Play interactive tour

Edit tour

Analysis Report ORDER.exe

Overview

General Information

Sample Name:	ORDER.exe
Analysis ID:	383969
MD5:	351279e865038f0d4f1c34be92c5ffcf
SHA1:	dd5ac844657d2351e686c593fc87a450381e3a89
SHA256:	dd7f52fd623b7913c7494ecebae45a9b4dd843b5a363652e3ab92da9cdb3a691
Tags:	AgentTeslaexe
Infos:
Most interesting Screenshot:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Scheduled temp file as task from temp location

Yara detected AgentTesla

Yara detected AntiVM3

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code contains very large array initializations

.NET source code references suspicious native API functions

Initial sample is a PE file and has a suspicious name

Injects a PE file into a foreign processes

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Uses schtasks.exe or at.exe to add and modify task schedules

Antivirus or Machine Learning detection for unpacked file

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

PE file contains strange resources

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Startup

System is w10x64

ORDER.exe (PID: 5428 cmdline: 'C:\Users\user\Desktop\ORDER.exe' MD5: 351279E865038F0D4F1C34BE92C5FFCF)

schtasks.exe (PID: 240 cmdline: 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\uAtuTtfXv' /XML 'C:\Users\user\AppData\Local\Temp\tmp7391.tmp' MD5: 15FF7D8324231381BAD48A052F85DF04)

conhost.exe (PID: 6072 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

ORDER.exe (PID: 6052 cmdline: {path} MD5: 351279E865038F0D4F1C34BE92C5FFCF)

dw20.exe (PID: 6088 cmdline: dw20.exe -x -s 756 MD5: 8D10DA8A3E11747E51F23C882C22BBC3)

cleanup

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "Telegram", "Chat id": "1422871978", "Chat URL": "https://api.telegram.org/bot1624300088:AAErstUTFyyeTcKqXZnnSnwnH27Dy-zCSTc/sendDocument"}

Yara Overview

Memory Dumps

Source	Rule	Description	Author
00000001.00000002.236134053.0000000003E01000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000006.00000002.249166242.0000000000402000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: ORDER.exe PID: 5428	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: ORDER.exe PID: 5428	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: ORDER.exe PID: 6052	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security

Unpacked PEs

Source	Rule	Description	Author
1.2.ORDER.exe.4085d88.2.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
6.2.ORDER.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
1.2.ORDER.exe.40bbfa8.4.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
1.2.ORDER.exe.4085d88.2.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
1.2.ORDER.exe.3f9d948.3.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security

Sigma Overview

System Summary:

Sigma detected: Scheduled temp file as task from temp location

Show sources

Source: Process started

Author: Joe Security: Data: Command: 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\uAtuTtfXv' /XML 'C:\Users\user\AppData\Local\Temp\tmp7391.tmp', CommandLine: 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\uAtuTtfXv' /XML 'C:\Users\user\AppData\Local\Temp\tmp7391.tmp', CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: 'C:\Users\user\Desktop\ORDER.exe' , ParentImage: C:\Users\user\Desktop\ORDER.exe, ParentProcessId: 5428, ProcessCommandLine: 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\uAtuTtfXv' /XML 'C:\Users\user\AppData\Local\Temp\tmp7391.tmp', ProcessId: 240

Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: 6.2.ORDER.exe.400000.0.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "Telegram", "Chat id": "1422871978", "Chat URL": "https://api.telegram.org/bot1624300088:AAErstUTFyyeTcKqXZnnSnwnH27Dy-zCSTc/sendDocument"}

Multi AV Scanner detection for dropped file

Show sources

Source: C:\Users\user\AppData\Roaming\uAtuTtfXv.exe

ReversingLabs: Detection: 27%

Multi AV Scanner detection for submitted file

Show sources

Source: ORDER.exe	Virustotal: Detection: 38%			Perma Link
Source: ORDER.exe	ReversingLabs: Detection: 27%

Source: 6.2.ORDER.exe.400000.0.unpack

Avira: Label: TR/Spy.Gen8

Source: ORDER.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: C:\Users\user\Desktop\ORDER.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9445_none_d08c58b4442ba54f\MSVCR80.dll

Source: ORDER.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source:

Binary string: mscorrc.pdb source: ORDER.exe, 00000001.00000002.240910596.00000000071E0000.00000002.00000001.sdmp, ORDER.exe, 00000006.00000002.250157695.0000000004D80000.00000002.00000001.sdmp

Source: ORDER.exe, 00000001.00000003.213511591.00000000012FD000.00000004.00000001.sdmp	String found in binary or memory: http://en.wDX
Source: ORDER.exe, 00000001.00000002.240280153.00000000065B2000.00000004.00000001.sdmp	String found in binary or memory: http://fontfabrik.com
Source: ORDER.exe, 00000001.00000003.214219445.000000000533B000.00000004.00000001.sdmp	String found in binary or memory: http://fontfabrik.com/
Source: ORDER.exe, 00000001.00000002.240280153.00000000065B2000.00000004.00000001.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: ORDER.exe, 00000001.00000003.216441928.0000000005330000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.com
Source: ORDER.exe, 00000001.00000002.240280153.00000000065B2000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: ORDER.exe, 00000001.00000002.240280153.00000000065B2000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: ORDER.exe, 00000001.00000002.240280153.00000000065B2000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: ORDER.exe, 00000001.00000002.240280153.00000000065B2000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: ORDER.exe, 00000001.00000002.240280153.00000000065B2000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: ORDER.exe, 00000001.00000002.240280153.00000000065B2000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: ORDER.exe, 00000001.00000002.240280153.00000000065B2000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: ORDER.exe, 00000001.00000002.240280153.00000000065B2000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: ORDER.exe, 00000001.00000002.240280153.00000000065B2000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: ORDER.exe, 00000001.00000003.220904273.0000000005329000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designersR
Source: ORDER.exe, 00000001.00000003.234693220.0000000005320000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.coma
Source: ORDER.exe, 00000001.00000003.213937928.000000000533B000.00000004.00000001.sdmp	String found in binary or memory: http://www.fonts.com
Source: ORDER.exe, 00000001.00000003.213958029.000000000533B000.00000004.00000001.sdmp	String found in binary or memory: http://www.fonts.com-u
Source: ORDER.exe, 00000001.00000003.213937928.000000000533B000.00000004.00000001.sdmp	String found in binary or memory: http://www.fonts.com4
Source: ORDER.exe, 00000001.00000003.213937928.000000000533B000.00000004.00000001.sdmp	String found in binary or memory: http://www.fonts.comic
Source: ORDER.exe, 00000001.00000003.213984328.000000000533B000.00000004.00000001.sdmp	String found in binary or memory: http://www.fonts.comn%
Source: ORDER.exe, 00000001.00000003.215985763.0000000005324000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.cl
Source: ORDER.exe, 00000001.00000003.216118395.000000000532B000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: ORDER.exe, 00000001.00000003.215985763.0000000005324000.00000004.00000001.sdmp, ORDER.exe, 00000001.00000003.215719190.000000000535D000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/
Source: ORDER.exe, 00000001.00000002.240280153.00000000065B2000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: ORDER.exe, 00000001.00000002.240280153.00000000065B2000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: ORDER.exe, 00000001.00000003.215719190.000000000535D000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn2
Source: ORDER.exe, 00000001.00000003.215719190.000000000535D000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cnJ
Source: ORDER.exe, 00000001.00000003.215719190.000000000535D000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cnl-sw
Source: ORDER.exe, 00000001.00000002.240280153.00000000065B2000.00000004.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: ORDER.exe, 00000001.00000002.240280153.00000000065B2000.00000004.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: ORDER.exe, 00000001.00000002.240280153.00000000065B2000.00000004.00000001.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: ORDER.exe, 00000001.00000002.240280153.00000000065B2000.00000004.00000001.sdmp, ORDER.exe, 00000001.00000003.217614683.0000000005324000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: ORDER.exe, 00000001.00000003.217614683.0000000005324000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/Gras
Source: ORDER.exe, 00000001.00000003.217614683.0000000005324000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/Verd
Source: ORDER.exe, 00000001.00000003.217614683.0000000005324000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/VerdJ
Source: ORDER.exe, 00000001.00000003.217614683.0000000005324000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/W
Source: ORDER.exe, 00000001.00000003.217614683.0000000005324000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/
Source: ORDER.exe, 00000001.00000003.217614683.0000000005324000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/0
Source: ORDER.exe, 00000001.00000003.217614683.0000000005324000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/x
Source: ORDER.exe, 00000001.00000003.213978180.0000000005344000.00000004.00000001.sdmp, ORDER.exe, 00000001.00000002.240280153.00000000065B2000.00000004.00000001.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: ORDER.exe, 00000001.00000003.213937928.000000000533B000.00000004.00000001.sdmp	String found in binary or memory: http://www.sajatypeworks.com4
Source: ORDER.exe, 00000001.00000002.240280153.00000000065B2000.00000004.00000001.sdmp	String found in binary or memory: http://www.sakkal.com
Source: ORDER.exe, 00000001.00000002.240280153.00000000065B2000.00000004.00000001.sdmp, ORDER.exe, 00000001.00000003.215056921.0000000005329000.00000004.00000001.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: ORDER.exe, 00000001.00000003.215056921.0000000005329000.00000004.00000001.sdmp	String found in binary or memory: http://www.sandoll.co.krtri
Source: ORDER.exe, 00000001.00000002.240280153.00000000065B2000.00000004.00000001.sdmp, ORDER.exe, 00000001.00000003.214219445.000000000533B000.00000004.00000001.sdmp	String found in binary or memory: http://www.tiro.com
Source: ORDER.exe, 00000001.00000003.214191426.000000000533B000.00000004.00000001.sdmp	String found in binary or memory: http://www.tiro.com3
Source: ORDER.exe, 00000001.00000003.214219445.000000000533B000.00000004.00000001.sdmp	String found in binary or memory: http://www.tiro.comF
Source: ORDER.exe, 00000001.00000002.240280153.00000000065B2000.00000004.00000001.sdmp	String found in binary or memory: http://www.typography.netD
Source: ORDER.exe, 00000001.00000002.240280153.00000000065B2000.00000004.00000001.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: ORDER.exe, 00000001.00000002.240280153.00000000065B2000.00000004.00000001.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: ORDER.exe, 00000001.00000002.236134053.0000000003E01000.00000004.00000001.sdmp, ORDER.exe, 00000006.00000002.249166242.0000000000402000.00000040.00000001.sdmp	String found in binary or memory: https://api.telegram.org/bot1624300088:AAErstUTFyyeTcKqXZnnSnwnH27Dy-zCSTc/
Source: ORDER.exe	String found in binary or memory: https://github.com/michel-pi/EasyBot.Net
Source: ORDER.exe, 00000001.00000002.236134053.0000000003E01000.00000004.00000001.sdmp, ORDER.exe, 00000006.00000002.249166242.0000000000402000.00000040.00000001.sdmp	String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip

System Summary:

.NET source code contains very large array initializations

Show sources

Source: 6.2.ORDER.exe.400000.0.unpack, u003cPrivateImplementationDetailsu003eu007b6DDA3EFAu002d4B94u002d45A4u002d8314u002dC206B63ABCA4u007d/FD4A8E35u002dA159u002d48C6u002dB730u002dD5C8C22BA113.cs

Large array initialization: .cctor: array initializer size 12007

Initial sample is a PE file and has a suspicious name

Show sources

Source: initial sample

Static PE information: Filename: ORDER.exe

Source: C:\Users\user\Desktop\ORDER.exe	Code function: 1_2_05002540
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 1_2_05000168
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 1_2_0500BDE8
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 1_2_0500CCF8
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 1_2_05002F58
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 1_2_05004B88
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 1_2_05001FE0
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 1_2_05004228
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 1_2_05005A48
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 1_2_0500CA50
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 1_2_05003AE0
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 1_2_05002AEF
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 1_2_05007908
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 1_2_05002530
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 1_2_05005949
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 1_2_05007D52
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 1_2_05000158
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 1_2_050059D5
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 1_2_0500BDDB
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 1_2_05008C97
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 1_2_0500ACB8
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 1_2_0500ACC8
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 1_2_05008CD0
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 1_2_0500A0E8
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 1_2_0500CCE8
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 1_2_0500A0F8
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 1_2_050078F9
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 1_2_0500C711
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 1_2_05007728
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 1_2_05007738
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 1_2_05007B60
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 1_2_05007B70
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 1_2_05009209
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 1_2_05003A33
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 1_2_05009A48
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 1_2_05009250
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 1_2_050046AA
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 1_2_05009EAA
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 1_2_05003AB5
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 1_2_0500A6C0
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 1_2_0500A6C8

Source: C:\Users\user\Desktop\ORDER.exe

Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe dw20.exe -x -s 756

Source: ORDER.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: uAtuTtfXv.exe.1.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: ORDER.exe	Binary or memory string: OriginalFilename vs ORDER.exe
Source: ORDER.exe, 00000001.00000000.212574641.0000000000762000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenamez! vs ORDER.exe
Source: ORDER.exe, 00000001.00000002.240647201.0000000006F70000.00000002.00000001.sdmp	Binary or memory string: originalfilename vs ORDER.exe
Source: ORDER.exe, 00000001.00000002.240647201.0000000006F70000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamepropsys.dll.mui@ vs ORDER.exe
Source: ORDER.exe, 00000001.00000002.236134053.0000000003E01000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameMajorRevision.exe< vs ORDER.exe
Source: ORDER.exe, 00000001.00000002.236134053.0000000003E01000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameztFsqdVrHZZUnwKBzrNwmgelgcKcSFZldwMyw.exe4 vs ORDER.exe
Source: ORDER.exe, 00000001.00000002.240910596.00000000071E0000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamemscorrc.dllT vs ORDER.exe
Source: ORDER.exe, 00000001.00000002.240985351.00000000072B0000.00000002.00000001.sdmp	Binary or memory string: System.OriginalFileName vs ORDER.exe
Source: ORDER.exe, 00000001.00000002.240978420.0000000007290000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameMetroFramework.dll> vs ORDER.exe
Source: ORDER.exe	Binary or memory string: OriginalFilename vs ORDER.exe
Source: ORDER.exe, 00000006.00000000.234348930.0000000000512000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenamez! vs ORDER.exe
Source: ORDER.exe, 00000006.00000002.250157695.0000000004D80000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamemscorrc.dllT vs ORDER.exe
Source: ORDER.exe, 00000006.00000002.249622939.0000000000BFA000.00000004.00000020.sdmp	Binary or memory string: OriginalFilenamemscorwks.dllT vs ORDER.exe
Source: ORDER.exe, 00000006.00000002.249166242.0000000000402000.00000040.00000001.sdmp	Binary or memory string: OriginalFilenameztFsqdVrHZZUnwKBzrNwmgelgcKcSFZldwMyw.exe4 vs ORDER.exe
Source: ORDER.exe	Binary or memory string: OriginalFilenamez! vs ORDER.exe

Source: ORDER.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: ORDER.exe	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: uAtuTtfXv.exe.1.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: 6.2.ORDER.exe.400000.0.unpack, A/b2.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 6.2.ORDER.exe.400000.0.unpack, A/b2.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'

Source: classification engine

Classification label: mal100.troj.evad.winEXE@8/6@0/0

Source: C:\Users\user\Desktop\ORDER.exe

File created: C:\Users\user\AppData\Roaming\uAtuTtfXv.exe

Jump to behavior

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6072:120:WilError_01

Source: C:\Users\user\Desktop\ORDER.exe

File created: C:\Users\user\AppData\Local\Temp\tmp7391.tmp

Jump to behavior

Source: ORDER.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\ORDER.exe	Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9603718106bd57ecfbb18fefd769cab4\mscorlib.ni.dll
Source: C:\Users\user\Desktop\ORDER.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp
Source: C:\Users\user\Desktop\ORDER.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp
Source: C:\Users\user\Desktop\ORDER.exe	Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9603718106bd57ecfbb18fefd769cab4\mscorlib.ni.dll
Source: C:\Users\user\Desktop\ORDER.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp
Source: C:\Users\user\Desktop\ORDER.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp

Source: C:\Users\user\Desktop\ORDER.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\ORDER.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Source: ORDER.exe	Virustotal: Detection: 38%
Source: ORDER.exe	ReversingLabs: Detection: 27%

Source: C:\Users\user\Desktop\ORDER.exe

File read: C:\Users\user\Desktop\ORDER.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\ORDER.exe 'C:\Users\user\Desktop\ORDER.exe'
Source: C:\Users\user\Desktop\ORDER.exe	Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\uAtuTtfXv' /XML 'C:\Users\user\AppData\Local\Temp\tmp7391.tmp'
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\ORDER.exe	Process created: C:\Users\user\Desktop\ORDER.exe {path}
Source: C:\Users\user\Desktop\ORDER.exe	Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe dw20.exe -x -s 756
Source: C:\Users\user\Desktop\ORDER.exe	Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\uAtuTtfXv' /XML 'C:\Users\user\AppData\Local\Temp\tmp7391.tmp'
Source: C:\Users\user\Desktop\ORDER.exe	Process created: C:\Users\user\Desktop\ORDER.exe {path}
Source: C:\Users\user\Desktop\ORDER.exe	Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe dw20.exe -x -s 756

Source: C:\Users\user\Desktop\ORDER.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\InProcServer32

Source: C:\Users\user\Desktop\ORDER.exe

File opened: C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorrc.dll

Source: ORDER.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: C:\Users\user\Desktop\ORDER.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9445_none_d08c58b4442ba54f\MSVCR80.dll

Source: ORDER.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source:

Binary string: mscorrc.pdb source: ORDER.exe, 00000001.00000002.240910596.00000000071E0000.00000002.00000001.sdmp, ORDER.exe, 00000006.00000002.250157695.0000000004D80000.00000002.00000001.sdmp

Data Obfuscation:

.NET source code contains method to dynamically call methods (often used by packers)

Show sources

Source: ORDER.exe, ImageManager/Main.cs	.Net Code: LateBinding.LateCall(V_6, null, "Invoke", new object[] { 0, V_0 }, null, null)
Source: uAtuTtfXv.exe.1.dr, ImageManager/Main.cs	.Net Code: LateBinding.LateCall(V_6, null, "Invoke", new object[] { 0, V_0 }, null, null)
Source: 1.2.ORDER.exe.760000.0.unpack, ImageManager/Main.cs	.Net Code: LateBinding.LateCall(V_6, null, "Invoke", new object[] { 0, V_0 }, null, null)
Source: 1.0.ORDER.exe.760000.0.unpack, ImageManager/Main.cs	.Net Code: LateBinding.LateCall(V_6, null, "Invoke", new object[] { 0, V_0 }, null, null)
Source: 6.0.ORDER.exe.510000.0.unpack, ImageManager/Main.cs	.Net Code: LateBinding.LateCall(V_6, null, "Invoke", new object[] { 0, V_0 }, null, null)
Source: 6.2.ORDER.exe.510000.1.unpack, ImageManager/Main.cs	.Net Code: LateBinding.LateCall(V_6, null, "Invoke", new object[] { 0, V_0 }, null, null)

Source: C:\Users\user\Desktop\ORDER.exe	Code function: 1_2_0500A5AC push ss; retf
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 1_2_0500842C push esp; iretd
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 1_2_0500D3B8 push edx; iretd

Source: initial sample	Static PE information: section name: .text entropy: 7.89896443713
Source: initial sample	Static PE information: section name: .text entropy: 7.89896443713

Source: C:\Users\user\Desktop\ORDER.exe

File created: C:\Users\user\AppData\Roaming\uAtuTtfXv.exe

Jump to dropped file

Boot Survival:

Uses schtasks.exe or at.exe to add and modify task schedules

Show sources

Source: C:\Users\user\Desktop\ORDER.exe

Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\uAtuTtfXv' /XML 'C:\Users\user\AppData\Local\Temp\tmp7391.tmp'

Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion:

Yara detected AntiVM3

Show sources

Source: Yara match

File source: Process Memory Space: ORDER.exe PID: 5428, type: MEMORY

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Show sources

Source: ORDER.exe, 00000001.00000002.241737239.0000000007572000.00000004.00000001.sdmp	Binary or memory string: WINE_GET_UNIX_FILE_NAME
Source: ORDER.exe, 00000001.00000002.241737239.0000000007572000.00000004.00000001.sdmp	Binary or memory string: SBIEDLL.DLL

Source: C:\Users\user\Desktop\ORDER.exe

File opened / queried: SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}

Source: C:\Users\user\Desktop\ORDER.exe

Thread delayed: delay time: 922337203685477

Source: C:\Users\user\Desktop\ORDER.exe TID: 4688	Thread sleep time: -31500s >= -30000s
Source: C:\Users\user\Desktop\ORDER.exe TID: 5080	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\ORDER.exe	Thread delayed: delay time: 31500
Source: C:\Users\user\Desktop\ORDER.exe	Thread delayed: delay time: 922337203685477

Source: ORDER.exe, 00000001.00000002.241737239.0000000007572000.00000004.00000001.sdmp	Binary or memory string: VMware SVGA IIOData Source=localhost\sqlexpress;Initial Catalog=dbSMS;Integrated Security=True
Source: ORDER.exe, 00000001.00000002.241737239.0000000007572000.00000004.00000001.sdmp	Binary or memory string: vmware
Source: ORDER.exe, 00000001.00000002.241737239.0000000007572000.00000004.00000001.sdmp	Binary or memory string: C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: ORDER.exe, 00000001.00000002.241737239.0000000007572000.00000004.00000001.sdmp	Binary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
Source: ORDER.exe, 00000001.00000002.241737239.0000000007572000.00000004.00000001.sdmp	Binary or memory string: VMWARE
Source: ORDER.exe, 00000001.00000002.241737239.0000000007572000.00000004.00000001.sdmp	Binary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: ORDER.exe, 00000001.00000002.241737239.0000000007572000.00000004.00000001.sdmp	Binary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
Source: ORDER.exe, 00000001.00000002.241737239.0000000007572000.00000004.00000001.sdmp	Binary or memory string: VMware SVGA II
Source: ORDER.exe, 00000001.00000002.241737239.0000000007572000.00000004.00000001.sdmp	Binary or memory string: vmwareNSYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000

Source: C:\Users\user\Desktop\ORDER.exe	Process queried: DebugPort
Source: C:\Users\user\Desktop\ORDER.exe	Process queried: DebugPort

Source: C:\Users\user\Desktop\ORDER.exe

Memory allocated: page read and write | page guard

HIPS / PFW / Operating System Protection Evasion:

.NET source code references suspicious native API functions

Show sources

Source: ORDER.exe, ImageManager/PInvoke/WinApi.cs	Reference to suspicious API methods: ('InternalLoadLibraryW', 'LoadLibraryW@kernel32.dll'), ('InternalGetProcAddress', 'GetProcAddress@kernel32.dll')
Source: uAtuTtfXv.exe.1.dr, ImageManager/PInvoke/WinApi.cs	Reference to suspicious API methods: ('InternalLoadLibraryW', 'LoadLibraryW@kernel32.dll'), ('InternalGetProcAddress', 'GetProcAddress@kernel32.dll')
Source: 1.2.ORDER.exe.760000.0.unpack, ImageManager/PInvoke/WinApi.cs	Reference to suspicious API methods: ('InternalLoadLibraryW', 'LoadLibraryW@kernel32.dll'), ('InternalGetProcAddress', 'GetProcAddress@kernel32.dll')
Source: 1.0.ORDER.exe.760000.0.unpack, ImageManager/PInvoke/WinApi.cs	Reference to suspicious API methods: ('InternalLoadLibraryW', 'LoadLibraryW@kernel32.dll'), ('InternalGetProcAddress', 'GetProcAddress@kernel32.dll')
Source: 6.0.ORDER.exe.510000.0.unpack, ImageManager/PInvoke/WinApi.cs	Reference to suspicious API methods: ('InternalLoadLibraryW', 'LoadLibraryW@kernel32.dll'), ('InternalGetProcAddress', 'GetProcAddress@kernel32.dll')
Source: 6.2.ORDER.exe.400000.0.unpack, A/b2.cs	Reference to suspicious API methods: ('A', 'MapVirtualKey@user32.dll')
Source: 6.2.ORDER.exe.510000.1.unpack, ImageManager/PInvoke/WinApi.cs	Reference to suspicious API methods: ('InternalLoadLibraryW', 'LoadLibraryW@kernel32.dll'), ('InternalGetProcAddress', 'GetProcAddress@kernel32.dll')

Injects a PE file into a foreign processes

Show sources

Source: C:\Users\user\Desktop\ORDER.exe

Memory written: C:\Users\user\Desktop\ORDER.exe base: 400000 value starts with: 4D5A

Source: C:\Users\user\Desktop\ORDER.exe	Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\uAtuTtfXv' /XML 'C:\Users\user\AppData\Local\Temp\tmp7391.tmp'
Source: C:\Users\user\Desktop\ORDER.exe	Process created: C:\Users\user\Desktop\ORDER.exe {path}
Source: C:\Users\user\Desktop\ORDER.exe	Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe dw20.exe -x -s 756

Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\seguisli.ttf VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\seguili.ttf VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\seguisbi.ttf VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\seguibl.ttf VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\seguibli.ttf VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation
Source: C:\Users\user\Desktop\ORDER.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation

Stealing of Sensitive Information:

Yara detected AgentTesla

Show sources

Source: Yara match	File source: 00000001.00000002.236134053.0000000003E01000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.249166242.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: ORDER.exe PID: 5428, type: MEMORY
Source: Yara match	File source: Process Memory Space: ORDER.exe PID: 6052, type: MEMORY
Source: Yara match	File source: 1.2.ORDER.exe.4085d88.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.ORDER.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.ORDER.exe.40bbfa8.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.ORDER.exe.4085d88.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.ORDER.exe.3f9d948.3.raw.unpack, type: UNPACKEDPE

Remote Access Functionality:

Yara detected AgentTesla

Show sources

Source: Yara match	File source: 00000001.00000002.236134053.0000000003E01000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.249166242.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: ORDER.exe PID: 5428, type: MEMORY
Source: Yara match	File source: Process Memory Space: ORDER.exe PID: 6052, type: MEMORY
Source: Yara match	File source: 1.2.ORDER.exe.4085d88.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.ORDER.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.ORDER.exe.40bbfa8.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.ORDER.exe.4085d88.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.ORDER.exe.3f9d948.3.raw.unpack, type: UNPACKEDPE

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Scheduled Task/Job1	Scheduled Task/Job1	Process Injection111	Masquerading1	OS Credential Dumping	Security Software Discovery221	Remote Services	Archive Collected Data11	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Native API1	Boot or Logon Initialization Scripts	Scheduled Task/Job1	Disable or Modify Tools1	LSASS Memory	Virtualization/Sandbox Evasion41	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Junk Data	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Virtualization/Sandbox Evasion41	Security Account Manager	Remote System Discovery1	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Steganography	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Process Injection111	NTDS	File and Directory Discovery1	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Deobfuscate/Decode Files or Information1	LSA Secrets	System Information Discovery11	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Obfuscated Files or Information2	Cached Domain Credentials	System Owner/User Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Software Packing13	DCSync	Network Sniffing	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
ORDER.exe	39%	Virustotal		Browse
ORDER.exe	27%	ReversingLabs	Win32.Trojan.AgentTesla

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\uAtuTtfXv.exe	27%	ReversingLabs	Win32.Trojan.AgentTesla

Unpacked PE Files

Source	Detection	Scanner	Label	Link	Download
6.2.ORDER.exe.400000.0.unpack	100%	Avira	TR/Spy.Gen8		Download File

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://www.founder.com.cn/cnJ	0%	Avira URL Cloud	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.sajatypeworks.com4	0%	Avira URL Cloud	safe
http://www.tiro.com3	0%	Avira URL Cloud	safe
http://en.wDX	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/jp/0	0%	Avira URL Cloud	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.tiro.comF	0%	Avira URL Cloud	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.carterandcone.com	0%	URL Reputation	safe
http://www.carterandcone.com	0%	URL Reputation	safe
http://www.carterandcone.com	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/Verd	0%	Avira URL Cloud	safe
http://www.founder.com.cn/cnl-sw	0%	Avira URL Cloud	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://www.fonts.comic	0%	URL Reputation	safe
http://www.fonts.comic	0%	URL Reputation	safe
http://www.fonts.comic	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.founder.cl	0%	Avira URL Cloud	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/W	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/W	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/W	0%	URL Reputation	safe
http://www.sandoll.co.krtri	0%	Avira URL Cloud	safe
http://www.fonts.comn%	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/Gras	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/jp/	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/jp/	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/jp/	0%	URL Reputation	safe
http://www.fontbureau.coma	0%	URL Reputation	safe
http://www.fontbureau.coma	0%	URL Reputation	safe
http://www.fontbureau.coma	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.founder.com.cn/cn/	0%	URL Reputation	safe
http://www.founder.com.cn/cn/	0%	URL Reputation	safe
http://www.founder.com.cn/cn/	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/x	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/x	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/x	0%	URL Reputation	safe
http://www.founder.com.cn/cn2	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/VerdJ	0%	Avira URL Cloud	safe
http://www.fonts.com4	0%	Avira URL Cloud	safe
http://www.fonts.com-u	0%	Avira URL Cloud	safe
http://fontfabrik.com/	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

No contacted domains info

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.fontbureau.com/designersG	ORDER.exe, 00000001.00000002.240280153.00000000065B2000.00000004.00000001.sdmp	false		high
http://www.fontbureau.com/designers/?	ORDER.exe, 00000001.00000002.240280153.00000000065B2000.00000004.00000001.sdmp	false		high
http://www.founder.com.cn/cnJ	ORDER.exe, 00000001.00000003.215719190.000000000535D000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.founder.com.cn/cn/bThe	ORDER.exe, 00000001.00000002.240280153.00000000065B2000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.sajatypeworks.com4	ORDER.exe, 00000001.00000003.213937928.000000000533B000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.tiro.com3	ORDER.exe, 00000001.00000003.214191426.000000000533B000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/michel-pi/EasyBot.Net	ORDER.exe	false		high
http://www.fontbureau.com/designers?	ORDER.exe, 00000001.00000002.240280153.00000000065B2000.00000004.00000001.sdmp	false		high
http://en.wDX	ORDER.exe, 00000001.00000003.213511591.00000000012FD000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.jiyu-kobo.co.jp/jp/0	ORDER.exe, 00000001.00000003.217614683.0000000005324000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.tiro.com	ORDER.exe, 00000001.00000002.240280153.00000000065B2000.00000004.00000001.sdmp, ORDER.exe, 00000001.00000003.214219445.000000000533B000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers	ORDER.exe, 00000001.00000002.240280153.00000000065B2000.00000004.00000001.sdmp	false		high
http://www.tiro.comF	ORDER.exe, 00000001.00000003.214219445.000000000533B000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.goodfont.co.kr	ORDER.exe, 00000001.00000002.240280153.00000000065B2000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.carterandcone.com	ORDER.exe, 00000001.00000003.216441928.0000000005330000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/Verd	ORDER.exe, 00000001.00000003.217614683.0000000005324000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.founder.com.cn/cnl-sw	ORDER.exe, 00000001.00000003.215719190.000000000535D000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designersR	ORDER.exe, 00000001.00000003.220904273.0000000005329000.00000004.00000001.sdmp	false		high
http://www.sajatypeworks.com	ORDER.exe, 00000001.00000003.213978180.0000000005344000.00000004.00000001.sdmp, ORDER.exe, 00000001.00000002.240280153.00000000065B2000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.typography.netD	ORDER.exe, 00000001.00000002.240280153.00000000065B2000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.founder.com.cn/cn/cThe	ORDER.exe, 00000001.00000002.240280153.00000000065B2000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.galapagosdesign.com/staff/dennis.htm	ORDER.exe, 00000001.00000002.240280153.00000000065B2000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://fontfabrik.com	ORDER.exe, 00000001.00000002.240280153.00000000065B2000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fonts.comic	ORDER.exe, 00000001.00000003.213937928.000000000533B000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.galapagosdesign.com/DPlease	ORDER.exe, 00000001.00000002.240280153.00000000065B2000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fonts.com	ORDER.exe, 00000001.00000003.213937928.000000000533B000.00000004.00000001.sdmp	false		high
http://www.sandoll.co.kr	ORDER.exe, 00000001.00000002.240280153.00000000065B2000.00000004.00000001.sdmp, ORDER.exe, 00000001.00000003.215056921.0000000005329000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.founder.cl	ORDER.exe, 00000001.00000003.215985763.0000000005324000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.urwpp.deDPlease	ORDER.exe, 00000001.00000002.240280153.00000000065B2000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.zhongyicts.com.cn	ORDER.exe, 00000001.00000002.240280153.00000000065B2000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.sakkal.com	ORDER.exe, 00000001.00000002.240280153.00000000065B2000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	ORDER.exe, 00000001.00000002.236134053.0000000003E01000.00000004.00000001.sdmp, ORDER.exe, 00000006.00000002.249166242.0000000000402000.00000040.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0	ORDER.exe, 00000001.00000002.240280153.00000000065B2000.00000004.00000001.sdmp	false		high
http://www.fontbureau.com	ORDER.exe, 00000001.00000002.240280153.00000000065B2000.00000004.00000001.sdmp	false		high
http://www.jiyu-kobo.co.jp/W	ORDER.exe, 00000001.00000003.217614683.0000000005324000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.sandoll.co.krtri	ORDER.exe, 00000001.00000003.215056921.0000000005329000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fonts.comn%	ORDER.exe, 00000001.00000003.213984328.000000000533B000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
http://www.jiyu-kobo.co.jp/Gras	ORDER.exe, 00000001.00000003.217614683.0000000005324000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.jiyu-kobo.co.jp/jp/	ORDER.exe, 00000001.00000003.217614683.0000000005324000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.coma	ORDER.exe, 00000001.00000003.234693220.0000000005320000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.carterandcone.coml	ORDER.exe, 00000001.00000002.240280153.00000000065B2000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.founder.com.cn/cn/	ORDER.exe, 00000001.00000003.215985763.0000000005324000.00000004.00000001.sdmp, ORDER.exe, 00000001.00000003.215719190.000000000535D000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers/cabarga.htmlN	ORDER.exe, 00000001.00000002.240280153.00000000065B2000.00000004.00000001.sdmp	false		high
http://www.founder.com.cn/cn	ORDER.exe, 00000001.00000003.216118395.000000000532B000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/x	ORDER.exe, 00000001.00000003.217614683.0000000005324000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers/frere-jones.html	ORDER.exe, 00000001.00000002.240280153.00000000065B2000.00000004.00000001.sdmp	false		high
http://www.founder.com.cn/cn2	ORDER.exe, 00000001.00000003.215719190.000000000535D000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.jiyu-kobo.co.jp/	ORDER.exe, 00000001.00000002.240280153.00000000065B2000.00000004.00000001.sdmp, ORDER.exe, 00000001.00000003.217614683.0000000005324000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers8	ORDER.exe, 00000001.00000002.240280153.00000000065B2000.00000004.00000001.sdmp	false		high
http://www.jiyu-kobo.co.jp/VerdJ	ORDER.exe, 00000001.00000003.217614683.0000000005324000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fonts.com4	ORDER.exe, 00000001.00000003.213937928.000000000533B000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://api.telegram.org/bot1624300088:AAErstUTFyyeTcKqXZnnSnwnH27Dy-zCSTc/	ORDER.exe, 00000001.00000002.236134053.0000000003E01000.00000004.00000001.sdmp, ORDER.exe, 00000006.00000002.249166242.0000000000402000.00000040.00000001.sdmp	false		high
http://www.fonts.com-u	ORDER.exe, 00000001.00000003.213958029.000000000533B000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://fontfabrik.com/	ORDER.exe, 00000001.00000003.214219445.000000000533B000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown

Contacted IPs

No contacted IP infos

General Information

Joe Sandbox Version:	31.0.0 Emerald
Analysis ID:	383969
Start date:	08.04.2021
Start time:	13:23:53
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 7m 55s
Hypervisor based Inspection enabled:	false
Report type:	light
Sample file name:	ORDER.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	31
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@8/6@0/0
EGA Information:	Failed
HDC Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Exclude process from analysis (whitelisted): taskhostw.exe, MpCmdRun.exe, BackgroundTransferHost.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, svchost.exe Excluded IPs from analysis (whitelisted): 23.54.113.53, 40.88.32.150, 104.42.151.234, 52.147.198.201, 13.88.21.125, 95.100.54.203, 20.82.210.154, 23.10.249.43, 23.10.249.26, 23.0.174.185, 23.0.174.200, 20.54.26.129, 104.43.193.48, 52.255.188.83, 13.64.90.137 Excluded domains from analysis (whitelisted): au.download.windowsupdate.com.edgesuite.net, arc.msn.com.nsatc.net, store-images.s-microsoft.com-c.edgekey.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, a1449.dscg2.akamai.net, arc.msn.com, e12564.dspb.akamaiedge.net, skypedataprdcoleus15.cloudapp.net, audownload.windowsupdate.nsatc.net, arc.trafficmanager.net, watson.telemetry.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, prod.fs.microsoft.com.akadns.net, au-bg-shim.trafficmanager.net, skypedataprdcolwus17.cloudapp.net, fs.microsoft.com, ris-prod.trafficmanager.net, e1723.g.akamaiedge.net, ctldl.windowsupdate.com, a767.dscg3.akamai.net, skypedataprdcolcus15.cloudapp.net, skypedataprdcoleus16.cloudapp.net, ris.api.iris.microsoft.com, skypedataprdcoleus17.cloudapp.net, store-images.s-microsoft.com, blobcollector.events.data.trafficmanager.net, skypedataprdcolwus16.cloudapp.net, skypedataprdcolwus15.cloudapp.net Report size getting too big, too many NtAllocateVirtualMemory calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
13:24:51	API Interceptor	2x Sleep call for process: ORDER.exe modified
13:25:02	API Interceptor	1x Sleep call for process: dw20.exe modified

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

No context

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_ORDER.exe_a98c55928929b2832be98a97c3d2d245aa320_00000000_17f4f2e7\Report.wer Download File
Process:	C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
File Type:	Little-endian UTF-16 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	10352
Entropy (8bit):	3.7755754040059637
Encrypted:	false
SSDEEP:	96:45de7TM1r0zmVzxWs5h5pXI/+BHUHZopAnQ0DFH2EmSonj+wdOyWnEeVc1F9ZQbk:8de7Y1DDHPaPLk9MK/u7sBS274Itf
MD5:	116DA349623C4F9A9371F060A59BD64F
SHA1:	3A0775340DE08C0FCE8071BAA82EB7B326CA3022
SHA-256:	AF1F8B4EE10A591BB8D4F747CA6E1CD89BC1A168E3BB63D823254F5A90BCF7A4
SHA-512:	7EF096F0DFC7EF3AA6089688D90F5B7F9237CC3B5A2B2AF84EC3F69E39BE9463DA2B88ACFF3C7FE535468AB0598A8B747C0E4E195E95EE7619DDED572D5838EF
Malicious:	true
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.2.6.2.3.8.7.0.9.6.2.8.8.4.6.9.5.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.2.6.2.3.8.7.0.9.6.5.8.5.3.4.3.8.....R.e.p.o.r.t.S.t.a.t.u.s.=.2.6.8.4.3.5.4.5.6.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.d.d.5.b.1.4.8.9.-.8.9.c.a.-.4.7.1.c.-.a.7.4.0.-.e.8.6.1.b.8.3.5.4.e.7.a.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.z.!.6.M...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.7.a.4.-.0.0.0.1.-.0.0.1.7.-.e.0.3.3.-.b.4.3.c.b.5.2.c.d.7.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.8.d.c.0.0.9.5.f.0.4.3.7.9.9.2.b.9.2.4.5.8.7.3.5.4.a.2.7.3.8.d.3.0.0.0.0.0.0.0.0.!.0.0.0.0.d.d.5.a.c.8.4.4.6.5.7.d.2.3.5.1.e.6.8.6.c.5.9.3.f.c.8.7.a.4.5.0.3.8.1.e.3.a.8.9.!.O.R.D.E.R...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.1././.0.4././.0.8.:.0.0.:.1.6.:.1.9.!.0.!.O.R.D.E.R...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.7.2.9.5.....T.a.r.g.e.t.A.s.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERDC42.tmp.WERInternalMetadata.xml Download File
Process:	C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
File Type:	XML 1.0 document, Little-endian UTF-16 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	7562
Entropy (8bit):	3.7059056723496213
Encrypted:	false
SSDEEP:	192:Rrl7r3GLNiGE6cP16YsB6tgmfo4T8SxSCp14nU1f5fIm:RrlsNiV6cP16YS6tgmfNYSx74n+f5l
MD5:	E848DB5E053961AD80EAACCC55EE5082
SHA1:	D68D6385562D9EBB81387D7FAF15EA6606F55B1A
SHA-256:	6DB4D2B3E08CB21DE99126C18DF4363CED175DC30F5FA31F2DA679F3928283B9
SHA-512:	40F8D02882C049E14ABAB06D5E7BC44A9B2A2879E2165F63C9C1E678A2CC26AF1429D4EC0406AF315D15A70138E245844B43D381DC934EAED1680D6C8D8F5007
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.7.1.3.4.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.7.1.3.4...1...a.m.d.6.4.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.1.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.1.0.3.3.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.0.5.2.<./.P.i.d.>.......

C:\ProgramData\Microsoft\Windows\WER\Temp\WERDCE0.tmp.xml Download File
Process:	C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
File Type:	XML 1.0 document, UTF-8 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	4564
Entropy (8bit):	4.4884439745445075
Encrypted:	false
SSDEEP:	48:cvIwSD8zswJgtWI9YmWSC8Bc8fm8M4JFKffsJoFN+q8LJsDJCquud:uITf2fnSN7JFKXEsAJmJCquud
MD5:	4650AED76587B321F6B29D3D0355B0CA
SHA1:	F7F1369DCC1AA686097C0893C3C9A19E66687070
SHA-256:	11E3EF95D68B1E1441D982BB3FC6148E75D83458B904F4F4294A03925E1E8B3F
SHA-512:	4D891BA3A90458ED36C1FD162579AB641DA0C19BBD0760D469079CD8DED10BD76815C51098C4F9C7A1C461D3976F2C9FEB335B3283E4B88269FF144EDECDC191
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="17134" />.. <arg nm="vercsdbld" val="1" />.. <arg nm="verqfe" val="1" />.. <arg nm="csdbld" val="1" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="1033" />.. <arg nm="geoid" val="244" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="937775" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.1.17134.0-11.0.47" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="4096" />..

C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\ORDER.exe.log Download File
Process:	C:\Users\user\Desktop\ORDER.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	525
Entropy (8bit):	5.2874233355119316
Encrypted:	false
SSDEEP:	12:Q3LaJU20NaL10U29hJ5g1B0U2ukyrFk70Ug+9Yz9tv:MLF20NaL329hJ5g522rWz2T
MD5:	61CCF53571C9ABA6511D696CB0D32E45
SHA1:	A13A42A20EC14942F52DB20FB16A0A520F8183CE
SHA-256:	3459BDF6C0B7F9D43649ADAAF19BA8D5D133BCBE5EF80CF4B7000DC91E10903B
SHA-512:	90E180D9A681F82C010C326456AC88EBB89256CC769E900BFB4B2DF92E69CA69726863B45DFE4627FC1EE8C281F2AF86A6A1E2EF1710094CCD3F4E092872F06F
Malicious:	true
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System\1ffc437de59fb69ba2b865ffdc98ffd1\System.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\54d944b3ca0ea1188d700fbd8089726b\System.Drawing.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\bd8d59c984c9f5f2695f64341115cdf0\System.Windows.Forms.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\cd7c74fce2a0eab72cd25cbe4bb61614\Microsoft.VisualBasic.ni.dll",0..

C:\Users\user\AppData\Local\Temp\tmp7391.tmp Download File
Process:	C:\Users\user\Desktop\ORDER.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1642
Entropy (8bit):	5.185842204775607
Encrypted:	false
SSDEEP:	24:2dH4+SEqC/Q7hxlNMFp1/rlMhEMjnGpwjpIgUYODOLD9RJh7h8gKBKtn:cbh47TlNQ//rydbz9I3YODOLNdq3C
MD5:	C30B598C6019BB98F01CD42F85E8E8D9
SHA1:	3BF8BEDC801D372BAF2278B9F148A80882D50D6E
SHA-256:	0D3DDFCC3AD50DDFCA495CC209EC58A1C4AC43CB2AA28DAC786F15F4D0517706
SHA-512:	EC98195FACD8B18DB899FDF69A2BDE59B211DF150F60DA6CC2FC707D69936B5F0F835960AD48B720B389FF2C495C638D53E8DB81CB839929029801D32C584618
Malicious:	true
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-16"?>..<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">.. <RegistrationInfo>.. <Date>2014-10-25T14:27:44.8929027</Date>.. <Author>computer\user</Author>.. </RegistrationInfo>.. <Triggers>.. <LogonTrigger>.. <Enabled>true</Enabled>.. <UserId>computer\user</UserId>.. </LogonTrigger>.. <RegistrationTrigger>.. <Enabled>false</Enabled>.. </RegistrationTrigger>.. </Triggers>.. <Principals>.. <Principal id="Author">.. <UserId>computer\user</UserId>.. <LogonType>InteractiveToken</LogonType>.. <RunLevel>LeastPrivilege</RunLevel>.. </Principal>.. </Principals>.. <Settings>.. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>.. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>.. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>.. <AllowHardTerminate>false</AllowHardTerminate>.. <StartWhenAvailable>true

C:\Users\user\AppData\Roaming\uAtuTtfXv.exe Download File
Process:	C:\Users\user\Desktop\ORDER.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	945152
Entropy (8bit):	7.733393625247205
Encrypted:	false
SSDEEP:	12288:FKXy1c0w2iNJn+oHxDZ3jKV/JyZ3LNFyzGx+5BXdfwkiJ2eb9B5eSiyyjK:cP1r+Sxd3jgYZ3RczOYZ1wfUwId8
MD5:	351279E865038F0D4F1C34BE92C5FFCF
SHA1:	DD5AC844657D2351E686C593FC87A450381E3A89
SHA-256:	DD7F52FD623B7913C7494ECEBAE45A9B4DD843B5A363652E3AB92DA9CDB3A691
SHA-512:	04771F68BB7901FC9B56C0813BA11AC247208B1A0FBECAFCA175E3416CF4290B5254062479A94D14B939FE62539917ED4F7DD3D78AA4E9BEC80480239764A010
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 27%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...SKn`..............0..v............... ........@.. ....................................@.....................................O.................................................................................... ............... ..H............text....u... ...v.................. ..`.rsrc................x..............@..@.reloc...............j..............@..B.......................H.......................Y...:..........................................^..}.....(.......(.........0..+.........,..{.......+....,...{....o........(.....*..0................(....s......s....}.....s....}.....s....}.....s....}.....s....}.....s....}.....s ...}.....s!...}.....{....o".....{....o#.....(".....{.....o$.....{....o%...."...Bs&...o'...&.{....o%...."...Bs&...o'...&.{....o(....{......o).....{....o(....{......o).....{....o(....{......o).....{....o(....{......o).....{....o

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.733393625247205
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	ORDER.exe
File size:	945152
MD5:	351279e865038f0d4f1c34be92c5ffcf
SHA1:	dd5ac844657d2351e686c593fc87a450381e3a89
SHA256:	dd7f52fd623b7913c7494ecebae45a9b4dd843b5a363652e3ab92da9cdb3a691
SHA512:	04771f68bb7901fc9b56c0813ba11ac247208b1a0fbecafca175e3416cf4290b5254062479a94d14b939fe62539917ed4f7dd3d78aa4e9bec80480239764a010
SSDEEP:	12288:FKXy1c0w2iNJn+oHxDZ3jKV/JyZ3LNFyzGx+5BXdfwkiJ2eb9B5eSiyyjK:cP1r+Sxd3jgYZ3RczOYZ1wfUwId8
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...SKn`..............0..v............... ........@.. ....................................@................................

File Icon


Icon Hash:	929296929e9e8eb2

Static PE Info

General
Entrypoint:	0x4b94fa
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE
DLL Characteristics:	NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x606E4B53 [Thu Apr 8 00:16:19 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:	v2.0.50727
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
mov dword ptr [eax+4Eh], edx
inc edi
or eax, 000A1A0Ah
add byte ptr [eax], al
add byte ptr [ecx+45h], cl
dec esi
inc esp
scasb
inc edx
pushad
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xb94a8	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xba000	0x2f0ac	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xea000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xb7518	0xb7600	False	0.907054149625	data	7.89896443713	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rsrc	0xba000	0x2f0ac	0x2f200	False	0.362421253316	data	6.2421551019	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xea000	0xc	0x200	False	0.044921875	data	0.101910425663	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type
RT_ICON	0xba2b0	0x709e	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
RT_ICON	0xc1350	0x10828	dBase IV DBT, blocks size 0, block length 2048, next free block index 40, next free block 318767104, next used block 117440512
RT_ICON	0xd1b78	0x94a8	data
RT_ICON	0xdb020	0x5488	data
RT_ICON	0xe04a8	0x4228	dBase IV DBT of \200.DBF, blocks size 0, block length 16896, next free block index 40, next free block 224, next used block 117440512
RT_ICON	0xe46d0	0x25a8	data
RT_ICON	0xe6c78	0x10a8	data
RT_ICON	0xe7d20	0x988	data
RT_ICON	0xe86a8	0x468	GLS_BINARY_LSB_FIRST
RT_GROUP_ICON	0xe8b10	0x84	data
RT_VERSION	0xe8b94	0x32c	data
RT_MANIFEST	0xe8ec0	0x1ea	XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators

Imports

DLL	Import
mscoree.dll	_CorExeMain

Version Infos

Description	Data
Translation	0x0000 0x04b0
LegalCopyright	Copyright 2018 - 2021
Assembly Version	3.1.0.5
InternalName	zM.exe
FileVersion	3.1.0.5
CompanyName
LegalTrademarks
Comments
ProductName	Image Manager
ProductVersion	3.1.0.5
FileDescription	Image Manager
OriginalFilename	zM.exe

Network Behavior

Network Port Distribution

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 8, 2021 13:24:40.569474936 CEST	50200	53	192.168.2.3	8.8.8.8
Apr 8, 2021 13:24:40.588349104 CEST	53	50200	8.8.8.8	192.168.2.3
Apr 8, 2021 13:24:42.784682989 CEST	51281	53	192.168.2.3	8.8.8.8
Apr 8, 2021 13:24:42.797214031 CEST	53	51281	8.8.8.8	192.168.2.3
Apr 8, 2021 13:24:43.706543922 CEST	49199	53	192.168.2.3	8.8.8.8
Apr 8, 2021 13:24:43.718858004 CEST	53	49199	8.8.8.8	192.168.2.3
Apr 8, 2021 13:24:45.143517017 CEST	50620	53	192.168.2.3	8.8.8.8
Apr 8, 2021 13:24:45.156260014 CEST	53	50620	8.8.8.8	192.168.2.3
Apr 8, 2021 13:24:46.883788109 CEST	64938	53	192.168.2.3	8.8.8.8
Apr 8, 2021 13:24:46.896325111 CEST	53	64938	8.8.8.8	192.168.2.3
Apr 8, 2021 13:24:48.457182884 CEST	60152	53	192.168.2.3	8.8.8.8
Apr 8, 2021 13:24:48.469640017 CEST	53	60152	8.8.8.8	192.168.2.3
Apr 8, 2021 13:24:49.472404957 CEST	57544	53	192.168.2.3	8.8.8.8
Apr 8, 2021 13:24:49.488020897 CEST	53	57544	8.8.8.8	192.168.2.3
Apr 8, 2021 13:24:50.534167051 CEST	55984	53	192.168.2.3	8.8.8.8
Apr 8, 2021 13:24:50.550154924 CEST	53	55984	8.8.8.8	192.168.2.3
Apr 8, 2021 13:24:51.457585096 CEST	64185	53	192.168.2.3	8.8.8.8
Apr 8, 2021 13:24:51.471801996 CEST	53	64185	8.8.8.8	192.168.2.3
Apr 8, 2021 13:24:57.920488119 CEST	65110	53	192.168.2.3	8.8.8.8
Apr 8, 2021 13:24:57.933506966 CEST	53	65110	8.8.8.8	192.168.2.3
Apr 8, 2021 13:25:03.651426077 CEST	58361	53	192.168.2.3	8.8.8.8
Apr 8, 2021 13:25:03.664046049 CEST	53	58361	8.8.8.8	192.168.2.3
Apr 8, 2021 13:25:04.704349995 CEST	63492	53	192.168.2.3	8.8.8.8
Apr 8, 2021 13:25:04.719369888 CEST	53	63492	8.8.8.8	192.168.2.3
Apr 8, 2021 13:25:05.349138021 CEST	60831	53	192.168.2.3	8.8.8.8
Apr 8, 2021 13:25:05.362237930 CEST	53	60831	8.8.8.8	192.168.2.3
Apr 8, 2021 13:25:10.124577999 CEST	60100	53	192.168.2.3	8.8.8.8
Apr 8, 2021 13:25:10.173801899 CEST	53	60100	8.8.8.8	192.168.2.3
Apr 8, 2021 13:25:12.177082062 CEST	53195	53	192.168.2.3	8.8.8.8
Apr 8, 2021 13:25:12.189585924 CEST	53	53195	8.8.8.8	192.168.2.3
Apr 8, 2021 13:25:13.210030079 CEST	50141	53	192.168.2.3	8.8.8.8
Apr 8, 2021 13:25:13.222681999 CEST	53	50141	8.8.8.8	192.168.2.3
Apr 8, 2021 13:25:16.184787035 CEST	53023	53	192.168.2.3	8.8.8.8
Apr 8, 2021 13:25:16.196759939 CEST	53	53023	8.8.8.8	192.168.2.3
Apr 8, 2021 13:25:27.971662998 CEST	49563	53	192.168.2.3	8.8.8.8
Apr 8, 2021 13:25:27.990072966 CEST	53	49563	8.8.8.8	192.168.2.3
Apr 8, 2021 13:25:34.350477934 CEST	51352	53	192.168.2.3	8.8.8.8
Apr 8, 2021 13:25:34.369616032 CEST	53	51352	8.8.8.8	192.168.2.3
Apr 8, 2021 13:25:43.725986004 CEST	59349	53	192.168.2.3	8.8.8.8
Apr 8, 2021 13:25:43.751817942 CEST	53	59349	8.8.8.8	192.168.2.3
Apr 8, 2021 13:25:45.549663067 CEST	57084	53	192.168.2.3	8.8.8.8
Apr 8, 2021 13:25:45.561527014 CEST	53	57084	8.8.8.8	192.168.2.3
Apr 8, 2021 13:25:46.346766949 CEST	58823	53	192.168.2.3	8.8.8.8
Apr 8, 2021 13:25:46.359770060 CEST	53	58823	8.8.8.8	192.168.2.3
Apr 8, 2021 13:25:47.424964905 CEST	57568	53	192.168.2.3	8.8.8.8
Apr 8, 2021 13:25:47.436907053 CEST	53	57568	8.8.8.8	192.168.2.3
Apr 8, 2021 13:25:48.470308065 CEST	50540	53	192.168.2.3	8.8.8.8
Apr 8, 2021 13:25:48.482166052 CEST	53	50540	8.8.8.8	192.168.2.3
Apr 8, 2021 13:25:51.655776978 CEST	54366	53	192.168.2.3	8.8.8.8
Apr 8, 2021 13:25:51.668162107 CEST	53	54366	8.8.8.8	192.168.2.3
Apr 8, 2021 13:25:55.663841963 CEST	53034	53	192.168.2.3	8.8.8.8
Apr 8, 2021 13:25:55.681936979 CEST	53	53034	8.8.8.8	192.168.2.3
Apr 8, 2021 13:26:26.452462912 CEST	57762	53	192.168.2.3	8.8.8.8
Apr 8, 2021 13:26:26.471427917 CEST	53	57762	8.8.8.8	192.168.2.3
Apr 8, 2021 13:26:28.661109924 CEST	55435	53	192.168.2.3	8.8.8.8
Apr 8, 2021 13:26:28.687755108 CEST	53	55435	8.8.8.8	192.168.2.3

Code Manipulations

Statistics

Behavior

Click to jump to process

System Behavior

Analysis Process: ORDER.exe PID: 5428 Parent PID: 5696

General

Start time:	13:24:44
Start date:	08/04/2021
Path:	C:\Users\user\Desktop\ORDER.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\ORDER.exe'
Imagebase:	0x760000
File size:	945152 bytes
MD5 hash:	351279E865038F0D4F1C34BE92C5FFCF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000001.00000002.236134053.0000000003E01000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	low

Analysis Process: schtasks.exe PID: 240 Parent PID: 5428

General

Start time:	13:24:54
Start date:	08/04/2021
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\uAtuTtfXv' /XML 'C:\Users\user\AppData\Local\Temp\tmp7391.tmp'
Imagebase:	0x8f0000
File size:	185856 bytes
MD5 hash:	15FF7D8324231381BAD48A052F85DF04
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: conhost.exe PID: 6072 Parent PID: 240

General

Start time:	13:24:54
Start date:	08/04/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6b2800000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: ORDER.exe PID: 6052 Parent PID: 5428

General

Start time:	13:24:55
Start date:	08/04/2021
Path:	C:\Users\user\Desktop\ORDER.exe
Wow64 process (32bit):	true
Commandline:	{path}
Imagebase:	0x510000
File size:	945152 bytes
MD5 hash:	351279E865038F0D4F1C34BE92C5FFCF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000006.00000002.249166242.0000000000402000.00000040.00000001.sdmp, Author: Joe Security
Reputation:	low

Analysis Process: dw20.exe PID: 6088 Parent PID: 6052

General

Start time:	13:24:55
Start date:	08/04/2021
Path:	C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
Wow64 process (32bit):	true
Commandline:	dw20.exe -x -s 756
Imagebase:	0x10000000
File size:	33936 bytes
MD5 hash:	8D10DA8A3E11747E51F23C882C22BBC3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Disassembly

Code Analysis

Reset < >

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically requires being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	File monitoring, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report ORDER.exe

Overview

General Information

Detection

Signatures

Classification

Startup

Malware Configuration

Threatname: Agenttesla

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

System Summary:

Signature Overview

AV Detection:

Compliance:

Networking:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Boot Survival:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

Contacted IPs

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Network Behavior

Network Port Distribution

UDP Packets

Code Manipulations

Statistics

Behavior

System Behavior

Analysis Process: ORDER.exe PID: 5428 Parent PID: 5696

General