Windows Analysis Report AGG POWER RFQ.xlsx

Overview

General Information

Sample Name:	AGG POWER RFQ.xlsx
Analysis ID:	435321
MD5:	b6d32254c5e3faa7fb26cccabddad2f4
SHA1:	abf474e378247ebeb3300de929a50d0996286c01
SHA256:	fca7f5cda93c9f473a6c3e9c3857d19d69c25835fd71b21d8b1354f78b102397
Tags:	VelvetSweatshopxlsx
Infos:
Most interesting Screenshot:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)

Sigma detected: Droppers Exploiting CVE-2017-11882

Sigma detected: EQNEDT32.EXE connecting to internet

Sigma detected: File Dropped By EQNEDT32EXE

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Yara detected AgentTesla

Yara detected AntiVM3

.NET source code contains very large array initializations

Drops PE files to the user root directory

Hides that the sample has been downloaded from the Internet (zone.identifier)

Injects a PE file into a foreign processes

Office equation editor drops PE file

Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Sigma detected: Execution from Suspicious Folder

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file access)

Allocates a big amount of memory (probably used for heap spraying)

Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Document misses a certain OLE stream usually present in this Microsoft Office document type

Downloads executable code via HTTP

Drops PE files

Drops PE files to the user directory

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Office Equation Editor has been started

PE file contains strange resources

Potential document exploit detected (performs DNS queries)

Potential document exploit detected (performs HTTP gets)

Potential document exploit detected (unknown TCP traffic)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Uses SMTP (mail sending)

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Signatures

AV Detection:

Found malware configuration

Source: 00000007.00000002.2243225346.0000000002351000.00000004.00000001.sdmp

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "SMTP Info": "sales5@alkhaleejautoparts.com]~%l3$ck*(U_mail.alkhaleejautoparts.comlisafury29@safina.cc"}

Multi AV Scanner detection for submitted file

Source: AGG POWER RFQ.xlsx	Virustotal: Detection: 27%			Perma Link
Source: AGG POWER RFQ.xlsx	ReversingLabs: Detection: 21%

Exploits:

Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Users\Public\vbc.exe
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Users\Public\vbc.exe			Jump to behavior

Office Equation Editor has been started

Source: unknown

Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE 'C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE' -Embedding

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Source: Traffic	Snort IDS: 2030171 ET TROJAN AgentTesla Exfil Via SMTP 192.168.2.22:49166 -> 148.66.138.106:587
Source: Traffic	Snort IDS: 2030171 ET TROJAN AgentTesla Exfil Via SMTP 192.168.2.22:49167 -> 148.66.138.106:587

Source: Joe Sandbox View	ASN Name: AS-26496-GO-DADDY-COM-LLCUS AS-26496-GO-DADDY-COM-LLCUS
Source: Joe Sandbox View	ASN Name: AS-COLOCROSSINGUS AS-COLOCROSSINGUS

Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.141.146
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.141.146
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.141.146
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.141.146
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.141.146
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.141.146
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.141.146
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.141.146
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.141.146
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.141.146
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.141.146
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.141.146
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.141.146
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.141.146
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.141.146
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.141.146
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.141.146
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.141.146
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.141.146
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.141.146
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.141.146
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.141.146
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.141.146
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.141.146
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.141.146
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.141.146
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.141.146
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.141.146
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.141.146
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.141.146
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.141.146
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.141.146
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.141.146
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.141.146
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.141.146
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.141.146
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.141.146
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.141.146
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.141.146
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.141.146
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.141.146
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.141.146
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.141.146
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.141.146
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.141.146
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.141.146
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.141.146
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.141.146
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.141.146
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.141.146

Source: vbc.exe, 00000005.00000002.2366999584.0000000002741000.00000004.00000001.sdmp, tnvLnx.exe, 00000007.00000002.2243225346.0000000002351000.00000004.00000001.sdmp	String found in binary or memory: http://127.0.0.1:HTTP/1.1
Source: tnvLnx.exe, 00000007.00000002.2243225346.0000000002351000.00000004.00000001.sdmp	String found in binary or memory: http://DTHLcG.com
Source: tnvLnx.exe, 00000007.00000002.2243225346.0000000002351000.00000004.00000001.sdmp	String found in binary or memory: http://DynDns.comDynDNS
Source: vbc.exe, 00000005.00000002.2367132534.0000000002821000.00000004.00000001.sdmp, vbc.exe, 00000005.00000002.2367250713.0000000002894000.00000004.00000001.sdmp	String found in binary or memory: http://gN3yhO7qZ2vk1Dl2x8.com
Source: vbc.exe, 00000005.00000002.2367334115.00000000028BB000.00000004.00000001.sdmp	String found in binary or memory: http://mail.alkhaleejautoparts.com
Source: vbc.exe, 00000005.00000002.2371482883.00000000060C0000.00000002.00000001.sdmp, tnvLnx.exe, 00000007.00000002.2244518505.0000000005B50000.00000002.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous.
Source: vbc.exe, 00000004.00000002.2155151223.0000000002401000.00000004.00000001.sdmp, tnvLnx.exe, 00000006.00000002.2221949010.0000000002401000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: vbc.exe, 00000005.00000002.2371482883.00000000060C0000.00000002.00000001.sdmp, tnvLnx.exe, 00000007.00000002.2244518505.0000000005B50000.00000002.00000001.sdmp	String found in binary or memory: http://www.%s.comPA
Source: vbc.exe, 00000005.00000002.2367072067.00000000027C8000.00000004.00000001.sdmp	String found in binary or memory: https://api.ipify.org%
Source: tnvLnx.exe, 00000007.00000002.2243225346.0000000002351000.00000004.00000001.sdmp	String found in binary or memory: https://api.ipify.org%GETMozilla/5.0
Source: tnvLnx.exe	String found in binary or memory: https://github.com/georgw777/
Source: tnvLnx.exe	String found in binary or memory: https://github.com/georgw777/MediaManager
Source: vbc.exe, 00000004.00000000.2148405134.0000000000AD2000.00000020.00020000.sdmp, vbc.exe, 00000005.00000002.2366734790.0000000000AD2000.00000020.00020000.sdmp, tnvLnx.exe, 00000006.00000002.2221233725.0000000000212000.00000020.00020000.sdmp, tnvLnx.exe, 00000007.00000000.2220311506.0000000000212000.00000020.00020000.sdmp, tnvLnx.exe, 00000008.00000000.2234165130.0000000000212000.00000020.00020000.sdmp	String found in binary or memory: https://github.com/georgw777/MediaManager;https://github.com/georgw777/
Source: vbc.exe, 00000004.00000002.2155176869.0000000002426000.00000004.00000001.sdmp, tnvLnx.exe, 00000006.00000002.2221988672.0000000002426000.00000004.00000001.sdmp, tnvLnx.exe, 00000008.00000002.2242859365.0000000002346000.00000004.00000001.sdmp	String found in binary or memory: https://stackpath.bootstrapcdn.com/bootstrap/4.5.0/css/bootstrap.min.css
Source: vbc.exe, 00000004.00000002.2155416176.0000000003409000.00000004.00000001.sdmp, vbc.exe, 00000005.00000002.2366050589.0000000000402000.00000040.00000001.sdmp, tnvLnx.exe, 00000006.00000002.2222286152.0000000003409000.00000004.00000001.sdmp, tnvLnx.exe, 00000007.00000002.2242803026.0000000000402000.00000040.00000001.sdmp	String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip
Source: vbc.exe, 00000005.00000002.2366999584.0000000002741000.00000004.00000001.sdmp, tnvLnx.exe, 00000007.00000002.2243225346.0000000002351000.00000004.00000001.sdmp	String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\vbc[1].exe			Jump to dropped file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File created: C:\Users\Public\vbc.exe			Jump to dropped file

Source: C:\Users\Public\vbc.exe	Memory allocated: 76E20000 page execute and read and write	Jump to behavior
Source: C:\Users\Public\vbc.exe	Memory allocated: 76D20000 page execute and read and write	Jump to behavior
Source: C:\Users\Public\vbc.exe	Memory allocated: 76E20000 page execute and read and write	Jump to behavior
Source: C:\Users\Public\vbc.exe	Memory allocated: 76D20000 page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Memory allocated: 76E20000 page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Memory allocated: 76D20000 page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Memory allocated: 76E20000 page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Memory allocated: 76D20000 page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Memory allocated: 76E20000 page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Memory allocated: 76D20000 page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Memory allocated: 76E20000 page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Memory allocated: 76D20000 page execute and read and write	Jump to behavior

Source: C:\Users\Public\vbc.exe	Code function: 4_2_002B9020	4_2_002B9020
Source: C:\Users\Public\vbc.exe	Code function: 4_2_002BBB10	4_2_002BBB10
Source: C:\Users\Public\vbc.exe	Code function: 4_2_002BDBA0	4_2_002BDBA0
Source: C:\Users\Public\vbc.exe	Code function: 4_2_002B549A	4_2_002B549A
Source: C:\Users\Public\vbc.exe	Code function: 4_2_002BFBB0	4_2_002BFBB0
Source: C:\Users\Public\vbc.exe	Code function: 4_2_002B2CC0	4_2_002B2CC0
Source: C:\Users\Public\vbc.exe	Code function: 4_2_002B4EA0	4_2_002B4EA0
Source: C:\Users\Public\vbc.exe	Code function: 4_2_002BAEEF	4_2_002BAEEF
Source: C:\Users\Public\vbc.exe	Code function: 4_2_02004668	4_2_02004668
Source: C:\Users\Public\vbc.exe	Code function: 4_2_0200927F	4_2_0200927F
Source: C:\Users\Public\vbc.exe	Code function: 4_2_020062AB	4_2_020062AB
Source: C:\Users\Public\vbc.exe	Code function: 4_2_020062D8	4_2_020062D8
Source: C:\Users\Public\vbc.exe	Code function: 4_2_020002E9	4_2_020002E9
Source: C:\Users\Public\vbc.exe	Code function: 4_2_020002F8	4_2_020002F8
Source: C:\Users\Public\vbc.exe	Code function: 4_2_02006F79	4_2_02006F79
Source: C:\Users\Public\vbc.exe	Code function: 4_2_02006F88	4_2_02006F88
Source: C:\Users\Public\vbc.exe	Code function: 4_2_02000007	4_2_02000007
Source: C:\Users\Public\vbc.exe	Code function: 4_2_02009424	4_2_02009424
Source: C:\Users\Public\vbc.exe	Code function: 4_2_02001027	4_2_02001027
Source: C:\Users\Public\vbc.exe	Code function: 4_2_02000048	4_2_02000048
Source: C:\Users\Public\vbc.exe	Code function: 4_2_02001058	4_2_02001058
Source: C:\Users\Public\vbc.exe	Code function: 4_2_02004C59	4_2_02004C59
Source: C:\Users\Public\vbc.exe	Code function: 4_2_02004C88	4_2_02004C88
Source: C:\Users\Public\vbc.exe	Code function: 4_2_020004C8	4_2_020004C8
Source: C:\Users\Public\vbc.exe	Code function: 4_2_020004D8	4_2_020004D8
Source: C:\Users\Public\vbc.exe	Code function: 4_2_02005CD9	4_2_02005CD9
Source: C:\Users\Public\vbc.exe	Code function: 4_2_02005CE8	4_2_02005CE8
Source: C:\Users\Public\vbc.exe	Code function: 4_2_0200490D	4_2_0200490D
Source: C:\Users\Public\vbc.exe	Code function: 4_2_02005530	4_2_02005530
Source: C:\Users\Public\vbc.exe	Code function: 4_2_02005540	4_2_02005540
Source: C:\Users\Public\vbc.exe	Code function: 4_2_020059DF	4_2_020059DF
Source: C:\Users\Public\vbc.exe	Code function: 4_2_020059F0	4_2_020059F0
Source: C:\Users\Public\vbc.exe	Code function: 5_2_0022E240	5_2_0022E240
Source: C:\Users\Public\vbc.exe	Code function: 5_2_0022DAE8	5_2_0022DAE8
Source: C:\Users\Public\vbc.exe	Code function: 5_2_00225330	5_2_00225330
Source: C:\Users\Public\vbc.exe	Code function: 5_2_00226350	5_2_00226350
Source: C:\Users\Public\vbc.exe	Code function: 5_2_00225678	5_2_00225678
Source: C:\Users\Public\vbc.exe	Code function: 5_2_0022E818	5_2_0022E818
Source: C:\Users\Public\vbc.exe	Code function: 5_2_00222099	5_2_00222099
Source: C:\Users\Public\vbc.exe	Code function: 5_2_0079478A	5_2_0079478A
Source: C:\Users\Public\vbc.exe	Code function: 5_2_007C0048	5_2_007C0048
Source: C:\Users\Public\vbc.exe	Code function: 5_2_007C9A28	5_2_007C9A28
Source: C:\Users\Public\vbc.exe	Code function: 5_2_007C9160	5_2_007C9160
Source: C:\Users\Public\vbc.exe	Code function: 5_2_007C33B0	5_2_007C33B0
Source: C:\Users\Public\vbc.exe	Code function: 5_2_007C89A0	5_2_007C89A0
Source: C:\Users\Public\vbc.exe	Code function: 5_2_007C0023	5_2_007C0023
Source: C:\Users\Public\vbc.exe	Code function: 5_2_007CB2F8	5_2_007CB2F8
Source: C:\Users\Public\vbc.exe	Code function: 5_2_007C3B70	5_2_007C3B70
Source: C:\Users\Public\vbc.exe	Code function: 5_2_007C7368	5_2_007C7368
Source: C:\Users\Public\vbc.exe	Code function: 5_2_007C3B6B	5_2_007C3B6B
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Code function: 6_2_00529020	6_2_00529020
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Code function: 6_2_0052C308	6_2_0052C308
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Code function: 6_2_0052BB10	6_2_0052BB10
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Code function: 6_2_0052DBA0	6_2_0052DBA0
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Code function: 6_2_0052549A	6_2_0052549A
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Code function: 6_2_0052FBB0	6_2_0052FBB0
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Code function: 6_2_00522CC0	6_2_00522CC0
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Code function: 6_2_0052AEEF	6_2_0052AEEF
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Code function: 6_2_00524EA0	6_2_00524EA0
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Code function: 6_2_00711058	6_2_00711058
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Code function: 6_2_00710048	6_2_00710048
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Code function: 6_2_00719424	6_2_00719424
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Code function: 6_2_00715CE8	6_2_00715CE8
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Code function: 6_2_00715CD9	6_2_00715CD9
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Code function: 6_2_007104D8	6_2_007104D8
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Code function: 6_2_007104C8	6_2_007104C8
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Code function: 6_2_00714C88	6_2_00714C88
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Code function: 6_2_00715540	6_2_00715540
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Code function: 6_2_0071490D	6_2_0071490D
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Code function: 6_2_007159F0	6_2_007159F0
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Code function: 6_2_0071927F	6_2_0071927F
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Code function: 6_2_00714668	6_2_00714668
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Code function: 6_2_00714600	6_2_00714600
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Code function: 6_2_007102F8	6_2_007102F8
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Code function: 6_2_007162D8	6_2_007162D8
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Code function: 6_2_00716F88	6_2_00716F88
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Code function: 7_2_00446350	7_2_00446350
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Code function: 7_2_00445330	7_2_00445330
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Code function: 7_2_00442099	7_2_00442099
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Code function: 7_2_00445678	7_2_00445678
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Code function: 8_2_00379020	8_2_00379020
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Code function: 8_2_0037BB10	8_2_0037BB10
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Code function: 8_2_0037DBA0	8_2_0037DBA0
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Code function: 8_2_0037549A	8_2_0037549A
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Code function: 8_2_0037FBB0	8_2_0037FBB0
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Code function: 8_2_00372CC0	8_2_00372CC0
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Code function: 8_2_00374EA0	8_2_00374EA0
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Code function: 8_2_0037AEEF	8_2_0037AEEF
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Code function: 8_2_00711058	8_2_00711058
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Code function: 8_2_00710048	8_2_00710048
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Code function: 8_2_00715CE8	8_2_00715CE8
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Code function: 8_2_00715CD9	8_2_00715CD9
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Code function: 8_2_007104D8	8_2_007104D8
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Code function: 8_2_007104C8	8_2_007104C8
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Code function: 8_2_00714C88	8_2_00714C88
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Code function: 8_2_00715540	8_2_00715540
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Code function: 8_2_0071490D	8_2_0071490D
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Code function: 8_2_007159F0	8_2_007159F0
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Code function: 8_2_00714600	8_2_00714600
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Code function: 8_2_007102F8	8_2_007102F8
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Code function: 8_2_007162D8	8_2_007162D8
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Code function: 8_2_00716F88	8_2_00716F88
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Code function: 9_2_00205330	9_2_00205330
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Code function: 9_2_00206350	9_2_00206350
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Code function: 9_2_00202099	9_2_00202099
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Code function: 9_2_00205678	9_2_00205678

Source: vbc[1].exe.2.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: vbc[1].exe.2.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: vbc[1].exe.2.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: tnvLnx.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: tnvLnx.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: tnvLnx.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: vbc[1].exe.2.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: tnvLnx.exe.5.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: vbc[1].exe.2.dr, MediaManager/DebuggableAttribute.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: vbc[1].exe.2.dr, MediaManager/DebuggableAttribute.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 4.2.vbc.exe.ad0000.2.unpack, MediaManager/DebuggableAttribute.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 4.2.vbc.exe.ad0000.2.unpack, MediaManager/DebuggableAttribute.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 4.0.vbc.exe.ad0000.0.unpack, MediaManager/DebuggableAttribute.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 4.0.vbc.exe.ad0000.0.unpack, MediaManager/DebuggableAttribute.cs	Cryptographic APIs: 'CreateDecryptor'
Source: tnvLnx.exe.5.dr, MediaManager/DebuggableAttribute.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: tnvLnx.exe.5.dr, MediaManager/DebuggableAttribute.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 5.2.vbc.exe.400000.0.unpack, A/b2.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 5.2.vbc.exe.400000.0.unpack, A/b2.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'

Source: C:\Users\Public\vbc.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\7582400666d289c016013ad0f6e0e3e6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\Public\vbc.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\7582400666d289c016013ad0f6e0e3e6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\7582400666d289c016013ad0f6e0e3e6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\7582400666d289c016013ad0f6e0e3e6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\7582400666d289c016013ad0f6e0e3e6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\7582400666d289c016013ad0f6e0e3e6\mscorlib.ni.dll	Jump to behavior

Source: C:\Users\Public\vbc.exe	WMI Queries: IWbemServices::CreateInstanceEnum - Win32_Processor
Source: C:\Users\Public\vbc.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\Public\vbc.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	WMI Queries: IWbemServices::CreateInstanceEnum - Win32_Processor
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	WMI Queries: IWbemServices::CreateInstanceEnum - Win32_Processor

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\Public\vbc.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\Public\vbc.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: vbc.exe, 00000004.00000002.2155176869.0000000002426000.00000004.00000001.sdmp, tnvLnx.exe, 00000006.00000002.2221988672.0000000002426000.00000004.00000001.sdmp, tnvLnx.exe, 00000008.00000002.2242859365.0000000002346000.00000004.00000001.sdmp	Binary or memory string: Select * from Clientes WHERE id=@id;;
Source: vbc.exe, 00000004.00000002.2155176869.0000000002426000.00000004.00000001.sdmp, tnvLnx.exe, 00000006.00000002.2221988672.0000000002426000.00000004.00000001.sdmp, tnvLnx.exe, 00000008.00000002.2242859365.0000000002346000.00000004.00000001.sdmp	Binary or memory string: Select * from Aluguel Erro ao listar Banco sql-Aluguel.INSERT INTO Aluguel VALUES(@clienteID, @data);
Source: vbc.exe, 00000004.00000002.2155176869.0000000002426000.00000004.00000001.sdmp, tnvLnx.exe, 00000006.00000002.2221988672.0000000002426000.00000004.00000001.sdmp, tnvLnx.exe, 00000008.00000002.2242859365.0000000002346000.00000004.00000001.sdmp	Binary or memory string: Select * from SecurityLogonType WHERE id=@id;
Source: vbc.exe, 00000004.00000002.2155176869.0000000002426000.00000004.00000001.sdmp, tnvLnx.exe, 00000006.00000002.2221988672.0000000002426000.00000004.00000001.sdmp, tnvLnx.exe, 00000008.00000002.2242859365.0000000002346000.00000004.00000001.sdmp	Binary or memory string: Select * from SecurityLogonType WHERE modelo=@modelo;
Source: vbc.exe, 00000004.00000002.2155176869.0000000002426000.00000004.00000001.sdmp, tnvLnx.exe, 00000006.00000002.2221988672.0000000002426000.00000004.00000001.sdmp, tnvLnx.exe, 00000008.00000002.2242859365.0000000002346000.00000004.00000001.sdmp	Binary or memory string: INSERT INTO Itens_Aluguel VALUES(@aluguelID, @aviaoID, @validade);
Source: vbc.exe, 00000004.00000002.2155176869.0000000002426000.00000004.00000001.sdmp, tnvLnx.exe, 00000006.00000002.2221988672.0000000002426000.00000004.00000001.sdmp, tnvLnx.exe, 00000008.00000002.2242859365.0000000002346000.00000004.00000001.sdmp	Binary or memory string: Insert into Clientes values (@nome, @cpf, @rg, @cidade, @endereco, @uf, @telefone);
Source: vbc.exe, 00000004.00000002.2155176869.0000000002426000.00000004.00000001.sdmp, tnvLnx.exe, 00000006.00000002.2221988672.0000000002426000.00000004.00000001.sdmp, tnvLnx.exe, 00000008.00000002.2242859365.0000000002346000.00000004.00000001.sdmp	Binary or memory string: INSERT INTO Aluguel VALUES(@clienteID, @data);
Source: vbc.exe, 00000004.00000002.2155176869.0000000002426000.00000004.00000001.sdmp, tnvLnx.exe, 00000006.00000002.2221988672.0000000002426000.00000004.00000001.sdmp, tnvLnx.exe, 00000008.00000002.2242859365.0000000002346000.00000004.00000001.sdmp	Binary or memory string: INSERT INTO SecurityLogonType VALUES(@modelo, @fabricante, @ano, @cor);
Source: vbc.exe, 00000004.00000002.2155176869.0000000002426000.00000004.00000001.sdmp, tnvLnx.exe, 00000006.00000002.2221988672.0000000002426000.00000004.00000001.sdmp, tnvLnx.exe, 00000008.00000002.2242859365.0000000002346000.00000004.00000001.sdmp	Binary or memory string: Select * from SecurityLogonTypeErro ao listar Banco sql-SecurityLogonType,Select from SecurityLogonType WHERE id=@id;Select * from SecurityLogonType WHERE (modelo LIKE @modelo)

Source: unknown	Process created: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE 'C:\Program Files\Microsoft Office\Office14\EXCEL.EXE' /automation -Embedding
Source: unknown	Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE 'C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE' -Embedding
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Users\Public\vbc.exe 'C:\Users\Public\vbc.exe'
Source: C:\Users\Public\vbc.exe	Process created: C:\Users\Public\vbc.exe C:\Users\Public\vbc.exe
Source: unknown	Process created: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe 'C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe'
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Process created: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe
Source: unknown	Process created: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe 'C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe'
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Process created: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Users\Public\vbc.exe 'C:\Users\Public\vbc.exe'	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process created: C:\Users\Public\vbc.exe C:\Users\Public\vbc.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Process created: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Process created: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Jump to behavior

Source: C:\Users\Public\vbc.exe	Code function: 4_2_00AD3BCE push es; ret	4_2_00AD3BDC
Source: C:\Users\Public\vbc.exe	Code function: 4_2_002B1122 push ecx; iretd	4_2_002B1123
Source: C:\Users\Public\vbc.exe	Code function: 4_2_002B117B push edx; iretd	4_2_002B117C
Source: C:\Users\Public\vbc.exe	Code function: 4_2_002B1144 push ecx; iretd	4_2_002B1145
Source: C:\Users\Public\vbc.exe	Code function: 4_2_02003232 push esp; retf	4_2_02003233
Source: C:\Users\Public\vbc.exe	Code function: 5_2_00AD3BCE push es; ret	5_2_00AD3BDC
Source: C:\Users\Public\vbc.exe	Code function: 5_2_00223868 pushfd ; iretd	5_2_0022386D
Source: C:\Users\Public\vbc.exe	Code function: 5_2_0022131F pushfd ; iretd	5_2_002213D9
Source: C:\Users\Public\vbc.exe	Code function: 5_2_00221390 pushfd ; iretd	5_2_002213D9
Source: C:\Users\Public\vbc.exe	Code function: 5_2_007C58AB pushad ; retf	5_2_007C58C1
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Code function: 6_2_00213BCE push es; ret	6_2_00213BDC
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Code function: 6_2_00713232 push esp; retf	6_2_00713233
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Code function: 7_2_00213BCE push es; ret	7_2_00213BDC
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Code function: 7_2_0044131F pushfd ; iretd	7_2_004413D9
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Code function: 7_2_00441390 pushfd ; iretd	7_2_004413D9
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Code function: 8_2_00371122 push ecx; ret	8_2_00371123
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Code function: 8_2_00371144 push ecx; ret	8_2_00371145
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Code function: 8_2_00713232 push esp; retf	8_2_00713233
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Code function: 9_2_002013D0 pushfd ; iretd	9_2_002013D9

Source: initial sample	Static PE information: section name: .text entropy: 7.65432769583
Source: initial sample	Static PE information: section name: .text entropy: 7.65432769583

Source: C:\Users\Public\vbc.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run tnvLnx			Jump to behavior
Source: C:\Users\Public\vbc.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run tnvLnx			Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: Yara match	File source: 00000008.00000002.2242859365.0000000002346000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2221988672.0000000002426000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2155176869.0000000002426000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: tnvLnx.exe PID: 1664, type: MEMORY
Source: Yara match	File source: Process Memory Space: vbc.exe PID: 2908, type: MEMORY
Source: Yara match	File source: Process Memory Space: tnvLnx.exe PID: 764, type: MEMORY

Windows Analysis Report AGG POWER RFQ.xlsx

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection:

Exploits:

Compliance:

Software Vulnerabilities:

Networking:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Boot Survival:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted Domains

Contacted URLs

Source: vbc.exe, 00000004.00000002.2155176869.0000000002426000.00000004.00000001.sdmp, tnvLnx.exe, 00000006.00000002.2221988672.0000000002426000.00000004.00000001.sdmp, tnvLnx.exe, 00000008.00000002.2242859365.0000000002346000.00000004.00000001.sdmp	Binary or memory string: WINE_GET_UNIX_FILE_NAME
Source: vbc.exe, 00000004.00000002.2155176869.0000000002426000.00000004.00000001.sdmp, tnvLnx.exe, 00000006.00000002.2221988672.0000000002426000.00000004.00000001.sdmp, tnvLnx.exe, 00000008.00000002.2242859365.0000000002346000.00000004.00000001.sdmp	Binary or memory string: SBIEDLL.DLL

Source: C:\Users\Public\vbc.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\Public\vbc.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Users\Public\vbc.exe	Window / User API: threadDelayed 9674	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Window / User API: threadDelayed 2968	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Window / User API: threadDelayed 9715	Jump to behavior

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE TID: 2704	Thread sleep time: -300000s >= -30000s	Jump to behavior
Source: C:\Users\Public\vbc.exe TID: 2864	Thread sleep time: -104524s >= -30000s	Jump to behavior
Source: C:\Users\Public\vbc.exe TID: 2968	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\Public\vbc.exe TID: 3016	Thread sleep time: -360000s >= -30000s	Jump to behavior
Source: C:\Users\Public\vbc.exe TID: 2312	Thread sleep time: -4611686018427385s >= -30000s	Jump to behavior
Source: C:\Users\Public\vbc.exe TID: 2312	Thread sleep time: -120000s >= -30000s	Jump to behavior
Source: C:\Users\Public\vbc.exe TID: 2292	Thread sleep count: 9674 > 30	Jump to behavior
Source: C:\Users\Public\vbc.exe TID: 856	Thread sleep count: 65 > 30	Jump to behavior
Source: C:\Users\Public\vbc.exe TID: 2312	Thread sleep count: 93 > 30	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe TID: 2628	Thread sleep time: -103694s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe TID: 2612	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe TID: 2432	Thread sleep time: -300000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe TID: 2724	Thread sleep time: -5534023222112862s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe TID: 2724	Thread sleep time: -90000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe TID: 2676	Thread sleep count: 2968 > 30	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe TID: 2676	Thread sleep count: 198 > 30	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe TID: 2112	Thread sleep time: -104455s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe TID: 2664	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe TID: 2548	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe TID: 2656	Thread sleep time: -300000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe TID: 3020	Thread sleep time: -5534023222112862s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe TID: 3020	Thread sleep time: -120000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe TID: 260	Thread sleep count: 9715 > 30	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe TID: 2864	Thread sleep count: 31 > 30	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe TID: 3020	Thread sleep count: 96 > 30	Jump to behavior

Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Last function: Thread delayed

Source: C:\Users\Public\vbc.exe	Thread delayed: delay time: 104524	Jump to behavior
Source: C:\Users\Public\vbc.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\Public\vbc.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\Public\vbc.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Thread delayed: delay time: 103694	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Thread delayed: delay time: 104455	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Thread delayed: delay time: 30000	Jump to behavior

Source: tnvLnx.exe, 00000008.00000002.2242859365.0000000002346000.00000004.00000001.sdmp	Binary or memory string: vmware
Source: tnvLnx.exe, 00000008.00000002.2242859365.0000000002346000.00000004.00000001.sdmp	Binary or memory string: C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: tnvLnx.exe, 00000008.00000002.2242859365.0000000002346000.00000004.00000001.sdmp	Binary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
Source: tnvLnx.exe, 00000008.00000002.2242859365.0000000002346000.00000004.00000001.sdmp	Binary or memory string: VMware SVGA II!Add-MpPreference -ExclusionPath "
Source: tnvLnx.exe, 00000008.00000002.2242859365.0000000002346000.00000004.00000001.sdmp	Binary or memory string: VMWARE
Source: tnvLnx.exe, 00000008.00000002.2242859365.0000000002346000.00000004.00000001.sdmp	Binary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: tnvLnx.exe, 00000008.00000002.2242859365.0000000002346000.00000004.00000001.sdmp	Binary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
Source: tnvLnx.exe, 00000008.00000002.2242859365.0000000002346000.00000004.00000001.sdmp	Binary or memory string: VMware SVGA II
Source: tnvLnx.exe, 00000008.00000002.2242859365.0000000002346000.00000004.00000001.sdmp	Binary or memory string: vmwareNSYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000

Source: C:\Users\Public\vbc.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\Public\vbc.exe	Memory written: C:\Users\Public\vbc.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Memory written: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe	Memory written: C:\Users\user\AppData\Roaming\tnvLnx\tnvLnx.exe base: 400000 value starts with: 4D5A	Jump to behavior

Source: vbc.exe, 00000005.00000002.2366923007.0000000000FB0000.00000002.00000001.sdmp	Binary or memory string: Program Manager
Source: vbc.exe, 00000005.00000002.2366923007.0000000000FB0000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: vbc.exe, 00000005.00000002.2366923007.0000000000FB0000.00000002.00000001.sdmp	Binary or memory string: !Progman