Analysis Report Purchase_order_397484658464974945648447564845.exe

AV Detection:

Found malware configuration

Source: 12.2.Purchase_order_397484658464974945648447564845.exe.400000.0.unpack

Malware Configuration Extractor: FormBook {"C2 list": ["www.aubonmarcheduparc.com/rina/"], "decoy": ["syndicauto.net", "techvorx.com", "palletrackingvancouver.com", "pricetrackerindia.com", "photocravings.com", "jenniferlwilsonrn.com", "cartucce-toner.com", "fred-auto-sport.com", "aletheajean.com", "beautyhacks.website", "seoalmaguer.com", "cursoencasa.net", "flex-eg.com", "dygdreams.com", "magnoliadawson.com", "whitehouseeffectband.com", "visualtrigger.art", "kalinahybridseeds.com", "glacesnamur.com", "drbordogna.com", "wealthtells.com", "opaoman.xyz", "ieltsjo.com", "graphicoustic.com", "jimboprivacy.com", "blockchainclood.com", "aulsgdcqg.icu", "swipeonyourself.com", "mccraft.club", "scirispartner.com", "mlinkstec.com", "allungamentopene.net", "quailridgeminischnauzers.com", "teensatoz.com", "3rud.net", "921squirecourt.com", "informaticas.net", "unicorndragonlearning.com", "duniatone.com", "abmzc023.com", "meteorproductions.com", "pinkcouturecollection.com", "dealsaction.store", "kailarosales.com", "maya-watches.com", "ladyunivers.com", "magenx2.info", "3ppschool.com", "panl.online", "intelligenten.com", "pepintre.com", "safarimadeira.info", "westglobalpartners.com", "tamilfgun.com", "upholsteredwineracks.com", "superdoctormk.club", "newfacesatv.info", "play-morepools.com", "allservice.center", "ladyandpen.com", "textileetobjet.com", "dallasgains.com", "littledeviltrainingcollar.com", "liquid-metalworks.com"]}

Multi AV Scanner detection for submitted file

Source: Purchase_order_397484658464974945648447564845.exe	Virustotal: Detection: 40%			Perma Link
Source: Purchase_order_397484658464974945648447564845.exe	ReversingLabs: Detection: 31%

Yara detected FormBook

Source: Yara match	File source: 0000000C.00000002.267253843.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.293197269.00000000044EF000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.289325554.0000000003F69000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 12.2.Purchase_order_397484658464974945648447564845.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.Purchase_order_397484658464974945648447564845.exe.400000.0.raw.unpack, type: UNPACKEDPE

Machine Learning detection for sample

Source: Purchase_order_397484658464974945648447564845.exe

Joe Sandbox ML: detected

Antivirus or Machine Learning detection for unpacked file

Source: 12.2.Purchase_order_397484658464974945648447564845.exe.400000.0.unpack

Avira: Label: TR/Crypt.XPACK.Gen2

Compliance:

Uses 32bit PE files

Source: Purchase_order_397484658464974945648447564845.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: Purchase_order_397484658464974945648447564845.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Binary contains paths to debug symbols

Source:	Binary string: System.Core.ni.pdbRSDSD source: WERFC3.tmp.dmp.15.dr
Source:	Binary string: System.Xml.ni.pdb source: WERFC3.tmp.dmp.15.dr
Source:	Binary string: System.ni.pdbRSDS source: WERFC3.tmp.dmp.15.dr
Source:	Binary string: C:\Users\user\Desktop\Purchase_order_397484658464974945648447564845.PDB source: Purchase_order_397484658464974945648447564845.exe, 00000000.00000002.281116526.0000000000F87000.00000004.00000010.sdmp
Source:	Binary string: wntdll.pdbUGP source: Purchase_order_397484658464974945648447564845.exe, 0000000C.00000002.268109455.00000000016E0000.00000040.00000001.sdmp
Source:	Binary string: wntdll.pdb source: Purchase_order_397484658464974945648447564845.exe, 0000000C.00000002.268109455.00000000016E0000.00000040.00000001.sdmp
Source:	Binary string: System.Configuration.ni.pdb source: WERFC3.tmp.dmp.15.dr
Source:	Binary string: mscorlib.ni.pdbRSDS source: WERFC3.tmp.dmp.15.dr
Source:	Binary string: jVisualBasic.pdb source: Purchase_order_397484658464974945648447564845.exe, 00000000.00000002.281116526.0000000000F87000.00000004.00000010.sdmp
Source:	Binary string: System.Configuration.pdb source: WERFC3.tmp.dmp.15.dr
Source:	Binary string: System.Xml.pdb source: WERFC3.tmp.dmp.15.dr
Source:	Binary string: System.pdb source: WERFC3.tmp.dmp.15.dr
Source:	Binary string: \??\C:\Windows\Microsoft.VisualBasic.pdb source: Purchase_order_397484658464974945648447564845.exe, 00000000.00000002.283343241.0000000001171000.00000004.00000020.sdmp
Source:	Binary string: Microsoft.VisualBasic.pdb source: WERFC3.tmp.dmp.15.dr
Source:	Binary string: System.Core.ni.pdb source: WERFC3.tmp.dmp.15.dr
Source:	Binary string: Purchase_order_397484658464974945648447564845.PDB source: Purchase_order_397484658464974945648447564845.exe, 00000000.00000002.281116526.0000000000F87000.00000004.00000010.sdmp
Source:	Binary string: System.Windows.Forms.pdb source: WERFC3.tmp.dmp.15.dr
Source:	Binary string: C:\Windows\Microsoft.VisualBasic.pdbpdbsic.pdb13 source: Purchase_order_397484658464974945648447564845.exe, 00000000.00000002.283343241.0000000001171000.00000004.00000020.sdmp
Source:	Binary string: mscorlib.pdb source: WERFC3.tmp.dmp.15.dr
Source:	Binary string: C:\Windows\Microsoft.Net\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.pdb source: Purchase_order_397484658464974945648447564845.exe, 00000000.00000002.283343241.0000000001171000.00000004.00000020.sdmp
Source:	Binary string: System.Drawing.pdb source: WERFC3.tmp.dmp.15.dr
Source:	Binary string: mscorlib.ni.pdb source: WERFC3.tmp.dmp.15.dr
Source:	Binary string: System.Configuration.ni.pdbRSDSO* source: WERFC3.tmp.dmp.15.dr
Source:	Binary string: System.Core.pdb source: WERFC3.tmp.dmp.15.dr
Source:	Binary string: .pdbHh source: Purchase_order_397484658464974945648447564845.exe, 00000000.00000002.281116526.0000000000F87000.00000004.00000010.sdmp
Source:	Binary string: System.Xml.ni.pdbRSDS source: WERFC3.tmp.dmp.15.dr
Source:	Binary string: System.ni.pdb source: WERFC3.tmp.dmp.15.dr

Software Vulnerabilities:

Found inlined nop instructions (likely shell or obfuscated code)

Source: C:\Users\user\Desktop\Purchase_order_397484658464974945648447564845.exe	Code function: 4x nop then pop edi		12_2_0040C3D7
Source: C:\Users\user\Desktop\Purchase_order_397484658464974945648447564845.exe	Code function: 4x nop then pop edi		12_2_00415686

Networking:

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: www.aubonmarcheduparc.com/rina/

HTTP GET or POST without a user agent

Source: global traffic	HTTP traffic detected: GET /base/23DEF5FFA542BB2D1BCA37F7C5ECC686.html HTTP/1.1Host: coroloboxorozor.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /base/C02C82A7124B198823DC14A0727ADA5A.html HTTP/1.1Host: coroloboxorozor.com

IP address seen in connection with other malware

Source: Joe Sandbox View

IP Address: 104.21.71.230 104.21.71.230

Downloads files from webservers via HTTP

Source: global traffic	HTTP traffic detected: GET /base/23DEF5FFA542BB2D1BCA37F7C5ECC686.html HTTP/1.1Host: coroloboxorozor.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /base/C02C82A7124B198823DC14A0727ADA5A.html HTTP/1.1Host: coroloboxorozor.com

Performs DNS lookups

Source: unknown

DNS traffic detected: queries for: coroloboxorozor.com

Urls found in memory or binary data

Source: Purchase_order_397484658464974945648447564845.exe, 00000000.00000002.286130454.0000000002E61000.00000004.00000001.sdmp	String found in binary or memory: http://coroloboxorozor.com
Source: Purchase_order_397484658464974945648447564845.exe, 00000000.00000002.286130454.0000000002E61000.00000004.00000001.sdmp	String found in binary or memory: http://coroloboxorozor.com/base/23DEF5FFA542BB2D1BCA37F7C5ECC686.html
Source: Purchase_order_397484658464974945648447564845.exe, 00000000.00000002.286130454.0000000002E61000.00000004.00000001.sdmp	String found in binary or memory: http://coroloboxorozor.com/base/C02C82A7124B198823DC14A0727ADA5A.html
Source: Purchase_order_397484658464974945648447564845.exe, 00000000.00000002.286130454.0000000002E61000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name

E-Banking Fraud:

Yara detected FormBook

Source: Yara match	File source: 0000000C.00000002.267253843.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.293197269.00000000044EF000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.289325554.0000000003F69000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 12.2.Purchase_order_397484658464974945648447564845.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.Purchase_order_397484658464974945648447564845.exe.400000.0.raw.unpack, type: UNPACKEDPE

System Summary:

Malicious sample detected (through community Yara rule)

Source: 0000000C.00000002.267253843.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000C.00000002.267253843.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000000.00000002.293197269.00000000044EF000.00000004.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000000.00000002.293197269.00000000044EF000.00000004.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000000.00000002.289325554.0000000003F69000.00000004.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000000.00000002.289325554.0000000003F69000.00000004.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 12.2.Purchase_order_397484658464974945648447564845.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 12.2.Purchase_order_397484658464974945648447564845.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 12.2.Purchase_order_397484658464974945648447564845.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 12.2.Purchase_order_397484658464974945648447564845.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: Purchase_order_397484658464974945648447564845.exe

Contains functionality to call native functions

Source: C:\Users\user\Desktop\Purchase_order_397484658464974945648447564845.exe	Code function: 0_2_015096C8 NtSetInformationThread,		0_2_015096C8
Source: C:\Users\user\Desktop\Purchase_order_397484658464974945648447564845.exe	Code function: 0_2_0150B60D NtSetInformationThread,		0_2_0150B60D
Source: C:\Users\user\Desktop\Purchase_order_397484658464974945648447564845.exe	Code function: 0_2_0150B6D0 NtSetInformationThread,		0_2_0150B6D0
Source: C:\Users\user\Desktop\Purchase_order_397484658464974945648447564845.exe	Code function: 12_2_004181C0 NtCreateFile,		12_2_004181C0
Source: C:\Users\user\Desktop\Purchase_order_397484658464974945648447564845.exe	Code function: 12_2_00418270 NtReadFile,		12_2_00418270
Source: C:\Users\user\Desktop\Purchase_order_397484658464974945648447564845.exe	Code function: 12_2_004182F0 NtClose,		12_2_004182F0
Source: C:\Users\user\Desktop\Purchase_order_397484658464974945648447564845.exe	Code function: 12_2_004183A0 NtAllocateVirtualMemory,		12_2_004183A0
Source: C:\Users\user\Desktop\Purchase_order_397484658464974945648447564845.exe	Code function: 12_2_0041826A NtReadFile,		12_2_0041826A
Source: C:\Users\user\Desktop\Purchase_order_397484658464974945648447564845.exe	Code function: 12_2_0041831B NtReadFile,		12_2_0041831B

Detected potential crypto function

Source: C:\Users\user\Desktop\Purchase_order_397484658464974945648447564845.exe	Code function: 0_2_00BDA434		0_2_00BDA434
Source: C:\Users\user\Desktop\Purchase_order_397484658464974945648447564845.exe	Code function: 0_2_0150D290		0_2_0150D290
Source: C:\Users\user\Desktop\Purchase_order_397484658464974945648447564845.exe	Code function: 12_2_00401030		12_2_00401030
Source: C:\Users\user\Desktop\Purchase_order_397484658464974945648447564845.exe	Code function: 12_2_0041C1B8		12_2_0041C1B8
Source: C:\Users\user\Desktop\Purchase_order_397484658464974945648447564845.exe	Code function: 12_2_0041A2F3		12_2_0041A2F3
Source: C:\Users\user\Desktop\Purchase_order_397484658464974945648447564845.exe	Code function: 12_2_00408C5C		12_2_00408C5C
Source: C:\Users\user\Desktop\Purchase_order_397484658464974945648447564845.exe	Code function: 12_2_00408C60		12_2_00408C60
Source: C:\Users\user\Desktop\Purchase_order_397484658464974945648447564845.exe	Code function: 12_2_0041BC7D		12_2_0041BC7D
Source: C:\Users\user\Desktop\Purchase_order_397484658464974945648447564845.exe	Code function: 12_2_0041B5E2		12_2_0041B5E2
Source: C:\Users\user\Desktop\Purchase_order_397484658464974945648447564845.exe	Code function: 12_2_00402D90		12_2_00402D90
Source: C:\Users\user\Desktop\Purchase_order_397484658464974945648447564845.exe	Code function: 12_2_0041C7F0		12_2_0041C7F0
Source: C:\Users\user\Desktop\Purchase_order_397484658464974945648447564845.exe	Code function: 12_2_0041BF92		12_2_0041BF92
Source: C:\Users\user\Desktop\Purchase_order_397484658464974945648447564845.exe	Code function: 12_2_00402FB0		12_2_00402FB0

One or more processes crash

Source: unknown

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6392 -s 964

Sample file is different than original file name gathered from version info

Source: Purchase_order_397484658464974945648447564845.exe	Binary or memory string: OriginalFilename vs Purchase_order_397484658464974945648447564845.exe
Source: Purchase_order_397484658464974945648447564845.exe, 00000000.00000000.211406162.0000000000B52000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameBPxnwGrR.exe2 vs Purchase_order_397484658464974945648447564845.exe
Source: Purchase_order_397484658464974945648447564845.exe, 00000000.00000002.289325554.0000000003F69000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameRFkL BUJ.exe2 vs Purchase_order_397484658464974945648447564845.exe
Source: Purchase_order_397484658464974945648447564845.exe, 00000000.00000002.293197269.00000000044EF000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameRunPeBraba.dll6 vs Purchase_order_397484658464974945648447564845.exe
Source: Purchase_order_397484658464974945648447564845.exe	Binary or memory string: OriginalFilename vs Purchase_order_397484658464974945648447564845.exe
Source: Purchase_order_397484658464974945648447564845.exe, 0000000C.00000002.267253843.0000000000400000.00000040.00000001.sdmp	Binary or memory string: OriginalFilenameRFkL BUJ.exe2 vs Purchase_order_397484658464974945648447564845.exe
Source: Purchase_order_397484658464974945648447564845.exe, 0000000C.00000002.269183019.000000000198F000.00000040.00000001.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs Purchase_order_397484658464974945648447564845.exe
Source: Purchase_order_397484658464974945648447564845.exe, 0000000C.00000000.264656959.0000000000CE2000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameBPxnwGrR.exe2 vs Purchase_order_397484658464974945648447564845.exe
Source: Purchase_order_397484658464974945648447564845.exe	Binary or memory string: OriginalFilenameBPxnwGrR.exe2 vs Purchase_order_397484658464974945648447564845.exe

Uses 32bit PE files

Source: Purchase_order_397484658464974945648447564845.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Yara signature match

Source: 0000000C.00000002.267253843.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000C.00000002.267253843.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000000.00000002.293197269.00000000044EF000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000000.00000002.293197269.00000000044EF000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000000.00000002.289325554.0000000003F69000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000000.00000002.289325554.0000000003F69000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 12.2.Purchase_order_397484658464974945648447564845.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 12.2.Purchase_order_397484658464974945648447564845.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 12.2.Purchase_order_397484658464974945648447564845.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 12.2.Purchase_order_397484658464974945648447564845.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research

Classification label

Source: classification engine

Classification label: mal100.troj.evad.winEXE@12/9@1/1

Creates files inside the user directory

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\Documents\20210223

Jump to behavior

Creates mutexes

Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6392
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7136:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6988:120:WilError_01

Creates temporary files

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zj10wm5e.0o0.ps1

Jump to behavior

PE file has an executable .text section and no other executable section

Source: Purchase_order_397484658464974945648447564845.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Parts of this applications are using the .NET runtime (Probably coded in C#)

Source: C:\Users\user\Desktop\Purchase_order_397484658464974945648447564845.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll			Jump to behavior

Reads ini files

Source: C:\Users\user\Desktop\Purchase_order_397484658464974945648447564845.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Reads software policies

Source: C:\Users\user\Desktop\Purchase_order_397484658464974945648447564845.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Reads the hosts file

Source: C:\Users\user\Desktop\Purchase_order_397484658464974945648447564845.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Users\user\Desktop\Purchase_order_397484658464974945648447564845.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Sample is known by Antivirus

Source: Purchase_order_397484658464974945648447564845.exe	Virustotal: Detection: 40%
Source: Purchase_order_397484658464974945648447564845.exe	ReversingLabs: Detection: 31%

Sample reads its own file content

Source: C:\Users\user\Desktop\Purchase_order_397484658464974945648447564845.exe

File read: C:\Users\user\Desktop\Purchase_order_397484658464974945648447564845.exe

Jump to behavior

Spawns processes

Source: unknown	Process created: C:\Users\user\Desktop\Purchase_order_397484658464974945648447564845.exe 'C:\Users\user\Desktop\Purchase_order_397484658464974945648447564845.exe'
Source: unknown	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\Purchase_order_397484658464974945648447564845.exe' -Force
Source: unknown	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\SysWOW64\cmd.exe 'C:\Windows\System32\cmd.exe' /c timeout 1
Source: unknown	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\SysWOW64\timeout.exe timeout 1
Source: unknown	Process created: C:\Users\user\Desktop\Purchase_order_397484658464974945648447564845.exe C:\Users\user\Desktop\Purchase_order_397484658464974945648447564845.exe
Source: unknown	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6392 -s 964
Source: C:\Users\user\Desktop\Purchase_order_397484658464974945648447564845.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\Purchase_order_397484658464974945648447564845.exe' -Force			Jump to behavior
Source: C:\Users\user\Desktop\Purchase_order_397484658464974945648447564845.exe	Process created: C:\Windows\SysWOW64\cmd.exe 'C:\Windows\System32\cmd.exe' /c timeout 1			Jump to behavior
Source: C:\Users\user\Desktop\Purchase_order_397484658464974945648447564845.exe	Process created: C:\Users\user\Desktop\Purchase_order_397484658464974945648447564845.exe C:\Users\user\Desktop\Purchase_order_397484658464974945648447564845.exe			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout 1			Jump to behavior

Uses an in-process (OLE) Automation server

Source: C:\Users\user\Desktop\Purchase_order_397484658464974945648447564845.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F324E4F9-8496-40b2-A1FF-9617C1C9AFFE}\InProcServer32

Jump to behavior

Found graphical window changes (likely an installer)

Source: Window Recorder

Window detected: More than 3 window changes detected

Uses Microsoft Silverlight

Source: C:\Users\user\Desktop\Purchase_order_397484658464974945648447564845.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

PE file contains a COM descriptor data directory

Source: Purchase_order_397484658464974945648447564845.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: Purchase_order_397484658464974945648447564845.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Binary contains paths to debug symbols

Source:	Binary string: System.Core.ni.pdbRSDSD source: WERFC3.tmp.dmp.15.dr
Source:	Binary string: System.Xml.ni.pdb source: WERFC3.tmp.dmp.15.dr
Source:	Binary string: System.ni.pdbRSDS source: WERFC3.tmp.dmp.15.dr
Source:	Binary string: C:\Users\user\Desktop\Purchase_order_397484658464974945648447564845.PDB source: Purchase_order_397484658464974945648447564845.exe, 00000000.00000002.281116526.0000000000F87000.00000004.00000010.sdmp
Source:	Binary string: wntdll.pdbUGP source: Purchase_order_397484658464974945648447564845.exe, 0000000C.00000002.268109455.00000000016E0000.00000040.00000001.sdmp
Source:	Binary string: wntdll.pdb source: Purchase_order_397484658464974945648447564845.exe, 0000000C.00000002.268109455.00000000016E0000.00000040.00000001.sdmp
Source:	Binary string: System.Configuration.ni.pdb source: WERFC3.tmp.dmp.15.dr
Source:	Binary string: mscorlib.ni.pdbRSDS source: WERFC3.tmp.dmp.15.dr
Source:	Binary string: jVisualBasic.pdb source: Purchase_order_397484658464974945648447564845.exe, 00000000.00000002.281116526.0000000000F87000.00000004.00000010.sdmp
Source:	Binary string: System.Configuration.pdb source: WERFC3.tmp.dmp.15.dr
Source:	Binary string: System.Xml.pdb source: WERFC3.tmp.dmp.15.dr
Source:	Binary string: System.pdb source: WERFC3.tmp.dmp.15.dr
Source:	Binary string: \??\C:\Windows\Microsoft.VisualBasic.pdb source: Purchase_order_397484658464974945648447564845.exe, 00000000.00000002.283343241.0000000001171000.00000004.00000020.sdmp
Source:	Binary string: Microsoft.VisualBasic.pdb source: WERFC3.tmp.dmp.15.dr
Source:	Binary string: System.Core.ni.pdb source: WERFC3.tmp.dmp.15.dr
Source:	Binary string: Purchase_order_397484658464974945648447564845.PDB source: Purchase_order_397484658464974945648447564845.exe, 00000000.00000002.281116526.0000000000F87000.00000004.00000010.sdmp
Source:	Binary string: System.Windows.Forms.pdb source: WERFC3.tmp.dmp.15.dr
Source:	Binary string: C:\Windows\Microsoft.VisualBasic.pdbpdbsic.pdb13 source: Purchase_order_397484658464974945648447564845.exe, 00000000.00000002.283343241.0000000001171000.00000004.00000020.sdmp
Source:	Binary string: mscorlib.pdb source: WERFC3.tmp.dmp.15.dr
Source:	Binary string: C:\Windows\Microsoft.Net\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.pdb source: Purchase_order_397484658464974945648447564845.exe, 00000000.00000002.283343241.0000000001171000.00000004.00000020.sdmp
Source:	Binary string: System.Drawing.pdb source: WERFC3.tmp.dmp.15.dr
Source:	Binary string: mscorlib.ni.pdb source: WERFC3.tmp.dmp.15.dr
Source:	Binary string: System.Configuration.ni.pdbRSDSO* source: WERFC3.tmp.dmp.15.dr
Source:	Binary string: System.Core.pdb source: WERFC3.tmp.dmp.15.dr
Source:	Binary string: .pdbHh source: Purchase_order_397484658464974945648447564845.exe, 00000000.00000002.281116526.0000000000F87000.00000004.00000010.sdmp
Source:	Binary string: System.Xml.ni.pdbRSDS source: WERFC3.tmp.dmp.15.dr
Source:	Binary string: System.ni.pdb source: WERFC3.tmp.dmp.15.dr

Data Obfuscation:

Binary contains a suspicious time stamp

Source: initial sample

Static PE information: 0xF27DBEB9 [Tue Dec 2 02:51:37 2098 UTC]

PE file contains an invalid checksum

Source: Purchase_order_397484658464974945648447564845.exe

Static PE information: real checksum: 0xa25a1 should be: 0xabc83

Uses code obfuscation techniques (call, push, ret)

Source: C:\Users\user\Desktop\Purchase_order_397484658464974945648447564845.exe	Code function: 12_2_0041C942 push es; ret		12_2_0041C943
Source: C:\Users\user\Desktop\Purchase_order_397484658464974945648447564845.exe	Code function: 12_2_0041B3B5 push eax; ret		12_2_0041B408
Source: C:\Users\user\Desktop\Purchase_order_397484658464974945648447564845.exe	Code function: 12_2_00415C5F push esi; ret		12_2_00415C66
Source: C:\Users\user\Desktop\Purchase_order_397484658464974945648447564845.exe	Code function: 12_2_0041B46C push eax; ret		12_2_0041B472
Source: C:\Users\user\Desktop\Purchase_order_397484658464974945648447564845.exe	Code function: 12_2_0041B402 push eax; ret		12_2_0041B408
Source: C:\Users\user\Desktop\Purchase_order_397484658464974945648447564845.exe	Code function: 12_2_0041B40B push eax; ret		12_2_0041B472
Source: C:\Users\user\Desktop\Purchase_order_397484658464974945648447564845.exe	Code function: 12_2_0041CD7C push ds; iretd		12_2_0041CD7D
Source: C:\Users\user\Desktop\Purchase_order_397484658464974945648447564845.exe	Code function: 12_2_0041850E push esp; iretd		12_2_0041850F
Source: C:\Users\user\Desktop\Purchase_order_397484658464974945648447564845.exe	Code function: 12_2_00415F8E push es; retf		12_2_00415F8F

Hooking and other Techniques for Hiding and Protection:

Icon mismatch, binary includes an icon from a different legit application in order to fool users

Source: initial sample

Icon embedded in binary file: icon matches a legit application icon: download (58).png

Disables application error messsages (SetErrorMode)

Source: C:\Users\user\Desktop\Purchase_order_397484658464974945648447564845.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Purchase_order_397484658464974945648447564845.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Purchase_order_397484658464974945648447564845.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Purchase_order_397484658464974945648447564845.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Purchase_order_397484658464974945648447564845.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Purchase_order_397484658464974945648447564845.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Purchase_order_397484658464974945648447564845.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Purchase_order_397484658464974945648447564845.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Purchase_order_397484658464974945648447564845.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Purchase_order_397484658464974945648447564845.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Purchase_order_397484658464974945648447564845.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Purchase_order_397484658464974945648447564845.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Purchase_order_397484658464974945648447564845.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Purchase_order_397484658464974945648447564845.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Purchase_order_397484658464974945648447564845.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Purchase_order_397484658464974945648447564845.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Purchase_order_397484658464974945648447564845.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Purchase_order_397484658464974945648447564845.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Purchase_order_397484658464974945648447564845.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Purchase_order_397484658464974945648447564845.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Purchase_order_397484658464974945648447564845.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Purchase_order_397484658464974945648447564845.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Purchase_order_397484658464974945648447564845.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Purchase_order_397484658464974945648447564845.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Purchase_order_397484658464974945648447564845.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Purchase_order_397484658464974945648447564845.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Purchase_order_397484658464974945648447564845.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Purchase_order_397484658464974945648447564845.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Purchase_order_397484658464974945648447564845.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Purchase_order_397484658464974945648447564845.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Purchase_order_397484658464974945648447564845.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Purchase_order_397484658464974945648447564845.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Purchase_order_397484658464974945648447564845.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Purchase_order_397484658464974945648447564845.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Purchase_order_397484658464974945648447564845.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Purchase_order_397484658464974945648447564845.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Purchase_order_397484658464974945648447564845.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Purchase_order_397484658464974945648447564845.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Purchase_order_397484658464974945648447564845.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Purchase_order_397484658464974945648447564845.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Purchase_order_397484658464974945648447564845.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Purchase_order_397484658464974945648447564845.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion:

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\Purchase_order_397484658464974945648447564845.exe	RDTSC instruction interceptor: First address: 00000000004085E4 second address: 00000000004085EA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Purchase_order_397484658464974945648447564845.exe	RDTSC instruction interceptor: First address: 000000000040897E second address: 0000000000408984 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc

Contains capabilities to detect virtual machines

Source: C:\Users\user\Desktop\Purchase_order_397484658464974945648447564845.exe

File opened / queried: SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}

Jump to behavior

Contains functionality for execution timing, often used to detect debuggers

Source: C:\Users\user\Desktop\Purchase_order_397484658464974945648447564845.exe

Code function: 12_2_004088B0 rdtsc

12_2_004088B0

Contains long sleeps (>= 3 min)

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4442			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2845			Jump to behavior

May sleep (evasive loops) to hinder dynamic analysis

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6876

Thread sleep time: -17524406870024063s >= -30000s

Jump to behavior

Sample execution stops while process was sleeping (likely an evasion)

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)

Source: powershell.exe, 00000006.00000003.343279532.0000000005825000.00000004.00000001.sdmp	Binary or memory string: Hyper-V
Source: powershell.exe, 00000006.00000003.343279532.0000000005825000.00000004.00000001.sdmp	Binary or memory string: l:C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Hyper-V

Queries a list of all running processes

Source: C:\Users\user\Desktop\Purchase_order_397484658464974945648447564845.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging:

Contains functionality to hide a thread from the debugger

Source: C:\Users\user\Desktop\Purchase_order_397484658464974945648447564845.exe

Code function: 0_2_015096C8 NtSetInformationThread ?,00000011,?,?,?,?,?,?,?,0150B5EF,00000000,00000000

0_2_015096C8

Hides threads from debuggers

Source: C:\Users\user\Desktop\Purchase_order_397484658464974945648447564845.exe	Thread information set: HideFromDebugger			Jump to behavior
Source: C:\Users\user\Desktop\Purchase_order_397484658464974945648447564845.exe	Thread information set: HideFromDebugger			Jump to behavior
Source: C:\Users\user\Desktop\Purchase_order_397484658464974945648447564845.exe	Thread information set: HideFromDebugger			Jump to behavior
Source: C:\Users\user\Desktop\Purchase_order_397484658464974945648447564845.exe	Thread information set: HideFromDebugger			Jump to behavior
Source: C:\Users\user\Desktop\Purchase_order_397484658464974945648447564845.exe	Thread information set: HideFromDebugger			Jump to behavior
Source: C:\Users\user\Desktop\Purchase_order_397484658464974945648447564845.exe	Thread information set: HideFromDebugger			Jump to behavior
Source: C:\Users\user\Desktop\Purchase_order_397484658464974945648447564845.exe	Thread information set: HideFromDebugger			Jump to behavior
Source: C:\Users\user\Desktop\Purchase_order_397484658464974945648447564845.exe	Thread information set: HideFromDebugger			Jump to behavior
Source: C:\Users\user\Desktop\Purchase_order_397484658464974945648447564845.exe	Thread information set: HideFromDebugger			Jump to behavior
Source: C:\Users\user\Desktop\Purchase_order_397484658464974945648447564845.exe	Thread information set: HideFromDebugger			Jump to behavior
Source: C:\Users\user\Desktop\Purchase_order_397484658464974945648447564845.exe	Thread information set: HideFromDebugger			Jump to behavior
Source: C:\Users\user\Desktop\Purchase_order_397484658464974945648447564845.exe	Thread information set: HideFromDebugger			Jump to behavior
Source: C:\Users\user\Desktop\Purchase_order_397484658464974945648447564845.exe	Thread information set: HideFromDebugger			Jump to behavior
Source: C:\Users\user\Desktop\Purchase_order_397484658464974945648447564845.exe	Thread information set: HideFromDebugger			Jump to behavior

Checks if the current process is being debugged

Source: C:\Users\user\Desktop\Purchase_order_397484658464974945648447564845.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\Purchase_order_397484658464974945648447564845.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\Purchase_order_397484658464974945648447564845.exe	Process queried: DebugPort			Jump to behavior

Contains functionality for execution timing, often used to detect debuggers

Source: C:\Users\user\Desktop\Purchase_order_397484658464974945648447564845.exe

Code function: 12_2_004088B0 rdtsc

12_2_004088B0

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Source: C:\Users\user\Desktop\Purchase_order_397484658464974945648447564845.exe

Code function: 0_2_00BBD91C LdrInitializeThunk,

0_2_00BBD91C

Enables debug privileges

Source: C:\Users\user\Desktop\Purchase_order_397484658464974945648447564845.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior

Creates guard pages, often used to prevent reverse engineering and debugging

Source: C:\Users\user\Desktop\Purchase_order_397484658464974945648447564845.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

Adds a directory exclusion to Windows Defender

Source: unknown	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\Purchase_order_397484658464974945648447564845.exe' -Force
Source: C:\Users\user\Desktop\Purchase_order_397484658464974945648447564845.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\Purchase_order_397484658464974945648447564845.exe' -Force			Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\Purchase_order_397484658464974945648447564845.exe

Memory written: C:\Users\user\Desktop\Purchase_order_397484658464974945648447564845.exe base: 400000 value starts with: 4D5A

Jump to behavior

Creates a process in suspended mode (likely to inject code)

Source: C:\Users\user\Desktop\Purchase_order_397484658464974945648447564845.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\Purchase_order_397484658464974945648447564845.exe' -Force			Jump to behavior
Source: C:\Users\user\Desktop\Purchase_order_397484658464974945648447564845.exe	Process created: C:\Windows\SysWOW64\cmd.exe 'C:\Windows\System32\cmd.exe' /c timeout 1			Jump to behavior
Source: C:\Users\user\Desktop\Purchase_order_397484658464974945648447564845.exe	Process created: C:\Users\user\Desktop\Purchase_order_397484658464974945648447564845.exe C:\Users\user\Desktop\Purchase_order_397484658464974945648447564845.exe			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout 1			Jump to behavior

Language, Device and Operating System Detection:

Queries the volume information (name, serial number etc) of a device

Source: C:\Users\user\Desktop\Purchase_order_397484658464974945648447564845.exe	Queries volume information: C:\Users\user\Desktop\Purchase_order_397484658464974945648447564845.exe VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\Purchase_order_397484658464974945648447564845.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\Purchase_order_397484658464974945648447564845.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\Purchase_order_397484658464974945648447564845.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll VolumeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-ds-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-base-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-base-Package~31bf3856ad364e35~amd64~en-US~10.0.17134.1.cat VolumeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.dll VolumeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration.Install\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll VolumeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation			Jump to behavior

Queries the cryptographic machine GUID

Source: C:\Users\user\Desktop\Purchase_order_397484658464974945648447564845.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information:

Yara detected FormBook

Source: Yara match	File source: 0000000C.00000002.267253843.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.293197269.00000000044EF000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.289325554.0000000003F69000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 12.2.Purchase_order_397484658464974945648447564845.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.Purchase_order_397484658464974945648447564845.exe.400000.0.raw.unpack, type: UNPACKEDPE

Remote Access Functionality:

Yara detected FormBook

Source: Yara match	File source: 0000000C.00000002.267253843.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.293197269.00000000044EF000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.289325554.0000000003F69000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 12.2.Purchase_order_397484658464974945648447564845.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.Purchase_order_397484658464974945648447564845.exe.400000.0.raw.unpack, type: UNPACKEDPE