Loading ...

Play interactive tourEdit tour

Analysis Report Orden de Compra.exe

Overview

General Information

Sample Name:Orden de Compra.exe
Analysis ID:383316
MD5:e6dcf6b66b611ffb7d2bc1a8045bf41f
SHA1:7b3871b1b077f764175c6d387e846372128a89ee
SHA256:280e118484090c0a9788dcad52f37995822757f44d230c9ff042c3507d8e20a3
Infos:

Most interesting Screenshot:

Detection

GuLoader
Score:96
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Multi AV Scanner detection for submitted file
Yara detected GuLoader
Contains functionality to detect hardware virtualization (CPUID execution measurement)
Contains functionality to hide a thread from the debugger
Detected RDTSC dummy instruction sequence (likely for instruction hammering)
Found potential dummy code loops (likely to delay analysis)
Hides threads from debuggers
Machine Learning detection for sample
Tries to detect Any.run
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Writes to foreign memory regions
Abnormal high CPU Usage
Checks if the current process is being debugged
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to call native functions
Contains functionality to read the PEB
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Found large amount of non-executed APIs
May sleep (evasive loops) to hinder dynamic analysis
PE file contains an invalid checksum
PE file contains strange resources
Program does not show much activity (idle)
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Tries to load missing DLLs
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)

Classification

Startup

  • System is w10x64
  • Orden de Compra.exe (PID: 6960 cmdline: 'C:\Users\user\Desktop\Orden de Compra.exe' MD5: E6DCF6B66B611FFB7D2BC1A8045BF41F)
    • RegAsm.exe (PID: 5700 cmdline: 'C:\Users\user\Desktop\Orden de Compra.exe' MD5: 6FD7592411112729BF6B1F2F6C34899F)
    • RegAsm.exe (PID: 2988 cmdline: 'C:\Users\user\Desktop\Orden de Compra.exe' MD5: 6FD7592411112729BF6B1F2F6C34899F)
    • RegAsm.exe (PID: 784 cmdline: 'C:\Users\user\Desktop\Orden de Compra.exe' MD5: 6FD7592411112729BF6B1F2F6C34899F)
    • RegAsm.exe (PID: 6128 cmdline: 'C:\Users\user\Desktop\Orden de Compra.exe' MD5: 6FD7592411112729BF6B1F2F6C34899F)
      • conhost.exe (PID: 5980 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
  • cleanup

Malware Configuration

No configs have been found

Yara Overview

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000017.00000002.849537125.0000000001100000.00000040.00000001.sdmpJoeSecurity_GuLoaderYara detected GuLoaderJoe Security
    Process Memory Space: RegAsm.exe PID: 6128JoeSecurity_GuLoaderYara detected GuLoaderJoe Security

      Sigma Overview

      No Sigma rule has matched

      Signature Overview

      Click to jump to signature section

      Show All Signature Results

      AV Detection:

      barindex
      Multi AV Scanner detection for submitted fileShow sources
      Source: Orden de Compra.exeReversingLabs: Detection: 10%
      Machine Learning detection for sampleShow sources
      Source: Orden de Compra.exeJoe Sandbox ML: detected
      Source: Orden de Compra.exeStatic PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
      Source: RegAsm.exe, 00000017.00000002.849831122.000000000141B000.00000004.00000020.sdmpString found in binary or memory: http://crl.globalsign.net/root-r2.crl0
      Source: RegAsm.exe, 00000017.00000002.849831122.000000000141B000.00000004.00000020.sdmp, RegAsm.exe, 00000017.00000002.849852280.0000000001439000.00000004.00000020.sdmpString found in binary or memory: http://crl.pki.goog/GTS1O1core.crl0
      Source: RegAsm.exe, 00000017.00000002.849831122.000000000141B000.00000004.00000020.sdmpString found in binary or memory: http://crl.pki.goog/gsr2/gsr2.crl0?
      Source: RegAsm.exe, 00000017.00000002.849831122.000000000141B000.00000004.00000020.sdmpString found in binary or memory: http://ocsp.pki.goog/gsr202
      Source: RegAsm.exe, 00000017.00000002.849852280.0000000001439000.00000004.00000020.sdmpString found in binary or memory: http://ocsp.pki.goog/gts1o1core0
      Source: RegAsm.exe, 00000017.00000002.849852280.0000000001439000.00000004.00000020.sdmpString found in binary or memory: http://pki.goog/gsr2/GTS1O1.crt0
      Source: RegAsm.exe, 00000017.00000002.849831122.000000000141B000.00000004.00000020.sdmp, RegAsm.exe, 00000017.00000002.849793142.00000000013EF000.00000004.00000020.sdmpString found in binary or memory: https://csp.withgoogle.com/csp/drive-explorer/
      Source: RegAsm.exe, 00000017.00000002.849793142.00000000013EF000.00000004.00000020.sdmpString found in binary or memory: https://csp.withgoogle.com/csp/drive-explorer/TeA
      Source: RegAsm.exe, 00000017.00000002.849852280.0000000001439000.00000004.00000020.sdmpString found in binary or memory: https://drive.google.com/
      Source: RegAsm.exe, 00000017.00000002.849852280.0000000001439000.00000004.00000020.sdmpString found in binary or memory: https://drive.google.com/.
      Source: RegAsm.exe, 00000017.00000002.849852280.0000000001439000.00000004.00000020.sdmpString found in binary or memory: https://drive.google.com/=
      Source: RegAsm.exe, 00000017.00000002.849852280.0000000001439000.00000004.00000020.sdmpString found in binary or memory: https://drive.google.com/A
      Source: RegAsm.exe, 00000017.00000002.849852280.0000000001439000.00000004.00000020.sdmpString found in binary or memory: https://drive.google.com/_
      Source: RegAsm.exe, 00000017.00000002.849831122.000000000141B000.00000004.00000020.sdmpString found in binary or memory: https://drive.google.com/b
      Source: RegAsm.exe, 00000017.00000002.849852280.0000000001439000.00000004.00000020.sdmpString found in binary or memory: https://drive.google.com/c
      Source: RegAsm.exe, 00000017.00000002.849852280.0000000001439000.00000004.00000020.sdmpString found in binary or memory: https://drive.google.com/user
      Source: RegAsm.exe, 00000017.00000002.849831122.000000000141B000.00000004.00000020.sdmpString found in binary or memory: https://drive.google.com/j
      Source: RegAsm.exe, 00000017.00000002.849852280.0000000001439000.00000004.00000020.sdmpString found in binary or memory: https://drive.google.com/r
      Source: RegAsm.exe, 00000017.00000002.849852280.0000000001439000.00000004.00000020.sdmp, RegAsm.exe, 00000017.00000002.849793142.00000000013EF000.00000004.00000020.sdmpString found in binary or memory: https://drive.google.com/uc?export=download&id=10rK4wk5oFGyPK_N03B_AXxsO7DxxXTMm
      Source: RegAsm.exe, 00000017.00000002.849852280.0000000001439000.00000004.00000020.sdmpString found in binary or memory: https://drive.google.com/uc?export=download&id=10rK4wk5oFGyPK_N03B_AXxsO7DxxXTMm#
      Source: RegAsm.exe, 00000017.00000002.849852280.0000000001439000.00000004.00000020.sdmpString found in binary or memory: https://drive.google.com/uc?export=download&id=10rK4wk5oFGyPK_N03B_AXxsO7DxxXTMm$
      Source: RegAsm.exe, 00000017.00000002.849852280.0000000001439000.00000004.00000020.sdmpString found in binary or memory: https://drive.google.com/uc?export=download&id=10rK4wk5oFGyPK_N03B_AXxsO7DxxXTMm/
      Source: RegAsm.exe, 00000017.00000002.849852280.0000000001439000.00000004.00000020.sdmpString found in binary or memory: https://drive.google.com/uc?export=download&id=10rK4wk5oFGyPK_N03B_AXxsO7DxxXTMm2#:
      Source: RegAsm.exe, 00000017.00000002.849852280.0000000001439000.00000004.00000020.sdmpString found in binary or memory: https://drive.google.com/uc?export=download&id=10rK4wk5oFGyPK_N03B_AXxsO7DxxXTMm4.8
      Source: RegAsm.exe, 00000017.00000002.849852280.0000000001439000.00000004.00000020.sdmpString found in binary or memory: https://drive.google.com/uc?export=download&id=10rK4wk5oFGyPK_N03B_AXxsO7DxxXTMm:
      Source: RegAsm.exe, 00000017.00000002.849757830.00000000013D8000.00000004.00000020.sdmpString found in binary or memory: https://drive.google.com/uc?export=download&id=10rK4wk5oFGyPK_N03B_AXxsO7DxxXTMm=
      Source: RegAsm.exe, 00000017.00000002.849852280.0000000001439000.00000004.00000020.sdmpString found in binary or memory: https://drive.google.com/uc?export=download&id=10rK4wk5oFGyPK_N03B_AXxsO7DxxXTMmB_AXxsO7DxxXTMm
      Source: RegAsm.exe, 00000017.00000002.849852280.0000000001439000.00000004.00000020.sdmpString found in binary or memory: https://drive.google.com/uc?export=download&id=10rK4wk5oFGyPK_N03B_AXxsO7DxxXTMmB_AXxsO7DxxXTMm5
      Source: RegAsm.exe, 00000017.00000002.849757830.00000000013D8000.00000004.00000020.sdmpString found in binary or memory: https://drive.google.com/uc?export=download&id=10rK4wk5oFGyPK_N03B_AXxsO7DxxXTMmCR
      Source: RegAsm.exe, 00000017.00000002.849852280.0000000001439000.00000004.00000020.sdmpString found in binary or memory: https://drive.google.com/uc?export=download&id=10rK4wk5oFGyPK_N03B_AXxsO7DxxXTMmH.
      Source: RegAsm.exe, 00000017.00000002.849852280.0000000001439000.00000004.00000020.sdmpString found in binary or memory: https://drive.google.com/uc?export=download&id=10rK4wk5oFGyPK_N03B_AXxsO7DxxXTMmK
      Source: RegAsm.exe, 00000017.00000002.849852280.0000000001439000.00000004.00000020.sdmpString found in binary or memory: https://drive.google.com/uc?export=download&id=10rK4wk5oFGyPK_N03B_AXxsO7DxxXTMmN
      Source: RegAsm.exe, 00000017.00000002.849852280.0000000001439000.00000004.00000020.sdmpString found in binary or memory: https://drive.google.com/uc?export=download&id=10rK4wk5oFGyPK_N03B_AXxsO7DxxXTMmV-&
      Source: RegAsm.exe, 00000017.00000002.849852280.0000000001439000.00000004.00000020.sdmpString found in binary or memory: https://drive.google.com/uc?export=download&id=10rK4wk5oFGyPK_N03B_AXxsO7DxxXTMmW
      Source: RegAsm.exe, 00000017.00000002.849852280.0000000001439000.00000004.00000020.sdmpString found in binary or memory: https://drive.google.com/uc?export=download&id=10rK4wk5oFGyPK_N03B_AXxsO7DxxXTMmb
      Source: RegAsm.exe, 00000017.00000002.849852280.0000000001439000.00000004.00000020.sdmpString found in binary or memory: https://drive.google.com/uc?export=download&id=10rK4wk5oFGyPK_N03B_AXxsO7DxxXTMmd
      Source: RegAsm.exe, 00000017.00000002.849852280.0000000001439000.00000004.00000020.sdmpString found in binary or memory: https://drive.google.com/uc?export=download&id=10rK4wk5oFGyPK_N03B_AXxsO7DxxXTMmd/
      Source: RegAsm.exe, 00000017.00000002.849852280.0000000001439000.00000004.00000020.sdmpString found in binary or memory: https://drive.google.com/uc?export=download&id=10rK4wk5oFGyPK_N03B_AXxsO7DxxXTMmg
      Source: RegAsm.exe, 00000017.00000002.849852280.0000000001439000.00000004.00000020.sdmpString found in binary or memory: https://drive.google.com/uc?export=download&id=10rK4wk5oFGyPK_N03B_AXxsO7DxxXTMmj-
      Source: RegAsm.exe, 00000017.00000002.849852280.0000000001439000.00000004.00000020.sdmpString found in binary or memory: https://drive.google.com/uc?export=download&id=10rK4wk5oFGyPK_N03B_AXxsO7DxxXTMmr.
      Source: RegAsm.exe, 00000017.00000002.849852280.0000000001439000.00000004.00000020.sdmpString found in binary or memory: https://drive.google.com/uc?export=download&id=10rK4wk5oFGyPK_N03B_AXxsO7DxxXTMms
      Source: RegAsm.exe, 00000017.00000002.849852280.0000000001439000.00000004.00000020.sdmpString found in binary or memory: https://drive.google.com/uc?export=download&id=10rK4wk5oFGyPK_N03B_AXxsO7DxxXTMmx
      Source: RegAsm.exe, 00000017.00000002.849852280.0000000001439000.00000004.00000020.sdmpString found in binary or memory: https://drive.google.com/uc?export=download&id=10rK4wk5oFGyPK_N03B_AXxsO7DxxXTMmz/
      Source: RegAsm.exe, 00000017.00000002.849831122.000000000141B000.00000004.00000020.sdmpString found in binary or memory: https://pki.goog/repository/0
      Source: C:\Users\user\Desktop\Orden de Compra.exeProcess Stats: CPU usage > 98%
      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 23_2_011071B1 NtQueryInformationProcess,23_2_011071B1
      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 23_2_01106C57 NtProtectVirtualMemory,23_2_01106C57
      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 23_2_01100898 NtSetInformationThread,LoadLibraryA,23_2_01100898
      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 23_2_01100631 EnumWindows,NtSetInformationThread,23_2_01100631
      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 23_2_011066BF NtSetInformationThread,23_2_011066BF
      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 23_2_0110751D NtQueryInformationProcess,23_2_0110751D
      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 23_2_0110754B NtQueryInformationProcess,23_2_0110754B
      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 23_2_011075C1 NtQueryInformationProcess,23_2_011075C1
      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 23_2_011071C9 NtQueryInformationProcess,23_2_011071C9
      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 23_2_011071E9 NtQueryInformationProcess,23_2_011071E9
      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 23_2_011075ED NtQueryInformationProcess,23_2_011075ED
      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 23_2_01107416 NtQueryInformationProcess,23_2_01107416
      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 23_2_01107435 NtQueryInformationProcess,23_2_01107435
      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 23_2_01107455 NtQueryInformationProcess,23_2_01107455
      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 23_2_0110749D NtQueryInformationProcess,23_2_0110749D
      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 23_2_01106C81 NtProtectVirtualMemory,23_2_01106C81
      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 23_2_011014BF NtSetInformationThread,23_2_011014BF
      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 23_2_011074C6 NtQueryInformationProcess,23_2_011074C6
      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 23_2_011074F5 NtQueryInformationProcess,23_2_011074F5
      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 23_2_01107316 NtQueryInformationProcess,23_2_01107316
      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 23_2_0110070D NtSetInformationThread,23_2_0110070D
      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 23_2_01107353 NtQueryInformationProcess,23_2_01107353
      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 23_2_01105F5B NtSetInformationThread,23_2_01105F5B
      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 23_2_0110074A NtSetInformationThread,23_2_0110074A
      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 23_2_0110736E NtQueryInformationProcess,23_2_0110736E
      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 23_2_011073B1 NtQueryInformationProcess,23_2_011073B1
      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 23_2_011007AD NtSetInformationThread,23_2_011007AD
      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 23_2_011073F1 NtQueryInformationProcess,23_2_011073F1
      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 23_2_01105E17 NtSetInformationThread,23_2_01105E17
      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 23_2_01107209 NtQueryInformationProcess,23_2_01107209
      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 23_2_0110722A NtQueryInformationProcess,23_2_0110722A
      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 23_2_01105E4F NtSetInformationThread,23_2_01105E4F
      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 23_2_01107267 NtQueryInformationProcess,23_2_01107267
      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 23_2_0110728B NtQueryInformationProcess,23_2_0110728B
      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 23_2_011006B1 NtSetInformationThread,23_2_011006B1
      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 23_2_011072A9 NtQueryInformationProcess,23_2_011072A9
      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 23_2_011006CD NtSetInformationThread,23_2_011006CD
      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 23_2_011072CE NtQueryInformationProcess,23_2_011072CE
      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 23_2_011072EF NtQueryInformationProcess,23_2_011072EF
      Source: C:\Users\user\Desktop\Orden de Compra.exeCode function: 1_2_00408F7E1_2_00408F7E
      Source: C:\Users\user\Desktop\Orden de Compra.exeCode function: 1_2_0040904E1_2_0040904E
      Source: C:\Users\user\Desktop\Orden de Compra.exeCode function: 1_2_0040942F1_2_0040942F
      Source: C:\Users\user\Desktop\Orden de Compra.exeCode function: 1_2_004090D11_2_004090D1
      Source: C:\Users\user\Desktop\Orden de Compra.exeCode function: 1_2_004091581_2_00409158
      Source: C:\Users\user\Desktop\Orden de Compra.exeCode function: 1_2_0040D5E21_2_0040D5E2
      Source: C:\Users\user\Desktop\Orden de Compra.exeCode function: 1_2_004095E71_2_004095E7
      Source: C:\Users\user\Desktop\Orden de Compra.exeCode function: 1_2_0040959E1_2_0040959E
      Source: C:\Users\user\Desktop\Orden de Compra.exeCode function: 1_2_004096721_2_00409672
      Source: C:\Users\user\Desktop\Orden de Compra.exeCode function: 1_2_004092D31_2_004092D3
      Source: C:\Users\user\Desktop\Orden de Compra.exeCode function: 1_2_004096FD1_2_004096FD
      Source: C:\Users\user\Desktop\Orden de Compra.exeCode function: 1_2_0040931B1_2_0040931B
      Source: C:\Users\user\Desktop\Orden de Compra.exeCode function: 1_2_004097961_2_00409796
      Source: C:\Users\user\Desktop\Orden de Compra.exeCode function: 1_2_004093A01_2_004093A0
      Source: C:\Users\user\Desktop\Orden de Compra.exeCode function: 1_2_00408FBB1_2_00408FBB
      Source: Orden de Compra.exeStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
      Source: Orden de Compra.exeStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
      Source: Orden de Compra.exe, 00000001.00000002.797833511.0000000000416000.00000002.00020000.sdmpBinary or memory string: OriginalFilenameGulvhoejde9.exe vs Orden de Compra.exe
      Source: Orden de Compra.exe, 00000001.00000002.798116754.00000000020C0000.00000002.00000001.sdmpBinary or memory string: OriginalFilenameuser32j% vs Orden de Compra.exe
      Source: Orden de Compra.exeBinary or memory string: OriginalFilenameGulvhoejde9.exe vs Orden de Compra.exe
      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: sfc.dllJump to behavior
      Source: Orden de Compra.exeStatic PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
      Source: classification engineClassification label: mal96.troj.evad.winEXE@10/0@0/0
      Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5980:120:WilError_01
      Source: C:\Users\user\Desktop\Orden de Compra.exeFile created: C:\Users\user\AppData\Local\Temp\~DF2E7F733036C9C82D.TMPJump to behavior
      Source: Orden de Compra.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
      Source: C:\Users\user\Desktop\Orden de Compra.exeSection loaded: C:\Windows\SysWOW64\msvbvm60.dllJump to behavior
      Source: C:\Users\user\Desktop\Orden de Compra.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
      Source: Orden de Compra.exeReversingLabs: Detection: 10%
      Source: unknownProcess created: C:\Users\user\Desktop\Orden de Compra.exe 'C:\Users\user\Desktop\Orden de Compra.exe'
      Source: C:\Users\user\Desktop\Orden de Compra.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe 'C:\Users\user\Desktop\Orden de Compra.exe'
      Source: C:\Users\user\Desktop\Orden de Compra.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe 'C:\Users\user\Desktop\Orden de Compra.exe'
      Source: C:\Users\user\Desktop\Orden de Compra.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe 'C:\Users\user\Desktop\Orden de Compra.exe'
      Source: C:\Users\user\Desktop\Orden de Compra.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe 'C:\Users\user\Desktop\Orden de Compra.exe'
      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      Source: C:\Users\user\Desktop\Orden de Compra.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe 'C:\Users\user\Desktop\Orden de Compra.exe' Jump to behavior
      Source: C:\Users\user\Desktop\Orden de Compra.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe 'C:\Users\user\Desktop\Orden de Compra.exe' Jump to behavior
      Source: C:\Users\user\Desktop\Orden de Compra.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe 'C:\Users\user\Desktop\Orden de Compra.exe' Jump to behavior
      Source: C:\Users\user\Desktop\Orden de Compra.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe 'C:\Users\user\Desktop\Orden de Compra.exe' Jump to behavior
      Source: Window RecorderWindow detected: More than 3 window changes detected

      Data Obfuscation:

      barindex
      Yara detected GuLoaderShow sources
      Source: Yara matchFile source: 00000017.00000002.849537125.0000000001100000.00000040.00000001.sdmp, type: MEMORY
      Source: Yara matchFile source: Process Memory Space: RegAsm.exe PID: 6128, type: MEMORY
      Source: Orden de Compra.exeStatic PE information: real checksum: 0x267f4 should be: 0x2673a
      Source: C:\Users\user\Desktop\Orden de Compra.exeCode function: 1_2_00402027 push ss; ret 1_2_0040204C
      Source: C:\Users\user\Desktop\Orden de Compra.exeCode function: 1_2_00404569 push FFFFFFCDh; ret 1_2_004046DC
      Source: C:\Users\user\Desktop\Orden de Compra.exeCode function: 1_2_0040753C push ebx; ret 1_2_0040753E
      Source: C:\Users\user\Desktop\Orden de Compra.exeCode function: 1_2_0040D5E2 pushfd ; iretd 1_2_0040D812
      Source: C:\Users\user\Desktop\Orden de Compra.exeCode function: 1_2_00404671 push FFFFFFCDh; ret 1_2_004046DC
      Source: C:\Users\user\Desktop\Orden de Compra.exeCode function: 1_2_0040BA18 push 7600FFCEh; iretd 1_2_0040BA1D
      Source: C:\Users\user\Desktop\Orden de Compra.exeCode function: 1_2_0040DAC0 push ss; ret 1_2_0040DAC7
      Source: C:\Users\user\Desktop\Orden de Compra.exeCode function: 1_2_00407AF1 push FFFFFF85h; ret 1_2_00407AF3
      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 23_2_011049EE push ss; iretd 23_2_01104A1E
      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 23_2_011050D6 push ss; retn 0008h23_2_0110510E
      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 23_2_011048E9 push ss; iretd 23_2_01104A1E
      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 23_2_01103A85 push esi; ret 23_2_01103AA9
      Source: C:\Users\user\Desktop\Orden de Compra.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

      Malware Analysis System Evasion:

      barindex
      Contains functionality to detect hardware virtualization (CPUID execution measurement)Show sources
      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 23_2_01103C14 InternetOpenA,InternetOpenUrlA,LoadLibraryA,23_2_01103C14
      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 23_2_01100898 NtSetInformationThread,LoadLibraryA,23_2_01100898
      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 23_2_0110171E 23_2_0110171E
      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 23_2_01101746 23_2_01101746
      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 23_2_01101783 23_2_01101783
      Detected RDTSC dummy instruction sequence (likely for instruction hammering)Show sources
      Source: C:\Users\user\Desktop\Orden de Compra.exeRDTSC instruction interceptor: First address: 0000000000545B81 second address: 0000000000545B81 instructions:
      Source: C:\Users\user\Desktop\Orden de Compra.exeRDTSC instruction interceptor: First address: 0000000000543395 second address: 0000000000543395 instructions: 0x00000000 rdtsc 0x00000002 xor eax, eax 0x00000004 inc eax 0x00000005 cpuid 0x00000007 popad 0x00000008 call 00007EFEA8B88F58h 0x0000000d lfence 0x00000010 mov edx, dword ptr [7FFE0014h] 0x00000016 lfence 0x00000019 ret 0x0000001a sub edx, esi 0x0000001c ret 0x0000001d cld 0x0000001e pop ecx 0x0000001f add edi, edx 0x00000021 jmp 00007EFEA8B88F6Ah 0x00000023 cmp bx, dx 0x00000026 dec ecx 0x00000027 cmp ecx, 00000000h 0x0000002a jne 00007EFEA8B88F20h 0x0000002c test al, cl 0x0000002e push ecx 0x0000002f test bl, FFFFFFB4h 0x00000032 call 00007EFEA8B88FADh 0x00000037 call 00007EFEA8B88F68h 0x0000003c lfence 0x0000003f mov edx, dword ptr [7FFE0014h] 0x00000045 lfence 0x00000048 ret 0x00000049 mov esi, edx 0x0000004b pushad 0x0000004c rdtsc
      Source: C:\Users\user\Desktop\Orden de Compra.exeRDTSC instruction interceptor: First address: 0000000000543468 second address: 00000000005435BF instructions: 0x00000000 rdtsc 0x00000002 mov eax, 00000001h 0x00000007 cpuid 0x00000009 popad 0x0000000a test ch, dh 0x0000000c xor edi, edi 0x0000000e cmp cl, cl 0x00000010 cld 0x00000011 mov ecx, 000186A0h 0x00000016 push ecx 0x00000017 jmp 00007EFEA8B88F6Ah 0x00000019 cmp bx, 495Bh 0x0000001e cmp eax, eax 0x00000020 call 00007EFEA8B88FE6h 0x00000025 call 00007EFEA8B88FD6h 0x0000002a lfence 0x0000002d rdtsc
      Source: C:\Users\user\Desktop\Orden de Compra.exeRDTSC instruction interceptor: First address: 0000000000540D95 second address: 0000000000540D95 instructions:
      Source: C:\Users\user\Desktop\Orden de Compra.exeRDTSC instruction interceptor: First address: 0000000000542F2A second address: 0000000000542F2A instructions:
      Source: C:\Users\user\Desktop\Orden de Compra.exeRDTSC instruction interceptor: First address: 0000000000544CFB second address: 0000000000544CFB instructions:
      Source: C:\Users\user\Desktop\Orden de Compra.exeRDTSC instruction interceptor: First address: 0000000000542E25 second address: 0000000000542E25 instructions:
      Source: C:\Users\user\Desktop\Orden de Compra.exeRDTSC instruction interceptor: First address: 0000000000542EEB second address: 0000000000542EEB instructions:
      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeRDTSC instruction interceptor: First address: 0000000001103DF6 second address: 0000000001103DF6 instructions:
      Tries to detect Any.runShow sources
      Source: C:\Users\user\Desktop\Orden de Compra.exeFile opened: C:\Program Files\Qemu-ga\qemu-ga.exeJump to behavior
      Source: C:\Users\user\Desktop\Orden de Compra.exeFile opened: C:\Program Files\qga\qga.exeJump to behavior
      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Program Files\Qemu-ga\qemu-ga.exeJump to behavior
      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Program Files\qga\qga.exeJump to behavior
      Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)Show sources
      Source: RegAsm.exeBinary or memory string: ROGRAM FILES\QEMU-GA\QEMU-GA.EXE
      Source: RegAsm.exe, 00000017.00000002.849537125.0000000001100000.00000040.00000001.sdmpBinary or memory string: C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXE
      Tries to detect virtualization through RDTSC time measurementsShow sources
      Source: C:\Users\user\Desktop\Orden de Compra.exeRDTSC instruction interceptor: First address: 000000000054054A second address: 0000000000545F85 instructions: 0x00000000 rdtsc 0x00000002 lfence 0x00000005 shl edx, 20h 0x00000008 or edx, eax 0x0000000a popad 0x0000000b push 2D9CC76Ch 0x00000010 test dl, dl 0x00000012 test bl, cl 0x00000014 test eax, eax 0x00000016 call 00007EFEA8B8E94Bh 0x0000001b cmp edi, 0DCBE3ACh 0x00000021 cmp ecx, edx 0x00000023 cmp edx, edx 0x00000025 jmp 00007EFEA8B88F6Ah 0x00000027 pushad 0x00000028 mov ebx, 000000C5h 0x0000002d rdtsc
      Source: C:\Users\user\Desktop\Orden de Compra.exeRDTSC instruction interceptor: First address: 0000000000545B81 second address: 0000000000545B81 instructions:
      Source: C:\Users\user\Desktop\Orden de Compra.exeRDTSC instruction interceptor: First address: 0000000000543395 second address: 0000000000543395 instructions: 0x00000000 rdtsc 0x00000002 xor eax, eax 0x00000004 inc eax 0x00000005 cpuid 0x00000007 popad 0x00000008 call 00007EFEA8B88F58h 0x0000000d lfence 0x00000010 mov edx, dword ptr [7FFE0014h] 0x00000016 lfence 0x00000019 ret 0x0000001a sub edx, esi 0x0000001c ret 0x0000001d cld 0x0000001e pop ecx 0x0000001f add edi, edx 0x00000021 jmp 00007EFEA8B88F6Ah 0x00000023 cmp bx, dx 0x00000026 dec ecx 0x00000027 cmp ecx, 00000000h 0x0000002a jne 00007EFEA8B88F20h 0x0000002c test al, cl 0x0000002e push ecx 0x0000002f test bl, FFFFFFB4h 0x00000032 call 00007EFEA8B88FADh 0x00000037 call 00007EFEA8B88F68h 0x0000003c lfence 0x0000003f mov edx, dword ptr [7FFE0014h] 0x00000045 lfence 0x00000048 ret 0x00000049 mov esi, edx 0x0000004b pushad 0x0000004c rdtsc
      Source: C:\Users\user\Desktop\Orden de Compra.exeRDTSC instruction interceptor: First address: 0000000000543437 second address: 0000000000543468 instructions: 0x00000000 rdtsc 0x00000002 popad 0x00000003 jmp 00007EFEA8B88D9Ah 0x00000005 test cx, dx 0x00000008 mov dword ptr [ebp+0000009Ch], 00000000h 0x00000012 test esi, 206C76DAh 0x00000018 pushad 0x00000019 rdtsc
      Source: C:\Users\user\Desktop\Orden de Compra.exeRDTSC instruction interceptor: First address: 0000000000543468 second address: 00000000005435BF instructions: 0x00000000 rdtsc 0x00000002 mov eax, 00000001h 0x00000007 cpuid 0x00000009 popad 0x0000000a test ch, dh 0x0000000c xor edi, edi 0x0000000e cmp cl, cl 0x00000010 cld 0x00000011 mov ecx, 000186A0h 0x00000016 push ecx 0x00000017 jmp 00007EFEA8B88F6Ah 0x00000019 cmp bx, 495Bh 0x0000001e cmp eax, eax 0x00000020 call 00007EFEA8B88FE6h 0x00000025 call 00007EFEA8B88FD6h 0x0000002a lfence 0x0000002d rdtsc
      Source: C:\Users\user\Desktop\Orden de Compra.exeRDTSC instruction interceptor: First address: 00000000005435BF second address: 00000000005435BF instructions: 0x00000000 rdtsc 0x00000002 lfence 0x00000005 shl edx, 20h 0x00000008 or edx, eax 0x0000000a ret 0x0000000b mov esi, edx 0x0000000d pushad 0x0000000e xor eax, eax 0x00000010 inc eax 0x00000011 cpuid 0x00000013 bt ecx, 1Fh 0x00000017 jc 00007EFEA8B8BA06h 0x0000001d popad 0x0000001e jmp 00007EFEA8B88D9Ah 0x00000020 cmp bx, ax 0x00000023 call 00007EFEA8B88DD1h 0x00000028 lfence 0x0000002b rdtsc
      Source: C:\Users\user\Desktop\Orden de Compra.exeRDTSC instruction interceptor: First address: 0000000000540D95 second address: 0000000000540D95 instructions:
      Source: C:\Users\user\Desktop\Orden de Compra.exeRDTSC instruction interceptor: First address: 0000000000542F2A second address: 0000000000542F2A instructions:
      Source: C:\Users\user\Desktop\Orden de Compra.exeRDTSC instruction interceptor: First address: 0000000000544CFB second address: 0000000000544CFB instructions:
      Source: C:\Users\user\Desktop\Orden de Compra.exeRDTSC instruction interceptor: First address: 0000000000542E25 second address: 0000000000542E25 instructions:
      Source: C:\Users\user\Desktop\Orden de Compra.exeRDTSC instruction interceptor: First address: 0000000000542EEB second address: 0000000000542EEB instructions:
      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeRDTSC instruction interceptor: First address: 000000000110054A second address: 0000000001105F85 instructions: 0x00000000 rdtsc 0x00000002 lfence 0x00000005 shl edx, 20h 0x00000008 or edx, eax 0x0000000a popad 0x0000000b push 2D9CC76Ch 0x00000010 test dl, dl 0x00000012 test bl, cl 0x00000014 test eax, eax 0x00000016 call 00007EFEA8B8E77Bh 0x0000001b cmp edi, 0DCBE3ACh 0x00000021 cmp ecx, edx 0x00000023 cmp edx, edx 0x00000025 jmp 00007EFEA8B88D9Ah 0x00000027 pushad 0x00000028 mov ebx, 000000C5h 0x0000002d rdtsc
      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeRDTSC instruction interceptor: First address: 0000000001103437 second address: 00000000011035BF instructions: 0x00000000 rdtsc 0x00000002 popad 0x00000003 jmp 00007EFEA8B88F6Ah 0x00000005 test cx, dx 0x00000008 mov dword ptr [ebp+0000009Ch], 00000000h 0x00000012 test esi, 206C76DAh 0x00000018 pushad 0x00000019 nop 0x0000001a nop 0x0000001b mov eax, 00000001h 0x00000020 cpuid 0x00000022 popad 0x00000023 test ch, dh 0x00000025 xor edi, edi 0x00000027 cmp cl, cl 0x00000029 cld 0x0000002a mov ecx, 000186A0h 0x0000002f push ecx 0x00000030 jmp 00007EFEA8B88F6Ah 0x00000032 cmp bx, 495Bh 0x00000037 cmp eax, eax 0x00000039 call 00007EFEA8B88FE6h 0x0000003e call 00007EFEA8B88FD6h 0x00000043 lfence 0x00000046 rdtsc
      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeRDTSC instruction interceptor: First address: 00000000011035BF second address: 00000000011035BF instructions: 0x00000000 rdtsc 0x00000002 lfence 0x00000005 shl edx, 20h 0x00000008 or edx, eax 0x0000000a ret 0x0000000b mov esi, edx 0x0000000d pushad 0x0000000e xor eax, eax 0x00000010 inc eax 0x00000011 cpuid 0x00000013 bt ecx, 1Fh 0x00000017 jc 00007EFEA8B8BA06h 0x0000001d popad 0x0000001e jmp 00007EFEA8B88D9Ah 0x00000020 cmp bx, ax 0x00000023 call 00007EFEA8B88DD1h 0x00000028 lfence 0x0000002b rdtsc
      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeRDTSC instruction interceptor: First address: 0000000001103DF6 second address: 0000000001103DF6 instructions:
      Source: C:\Users\user\Desktop\Orden de Compra.exeCode function: 1_2_00408F7E rdtsc 1_2_00408F7E
      Source: C:\Users\user\Desktop\Orden de Compra.exeAPI coverage: 9.3 %
      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeAPI coverage: 6.5 %
      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 6380Thread sleep time: -2580000s >= -30000sJump to behavior
      Source: all processesThread injection, dropped files, key value created, disk infection and DNS query: no activity detected
      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeLast function: Thread delayed
      Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
      Source: RegAsm.exeBinary or memory string: rogram Files\Qemu-ga\qemu-ga.exe
      Source: RegAsm.exe, 00000017.00000002.849793142.00000000013EF000.00000004.00000020.sdmpBinary or memory string: Hyper-V RAWpZB
      Source: RegAsm.exe, 00000017.00000002.849831122.000000000141B000.00000004.00000020.sdmpBinary or memory string: Hyper-V RAW
      Source: RegAsm.exe, 00000017.00000002.849537125.0000000001100000.00000040.00000001.sdmpBinary or memory string: C:\Program Files\Qemu-ga\qemu-ga.exe

      Anti Debugging:

      barindex
      Contains functionality to hide a thread from the debuggerShow sources
      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 23_2_01100898 NtSetInformationThread 000000FE,00000011,00000000,00000000,00000040,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000,?,0110582323_2_01100898
      Found potential dummy code loops (likely to delay analysis)Show sources
      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess Stats: CPU usage > 90% for more than 60s
      Hides threads from debuggersShow sources
      Source: C:\Users\user\Desktop\Orden de Compra.exeThread information set: HideFromDebuggerJump to behavior
      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeThread information set: HideFromDebuggerJump to behavior
      Source: C:\Users\user\Desktop\Orden de Compra.exeProcess queried: DebugPortJump to behavior
      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess queried: DebugPortJump to behavior
      Source: C:\Users\user\Desktop\Orden de Compra.exeCode function: 1_2_00408F7E rdtsc 1_2_00408F7E
      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 23_2_011066BF mov eax, dword ptr fs:[00000030h]23_2_011066BF
      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 23_2_01102161 mov eax, dword ptr fs:[00000030h]23_2_01102161
      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 23_2_01102165 mov eax, dword ptr fs:[00000030h]23_2_01102165
      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 23_2_0110219E mov eax, dword ptr fs:[00000030h]23_2_0110219E
      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 23_2_011031C9 mov eax, dword ptr fs:[00000030h]23_2_011031C9
      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 23_2_011054C7 mov eax, dword ptr fs:[00000030h]23_2_011054C7
      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 23_2_011018C8 mov eax, dword ptr fs:[00000030h]23_2_011018C8
      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 23_2_011054C9 mov eax, dword ptr fs:[00000030h]23_2_011054C9
      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 23_2_01101F07 mov eax, dword ptr fs:[00000030h]23_2_01101F07
      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 23_2_01105E4F mov eax, dword ptr fs:[00000030h]23_2_01105E4F
      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 23_2_011066CD mov eax, dword ptr fs:[00000030h]23_2_011066CD
      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 23_2_011066E8 mov eax, dword ptr fs:[00000030h]23_2_011066E8
      Source: all processesThread injection, dropped files, key value created, disk infection and DNS query: no activity detected

      HIPS / PFW / Operating System Protection Evasion:

      barindex
      Writes to foreign memory regionsShow sources
      Source: C:\Users\user\Desktop\Orden de Compra.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 1100000Jump to behavior
      Source: C:\Users\user\Desktop\Orden de Compra.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe 'C:\Users\user\Desktop\Orden de Compra.exe' Jump to behavior
      Source: C:\Users\user\Desktop\Orden de Compra.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe 'C:\Users\user\Desktop\Orden de Compra.exe' Jump to behavior
      Source: C:\Users\user\Desktop\Orden de Compra.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe 'C:\Users\user\Desktop\Orden de Compra.exe' Jump to behavior
      Source: C:\Users\user\Desktop\Orden de Compra.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe 'C:\Users\user\Desktop\Orden de Compra.exe' Jump to behavior
      Source: RegAsm.exe, 00000017.00000002.849941377.0000000001990000.00000002.00000001.sdmpBinary or memory string: Shell_TrayWnd
      Source: RegAsm.exe, 00000017.00000002.849941377.0000000001990000.00000002.00000001.sdmpBinary or memory string: Progman
      Source: RegAsm.exe, 00000017.00000002.849941377.0000000001990000.00000002.00000001.sdmpBinary or memory string: &Program Manager
      Source: RegAsm.exe, 00000017.00000002.849941377.0000000001990000.00000002.00000001.sdmpBinary or memory string: Progmanlock

      Mitre Att&ck Matrix

      Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
      Valid AccountsWindows Management InstrumentationDLL Side-Loading1Process Injection112Virtualization/Sandbox Evasion321OS Credential DumpingSecurity Software Discovery821Remote ServicesArchive Collected Data1Exfiltration Over Other Network MediumEncrypted Channel1Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
      Default AccountsScheduled Task/JobBoot or Logon Initialization ScriptsDLL Side-Loading1Process Injection112LSASS MemoryVirtualization/Sandbox Evasion321Remote Desktop ProtocolData from Removable MediaExfiltration Over BluetoothJunk DataExploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
      Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)DLL Side-Loading1Security Account ManagerProcess Discovery1SMB/Windows Admin SharesData from Network Shared DriveAutomated ExfiltrationSteganographyExploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
      Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)Obfuscated Files or Information1NTDSSystem Information Discovery31Distributed Component Object ModelInput CaptureScheduled TransferProtocol ImpersonationSIM Card SwapCarrier Billing Fraud
      Cloud AccountsCronNetwork Logon ScriptNetwork Logon ScriptSoftware PackingLSA SecretsRemote System Discovery1SSHKeyloggingData Transfer Size LimitsFallback ChannelsManipulate Device CommunicationManipulate App Store Rankings or Ratings

      Behavior Graph

      Hide Legend

      Legend:

      • Process
      • Signature
      • Created File
      • DNS/IP Info
      • Is Dropped
      • Is Windows Process
      • Number of created Registry Values
      • Number of created Files
      • Visual Basic
      • Delphi
      • Java
      • .Net C# or VB.NET
      • C, C++ or other language
      • Is malicious
      • Internet

      Screenshots

      Thumbnails

      This section contains all screenshots as thumbnails, including those not shown in the slideshow.