl0w
Source: PO-75013.exe	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: PO-75013.exe	String found in binary or memory: http://crl4.digicert.com/EVCodeSigningSHA2-g1.crl0K
Source: PO-75013.exe, 00000000.00000003.272434959.0000000000FC9000.00000004.00000001.sdmp	String found in binary or memory: http://iptc.org/mpCore
Source: PO-75013.exe, 00000000.00000003.272434959.0000000000FC9000.00000004.00000001.sdmp	String found in binary or memory: http://n._
Source: PO-75013.exe, 00000000.00000003.272434959.0000000000FC9000.00000004.00000001.sdmp	String found in binary or memory: http://ns.adp/1.0/
Source: PO-75013.exe, 00000000.00000003.272434959.0000000000FC9000.00000004.00000001.sdmp	String found in binary or memory: http://ns.ao
Source: PO-75013.exe	String found in binary or memory: http://ocsp.digicert.com0A
Source: PO-75013.exe	String found in binary or memory: http://ocsp.digicert.com0C
Source: PO-75013.exe	String found in binary or memory: http://ocsp.digicert.com0H
Source: PO-75013.exe	String found in binary or memory: http://www.digicert.com/ssl-cps-repository.htm0
Source: PO-75013.exe	String found in binary or memory: https://www.digicert.com/CPS0

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443

Source: explore.exe, 00000005.00000002.277648767.0000000000B69000.00000004.00000020.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

Source: C:\Users\user\Desktop\PO-75013.exe	Code function: 0_2_00C299F8	0_2_00C299F8
Source: C:\Users\user\Desktop\PO-75013.exe	Code function: 0_2_00C2A4F0	0_2_00C2A4F0
Source: C:\Users\user\Desktop\PO-75013.exe	Code function: 0_2_00C2BC20	0_2_00C2BC20
Source: C:\Users\user\Desktop\PO-75013.exe	Code function: 0_2_00C2D6E0	0_2_00C2D6E0
Source: C:\Users\user\Desktop\PO-75013.exe	Code function: 0_2_00C276F0	0_2_00C276F0
Source: C:\Users\user\Desktop\PO-75013.exe	Code function: 0_2_00C2F650	0_2_00C2F650
Source: C:\Users\user\Desktop\PO-75013.exe	Code function: 0_2_00C2EE1A	0_2_00C2EE1A
Source: C:\Users\user\Desktop\PO-75013.exe	Code function: 0_2_00C23FD8	0_2_00C23FD8
Source: C:\Users\user\Desktop\PO-75013.exe	Code function: 0_2_00C2F64F	0_2_00C2F64F
Source: C:\Users\user\Desktop\PO-75013.exe	Code function: 0_2_00C2EE50	0_2_00C2EE50
Source: C:\Users\user\Desktop\PO-75013.exe	Code function: 0_2_04EAB5F1	0_2_04EAB5F1
Source: C:\Users\user\Desktop\PO-75013.exe	Code function: 0_2_04EAB600	0_2_04EAB600
Source: C:\Users\user\Desktop\PO-75013.exe	Code function: 0_2_04EA572A	0_2_04EA572A
Source: C:\Users\user\Desktop\PO-75013.exe	Code function: 0_2_04EA5738	0_2_04EA5738
Source: C:\Users\user\Desktop\PO-75013.exe	Code function: 0_2_04EA0188	0_2_04EA0188
Source: C:\Users\user\Desktop\PO-75013.exe	Code function: 0_2_04EA5188	0_2_04EA5188
Source: C:\Users\user\Desktop\PO-75013.exe	Code function: 0_2_04EA5178	0_2_04EA5178
Source: C:\Users\user\Desktop\PO-75013.exe	Code function: 0_2_04EA517F	0_2_04EA517F
Source: C:\Users\user\Desktop\PO-75013.exe	Code function: 0_2_04EAC110	0_2_04EAC110
Source: C:\Users\user\explore.exe	Code function: 5_2_00EE9A08	5_2_00EE9A08
Source: C:\Users\user\explore.exe	Code function: 5_2_00EEBC30	5_2_00EEBC30
Source: C:\Users\user\explore.exe	Code function: 5_2_00EEA500	5_2_00EEA500
Source: C:\Users\user\explore.exe	Code function: 5_2_00EED6F0	5_2_00EED6F0
Source: C:\Users\user\explore.exe	Code function: 5_2_00EE3FD8	5_2_00EE3FD8
Source: C:\Users\user\explore.exe	Code function: 5_2_00EE99F8	5_2_00EE99F8
Source: C:\Users\user\explore.exe	Code function: 5_2_00EEA4F0	5_2_00EEA4F0
Source: C:\Users\user\explore.exe	Code function: 5_2_00EEBC20	5_2_00EEBC20
Source: C:\Users\user\explore.exe	Code function: 5_2_00EED6E0	5_2_00EED6E0
Source: C:\Users\user\explore.exe	Code function: 6_2_012A9A08	6_2_012A9A08
Source: C:\Users\user\explore.exe	Code function: 6_2_012AA500	6_2_012AA500
Source: C:\Users\user\explore.exe	Code function: 6_2_012ABC30	6_2_012ABC30
Source: C:\Users\user\explore.exe	Code function: 6_2_012A3FD8	6_2_012A3FD8
Source: C:\Users\user\explore.exe	Code function: 6_2_012A76F0	6_2_012A76F0
Source: C:\Users\user\explore.exe	Code function: 6_2_012AD6F0	6_2_012AD6F0
Source: C:\Users\user\explore.exe	Code function: 6_2_012A99F8	6_2_012A99F8
Source: C:\Users\user\explore.exe	Code function: 6_2_012ABC20	6_2_012ABC20
Source: C:\Users\user\explore.exe	Code function: 6_2_012AA4F0	6_2_012AA4F0
Source: C:\Users\user\explore.exe	Code function: 6_2_012AD6E0	6_2_012AD6E0

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Local\Temp\InstallUtil.exe 46DEE184523A584E56DF93389F81992911A1BA6B1F05AD7D803C6AB1450E18CB

Source: PO-75013.exe

Static PE information: invalid certificate

Source: PO-75013.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: explore.exe.0.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: PO-75013.exe, 00000000.00000002.274910073.0000000002890000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameSHCore1.dll0 vs PO-75013.exe
Source: PO-75013.exe, 00000000.00000002.281922390.0000000005890000.00000002.00000001.sdmp	Binary or memory string: originalfilename vs PO-75013.exe
Source: PO-75013.exe, 00000000.00000002.281922390.0000000005890000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamepropsys.dll.mui@ vs PO-75013.exe
Source: PO-75013.exe, 00000000.00000002.276366606.0000000003AB1000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameRICSSWYL.exe4 vs PO-75013.exe
Source: PO-75013.exe, 00000000.00000002.274615352.0000000002780000.00000002.00000001.sdmp	Binary or memory string: System.OriginalFileName vs PO-75013.exe
Source: PO-75013.exe, 00000000.00000002.281061800.0000000005700000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameKernelbase.dll.muij% vs PO-75013.exe

Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe

Section loaded: dwmapi.dll

Jump to behavior

Source: PO-75013.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: unknown

Process created: C:\Windows\SysWOW64\reg.exe REG ADD 'HKCU\Software\Microsoft\Windows\CurrentVersion\Run' /f /v 'explore' /t REG_SZ /d 'C:\Users\user\explore.exe'

Source: classification engine

Classification label: mal88.troj.spyw.evad.winEXE@14/6@3/3

Source: C:\Users\user\Desktop\PO-75013.exe

File created: C:\Users\user\explore.exe

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7000:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:5948:120:WilError_01

Source: C:\Users\user\Desktop\PO-75013.exe

File created: C:\Users\user~1\AppData\Local\Temp\InstallUtil.exe

Jump to behavior

Source: PO-75013.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\PO-75013.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\explore.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\explore.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\explore.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior

Source: C:\Users\user\Desktop\PO-75013.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\PO-75013.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: C:\Users\user\Desktop\PO-75013.exe

File read: C:\Users\user\Desktop\PO-75013.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\PO-75013.exe 'C:\Users\user\Desktop\PO-75013.exe'
Source: unknown	Process created: C:\Windows\SysWOW64\cmd.exe 'cmd.exe' /c REG ADD 'HKCU\Software\Microsoft\Windows\CurrentVersion\Run' /f /v 'explore' /t REG_SZ /d 'C:\Users\user\explore.exe'
Source: unknown	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\SysWOW64\reg.exe REG ADD 'HKCU\Software\Microsoft\Windows\CurrentVersion\Run' /f /v 'explore' /t REG_SZ /d 'C:\Users\user\explore.exe'
Source: unknown	Process created: C:\Users\user\explore.exe 'C:\Users\user\explore.exe'
Source: unknown	Process created: C:\Users\user\explore.exe 'C:\Users\user\explore.exe'
Source: unknown	Process created: C:\Users\user\explore.exe 'C:\Users\user\explore.exe'
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\InstallUtil.exe C:\Users\user~1\AppData\Local\Temp\InstallUtil.exe
Source: unknown	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe 'C:\Program Files\Windows Defender\mpcmdrun.exe' -wdenable
Source: unknown	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\PO-75013.exe	Process created: C:\Windows\SysWOW64\cmd.exe 'cmd.exe' /c REG ADD 'HKCU\Software\Microsoft\Windows\CurrentVersion\Run' /f /v 'explore' /t REG_SZ /d 'C:\Users\user\explore.exe'	Jump to behavior
Source: C:\Users\user\Desktop\PO-75013.exe	Process created: C:\Users\user\explore.exe 'C:\Users\user\explore.exe'	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe REG ADD 'HKCU\Software\Microsoft\Windows\CurrentVersion\Run' /f /v 'explore' /t REG_SZ /d 'C:\Users\user\explore.exe'	Jump to behavior
Source: C:\Users\user\explore.exe	Process created: C:\Users\user\AppData\Local\Temp\InstallUtil.exe C:\Users\user~1\AppData\Local\Temp\InstallUtil.exe	Jump to behavior

Source: C:\Users\user\Desktop\PO-75013.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\PO-75013.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: PO-75013.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: PO-75013.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: PO-75013.exe

Static file information: File size 1634760 > 1048576

Source: PO-75013.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x162e00

Source: PO-75013.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT, HIGH_ENTROPY_VA

Source:	Binary string: InstallUtil.pdb\rvr hr_CorExeMainmscoree.dll source: InstallUtil.exe, 00000011.00000000.318356080.00000000003E2000.00000002.00020000.sdmp, InstallUtil.exe.0.dr
Source:	Binary string: InstallUtil.pdb source: InstallUtil.exe, 00000011.00000000.318356080.00000000003E2000.00000002.00020000.sdmp, InstallUtil.exe.0.dr

Source: C:\Users\user\Desktop\PO-75013.exe	Code function: 0_2_00348136 pushfd ; ret	0_2_0034814C
Source: C:\Users\user\Desktop\PO-75013.exe	Code function: 0_2_00C27494 pushad ; retf	0_2_00C27495
Source: C:\Users\user\explore.exe	Code function: 5_2_002D8136 pushfd ; ret	5_2_002D814C
Source: C:\Users\user\explore.exe	Code function: 5_2_00EE8980 push 84027BEDh; retf 00E7h	5_2_00EE8ADD
Source: C:\Users\user\explore.exe	Code function: 6_2_00768136 pushfd ; ret	6_2_0076814C
Source: C:\Users\user\explore.exe	Code function: 6_2_012A8980 push 840509EDh; retf 00FBh	6_2_012A8ADD

Source: C:\Users\user\Desktop\PO-75013.exe	File created: C:\Users\user\explore.exe			Jump to dropped file
Source: C:\Users\user\Desktop\PO-75013.exe	File created: C:\Users\user\AppData\Local\Temp\InstallUtil.exe			Jump to dropped file

Source: C:\Users\user\Desktop\PO-75013.exe

File created: C:\Users\user\explore.exe

Jump to dropped file

Boot Survival:

Drops PE files to the user root directory

Show sources

Source: C:\Users\user\Desktop\PO-75013.exe

File created: C:\Users\user\explore.exe

Jump to dropped file

Source: C:\Windows\SysWOW64\reg.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run explore			Jump to behavior
Source: C:\Windows\SysWOW64\reg.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run explore			Jump to behavior

Hooking and other Techniques for Hiding and Protection:

Hides that the sample has been downloaded from the Internet (zone.identifier)

Show sources

Source: C:\Users\user\Desktop\PO-75013.exe	File opened: C:\Users\user\Desktop\PO-75013.exe\:Zone.Identifier read attributes \| delete			Jump to behavior
Source: C:\Users\user\explore.exe	File opened: C:\Users\user\explore.exe\:Zone.Identifier read attributes \| delete			Jump to behavior

Source: C:\Users\user\Desktop\PO-75013.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-75013.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-75013.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-75013.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-75013.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-75013.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-75013.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-75013.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-75013.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-75013.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-75013.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-75013.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-75013.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-75013.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-75013.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-75013.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-75013.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-75013.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-75013.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-75013.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-75013.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-75013.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-75013.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-75013.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-75013.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-75013.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-75013.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-75013.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-75013.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-75013.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-75013.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-75013.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-75013.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-75013.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-75013.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-75013.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-75013.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-75013.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-75013.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-75013.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-75013.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\PO-75013.exe

File opened / queried: SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}

Jump to behavior

Source: C:\Users\user\Desktop\PO-75013.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\PO-75013.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\explore.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\explore.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\explore.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Users\user\explore.exe	Window / User API: threadDelayed 834			Jump to behavior
Source: C:\Users\user\explore.exe	Window / User API: threadDelayed 4100			Jump to behavior

Source: C:\Users\user\Desktop\PO-75013.exe TID: 7084	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO-75013.exe TID: 7096	Thread sleep count: 69 > 30	Jump to behavior
Source: C:\Users\user\Desktop\PO-75013.exe TID: 7096	Thread sleep count: 102 > 30	Jump to behavior
Source: C:\Users\user\Desktop\PO-75013.exe TID: 6924	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\explore.exe TID: 6256	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\explore.exe TID: 5996	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\explore.exe TID: 5424	Thread sleep count: 195 > 30	Jump to behavior
Source: C:\Users\user\explore.exe TID: 5424	Thread sleep time: -195000s >= -30000s	Jump to behavior
Source: C:\Users\user\explore.exe TID: 2848	Thread sleep time: -11068046444225724s >= -30000s	Jump to behavior
Source: C:\Users\user\explore.exe TID: 4812	Thread sleep count: 834 > 30	Jump to behavior
Source: C:\Users\user\explore.exe TID: 4812	Thread sleep count: 4100 > 30	Jump to behavior
Source: C:\Users\user\explore.exe TID: 976	Thread sleep count: 180 > 30	Jump to behavior
Source: C:\Users\user\explore.exe TID: 976	Thread sleep time: -180000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: explore.exe, 00000006.00000002.279631204.0000000003BB1000.00000004.00000001.sdmp	Binary or memory string: VMware
Source: explore.exe, 00000006.00000002.279631204.0000000003BB1000.00000004.00000001.sdmp	Binary or memory string: vmware svga
Source: PO-75013.exe, 00000000.00000002.281061800.0000000005700000.00000002.00000001.sdmp, reg.exe, 00000003.00000002.245256089.0000000002E00000.00000002.00000001.sdmp	Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: explore.exe, 00000006.00000002.279631204.0000000003BB1000.00000004.00000001.sdmp	Binary or memory string: vmware
Source: PO-75013.exe, 00000000.00000002.274910073.0000000002890000.00000004.00000001.sdmp, explore.exe, 00000005.00000002.278748395.00000000038E1000.00000004.00000001.sdmp, expl

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report PO-75013.scr

Overview

General Information

Detection

Signatures

Classification

Startup

Malware Configuration

Yara Overview

Memory Dumps

Sigma Overview

Signature Overview

Compliance:

Software Vulnerabilities:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Boot Survival:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion: