Analysis Report pan0ramic0.jpg.dll

Overview

General Information

Sample Name: pan0ramic0.jpg.dll
Analysis ID: 343140
MD5: 9fe062a79018b4df322391a8f055d6be
SHA1: dee5ab23ff6f339fabddbb5b2bedc9d13329682c
SHA256: 63bee368085136ef7eed0823b6d8fb25ffecfd6f6d9050ee26f782e2b35df9a4
Tags: dllenigaelucegoziisfbursnif

Most interesting Screenshot:

Detection

Ursnif
Score: 64
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Found malware configuration
Yara detected Ursnif
Writes or reads registry keys via WMI
Writes registry values via WMI
Contains functionality to call native functions
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to query CPU information (cpuid)
Contains functionality to query locales information (e.g. system language)
Contains functionality to read the PEB
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Registers a DLL
Sample execution stops while process was sleeping (likely an evasion)
Tries to load missing DLLs
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)

Classification

AV Detection:

barindex
Found malware configuration
Source: regsvr32.exe.5656.2.memstr Malware Configuration Extractor: Ursnif {"server": "12", "whoami": "user@724536ceL", "dns": "724536", "version": "250171", "uptime": "189", "crc": "1", "id": "7248", "user": "253fc4ee08f8d2d8cdc8873aecc584b8", "soft": "3"}

Compliance:

barindex
Uses 32bit PE files
Source: pan0ramic0.jpg.dll Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL
Uses new MSVCR Dlls
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll Jump to behavior
Uses secure TLS version for HTTPS connections
Source: unknown HTTPS traffic detected: 151.101.1.44:443 -> 192.168.2.3:49742 version: TLS 1.2
Source: unknown HTTPS traffic detected: 151.101.1.44:443 -> 192.168.2.3:49746 version: TLS 1.2
Source: unknown HTTPS traffic detected: 151.101.1.44:443 -> 192.168.2.3:49745 version: TLS 1.2
Source: unknown HTTPS traffic detected: 151.101.1.44:443 -> 192.168.2.3:49743 version: TLS 1.2
Source: unknown HTTPS traffic detected: 151.101.1.44:443 -> 192.168.2.3:49741 version: TLS 1.2
Source: unknown HTTPS traffic detected: 151.101.1.44:443 -> 192.168.2.3:49744 version: TLS 1.2
Binary contains paths to debug symbols
Source: Binary string: c:\LawDivision\Sawsit\yearcolor\BloodRaise\Possible.pdb source: regsvr32.exe, 00000002.00000002.606557891.000000006E271000.00000002.00020000.sdmp, pan0ramic0.jpg.dll
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 2_2_02E0523C RtlAllocateHeap,RtlAllocateHeap,RtlAllocateHeap,memset,CreateFileA,GetFileTime,FindCloseChangeNotification,StrRChrA,lstrcat,FindFirstFileA,FindFirstFileA,CompareFileTime,CompareFileTime,FindClose,FindNextFileA,FindClose,FindFirstFileA,CompareFileTime,StrChrA,memcpy,FindNextFileA,FindClose,FindFirstFileA,CompareFileTime,FindClose,HeapFree,HeapFree, 2_2_02E0523C

Networking:

barindex
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 151.101.1.44 151.101.1.44
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: 9e10692f1b7f78228b2d4e424db3a98c
Source: global traffic HTTP traffic detected: GET /images/kVEpvusUliP22lb4Rk/d17iizKsx/VYoeVRB64FpgrYeurIWv/f_2FrjqocbrZFkeJAAU/ZoluLt_2FQc9thneSLw55s/rwD_2B7CC3E4m/h1h_2BYD/_2BOIFG4qmOWI2_2BZz8VRe/v0IC7ic1ri/fa6P17gcmqONonsX_/2FtCrClp9vts/iYUQT4nflFM/pDsA_2BimLN1V1/YiWwAdx5I/qkR.avi HTTP/1.1Accept: text/html, application/xhtml+xml, image/jxr, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: ocsp.sca1b.amazontrust.comConnection: Keep-Alive
Source: de-ch[1].htm.5.dr String found in binary or memory: <a href="https://www.facebook.com/" target="_blank" data-piitxt="facebooklite" piiurl="https://www.facebook.com/"> equals www.facebook.com (Facebook)
Source: msapplication.xml0.4.dr String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.facebook.com/"/><date>0xeba233ab,0x01d6f0f7</date><accdate>0xeba233ab,0x01d6f0f7</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig> equals www.facebook.com (Facebook)
Source: msapplication.xml0.4.dr String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.facebook.com/"/><date>0xeba233ab,0x01d6f0f7</date><accdate>0xeba233ab,0x01d6f0f7</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Facebook.url"/></tile></msapplication></browserconfig> equals www.facebook.com (Facebook)
Source: msapplication.xml5.4.dr String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.twitter.com/"/><date>0xeba49602,0x01d6f0f7</date><accdate>0xeba49602,0x01d6f0f7</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig> equals www.twitter.com (Twitter)
Source: msapplication.xml5.4.dr String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.twitter.com/"/><date>0xeba49602,0x01d6f0f7</date><accdate>0xeba49602,0x01d6f0f7</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Twitter.url"/></tile></msapplication></browserconfig> equals www.twitter.com (Twitter)
Source: msapplication.xml7.4.dr String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.youtube.com/"/><date>0xeba6f84f,0x01d6f0f7</date><accdate>0xeba6f84f,0x01d6f0f7</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig> equals www.youtube.com (Youtube)
Source: msapplication.xml7.4.dr String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.youtube.com/"/><date>0xeba6f84f,0x01d6f0f7</date><accdate>0xeba6f84f,0x01d6f0f7</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Youtube.url"/></tile></msapplication></browserconfig> equals www.youtube.com (Youtube)
Source: de-ch[1].htm.5.dr String found in binary or memory: <link rel="preconnect" href="img-s-msn-com.akamaized.net" /><link rel="preconnect" href="c.msn.com" /><link rel="preconnect" href="c.msn.cn" /><link rel="preconnect" href="https://www.bing.com" /><link rel="preconnect" href="//web.vortex.data.msn.com" /><link rel="dns-prefetch" href="img-s-msn-com.akamaized.net" /><link rel="dns-prefetch" href="c.msn.com" /><link rel="dns-prefetch" href="c.msn.cn" /><link rel="dns-prefetch" href="https://www.bing.com" /><link rel="dns-prefetch" href="//web.vortex.data.msn.com" /><link rel="canonical" href="https://www.msn.com/de-ch/" /><meta name="msapplication-TileColor" content="#224f7b"/><meta name="msapplication-TileImage" content="//static-global-s-msn-com.akamaized.net/hp-neu/sc/1f/08ced4.png"/><meta name="msapplication-config" content="none"/> <title>MSN Schweiz | Sign in Hotmail, Outlook Login, Windows Live, Office 365</title> equals www.hotmail.com (Hotmail)
Source: 85-0f8009-68ddb2ab[1].js.5.dr String found in binary or memory: glich.",errorFooterText:"Zu Twitter wechseln",taskLinks:"Benachrichtigungen|https://twitter.com/i/notifications;Ich|#;Abmelden|#"}],xbox:[{header:"Spotlight",content:"",footerText:"Alle anzeigen",footerUrl:"",taskLinks:"me_groove_taskLinks_store|https://www.microsoft.com/store/media/redirect/music?view=hub;me_groove_taskLinks_play|https://aka.ms/Ixhi8e;me_groove_taskLinks_try|https://aka.ms/msvmj1"},{header:"Meine tolle Wiedergabeliste",headerUrl:"https://aka.ms/qeqf5y",content:"",errorMessage:"",taskLinks:"me_groove_taskLinks_store|https://www.microsoft.com/store/media/redirect/music?view=hub;me_groove_taskLinks_play|https://aka.ms/Ixhi8e;me_groove_taskLinks_try|https://aka.ms/msvmj1"}],bingrewards:[{header:"Pr equals www.twitter.com (Twitter)
Source: de-ch[1].htm.5.dr String found in binary or memory: hren, die sich auf Ihren Internetdatenverkehr auswirken.<br/><br/><a href=\""+e.html(f)+'" onclick="window.location.reload(true)">Klicken Sie hier<\/a> um diese Seite erneut zu laden, oder besuchen Sie: <a href="'+i+'">'+i+"<\/a><\/p><\/div><div id='errorref'><span>Ref 1: "+e.html(o(t.clientSettings.aid))+"&nbsp;&nbsp;&nbsp;Ref 2: "+e.html(t.clientSettings.sid||"000000")+"&nbsp;&nbsp;&nbsp;Ref 3: "+e.html((new r.Date).toUTCString())+"<\/span><\/div><\/div>"});ot({errId:1512,errMsg:n})}function ot(n){require(["track"],function(t){var i={errId:n.errId,errMsg:n.errMsg,reportingType:0};t.trackAppErrorEvent(i)})}function tt(){var n=v(arguments);a(l(n,b),n,!0)}function st(){var n=v(arguments);a(l(n,h),n)}function ht(){var n=v(arguments);a(l(n,y),n)}function ct(n){(r.console||{}).timeStamp?console.timeStamp(n):(r.performance||{}).mark&&r.performance.mark(n)}var w=0,it=-1,b=0,h=1,y=2,s=[],p,k,rt,o,d=!1,c=Math.random()*100<=-1;return ut(r,function(n,t,i,r){return w++,n=nt(n,t,i,r," [ENDMESSAGE]"),n&&tt("[SCRIPTERROR] "+n),!0}),c&&require(["jquery","c.deferred"],function(n){k=!0;rt=n;s.length&&g()}),{error:tt,fatalError:et,unhandledErrorCount:function(){return w},perfMark:ct,warning:st,information:ht}});require(["viewAwareInit"],function(n){n({size2row:"(min-height: 48.75em)",size1row:"(max-height: 48.74em)",size4column:"(min-width: 72em)",size3column:"(min-width: 52.313em) and (max-width: 71.99em)",size2column:"(min-width: 43.75em) and (max-width: 52.303em)",size2rowsize4column:"(min-width: 72em) and (min-height: 48.75em)",size2rowsize3column:"(min-width: 52.313em) and (max-width: 71.99em) and (min-height: 48.75em)",size2rowsize2column:"(max-width: 52.303em) and (min-height: 48.75em)",size1rowsize4column:"(min-width: 72em) and (max-height: 48.74em)",size1rowsize3column:"(min-width: 52.313em) and (max-width: 71.99em) and (max-height: 48.74em)",size1rowsize2column:"(max-width: 52.303em) and (max-height: 48.74em)"})});require(["deviceInit"],function(n){n({AllowTransform3d:"false",AllowTransform2d:"true",RtlScrollLeftAdjustment:"none",ShowMoveTouchGestures:"true",SupportFixedPosition:"true",UseCustomMatchMedia:null,Viewport_Behavior:"Default",Viewport_Landscape:null,Viewport:"width=device-width,initial-scale=1.0",IsMobileDevice:"false"})})</script><meta property="sharing_url" content="https://www.msn.com/de-ch"/><meta property="og:url" content="https://www.msn.com/de-ch/"/><meta property="og:title" content="MSN Schweiz | Sign in Hotmail, Outlook Login, Windows Live, Office 365"/><meta property="twitter:card" content="summary_large_image"/><meta property="og:type" content="website"/><meta property="og:site_name" content="MSN"/><meta property="og:image" content="https://static-global-s-msn-com.akamaized.net/hp-neu/sc/c6/519670.jpg"/><link rel="shortcut icon" href="//static-global-s-msn-com.akamaized.net/hp-neu/sc/2b/a5ea21.ico" /><style>@media screen and (max-width:78.99em) and (min-width:58.875em){.layout-none:not(.mod1) .pos2{left:0}}.ie8 .grid .pick4~li.pick
Source: 85-0f8009-68ddb2ab[1].js.5.dr String found in binary or memory: pfen Sie Ihr Skype-Konto und Ihr Microsoft-Konto.",continueButtonText:"Weiter",learnMoreText:"Hilfe",learnMoreUrl:"https://support.skype.com",callMessageText:"Anruf",fileMessageText:"Datei gesendet",videoMessageText:"Videonachricht",contactMessageText:"Kontakt gesendet"}],jsskype:[{},{}],facebookLite:[{},{likeUrl:"https://www.facebook.com/msnch"}],twitter:[{header:"Twitter",content:"Rufen Sie Ihre Twitter-Updates ab",footerText:"Anmelden",footerUrl:"https://twitter.com",requestTimeout:"10000",taskLinks:""},{header:"Tweets",headerUrl:"https://twitter.com",content:"Laden ...",noContent:"Ihre Timeline ist derzeit leer",errorMessage:"Anmelden bei Twitter nicht m equals www.facebook.com (Facebook)
Source: 85-0f8009-68ddb2ab[1].js.5.dr String found in binary or memory: pfen Sie Ihr Skype-Konto und Ihr Microsoft-Konto.",continueButtonText:"Weiter",learnMoreText:"Hilfe",learnMoreUrl:"https://support.skype.com",callMessageText:"Anruf",fileMessageText:"Datei gesendet",videoMessageText:"Videonachricht",contactMessageText:"Kontakt gesendet"}],jsskype:[{},{}],facebookLite:[{},{likeUrl:"https://www.facebook.com/msnch"}],twitter:[{header:"Twitter",content:"Rufen Sie Ihre Twitter-Updates ab",footerText:"Anmelden",footerUrl:"https://twitter.com",requestTimeout:"10000",taskLinks:""},{header:"Tweets",headerUrl:"https://twitter.com",content:"Laden ...",noContent:"Ihre Timeline ist derzeit leer",errorMessage:"Anmelden bei Twitter nicht m equals www.twitter.com (Twitter)
Source: 85-0f8009-68ddb2ab[1].js.5.dr String found in binary or memory: ter erneut.",viewInboxErrorMessage:"Wenn beim Anzeigen Ihres Posteingangs weiterhin ein Problem auftritt, besuchen Sie",taskLinks:"Verfassen|https://outlook.live.com/mail/deeplink/compose;Kalender|https://outlook.live.com/calendar",piiText:"Read Outlook Email",piiUrl:"http://www.hotmail.msn.com/pii/ReadOutlookEmail/"}],office:[{header:"Office",content:"Zeigen Sie Ihre zuletzt verwendeten Dokumente an oder erstellen Sie kostenlos mit Office Online ein neues.",footerText:"Anmelden",footerUrl:"[[signin]]",ssoAutoRefresh:!0,taskLinks:"Word Online|https://office.live.com/start/Word.aspx?WT.mc_id=MSN_site;Excel Online|https://office.live.com/start/Excel.aspx?WT.mc_id=MSN_site;Sway|https://www.sway.com/?WT.mc_id=MSN_site&utm_source=MSN&utm_medium=Topnav&utm_campaign=link;PowerPoint Online|https://office.live.com/start/PowerPoint.aspx?WT.mc_id=MSN_site"},{header:"Aktuelle Dokumente",headerUrl:"https://onedrive.live.com/#qt=mru",content:"Wird geladen ...",noContent:"Dieser Ordner ist leer. Klicken Sie unten, um ein neues Dokument zu erstellen.",errorMessage:"Keine Verbindung mit Office Online m equals www.hotmail.com (Hotmail)
Source: unknown DNS traffic detected: queries for: www.msn.com
Source: de-ch[1].htm.5.dr String found in binary or memory: http://ogp.me/ns#
Source: de-ch[1].htm.5.dr String found in binary or memory: http://ogp.me/ns/fb#
Source: auction[1].htm.5.dr String found in binary or memory: http://popup.taboola.com/german
Source: {150E5F03-5CEB-11EB-90E4-ECF4BB862DED}.dat.4.dr String found in binary or memory: http://searchads.msn.net/.cfm?&&kp=1&
Source: msapplication.xml.4.dr String found in binary or memory: http://www.amazon.com/
Source: msapplication.xml1.4.dr String found in binary or memory: http://www.google.com/
Source: 85-0f8009-68ddb2ab[1].js.5.dr String found in binary or memory: http://www.hotmail.msn.com/pii/ReadOutlookEmail/
Source: msapplication.xml2.4.dr String found in binary or memory: http://www.live.com/
Source: msapplication.xml3.4.dr String found in binary or memory: http://www.nytimes.com/
Source: msapplication.xml4.4.dr String found in binary or memory: http://www.reddit.com/
Source: msapplication.xml5.4.dr String found in binary or memory: http://www.twitter.com/
Source: msapplication.xml6.4.dr String found in binary or memory: http://www.wikipedia.com/
Source: msapplication.xml7.4.dr String found in binary or memory: http://www.youtube.com/
Source: de-ch[1].htm.5.dr String found in binary or memory: https://amzn.to/2TTxhNg
Source: auction[1].htm.5.dr String found in binary or memory: https://api.taboola.com/2.0/json/msn-ch-de-home/recommendations.notify-click?app.type=desktop&amp;ap
Source: iab2Data[1].json.5.dr String found in binary or memory: https://bealion.com/politica-de-cookies
Source: 55a804ab-e5c6-4b97-9319-86263d365d28[1].json.5.dr String found in binary or memory: https://cdn.cookielaw.org/vendorlist/googleData.json
Source: 55a804ab-e5c6-4b97-9319-86263d365d28[1].json.5.dr String found in binary or memory: https://cdn.cookielaw.org/vendorlist/iab2Data.json
Source: 55a804ab-e5c6-4b97-9319-86263d365d28[1].json.5.dr String found in binary or memory: https://cdn.cookielaw.org/vendorlist/iabData.json
Source: iab2Data[1].json.5.dr String found in binary or memory: https://channelpilot.co.uk/privacy-policy
Source: de-ch[1].htm.5.dr String found in binary or memory: https://click.linksynergy.com/deeplink?id=xoqYgl4JDe8&amp;mid=46130&amp;u1=dech_mestripe_office&amp;
Source: de-ch[1].htm.5.dr String found in binary or memory: https://click.linksynergy.com/deeplink?id=xoqYgl4JDe8&amp;mid=46130&amp;u1=dech_mestripe_store&amp;m
Source: 85-0f8009-68ddb2ab[1].js.5.dr String found in binary or memory: https://client-s.gateway.messenger.live.com
Source: de-ch[1].htm.5.dr String found in binary or memory: https://clk.tradedoubler.com/click?p=245744&amp;a=3064090&amp;g=21863656
Source: de-ch[1].htm.5.dr String found in binary or memory: https://clkde.tradedoubler.com/click?p=245744&amp;a=3064090&amp;g=24903118&amp;epi=ch-de
Source: {150E5F03-5CEB-11EB-90E4-ECF4BB862DED}.dat.4.dr String found in binary or memory: https://contextual.media.net/checksync.php?&vsSync=1&cs=1&hb=1&cv=37&ndec=1&cid=8HBI57XIG&prvid=77%2
Source: de-ch[1].htm.5.dr String found in binary or memory: https://contextual.media.net/medianet.php?cid=8CU157172
Source: de-ch[1].htm.5.dr String found in binary or memory: https://contextual.media.net/medianet.php?cid=8CU157172&amp;crid=722878611&amp;size=306x271&amp;http
Source: de-ch[1].htm.5.dr String found in binary or memory: https://contextual.media.net/medianet.php?cid=8CU157172&amp;crid=858412214&amp;size=306x271&amp;http
Source: {150E5F03-5CEB-11EB-90E4-ECF4BB862DED}.dat.4.dr String found in binary or memory: https://contextual.media.net/medianet.php?cid=8CU157172&crid=722878611&size=306x271&https=1
Source: {150E5F03-5CEB-11EB-90E4-ECF4BB862DED}.dat.4.dr String found in binary or memory: https://contextual.media.net/medianet.php?cid=8CU157172&crid=858412214&size=306x271&https=1
Source: iab2Data[1].json.5.dr String found in binary or memory: https://docs.prebid.org/privacy.html
Source: 55a804ab-e5c6-4b97-9319-86263d365d28[1].json.5.dr String found in binary or memory: https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location
Source: auction[1].htm.5.dr String found in binary or memory: https://img.img-taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ce_sharpen%2Ch_311%2Cw_207%2Cc_fill%
Source: auction[1].htm.5.dr String found in binary or memory: https://img.img-taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_311%2Cw_207%2Cc_fill%2Cg_faces:au
Source: de-ch[1].htm.5.dr String found in binary or memory: https://itunes.apple.com/ch/app/microsoft-news/id945416273?pt=80423&amp;ct=prime_footer&amp;mt=8
Source: de-ch[1].htm.5.dr String found in binary or memory: https://linkmaker.itunes.apple.com/assets/shared/badges/de-de/appstore-lrg.svg&quot;
Source: iab2Data[1].json.5.dr String found in binary or memory: https://listonic.com/privacy/
Source: de-ch[1].htm.5.dr String found in binary or memory: https://login.live.com/login.srf?wa=wsignin1.0&amp;rpsnv=13&amp;checkda=1&amp;ct=1611312633&amp;rver
Source: de-ch[1].htm.5.dr String found in binary or memory: https://login.live.com/login.srf?wa=wsignin1.0&amp;rpsnv=13&amp;ct=1611312633&amp;rver=7.0.6730.0&am
Source: de-ch[1].htm.5.dr String found in binary or memory: https://login.live.com/logout.srf?ct=1611312634&amp;rver=7.0.6730.0&amp;lc=1033&amp;id=1184&amp;lru=
Source: de-ch[1].htm.5.dr String found in binary or memory: https://login.live.com/me.srf?wa=wsignin1.0&amp;rpsnv=13&amp;ct=1611312633&amp;rver=7.0.6730.0&amp;w
Source: 85-0f8009-68ddb2ab[1].js.5.dr String found in binary or memory: https://login.skype.com/login/oauth/microsoft?client_id=738133
Source: de-ch[1].htm.5.dr String found in binary or memory: https://mem.gfx.ms/meversion/?partner=msn&amp;market=de-ch&quot;
Source: 85-0f8009-68ddb2ab[1].js.5.dr String found in binary or memory: https://office.live.com/start/Excel.aspx?WT.mc_id=MSN_site;Sway
Source: 85-0f8009-68ddb2ab[1].js.5.dr String found in binary or memory: https://office.live.com/start/PowerPoint.aspx?WT.mc_id=MSN_site
Source: 85-0f8009-68ddb2ab[1].js.5.dr String found in binary or memory: https://office.live.com/start/Word.aspx?WT.mc_id=MSN_site;Excel
Source: 85-0f8009-68ddb2ab[1].js.5.dr String found in binary or memory: https://onedrive.live.com/#qt=mru
Source: 85-0f8009-68ddb2ab[1].js.5.dr String found in binary or memory: https://onedrive.live.com/?qt=allmyphotos;Aktuelle
Source: 85-0f8009-68ddb2ab[1].js.5.dr String found in binary or memory: https://onedrive.live.com/?qt=mru;Aktuelle
Source: 85-0f8009-68ddb2ab[1].js.5.dr String found in binary or memory: https://onedrive.live.com/?qt=mru;OneDrive-App
Source: de-ch[1].htm.5.dr String found in binary or memory: https://onedrive.live.com/?wt.mc_id=oo_msn_msnhomepage_header
Source: 85-0f8009-68ddb2ab[1].js.5.dr String found in binary or memory: https://onedrive.live.com/about/en/download/
Source: 85-0f8009-68ddb2ab[1].js.5.dr String found in binary or memory: https://onedrive.live.com;Fotos
Source: 85-0f8009-68ddb2ab[1].js.5.dr String found in binary or memory: https://onedrive.live.com;OneDrive-App
Source: 85-0f8009-68ddb2ab[1].js.5.dr String found in binary or memory: https://onedrive.live.com?wt.mc_id=oo_msn_msnhomepage_header
Source: de-ch[1].htm.5.dr String found in binary or memory: https://outlook.com/
Source: 85-0f8009-68ddb2ab[1].js.5.dr String found in binary or memory: https://outlook.live.com/calendar
Source: 85-0f8009-68ddb2ab[1].js.5.dr String found in binary or memory: https://outlook.live.com/mail/deeplink/compose;Kalender
Source: de-ch[1].htm.5.dr String found in binary or memory: https://play.google.com/intl/en_us/badges/images/generic/de_badge_web_generic.png&quot;
Source: de-ch[1].htm.5.dr String found in binary or memory: https://play.google.com/store/apps/details?id=com.microsoft.amp.apps.bingnews&amp;hl=de-ch&amp;refer
Source: iab2Data[1].json.5.dr String found in binary or memory: https://portal.eu.numbereight.me/policies-license#software-privacy-notice
Source: iab2Data[1].json.5.dr String found in binary or memory: https://quantyoo.de/datenschutz
Source: iab2Data[1].json.5.dr String found in binary or memory: https://related.hu/adatkezeles/
Source: {150E5F03-5CEB-11EB-90E4-ECF4BB862DED}.dat.4.dr String found in binary or memory: https://res-a.akamaihd.net/__media__/pics/8000/72/941/fallback1.jpg
Source: de-ch[1].htm.5.dr String found in binary or memory: https://rover.ebay.com/rover/1/5222-53480-19255-0/1?mpre=https%3A%2F%2Fwww.ebay.ch&amp;campid=533862
Source: de-ch[1].htm.5.dr String found in binary or memory: https://sp.booking.com/index.html?aid=1589774&amp;label=dech-prime-hp-me
Source: de-ch[1].htm.5.dr String found in binary or memory: https://sp.booking.com/index.html?aid=1589774&amp;label=dech-prime-hp-shoppingstripe-nav
Source: de-ch[1].htm.5.dr String found in binary or memory: https://sp.booking.com/index.html?aid=1589774&amp;label=travelnavlink
Source: de-ch[1].htm.5.dr String found in binary or memory: https://static-global-s-msn-com.akamaized.net/de-ch/homepage/api/modules/cdnfetch&quot;
Source: imagestore.dat.4.dr String found in binary or memory: https://static-global-s-msn-com.akamaized.net/hp-neu/sc/2b/a5ea21.ico
Source: de-ch[1].htm.5.dr String found in binary or memory: https://static-global-s-msn-com.akamaized.net/hp-neu/sc/c6/519670.jpg
Source: de-ch[1].htm.5.dr String found in binary or memory: https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB12jAN6.img?h=27&amp;
Source: de-ch[1].htm.5.dr String found in binary or memory: https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB1cEP3G.img?h=27&amp;
Source: de-ch[1].htm.5.dr String found in binary or memory: https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB1cG73h.img?h=27&amp;
Source: de-ch[1].htm.5.dr String found in binary or memory: https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB1cZb1L.img?h=368&amp
Source: de-ch[1].htm.5.dr String found in binary or memory: https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BBPfCZL.img?h=27&amp;w
Source: de-ch[1].htm.5.dr String found in binary or memory: https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BBX2afX.img?h=27&amp;w
Source: 85-0f8009-68ddb2ab[1].js.5.dr String found in binary or memory: https://support.skype.com
Source: de-ch[1].htm.5.dr String found in binary or memory: https://twitter.com/
Source: 85-0f8009-68ddb2ab[1].js.5.dr String found in binary or memory: https://twitter.com/i/notifications;Ich
Source: de-ch[1].htm.5.dr String found in binary or memory: https://web.vortex.data.msn.com/collect/v1/t.gif?name=%27Ms.Webi.PageView%27&amp;ver=%272.1%27&amp;a
Source: iab2Data[1].json.5.dr String found in binary or memory: https://www.admo.tv/en/privacy-policy
Source: de-ch[1].htm.5.dr String found in binary or memory: https://www.awin1.com/cread.php?awinmid=11518&amp;awinaffid=696593&amp;clickref=dech-edge-dhp-infopa
Source: de-ch[1].htm.5.dr String found in binary or memory: https://www.awin1.com/cread.php?awinmid=15168&amp;awinaffid=696593&amp;clickref=de-ch-edge-dhp-river
Source: de-ch[1].htm.5.dr String found in binary or memory: https://www.awin1.com/cread.php?awinmid=15168&amp;awinaffid=696593&amp;clickref=de-ch-ss&amp;ued=htt
Source: iab2Data[1].json.5.dr String found in binary or memory: https://www.bet365affiliates.com/UI/Pages/Affiliates/Affiliates.aspx?ContentPath
Source: iab2Data[1].json.5.dr String found in binary or memory: https://www.bidstack.com/privacy-policy/
Source: iab2Data[1].json.5.dr String found in binary or memory: https://www.brightcom.com/privacy-policy/
Source: iab2Data[1].json.5.dr String found in binary or memory: https://www.gadsme.com/privacy-policy/
Source: de-ch[1].htm.5.dr String found in binary or memory: https://www.msn.com/de-ch
Source: de-ch[1].htm.5.dr String found in binary or memory: https://www.msn.com/de-ch/
Source: {150E5F03-5CEB-11EB-90E4-ECF4BB862DED}.dat.4.dr String found in binary or memory: https://www.msn.com/de-ch/?ocid=iehp
Source: de-ch[1].htm.5.dr String found in binary or memory: https://www.msn.com/de-ch/?ocid=iehp&amp;item=deferred_page%3a1&amp;ignorejs=webcore%2fmodules%2fjsb
Source: de-ch[1].htm.5.dr String found in binary or memory: https://www.msn.com/de-ch/homepage/api/modules/fetch&quot;
Source: de-ch[1].htm.5.dr String found in binary or memory: https://www.msn.com/de-ch/homepage/api/pdp/updatepdpdata&quot;
Source: de-ch[1].htm.5.dr String found in binary or memory: https://www.msn.com/de-ch/nachrichten/coronareisen
Source: de-ch[1].htm.5.dr String found in binary or memory: https://www.msn.com/de-ch/nachrichten/regional
Source: de-ch[1].htm.5.dr String found in binary or memory: https://www.msn.com/de-ch/news/other/auto-der-milit%c3%a4rpolizei-kollidiert-mit-tram/ar-BB1cZe9U?oc
Source: de-ch[1].htm.5.dr String found in binary or memory: https://www.msn.com/de-ch/news/other/bau-des-neuen-calatrava-geb%c3%a4udes-startet-im-fr%c3%bchling/
Source: de-ch[1].htm.5.dr String found in binary or memory: https://www.msn.com/de-ch/news/other/die-stadt-z%c3%bcrich-schnappt-sich-einen-begehrten-kita-stando
Source: de-ch[1].htm.5.dr String found in binary or memory: https://www.msn.com/de-ch/news/other/ich-habe-mehrere-kritische-man%c3%b6ver-mit-autofahrern-erlebt/
Source: de-ch[1].htm.5.dr String found in binary or memory: https://www.msn.com/de-ch/news/other/j%c3%bcdische-gemeinden-in-z%c3%bcrich-erhalten-700-000-franken
Source: de-ch[1].htm.5.dr String found in binary or memory: https://www.msn.com/de-ch/news/other/kommentar-es-braucht-keine-staatlichen-kitas-in-der-stadt-z%c3%
Source: de-ch[1].htm.5.dr String found in binary or memory: https://www.msn.com/de-ch/news/other/mehr-geld-f%c3%bcr-die-sicherheit-j%c3%bcdischer-organisationen
Source: de-ch[1].htm.5.dr String found in binary or memory: https://www.msn.com/de-ch/news/other/nach-razzia-gegen-mutmassliche-neonazis-rechtsextreme-junge-tat
Source: de-ch[1].htm.5.dr String found in binary or memory: https://www.msn.com/de-ch/news/other/twitter-sperrt-accounts-von-svp-kantonsrat-claudio-schmid/ar-BB
Source: de-ch[1].htm.5.dr String found in binary or memory: https://www.msn.com/de-ch/news/other/wir-sind-froh-dass-filou-den-angriff-%c3%bcberlebt-hat/ar-BB1cZ
Source: de-ch[1].htm.5.dr String found in binary or memory: https://www.msn.com?form=MY01O4&OCID=MY01O4
Source: 85-0f8009-68ddb2ab[1].js.5.dr String found in binary or memory: https://www.onenote.com/notebooks?WT.mc_id=MSN_OneNote_QuickNote&auth=1
Source: 85-0f8009-68ddb2ab[1].js.5.dr String found in binary or memory: https://www.onenote.com/notebooks?WT.mc_id=MSN_OneNote_Recent&auth=1&wdorigin=msn
Source: de-ch[1].htm.5.dr String found in binary or memory: https://www.onenote.com/notebooks?WT.mc_id=MSN_OneNote_TopMenu&amp;auth=1&amp;wdorigin=msn
Source: iab2Data[1].json.5.dr String found in binary or memory: https://www.remixd.com/privacy_policy.html
Source: de-ch[1].htm.5.dr String found in binary or memory: https://www.ricardo.ch/?utm_source=msn&amp;utm_medium=affiliate&amp;utm_campaign=msn_mestripe_logo_d
Source: de-ch[1].htm.5.dr String found in binary or memory: https://www.ricardo.ch/?utm_source=msn&amp;utm_medium=affiliate&amp;utm_campaign=msn_shop_de&amp;utm
Source: de-ch[1].htm.5.dr String found in binary or memory: https://www.skype.com/
Source: 85-0f8009-68ddb2ab[1].js.5.dr String found in binary or memory: https://www.skype.com/de
Source: 85-0f8009-68ddb2ab[1].js.5.dr String found in binary or memory: https://www.skype.com/de/download-skype
Source: 85-0f8009-68ddb2ab[1].js.5.dr String found in binary or memory: https://www.skype.com/go/onedrivepromo.download?cm_mmc=MSFT_2390_MSN-com
Source: de-ch[1].htm.5.dr String found in binary or memory: https://www.skyscanner.net/flights?associateid=API_B2B_19305_00001&amp;vertical=custom&amp;pageType=
Source: de-ch[1].htm.5.dr String found in binary or memory: https://www.skyscanner.net/g/referrals/v1/cars/home?associateid=API_B2B_19305_00002
Source: iab2Data[1].json.5.dr String found in binary or memory: https://www.stroeer.de/fileadmin/de/Konvergenz_und_Konzepte/Daten_und_Technologien/Stroeer_SSP/Downl
Source: 85-0f8009-68ddb2ab[1].js.5.dr String found in binary or memory: https://www.sway.com/?WT.mc_id=MSN_site&utm_source=MSN&utm_medium=Topnav&utm_campaign=link;PowerPoin
Source: iab2Data[1].json.5.dr String found in binary or memory: https://www.vidstart.com/wp-content/uploads/2018/09/PrivacyPolicyPDF-Vidstart.pdf
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown HTTPS traffic detected: 151.101.1.44:443 -> 192.168.2.3:49742 version: TLS 1.2
Source: unknown HTTPS traffic detected: 151.101.1.44:443 -> 192.168.2.3:49746 version: TLS 1.2
Source: unknown HTTPS traffic detected: 151.101.1.44:443 -> 192.168.2.3:49745 version: TLS 1.2
Source: unknown HTTPS traffic detected: 151.101.1.44:443 -> 192.168.2.3:49743 version: TLS 1.2
Source: unknown HTTPS traffic detected: 151.101.1.44:443 -> 192.168.2.3:49741 version: TLS 1.2
Source: unknown HTTPS traffic detected: 151.101.1.44:443 -> 192.168.2.3:49744 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing:

barindex
Yara detected Ursnif
Source: Yara match File source: 00000002.00000003.361949894.00000000056E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000003.361918322.00000000056E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000003.362192746.00000000056E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000003.361993159.00000000056E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.604203700.00000000056E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000003.362284238.00000000056E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000003.362267266.00000000056E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000003.362050121.00000000056E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000003.362111808.00000000056E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: regsvr32.exe PID: 5656, type: MEMORY

E-Banking Fraud:

barindex
Yara detected Ursnif
Source: Yara match File source: 00000002.00000003.361949894.00000000056E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000003.361918322.00000000056E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000003.362192746.00000000056E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000003.361993159.00000000056E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.604203700.00000000056E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000003.362284238.00000000056E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000003.362267266.00000000056E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000003.362050121.00000000056E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000003.362111808.00000000056E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: regsvr32.exe PID: 5656, type: MEMORY

System Summary:

barindex
Writes or reads registry keys via WMI
Source: C:\Windows\SysWOW64\regsvr32.exe WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetStringValue
Source: C:\Windows\SysWOW64\regsvr32.exe WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::SetDWORDValue
Source: C:\Windows\SysWOW64\regsvr32.exe WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue
Source: C:\Windows\SysWOW64\regsvr32.exe WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::SetStringValue
Writes registry values via WMI
Source: C:\Windows\SysWOW64\regsvr32.exe WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetDWORDValue
Source: C:\Windows\SysWOW64\regsvr32.exe WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue
Source: C:\Windows\SysWOW64\regsvr32.exe WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetStringValue
Contains functionality to call native functions
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 2_2_6E221812 NtMapViewOfSection, 2_2_6E221812
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 2_2_6E221DD0 GetProcAddress,NtCreateSection,memset, 2_2_6E221DD0
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 2_2_6E2222E5 NtQueryVirtualMemory, 2_2_6E2222E5
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 2_2_02E09932 NtOpenProcess,NtOpenProcessToken,NtQueryInformationToken,NtQueryInformationToken,NtQueryInformationToken,memcpy,NtClose,NtClose, 2_2_02E09932
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 2_2_02E0B2C1 NtQueryVirtualMemory, 2_2_02E0B2C1
Detected potential crypto function
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 2_2_6E2220C4 2_2_6E2220C4
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 2_2_02E0B09C 2_2_02E0B09C
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 2_2_02E0EC41 2_2_02E0EC41
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 2_2_02E0EC48 2_2_02E0EC48
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 2_2_02E099FC 2_2_02E099FC
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 2_2_6E26E71F 2_2_6E26E71F
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 2_2_6E235FB1 2_2_6E235FB1
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 2_2_6E236791 2_2_6E236791
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 2_2_6E26EC63 2_2_6E26EC63
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 2_2_6E236CC2 2_2_6E236CC2
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 2_2_6E235ADC 2_2_6E235ADC
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 2_2_6E236385 2_2_6E236385
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 2_2_6E2700BC 2_2_6E2700BC
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 2_2_6E26E1DB 2_2_6E26E1DB
Tries to load missing DLLs
Source: C:\Windows\SysWOW64\regsvr32.exe Section loaded: sfc.dll Jump to behavior
Uses 32bit PE files
Source: pan0ramic0.jpg.dll Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL
Source: pan0ramic0.jpg.dll Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: classification engine Classification label: mal64.troj.winDLL@13/127@9/3
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 2_2_02E0244A CreateToolhelp32Snapshot,Process32First,Process32Next,CloseHandle, 2_2_02E0244A
Source: C:\Program Files\internet explorer\iexplore.exe File created: C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe File created: C:\Users\user\AppData\Local\Temp\~DF8682B98511D3EB4D.TMP Jump to behavior
Source: pan0ramic0.jpg.dll Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: C:\Program Files\internet explorer\iexplore.exe File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Windows\System32\loaddll32.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: unknown Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe 'C:\Users\user\Desktop\pan0ramic0.jpg.dll'
Source: unknown Process created: C:\Windows\SysWOW64\regsvr32.exe regsvr32.exe /s C:\Users\user\Desktop\pan0ramic0.jpg.dll
Source: unknown Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c 'C:\Program Files\Internet Explorer\iexplore.exe'
Source: unknown Process created: C:\Program Files\internet explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe
Source: unknown Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5560 CREDAT:17410 /prefetch:2
Source: unknown Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5560 CREDAT:82960 /prefetch:2
Source: unknown Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5560 CREDAT:17426 /prefetch:2
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\regsvr32.exe regsvr32.exe /s C:\Users\user\Desktop\pan0ramic0.jpg.dll Jump to behavior
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c 'C:\Program Files\Internet Explorer\iexplore.exe' Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Program Files\internet explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5560 CREDAT:17410 /prefetch:2 Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5560 CREDAT:82960 /prefetch:2 Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5560 CREDAT:17426 /prefetch:2 Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32 Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll Jump to behavior
Source: pan0ramic0.jpg.dll Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: pan0ramic0.jpg.dll Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: pan0ramic0.jpg.dll Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: pan0ramic0.jpg.dll Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: pan0ramic0.jpg.dll Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: pan0ramic0.jpg.dll Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
Source: pan0ramic0.jpg.dll Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: c:\LawDivision\Sawsit\yearcolor\BloodRaise\Possible.pdb source: regsvr32.exe, 00000002.00000002.606557891.000000006E271000.00000002.00020000.sdmp, pan0ramic0.jpg.dll
Source: pan0ramic0.jpg.dll Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: pan0ramic0.jpg.dll Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: pan0ramic0.jpg.dll Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: pan0ramic0.jpg.dll Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: pan0ramic0.jpg.dll Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Data Obfuscation:

barindex
Registers a DLL
Source: unknown Process created: C:\Windows\SysWOW64\regsvr32.exe regsvr32.exe /s C:\Users\user\Desktop\pan0ramic0.jpg.dll
Uses code obfuscation techniques (call, push, ret)
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 2_2_6E222060 push ecx; ret 2_2_6E222069
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 2_2_6E2220B3 push ecx; ret 2_2_6E2220C3
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 2_2_02E0ACD0 push ecx; ret 2_2_02E0ACD9
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 2_2_02E0B08B push ecx; ret 2_2_02E0B09B
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 2_2_6E240519 push 898B89EBh; ret 2_2_6E24051E
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 2_2_6E23057D push ecx; ret 2_2_6E230590
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 2_2_6E241AC7 push esi; iretd 2_2_6E241AD6
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 2_2_6E23FB39 push ecx; retf 2_2_6E23FB4E
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 2_2_6E241B3E push esi; iretd 2_2_6E241AD6
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 2_2_6E27EE1F push ecx; retf 2_2_6E27EE09
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 2_2_6E27EDF2 push ecx; retf 2_2_6E27EE09
Source: initial sample Static PE information: section name: .text entropy: 6.9008177504

Hooking and other Techniques for Hiding and Protection:

barindex
Yara detected Ursnif
Source: Yara match File source: 00000002.00000003.361949894.00000000056E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000003.361918322.00000000056E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000003.362192746.00000000056E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000003.361993159.00000000056E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.604203700.00000000056E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000003.362284238.00000000056E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000003.362267266.00000000056E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000003.362050121.00000000056E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000003.362111808.00000000056E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: regsvr32.exe PID: 5656, type: MEMORY
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Source: C:\Windows\SysWOW64\regsvr32.exe Registry key monitored for changes: HKEY_CURRENT_USER_Classes Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion:

barindex
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 4604 Thread sleep count: 75 > 30 Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 476 Thread sleep count: 32 > 30 Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 476 Thread sleep count: 201 > 30 Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 476 Thread sleep time: -100500s >= -30000s Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\SysWOW64\regsvr32.exe Last function: Thread delayed
Source: C:\Windows\SysWOW64\regsvr32.exe Last function: Thread delayed
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 2_2_02E0523C RtlAllocateHeap,RtlAllocateHeap,RtlAllocateHeap,memset,CreateFileA,GetFileTime,FindCloseChangeNotification,StrRChrA,lstrcat,FindFirstFileA,FindFirstFileA,CompareFileTime,CompareFileTime,FindClose,FindNextFileA,FindClose,FindFirstFileA,CompareFileTime,StrChrA,memcpy,FindNextFileA,FindClose,FindFirstFileA,CompareFileTime,FindClose,HeapFree,HeapFree, 2_2_02E0523C

Anti Debugging:

barindex
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 2_2_6E22E53A IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 2_2_6E22E53A
Contains functionality to read the PEB
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 2_2_6E27D2A9 mov eax, dword ptr fs:[00000030h] 2_2_6E27D2A9
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 2_2_6E27CDE6 push dword ptr fs:[00000030h] 2_2_6E27CDE6
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 2_2_6E27D1DF mov eax, dword ptr fs:[00000030h] 2_2_6E27D1DF
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 2_2_6E22E53A IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 2_2_6E22E53A

HIPS / PFW / Operating System Protection Evasion:

barindex
Creates a process in suspended mode (likely to inject code)
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c 'C:\Program Files\Internet Explorer\iexplore.exe' Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Program Files\internet explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe Jump to behavior
Source: regsvr32.exe, 00000002.00000002.603874594.0000000003650000.00000002.00000001.sdmp Binary or memory string: Program Manager
Source: regsvr32.exe, 00000002.00000002.603874594.0000000003650000.00000002.00000001.sdmp Binary or memory string: Shell_TrayWnd
Source: regsvr32.exe, 00000002.00000002.603874594.0000000003650000.00000002.00000001.sdmp Binary or memory string: Progman
Source: regsvr32.exe, 00000002.00000002.603874594.0000000003650000.00000002.00000001.sdmp Binary or memory string: Progmanlock

Language, Device and Operating System Detection:

barindex
Contains functionality to query CPU information (cpuid)
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 2_2_02E05DC6 cpuid 2_2_02E05DC6
Contains functionality to query locales information (e.g. system language)
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: __crtGetLocaleInfoA_stat, 2_2_6E238E4A
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: GetLocaleInfoA, 2_2_6E23764E
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,_TestDefaultLanguage, 2_2_6E235787
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: __getptd,_LcidFromHexString,GetLocaleInfoA, 2_2_6E2354A9
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: GetLocaleInfoW, 2_2_6E238CD7
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: GetLastError,WideCharToMultiByte,GetLocaleInfoA, 2_2_6E238D0B
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: GetLocaleInfoA,_LcidFromHexString,_GetPrimaryLen, 2_2_6E235541
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: GetLocaleInfoA,GetLocaleInfoA,GetACP, 2_2_6E235392
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: _GetPrimaryLen,EnumSystemLocalesA, 2_2_6E235848
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: _GetPrimaryLen,EnumSystemLocalesA, 2_2_6E2358AF
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: __getptd,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,EnumSystemLocalesA,GetUserDefaultLCID,_ProcessCodePage,IsValidCodePage,IsValidLocale, 2_2_6E2358EB
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 2_2_6E221266 GetSystemTimeAsFileTime,_aulldiv,_snwprintf,CreateFileMappingW,GetLastError,GetLastError,MapViewOfFile,GetLastError,CloseHandle,GetLastError, 2_2_6E221266
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 2_2_02E05DC6 RtlAllocateHeap,GetUserNameW,RtlAllocateHeap,GetUserNameW,HeapFree,GetComputerNameW,GetComputerNameW,RtlAllocateHeap,GetComputerNameW,HeapFree, 2_2_02E05DC6
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 2_2_6E221799 CreateEventA,GetVersion,GetCurrentProcessId,OpenProcess,GetLastError, 2_2_6E221799

Stealing of Sensitive Information:

barindex
Yara detected Ursnif
Source: Yara match File source: 00000002.00000003.361949894.00000000056E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000003.361918322.00000000056E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000003.362192746.00000000056E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000003.361993159.00000000056E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.604203700.00000000056E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000003.362284238.00000000056E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000003.362267266.00000000056E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000003.362050121.00000000056E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000003.362111808.00000000056E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: regsvr32.exe PID: 5656, type: MEMORY

Remote Access Functionality:

barindex
Yara detected Ursnif
Source: Yara match File source: 00000002.00000003.361949894.00000000056E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000003.361918322.00000000056E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000003.362192746.00000000056E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000003.361993159.00000000056E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.604203700.00000000056E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000003.362284238.00000000056E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000003.362267266.00000000056E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000003.362050121.00000000056E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000003.362111808.00000000056E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: regsvr32.exe PID: 5656, type: MEMORY
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 343140 Sample: pan0ramic0.jpg.dll Startdate: 22/01/2021 Architecture: WINDOWS Score: 64 32 Found malware configuration 2->32 34 Yara detected  Ursnif 2->34 8 loaddll32.exe 1 2->8         started        process3 process4 10 regsvr32.exe 8->10         started        13 cmd.exe 1 8->13         started        signatures5 36 Writes or reads registry keys via WMI 10->36 38 Writes registry values via WMI 10->38 15 iexplore.exe 2 91 13->15         started        process6 process7 17 iexplore.exe 5 144 15->17         started        20 iexplore.exe 25 15->20         started        22 iexplore.exe 29 15->22         started        dnsIp8 24 tls13.taboola.map.fastly.net 151.101.1.44, 443, 49741, 49742 FASTLYUS United States 17->24 26 192.168.2.1 unknown unknown 17->26 30 8 other IPs or domains 17->30 28 ocsp.sca1b.amazontrust.com 143.204.214.141, 49768, 49769, 80 AMAZON-02US United States 20->28
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
143.204.214.141
 unknown United States
16509 AMAZON-02US false
151.101.1.44
 unknown United States
54113 FASTLYUS false

Private
IP
192.168.2.1

Contacted Domains

Name IP Active
contextual.media.net 104.76.200.23 true
tls13.taboola.map.fastly.net 151.101.1.44 true
ocsp.sca1b.amazontrust.com 143.204.214.141 true
hblg.media.net 104.76.200.23 true
lg3.media.net 104.76.200.23 true
web.vortex.data.msn.com unknown unknown
www.msn.com unknown unknown
srtb.msn.com unknown unknown
img.img-taboola.com unknown unknown
cvision.media.net unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://ocsp.sca1b.amazontrust.com/images/kVEpvusUliP22lb4Rk/d17iizKsx/VYoeVRB64FpgrYeurIWv/f_2FrjqocbrZFkeJAAU/ZoluLt_2FQc9thneSLw55s/rwD_2B7CC3E4m/h1h_2BYD/_2BOIFG4qmOWI2_2BZz8VRe/v0IC7ic1ri/fa6P17gcmqONonsX_/2FtCrClp9vts/iYUQT4nflFM/pDsA_2BimLN1V1/YiWwAdx5I/qkR.avi false
  • Avira URL Cloud: safe
 unknown