Play interactive tour

Edit tour

Windows Analysis Report ENQUIRY_101.exe

Overview

General Information

Sample Name:	ENQUIRY_101.exe
Analysis ID:	452731
MD5:	5b14a7366cf5dbea3386c6afbd25f012
SHA1:	2a39f1d215a739ddf4e2daf87fb42e26f12f72ac
SHA256:	f6ef92f6911bb14f5b8905f3964d21a9569c41c4e5367d0ee8aec59d54eb7024
Tags:	exe
Infos:
Most interesting Screenshot:

Detection

AgentTesla

Score:	84
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Yara detected AgentTesla

Initial sample is a PE file and has a suspicious name

Injects a PE file into a foreign processes

Machine Learning detection for sample

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Antivirus or Machine Learning detection for unpacked file

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

May sleep (evasive loops) to hinder dynamic analysis

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

ENQUIRY_101.exe (PID: 6796 cmdline: 'C:\Users\user\Desktop\ENQUIRY_101.exe' MD5: 5B14A7366CF5DBEA3386C6AFBD25F012)

ENQUIRY_101.exe (PID: 6292 cmdline: C:\Users\user\Desktop\ENQUIRY_101.exe MD5: 5B14A7366CF5DBEA3386C6AFBD25F012)

cleanup

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Username": "info@hajartrading.net", "Password": "Hajarbh@1993", "Host": "box5363.bluehost.com"}

Yara Overview

Memory Dumps

Source	Rule	Description	Author
00000007.00000002.943178137.0000000000402000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000007.00000002.943178137.0000000000402000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000007.00000002.944445963.0000000003431000.00000004.00000001.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: ENQUIRY_101.exe PID: 6292	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: ENQUIRY_101.exe PID: 6292	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
7.2.ENQUIRY_101.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
7.2.ENQUIRY_101.exe.400000.0.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security

Sigma Overview

No Sigma rule has matched

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: 7.2.ENQUIRY_101.exe.400000.0.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Username": "info@hajartrading.net", "Password": "Hajarbh@1993", "Host": "box5363.bluehost.com"}

Machine Learning detection for sample

Show sources

Source: ENQUIRY_101.exe

Joe Sandbox ML: detected

Source: 7.2.ENQUIRY_101.exe.400000.0.unpack

Avira: Label: TR/Spy.Gen8

Source: ENQUIRY_101.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: ENQUIRY_101.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source: ENQUIRY_101.exe, 00000007.00000002.944445963.0000000003431000.00000004.00000001.sdmp	String found in binary or memory: http://127.0.0.1:HTTP/1.1
Source: ENQUIRY_101.exe, 00000007.00000002.944445963.0000000003431000.00000004.00000001.sdmp	String found in binary or memory: http://AeXMrV.com
Source: ENQUIRY_101.exe, 00000007.00000002.944445963.0000000003431000.00000004.00000001.sdmp	String found in binary or memory: http://DynDns.comDynDNS
Source: ENQUIRY_101.exe, 00000000.00000003.684736714.000000000AB3A000.00000004.00000001.sdmp	String found in binary or memory: http://www.agfamonotype.
Source: ENQUIRY_101.exe, 00000000.00000003.684612731.000000000AB3A000.00000004.00000001.sdmp	String found in binary or memory: http://www.agfamonotype.c
Source: ENQUIRY_101.exe, 00000000.00000003.684736714.000000000AB3A000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: ENQUIRY_101.exe, 00000000.00000003.683368341.000000000AB3A000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com.TTF
Source: ENQUIRY_101.exe, 00000000.00000003.684736714.000000000AB3A000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: ENQUIRY_101.exe, 00000000.00000003.683368341.000000000AB3A000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comF
Source: ENQUIRY_101.exe, 00000000.00000003.683368341.000000000AB3A000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comFz
Source: ENQUIRY_101.exe, 00000000.00000003.683368341.000000000AB3A000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.coma
Source: ENQUIRY_101.exe, 00000000.00000003.683368341.000000000AB3A000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comalic
Source: ENQUIRY_101.exe, 00000000.00000003.683368341.000000000AB3A000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comalse
Source: ENQUIRY_101.exe, 00000000.00000003.683368341.000000000AB3A000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comd
Source: ENQUIRY_101.exe, 00000000.00000003.683368341.000000000AB3A000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comituF
Source: ENQUIRY_101.exe, 00000000.00000003.684736714.000000000AB3A000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comma
Source: ENQUIRY_101.exe, 00000000.00000003.678773997.000000000AB65000.00000004.00000001.sdmp	String found in binary or memory: http://www.fonts.com
Source: ENQUIRY_101.exe, 00000000.00000003.678741871.000000000AB65000.00000004.00000001.sdmp	String found in binary or memory: http://www.fonts.comD
Source: ENQUIRY_101.exe, 00000000.00000003.678749215.000000000AB4B000.00000004.00000001.sdmp	String found in binary or memory: http://www.fonts.comic~
Source: ENQUIRY_101.exe, 00000000.00000003.678749215.000000000AB4B000.00000004.00000001.sdmp	String found in binary or memory: http://www.fonts.comtx
Source: ENQUIRY_101.exe, 00000000.00000003.680561593.000000000AB46000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn_tr
Source: ENQUIRY_101.exe, 00000000.00000003.682210421.000000000AB3A000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: ENQUIRY_101.exe, 00000000.00000003.681958848.000000000AB3A000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp//e
Source: ENQUIRY_101.exe, 00000000.00000003.682210421.000000000AB3A000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/5
Source: ENQUIRY_101.exe, 00000000.00000003.682210421.000000000AB3A000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/L
Source: ENQUIRY_101.exe, 00000000.00000003.681480130.000000000AB33000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/Q
Source: ENQUIRY_101.exe, 00000000.00000003.681958848.000000000AB3A000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/Y0-g
Source: ENQUIRY_101.exe, 00000000.00000003.682210421.000000000AB3A000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/Y0/
Source: ENQUIRY_101.exe, 00000000.00000003.681480130.000000000AB33000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/a-d
Source: ENQUIRY_101.exe, 00000000.00000003.681958848.000000000AB3A000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/c
Source: ENQUIRY_101.exe, 00000000.00000003.682210421.000000000AB3A000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/h
Source: ENQUIRY_101.exe, 00000000.00000003.682210421.000000000AB3A000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/
Source: ENQUIRY_101.exe, 00000000.00000003.682210421.000000000AB3A000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/c
Source: ENQUIRY_101.exe, 00000000.00000003.681958848.000000000AB3A000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/s-ez
Source: ENQUIRY_101.exe, 00000000.00000003.682527218.000000000AB3A000.00000004.00000001.sdmp	String found in binary or memory: http://www.sakkal.com
Source: ENQUIRY_101.exe, 00000000.00000003.682527218.000000000AB3A000.00000004.00000001.sdmp	String found in binary or memory: http://www.sakkal.comgu
Source: ENQUIRY_101.exe, 00000000.00000003.679889371.000000000AB4B000.00000004.00000001.sdmp	String found in binary or memory: http://www.tiro.comZ
Source: ENQUIRY_101.exe, 00000007.00000002.943178137.0000000000402000.00000040.00000001.sdmp	String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip
Source: ENQUIRY_101.exe, 00000007.00000002.944445963.0000000003431000.00000004.00000001.sdmp	String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha

System Summary:

Initial sample is a PE file and has a suspicious name

Show sources

Source: initial sample

Static PE information: Filename: ENQUIRY_101.exe

Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Code function: 7_2_011D2618	7_2_011D2618
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Code function: 7_2_011D2D50	7_2_011D2D50
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Code function: 7_2_011D1FE0	7_2_011D1FE0
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Code function: 7_2_01AC46A0	7_2_01AC46A0
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Code function: 7_2_01AC45FB	7_2_01AC45FB
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Code function: 7_2_01ACD2E0	7_2_01ACD2E0
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Code function: 7_2_065C7538	7_2_065C7538
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Code function: 7_2_065C90F8	7_2_065C90F8
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Code function: 7_2_065C6920	7_2_065C6920
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Code function: 7_2_065C6C68	7_2_065C6C68

Source: ENQUIRY_101.exe, 00000000.00000000.673884705.0000000000232000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameIEnumSTORECATEGO.exeJ vs ENQUIRY_101.exe
Source: ENQUIRY_101.exe	Binary or memory string: OriginalFilename vs ENQUIRY_101.exe
Source: ENQUIRY_101.exe, 00000007.00000000.737670921.0000000000FC2000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameIEnumSTORECATEGO.exeJ vs ENQUIRY_101.exe
Source: ENQUIRY_101.exe, 00000007.00000002.943231367.0000000000438000.00000040.00000001.sdmp	Binary or memory string: OriginalFilenameDTfpBFpSbSGFkbQWBkwqyADFDMmpfzwACJDd.exe4 vs ENQUIRY_101.exe
Source: ENQUIRY_101.exe, 00000007.00000002.945972848.0000000006430000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameKernelbase.dll.muij% vs ENQUIRY_101.exe
Source: ENQUIRY_101.exe	Binary or memory string: OriginalFilenameIEnumSTORECATEGO.exeJ vs ENQUIRY_101.exe

Source: ENQUIRY_101.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: ENQUIRY_101.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: mal84.troj.evad.winEXE@3/1@0/0

Source: C:\Users\user\Desktop\ENQUIRY_101.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\ENQUIRY_101.exe.log

Jump to behavior

Source: ENQUIRY_101.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll			Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll			Jump to behavior

Source: C:\Users\user\Desktop\ENQUIRY_101.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Users\user\Desktop\ENQUIRY_101.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\ENQUIRY_101.exe 'C:\Users\user\Desktop\ENQUIRY_101.exe'
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Process created: C:\Users\user\Desktop\ENQUIRY_101.exe C:\Users\user\Desktop\ENQUIRY_101.exe
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Process created: C:\Users\user\Desktop\ENQUIRY_101.exe C:\Users\user\Desktop\ENQUIRY_101.exe	Jump to behavior

Source: C:\Users\user\Desktop\ENQUIRY_101.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{172BDDF8-CEEA-11D1-8B05-00600806D9B6}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\ENQUIRY_101.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: ENQUIRY_101.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: ENQUIRY_101.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Code function: 7_2_01048C34 push ecx; retf	7_2_01048C37
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Code function: 7_2_01048E68 push esp; ret	7_2_01048E69
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Code function: 7_2_0104AFEF push cs; retf	7_2_0104B05B

Source: initial sample

Static PE information: section name: .text entropy: 7.77326608249

Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion:

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Show sources

Source: C:\Users\user\Desktop\ENQUIRY_101.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Show sources

Source: C:\Users\user\Desktop\ENQUIRY_101.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Window / User API: threadDelayed 9317			Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Window / User API: threadDelayed 532			Jump to behavior

Source: C:\Users\user\Desktop\ENQUIRY_101.exe TID: 6800	Thread sleep time: -59646s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe TID: 6824	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe TID: 7068	Thread sleep time: -25825441703193356s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe TID: 3400	Thread sleep count: 9317 > 30	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe TID: 3400	Thread sleep count: 532 > 30	Jump to behavior

Source: C:\Users\user\Desktop\ENQUIRY_101.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Thread delayed: delay time: 59646	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: ENQUIRY_101.exe, 00000007.00000002.945972848.0000000006430000.00000002.00000001.sdmp	Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: ENQUIRY_101.exe, 00000007.00000002.945972848.0000000006430000.00000002.00000001.sdmp	Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: ENQUIRY_101.exe, 00000007.00000002.945972848.0000000006430000.00000002.00000001.sdmp	Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: ENQUIRY_101.exe, 00000007.00000002.945972848.0000000006430000.00000002.00000001.sdmp	Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.

Source: C:\Users\user\Desktop\ENQUIRY_101.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\ENQUIRY_101.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\ENQUIRY_101.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

Injects a PE file into a foreign processes

Show sources

Source: C:\Users\user\Desktop\ENQUIRY_101.exe

Memory written: C:\Users\user\Desktop\ENQUIRY_101.exe base: 400000 value starts with: 4D5A

Jump to behavior

Source: C:\Users\user\Desktop\ENQUIRY_101.exe

Process created: C:\Users\user\Desktop\ENQUIRY_101.exe C:\Users\user\Desktop\ENQUIRY_101.exe

Jump to behavior

Source: ENQUIRY_101.exe, 00000007.00000002.944253391.0000000001EB0000.00000002.00000001.sdmp	Binary or memory string: Program Manager
Source: ENQUIRY_101.exe, 00000007.00000002.944253391.0000000001EB0000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: ENQUIRY_101.exe, 00000007.00000002.944253391.0000000001EB0000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: ENQUIRY_101.exe, 00000007.00000002.944253391.0000000001EB0000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Users\user\Desktop\ENQUIRY_101.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Users\user\Desktop\ENQUIRY_101.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ENQUIRY_101.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\ENQUIRY_101.exe

Code function: 7_2_065C2654 GetUserNameW,

7_2_065C2654

Source: C:\Users\user\Desktop\ENQUIRY_101.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information:

Yara detected AgentTesla

Show sources

Source: Yara match	File source: 7.2.ENQUIRY_101.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000002.943178137.0000000000402000.00000040.00000001.sdmp, type: MEMORY

Yara detected AgentTesla

Show sources

Source: Yara match	File source: 7.2.ENQUIRY_101.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000002.943178137.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: ENQUIRY_101.exe PID: 6292, type: MEMORY

Source: Yara match	File source: 00000007.00000002.944445963.0000000003431000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: ENQUIRY_101.exe PID: 6292, type: MEMORY

Remote Access Functionality:

Yara detected AgentTesla

Show sources

Source: Yara match	File source: 7.2.ENQUIRY_101.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000002.943178137.0000000000402000.00000040.00000001.sdmp, type: MEMORY

Yara detected AgentTesla

Show sources

Source: Yara match	File source: 7.2.ENQUIRY_101.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000002.943178137.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: ENQUIRY_101.exe PID: 6292, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation211	Path Interception	Process Injection112	Masquerading1	OS Credential Dumping	Security Software Discovery111	Remote Services	Archive Collected Data1	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Disable or Modify Tools1	LSASS Memory	Process Discovery2	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Junk Data	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Virtualization/Sandbox Evasion131	Security Account Manager	Virtualization/Sandbox Evasion131	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Steganography	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Process Injection112	NTDS	Application Window Discovery1	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Obfuscated Files or Information2	LSA Secrets	Account Discovery1	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Software Packing3	Cached Domain Credentials	System Owner/User Discovery1	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Compile After Delivery	DCSync	System Information Discovery113	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
ENQUIRY_101.exe	100%	Joe Sandbox ML

Dropped Files

No Antivirus matches

Unpacked PE Files

Source	Detection	Scanner	Label	Link	Download
7.2.ENQUIRY_101.exe.400000.0.unpack	100%	Avira	TR/Spy.Gen8		Download File

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://www.agfamonotype.c	0%	Avira URL Cloud	safe
http://127.0.0.1:HTTP/1.1	0%	Avira URL Cloud	safe
http://AeXMrV.com	0%	Avira URL Cloud	safe
http://DynDns.comDynDNS	0%	URL Reputation	safe
http://DynDns.comDynDNS	0%	URL Reputation	safe
http://DynDns.comDynDNS	0%	URL Reputation	safe
http://www.fontbureau.comF	0%	URL Reputation	safe
http://www.fontbureau.comF	0%	URL Reputation	safe
http://www.fontbureau.comF	0%	URL Reputation	safe
http://www.agfamonotype.	0%	URL Reputation	safe
http://www.agfamonotype.	0%	URL Reputation	safe
http://www.agfamonotype.	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/Q	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/Q	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/Q	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/a-d	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/a-d	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/a-d	0%	URL Reputation	safe
http://www.founder.com.cn/cn_tr	0%	Avira URL Cloud	safe
http://www.fontbureau.comma	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/L	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/L	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/L	0%	URL Reputation	safe
http://www.fonts.comic~	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp//e	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/jp/	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/jp/	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/jp/	0%	URL Reputation	safe
http://www.fontbureau.coma	0%	URL Reputation	safe
http://www.fontbureau.coma	0%	URL Reputation	safe
http://www.fontbureau.coma	0%	URL Reputation	safe
http://www.fontbureau.comd	0%	URL Reputation	safe
http://www.fontbureau.comd	0%	URL Reputation	safe
http://www.fontbureau.comd	0%	URL Reputation	safe
http://www.sakkal.comgu	0%	Avira URL Cloud	safe
http://www.fonts.comtx	0%	Avira URL Cloud	safe
http://www.tiro.comZ	0%	Avira URL Cloud	safe
http://www.fontbureau.comituF	0%	URL Reputation	safe
http://www.fontbureau.comituF	0%	URL Reputation	safe
http://www.fontbureau.comituF	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/5	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/5	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/5	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/jp/c	0%	Avira URL Cloud	safe
http://www.fonts.comD	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/Y0/	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/Y0/	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/Y0/	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/Y0-g	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.fontbureau.comFz	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/h	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/h	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/h	0%	URL Reputation	safe
http://www.fontbureau.comalic	0%	URL Reputation	safe
http://www.fontbureau.comalic	0%	URL Reputation	safe
http://www.fontbureau.comalic	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/c	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/c	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/c	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/s-ez	0%	Avira URL Cloud	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://www.fontbureau.com.TTF	0%	URL Reputation	safe
http://www.fontbureau.com.TTF	0%	URL Reputation	safe
http://www.fontbureau.com.TTF	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	0%	URL Reputation	safe
http://www.fontbureau.comalse	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

No contacted domains info

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.agfamonotype.c	ENQUIRY_101.exe, 00000000.00000003.684612731.000000000AB3A000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://127.0.0.1:HTTP/1.1	ENQUIRY_101.exe, 00000007.00000002.944445963.0000000003431000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
http://AeXMrV.com	ENQUIRY_101.exe, 00000007.00000002.944445963.0000000003431000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com	ENQUIRY_101.exe, 00000000.00000003.684736714.000000000AB3A000.00000004.00000001.sdmp	false		high
http://DynDns.comDynDNS	ENQUIRY_101.exe, 00000007.00000002.944445963.0000000003431000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.comF	ENQUIRY_101.exe, 00000000.00000003.683368341.000000000AB3A000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.agfamonotype.	ENQUIRY_101.exe, 00000000.00000003.684736714.000000000AB3A000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/Q	ENQUIRY_101.exe, 00000000.00000003.681480130.000000000AB33000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	ENQUIRY_101.exe, 00000007.00000002.944445963.0000000003431000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/a-d	ENQUIRY_101.exe, 00000000.00000003.681480130.000000000AB33000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.founder.com.cn/cn_tr	ENQUIRY_101.exe, 00000000.00000003.680561593.000000000AB46000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.comma	ENQUIRY_101.exe, 00000000.00000003.684736714.000000000AB3A000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.jiyu-kobo.co.jp/L	ENQUIRY_101.exe, 00000000.00000003.682210421.000000000AB3A000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fonts.comic~	ENQUIRY_101.exe, 00000000.00000003.678749215.000000000AB4B000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
http://www.jiyu-kobo.co.jp//e	ENQUIRY_101.exe, 00000000.00000003.681958848.000000000AB3A000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers	ENQUIRY_101.exe, 00000000.00000003.684736714.000000000AB3A000.00000004.00000001.sdmp	false		high
http://www.jiyu-kobo.co.jp/jp/	ENQUIRY_101.exe, 00000000.00000003.682210421.000000000AB3A000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.coma	ENQUIRY_101.exe, 00000000.00000003.683368341.000000000AB3A000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.comd	ENQUIRY_101.exe, 00000000.00000003.683368341.000000000AB3A000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.sakkal.comgu	ENQUIRY_101.exe, 00000000.00000003.682527218.000000000AB3A000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fonts.comtx	ENQUIRY_101.exe, 00000000.00000003.678749215.000000000AB4B000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.tiro.comZ	ENQUIRY_101.exe, 00000000.00000003.679889371.000000000AB4B000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.comituF	ENQUIRY_101.exe, 00000000.00000003.683368341.000000000AB3A000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/5	ENQUIRY_101.exe, 00000000.00000003.682210421.000000000AB3A000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/jp/c	ENQUIRY_101.exe, 00000000.00000003.682210421.000000000AB3A000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fonts.comD	ENQUIRY_101.exe, 00000000.00000003.678741871.000000000AB65000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.jiyu-kobo.co.jp/Y0/	ENQUIRY_101.exe, 00000000.00000003.682210421.000000000AB3A000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/Y0-g	ENQUIRY_101.exe, 00000000.00000003.681958848.000000000AB3A000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.jiyu-kobo.co.jp/	ENQUIRY_101.exe, 00000000.00000003.682210421.000000000AB3A000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.comFz	ENQUIRY_101.exe, 00000000.00000003.683368341.000000000AB3A000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.jiyu-kobo.co.jp/h	ENQUIRY_101.exe, 00000000.00000003.682210421.000000000AB3A000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fonts.com	ENQUIRY_101.exe, 00000000.00000003.678773997.000000000AB65000.00000004.00000001.sdmp	false		high
http://www.fontbureau.comalic	ENQUIRY_101.exe, 00000000.00000003.683368341.000000000AB3A000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/c	ENQUIRY_101.exe, 00000000.00000003.681958848.000000000AB3A000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/s-ez	ENQUIRY_101.exe, 00000000.00000003.681958848.000000000AB3A000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.sakkal.com	ENQUIRY_101.exe, 00000000.00000003.682527218.000000000AB3A000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com.TTF	ENQUIRY_101.exe, 00000000.00000003.683368341.000000000AB3A000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	ENQUIRY_101.exe, 00000007.00000002.943178137.0000000000402000.00000040.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.comalse	ENQUIRY_101.exe, 00000000.00000003.683368341.000000000AB3A000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown

Contacted IPs

No contacted IP infos

General Information

Joe Sandbox Version:	33.0.0 White Diamond
Analysis ID:	452731
Start date:	22.07.2021
Start time:	19:11:21
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 9m 6s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	ENQUIRY_101.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	18
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal84.troj.evad.winEXE@3/1@0/0
EGA Information:	Failed
HDC Information:	Successful, ratio: 1.1% (good quality ratio 0.7%) Quality average: 41.9% Quality standard deviation: 33%
HCA Information:	Successful, ratio: 99% Number of executed functions: 38 Number of non-executed functions: 2
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Exclude process from analysis (whitelisted): BackgroundTransferHost.exe, backgroundTaskHost.exe, svchost.exe, wuapihost.exe Report size getting too big, too many NtAllocateVirtualMemory calls found. Report size getting too big, too many NtOpenKeyEx calls found.

Simulations

Behavior and APIs

Time	Type	Description
19:12:53	API Interceptor	592x Sleep call for process: ENQUIRY_101.exe modified

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

No context

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\ENQUIRY_101.exe.log Download File
Process:	C:\Users\user\Desktop\ENQUIRY_101.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.355304211458859
Encrypted:	false
SSDEEP:	24:MLUE4K5E4Ks2E1qE4x84qXKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7FE4j:MIHK5HKXE1qHxviYHKhQnoPtHoxHhAHY
MD5:	69206D3AF7D6EFD08F4B4726998856D3
SHA1:	E778D4BF781F7712163CF5E2F5E7C15953E484CF
SHA-256:	A937AD22F9C3E667A062BA0E116672960CD93522F6997C77C00370755929BA87
SHA-512:	CD270C3DF75E548C9B0727F13F44F45262BD474336E89AAEBE56FABFE8076CD4638F88D3C0837B67C2EB3C54055679B07E4212FB3FEDBF88C015EB5DBBCD7FF8
Malicious:	true
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.763416763918635
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	ENQUIRY_101.exe
File size:	747008
MD5:	5b14a7366cf5dbea3386c6afbd25f012
SHA1:	2a39f1d215a739ddf4e2daf87fb42e26f12f72ac
SHA256:	f6ef92f6911bb14f5b8905f3964d21a9569c41c4e5367d0ee8aec59d54eb7024
SHA512:	df11b3ff17cb7a4508a7629e978ca175824f4dae73f9cbdde60da7825ebac73f9c335fc02883a0bcdd007e8806c6372400eeb1e746cc97cfcaf051d55169a172
SSDEEP:	12288:NCKE0cM4fvJZx2wzrO+kaA6i0NrJhVFo4actOTj1xcoPGniqEW5zh1Sly:NCKEZM4ZHNzrOlaA7u9S4jtOooenio
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....~.`..............P..Z...........x... ........@.. ....................................@................................

File Icon


Icon Hash:	00828e8e8686b000

Static PE Info

General
Entrypoint:	0x4b78fe
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE
DLL Characteristics:	NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x60F87E15 [Wed Jul 21 20:05:41 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:	v4.0.30319
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xb78ac	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xb8000	0x650	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xba000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xb5904	0xb5a00	False	0.862994935048	data	7.77326608249	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rsrc	0xb8000	0x650	0x800	False	0.34765625	data	3.55281808773	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xba000	0xc	0x200	False	0.041015625	data	0.0815394123432	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_VERSION	0xb80a0	0x3c4	data
RT_MANIFEST	0xb8464	0x1ea	XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators

Imports

DLL	Import
mscoree.dll	_CorExeMain

Version Infos

Description	Data
Translation	0x0000 0x04b0
LegalCopyright	Copyright 2014
Assembly Version	2.1.0.0
InternalName	IEnumSTORECATEGO.exe
FileVersion	2.1.0.0
CompanyName	Canon Viet Nam
LegalTrademarks
Comments	Library for AGV control system
ProductName	ControlSystemLibrary
ProductVersion	2.1.0.0
FileDescription	ControlSystemLibrary
OriginalFilename	IEnumSTORECATEGO.exe

Network Behavior

No network behavior found

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: ENQUIRY_101.exe PID: 6796 Parent PID: 5812

General

Start time:	19:12:23
Start date:	22/07/2021
Path:	C:\Users\user\Desktop\ENQUIRY_101.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\ENQUIRY_101.exe'
Imagebase:	0x230000
File size:	747008 bytes
MD5 hash:	5B14A7366CF5DBEA3386C6AFBD25F012
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	low

Chronological Activities

Analysis Process: ENQUIRY_101.exe PID: 6292 Parent PID: 6796

General

Start time:	19:12:53
Start date:	22/07/2021
Path:	C:\Users\user\Desktop\ENQUIRY_101.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\ENQUIRY_101.exe
Imagebase:	0xfc0000
File size:	747008 bytes
MD5 hash:	5B14A7366CF5DBEA3386C6AFBD25F012
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000007.00000002.943178137.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000007.00000002.943178137.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000007.00000002.944445963.0000000003431000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: ENQUIRY_101.exe PID: 6292 Parent PID: 6796 ENQUIRY_101.exeCOMMON

Executed Functions

Function 065C2654, Relevance: 1.6, APIs: 1, Instructions: 135COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(00000000,00000000), ref: 065CB633

Memory Dump Source

Source File: 00000007.00000002.946242978.00000000065C0000.00000040.00000001.sdmp, Offset: 065C0000, based on PE: false

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: 5782cf0e57f3fc3193b3e9f9f1338db3d0eda4f50030a7fa56d9b52563a35b89
Instruction ID: fe6015770e8e5a7333c572b48f8eba3bf52bb773b3809a1a390101fe7adb2e30
Opcode Fuzzy Hash: 5782cf0e57f3fc3193b3e9f9f1338db3d0eda4f50030a7fa56d9b52563a35b89
Instruction Fuzzy Hash: 2D5102B5E102188FDB58CFA9C886B9EBBB1BF48324F14852DE815BB350DB749844CF91

Uniqueness

Uniqueness Score: -1.00%

Function 011D2D50, Relevance: .9, Instructions: 893COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.943425174.00000000011D0000.00000040.00000001.sdmp, Offset: 011D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 573d7f8f0c9d88f1e152da319daa57398be2d72a7795828eabee46d6aae26d34
Instruction ID: c0956a95cb8d8bdf24fe4a89ab6311d05450831329f4aad3b405f92f01a715c4
Opcode Fuzzy Hash: 573d7f8f0c9d88f1e152da319daa57398be2d72a7795828eabee46d6aae26d34
Instruction Fuzzy Hash: B8827CB0A10605DFCB19CF68C984AAEBBF2FF48314F158669E5659B361C730EC41CB62

Uniqueness

Uniqueness Score: -1.00%

Function 011D1FE0, Relevance: .5, Instructions: 524COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.943425174.00000000011D0000.00000040.00000001.sdmp, Offset: 011D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ec19794a88a8bbe921e06013737ba781afee76fe58ba576cafabf4777a2e65c
Instruction ID: 007def352276f358ebc722267ac9ad2cf7774a1f9d10b3a0735d31cfd027534f
Opcode Fuzzy Hash: 6ec19794a88a8bbe921e06013737ba781afee76fe58ba576cafabf4777a2e65c
Instruction Fuzzy Hash: C1128C71A002199FDB18DF68C894BAEBBF6BF88304F158129E916AB355DF34DC41CB91

Uniqueness

Uniqueness Score: -1.00%

Function 011D2618, Relevance: .5, Instructions: 465COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.943425174.00000000011D0000.00000040.00000001.sdmp, Offset: 011D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9863c3765582ff66f92e399c0972482045844ef8cb57e87c0d7274ca79cbb6d
Instruction ID: 4081b662238d38fd85f3b19c4d49bc6c8d8fa9744b664a82551c3289f81dac6e
Opcode Fuzzy Hash: c9863c3765582ff66f92e399c0972482045844ef8cb57e87c0d7274ca79cbb6d
Instruction Fuzzy Hash: 29126F31A00219DFDB19CFA8C984AADBBF6FF89300F158069E925AB361D775EC41CB51

Uniqueness

Uniqueness Score: -1.00%

Function 065C90F8, Relevance: .3, Instructions: 344COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.946242978.00000000065C0000.00000040.00000001.sdmp, Offset: 065C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8293dd2d56f55274e6cef141139915e4f9fc9f28b914d19d1c55b84345c5e395
Instruction ID: 79a664fa7f07d6e962f5565ff43ec923176ceea508ae5ee81703e75dc8853c0a
Opcode Fuzzy Hash: 8293dd2d56f55274e6cef141139915e4f9fc9f28b914d19d1c55b84345c5e395
Instruction Fuzzy Hash: 8BD16E75E002098FCB54DFA8C884AAEFBF2FF88324F158559E515AB351DB34A946CF90

Uniqueness

Uniqueness Score: -1.00%

Function 01AC46A0, Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.944116977.0000000001AC0000.00000040.00000001.sdmp, Offset: 01AC0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d372d8a652038f3217ba7527b1950a4495b566dd679abf4c3bdd8a5071179177
Instruction ID: 0ec86b41dd4d68cf6d5ddfd8112c4cfbfdac22bfeb1a502a8648f8b081ef01c8
Opcode Fuzzy Hash: d372d8a652038f3217ba7527b1950a4495b566dd679abf4c3bdd8a5071179177
Instruction Fuzzy Hash: 6E12B0BD5017568AE330CFA5E9881C97BA1F745728F51830CD2A91B2E9D7F9218BCF44

Uniqueness

Uniqueness Score: -1.00%

Function 01AC45FB, Relevance: .3, Instructions: 278COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.944116977.0000000001AC0000.00000040.00000001.sdmp, Offset: 01AC0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96961bd86f3e8b09ead125a456922e2af2a21dc847f3cd5dfe01bdb4c396a336
Instruction ID: 4fe7bfd4a4ba8dcb5c27a4cd4c5016a35584e9f66009ab858dcb4513933f0ae9
Opcode Fuzzy Hash: 96961bd86f3e8b09ead125a456922e2af2a21dc847f3cd5dfe01bdb4c396a336
Instruction Fuzzy Hash: E8D135BD9047868FD721CFA4E8481C97BB1FB46328B11830DD1696B2E9D7B9244BCF94

Uniqueness

Uniqueness Score: -1.00%

Function 065C7538, Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.946242978.00000000065C0000.00000040.00000001.sdmp, Offset: 065C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e01d3ab2394bc0c24fad3695d35bed9202641c60fc0ee64d89021dcc9bbf5b8
Instruction ID: 0465b95425bc8aa6ab0ca0fef8de84a1af69d993559a2c42371af2ad76335da8
Opcode Fuzzy Hash: 2e01d3ab2394bc0c24fad3695d35bed9202641c60fc0ee64d89021dcc9bbf5b8
Instruction Fuzzy Hash: 9DB14B70E006098FDB94CFE9C885B9DBBF2BF88364F14852DD819A7694DB749885CF81

Uniqueness

Uniqueness Score: -1.00%

Function 065C6920, Relevance: .2, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.946242978.00000000065C0000.00000040.00000001.sdmp, Offset: 065C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 992c8be24daa2439e786691668df6232282dea1b2ab04b7897d2e73a8e3b4f06
Instruction ID: 84613575fccf29cfb8a928395c20daf37e6ec7991951be1cec2a2cd876dbfd74
Opcode Fuzzy Hash: 992c8be24daa2439e786691668df6232282dea1b2ab04b7897d2e73a8e3b4f06
Instruction Fuzzy Hash: 06915970E002199FDB50CFA9C9957AEBBF2BF88328F14812DE405A7254DB749985CF81

Uniqueness

Uniqueness Score: -1.00%

Function 01AC6940, Relevance: 6.1, APIs: 4, Instructions: 120threadCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 01AC69A0
GetCurrentThread.KERNEL32 ref: 01AC69DD
GetCurrentProcess.KERNEL32 ref: 01AC6A1A
GetCurrentThreadId.KERNEL32 ref: 01AC6A73

Memory Dump Source

Source File: 00000007.00000002.944116977.0000000001AC0000.00000040.00000001.sdmp, Offset: 01AC0000, based on PE: false

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: cea0f94d7edb74d67a3fbe72dcd0117e6333c3700500774154a0ef6452219892
Instruction ID: 879edb6e3ce0833ce06a3c284ebdfd1f65afbe3653a1854123de0f3da6cb9467
Opcode Fuzzy Hash: cea0f94d7edb74d67a3fbe72dcd0117e6333c3700500774154a0ef6452219892
Instruction Fuzzy Hash: 235143B49002498FEB14CFAAD588BDEBBF5EF88314F20846DE509A7350DB745944CF66

Uniqueness

Uniqueness Score: -1.00%

Function 065CB4EC, Relevance: 1.6, APIs: 1, Instructions: 137COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(00000000,00000000), ref: 065CB633

Memory Dump Source

Source File: 00000007.00000002.946242978.00000000065C0000.00000040.00000001.sdmp, Offset: 065C0000, based on PE: false

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: 6c8b952df8de0cc38e09d441675a363866771b710ccaef2bb6e11d7f95b522d6
Instruction ID: 016adb0c87eb6d27b3dbebb791183810c3e3b826c9680999d8843f61ff250011
Opcode Fuzzy Hash: 6c8b952df8de0cc38e09d441675a363866771b710ccaef2bb6e11d7f95b522d6
Instruction Fuzzy Hash: 125122B4D102188FDB58CFAAC886B9EBBB1BF48324F14812DE815BB351D774A844CF91

Uniqueness

Uniqueness Score: -1.00%

Function 01AC5084, Relevance: 1.6, APIs: 1, Instructions: 115COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 01AC51A2

Memory Dump Source

Source File: 00000007.00000002.944116977.0000000001AC0000.00000040.00000001.sdmp, Offset: 01AC0000, based on PE: false

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: dad722834dfa27ec0a1209f578c5b20cc4eef55d45d19fba2c76fa62bd213bd2
Instruction ID: e3ac55f3ba3f373959bbcfcd4896f017bcb0729f4bebc6162303799f073bae35
Opcode Fuzzy Hash: dad722834dfa27ec0a1209f578c5b20cc4eef55d45d19fba2c76fa62bd213bd2
Instruction Fuzzy Hash: 7C51B2B1D10309DFDB14CFAAC884ADEBBB5BF88314F64812AE815AB210D775A945CF90

Uniqueness

Uniqueness Score: -1.00%

Function 01AC5090, Relevance: 1.6, APIs: 1, Instructions: 113COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 01AC51A2

Memory Dump Source

Source File: 00000007.00000002.944116977.0000000001AC0000.00000040.00000001.sdmp, Offset: 01AC0000, based on PE: false

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: ba997be8e040bee95357ca95b98031fa7ea15bb697e852ee18c72d77d26902bc
Instruction ID: a8a912ca06672f3761447def49adf5f14f295f3d46cb1c86eb152e39a1aee0cf
Opcode Fuzzy Hash: ba997be8e040bee95357ca95b98031fa7ea15bb697e852ee18c72d77d26902bc
Instruction Fuzzy Hash: 2041C0B1D103099FDF14CF9AC884ADEBBB5BF88314F64812AE819AB210D775A945CF90

Uniqueness

Uniqueness Score: -1.00%

Function 01AC7780, Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 01AC7F09

Memory Dump Source

Source File: 00000007.00000002.944116977.0000000001AC0000.00000040.00000001.sdmp, Offset: 01AC0000, based on PE: false

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: c61f1565e8b2d5cca31d6ae2deaa1e978b95c9ae7dcdd6ddc34ec9d0da91efb0
Instruction ID: 1df9a7ea75fe969910dc73538c5e8b92f1ca97747ca3b844027e7e957a93bde7
Opcode Fuzzy Hash: c61f1565e8b2d5cca31d6ae2deaa1e978b95c9ae7dcdd6ddc34ec9d0da91efb0
Instruction Fuzzy Hash: 0F4115B5A002098FDB14CF99C488BAABBF5FF88714F25C45DE519AB321D774A941CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 01AC6B62, Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 01AC6BEF

Memory Dump Source

Source File: 00000007.00000002.944116977.0000000001AC0000.00000040.00000001.sdmp, Offset: 01AC0000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 271c4fc1ac85707e6a6d4811064ac31412866e14af8163fc6a9fbfc1fdd6b679
Instruction ID: 8ad3de7583fe327d221d8f6f38296730c4aa8efd1da8d7703ef0a914285233a3
Opcode Fuzzy Hash: 271c4fc1ac85707e6a6d4811064ac31412866e14af8163fc6a9fbfc1fdd6b679
Instruction Fuzzy Hash: 092103B59002089FDB10CFA9D584AEEBBF4FF48314F14841AE918A7310D378A940CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 01AC6B68, Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 01AC6BEF

Memory Dump Source

Source File: 00000007.00000002.944116977.0000000001AC0000.00000040.00000001.sdmp, Offset: 01AC0000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: b74bfd4f91a5f99efa171b8c76008f617de106612a622389c54c0fdfacdac1a0
Instruction ID: ea145b8aff70c35ed804de979831f28cbc6bc4ab14058f38fcfb203495a7f382
Opcode Fuzzy Hash: b74bfd4f91a5f99efa171b8c76008f617de106612a622389c54c0fdfacdac1a0
Instruction Fuzzy Hash: F421E4B59002489FDB10CF99D584ADEBBF8EB48324F14841AE918A3310D378A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 01ACBE78, Relevance: 1.6, APIs: 1, Instructions: 59COMMON

Download Yara Rule

APIs

RtlEncodePointer.NTDLL(00000000), ref: 01ACBF02

Memory Dump Source

Source File: 00000007.00000002.944116977.0000000001AC0000.00000040.00000001.sdmp, Offset: 01AC0000, based on PE: false

Similarity

API ID: EncodePointer
String ID:
API String ID: 2118026453-0
Opcode ID: 5a7dbf8ead9af963e230cf2a6f5e1e5a26dce54ab60909806edd44f247e963a2
Instruction ID: ffe8ed02046ebf947110734af05b91e4159d0f2510b949efa4d1d8319d78ad69
Opcode Fuzzy Hash: 5a7dbf8ead9af963e230cf2a6f5e1e5a26dce54ab60909806edd44f247e963a2
Instruction Fuzzy Hash: 0E21BB718043458FDB20DFA9E4887DABFF4FB48714F24882ED445A7242C73A6545CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 01ACBE88, Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

RtlEncodePointer.NTDLL(00000000), ref: 01ACBF02

Memory Dump Source

Source File: 00000007.00000002.944116977.0000000001AC0000.00000040.00000001.sdmp, Offset: 01AC0000, based on PE: false

Similarity

API ID: EncodePointer
String ID:
API String ID: 2118026453-0
Opcode ID: 29c26ad93bd54c54173c57c234a0ecf91dd3da062ccd2b45168649dd23689998
Instruction ID: a8a14d83ba571aa7b37e60e8668ae563a5af9e6ce1e5e35776886962ed850764
Opcode Fuzzy Hash: 29c26ad93bd54c54173c57c234a0ecf91dd3da062ccd2b45168649dd23689998
Instruction Fuzzy Hash: 4611A9B19013098FDB20DFAAE4897DEBBF8FB48754F24842DD405A7641CB7AA544CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 011D3E28, Relevance: .8, Instructions: 827COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.943425174.00000000011D0000.00000040.00000001.sdmp, Offset: 011D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5e3b930ce761c4b7557680223ff0ba16dc709ae432be138d8501b9d8460ca1f
Instruction ID: c67c813595fc063cf2881039c269934290ce94a723a099797cc21763315a1249
Opcode Fuzzy Hash: b5e3b930ce761c4b7557680223ff0ba16dc709ae432be138d8501b9d8460ca1f
Instruction Fuzzy Hash: 0F725F74A041588FEB24DBA0D850BAEBBB3FF85304F1180A9D20A6B794DF359D81DF61

Uniqueness

Uniqueness Score: -1.00%

Function 011D4C78, Relevance: .3, Instructions: 318COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.943425174.00000000011D0000.00000040.00000001.sdmp, Offset: 011D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30be5ec3abbf04895b8da79fef62881d1dd610b3859a3eb6ade1757bd85a2448
Instruction ID: 5e7f6b17e5e9de79c54e0e0fa62e515ab2727a2212a82ec01e1208681a66fdfb
Opcode Fuzzy Hash: 30be5ec3abbf04895b8da79fef62881d1dd610b3859a3eb6ade1757bd85a2448
Instruction Fuzzy Hash: 30D1F876A005148FCB19CF6DD588DADBBF6BF88314B1A84A9E509AB771CB30EC41CB51

Uniqueness

Uniqueness Score: -1.00%

Function 011D4B58, Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.943425174.00000000011D0000.00000040.00000001.sdmp, Offset: 011D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67c6835a0a24720f87b6fbfe5c191dfb36ea924be94da016ff023af0cfe4c96a
Instruction ID: 73a84984687af372614aa9e9a11ecf10568d82ade57fe1ae7c2f613f8d5ef1f6
Opcode Fuzzy Hash: 67c6835a0a24720f87b6fbfe5c191dfb36ea924be94da016ff023af0cfe4c96a
Instruction Fuzzy Hash: 42D13A71A001158FCB09CF6DC98899EBBF6FF89314B1A8099E519ABB61CB34EC41CB50

Uniqueness

Uniqueness Score: -1.00%

Function 011D16C8, Relevance: .3, Instructions: 271COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.943425174.00000000011D0000.00000040.00000001.sdmp, Offset: 011D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c3f0e1d09b4f5ca182b5d33c879531df4010ac4884867a509f1493497e4d4d2
Instruction ID: 963f33202f1dd3aee43b6274fc5430acc6f14fd638b349fa98008eb11c9dd234
Opcode Fuzzy Hash: 7c3f0e1d09b4f5ca182b5d33c879531df4010ac4884867a509f1493497e4d4d2
Instruction Fuzzy Hash: 9D91E134304215AFEB1AEF64D894B6E7BF6AF89205F068529E506CB395DF74CC01C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 011D1AD0, Relevance: .2, Instructions: 233COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.943425174.00000000011D0000.00000040.00000001.sdmp, Offset: 011D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26c4abe426db50894a41f84584bc59287a84549b6ebbd41c01001f60be848998
Instruction ID: e23e0a5248685023c586c7f95c5c7b114a6c3e50f6c66cf401ef30fdf5ee8727
Opcode Fuzzy Hash: 26c4abe426db50894a41f84584bc59287a84549b6ebbd41c01001f60be848998
Instruction Fuzzy Hash: 9581AE34B00615AFDB1CDFACC488AAEBBB6FF89254B158169D506DB361D731EC01CB91

Uniqueness

Uniqueness Score: -1.00%

Function 011D3AC8, Relevance: .2, Instructions: 185COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.943425174.00000000011D0000.00000040.00000001.sdmp, Offset: 011D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02a9a030894cb3c9e3171022eed10ec3d704b3f16597a8cd9ed4b6c34d773e2f
Instruction ID: cf26d0c31a18a6711c18a1723c3c9f058660be26a6b6a33a1bfbfba32f0406b1
Opcode Fuzzy Hash: 02a9a030894cb3c9e3171022eed10ec3d704b3f16597a8cd9ed4b6c34d773e2f
Instruction Fuzzy Hash: 3251B3713241119FD718DF3ED88496ABBE9FF4565071A40BAE526CB362DB31DC01C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 011D54F2, Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.943425174.00000000011D0000.00000040.00000001.sdmp, Offset: 011D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b550c49f25f20b77b216ee81f9c8b22c39fc6bbb36fdd13a4d42e3b0da3da1a
Instruction ID: ae1ada31449638c59adac96369f88eb3cb935502146620c756df5ca1c727c943
Opcode Fuzzy Hash: 0b550c49f25f20b77b216ee81f9c8b22c39fc6bbb36fdd13a4d42e3b0da3da1a
Instruction Fuzzy Hash: 6C41D4353052559FDB1A9F28E8546BA3BF7EF85311F05806AE54ACB3A1DB38CC12CB61

Uniqueness

Uniqueness Score: -1.00%

Function 011D38D8, Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.943425174.00000000011D0000.00000040.00000001.sdmp, Offset: 011D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef34d3cf1125b57d6df38686ab75c4efd579aa931b3b4aecc09da99189cdd7b5
Instruction ID: 5d499500c4e9c1f240ce3a7d95f7fd80bcebc89b2d8de102c7415c7e6c84181c
Opcode Fuzzy Hash: ef34d3cf1125b57d6df38686ab75c4efd579aa931b3b4aecc09da99189cdd7b5
Instruction Fuzzy Hash: 154148B57101158FDB09DF28D888AAA7BB6FF88314F114069FA26CB3A1D731DD40CB92

Uniqueness

Uniqueness Score: -1.00%

Function 011D3D08, Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.943425174.00000000011D0000.00000040.00000001.sdmp, Offset: 011D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a60d9c88f453d908f3556b98abd36900509c8a22b8484f64f8f3e4ad2abf910
Instruction ID: e1fa799d62f2a2b0dae86f645e0c909eae685f508cef57f02aa5fdf76c7c2f22
Opcode Fuzzy Hash: 7a60d9c88f453d908f3556b98abd36900509c8a22b8484f64f8f3e4ad2abf910
Instruction Fuzzy Hash: 35214B713106254BDB2E263D989853F7B9BBFC15147540079E522CB3E6DF24C8129B93

Uniqueness

Uniqueness Score: -1.00%

Function 011D3D18, Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.943425174.00000000011D0000.00000040.00000001.sdmp, Offset: 011D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 883387abad93cfbc57d3b5f8b43933040cba98aecb1be90f45642d12b75036ac
Instruction ID: c0dbcb99844ef970661d021a0e6fdbf772b7ca3da1ac467443fde6dc58594d92
Opcode Fuzzy Hash: 883387abad93cfbc57d3b5f8b43933040cba98aecb1be90f45642d12b75036ac
Instruction Fuzzy Hash: 0421C5723206254BDB2E2639989477E769BBFC0604F544039D522CB395EF29CC529793

Uniqueness

Uniqueness Score: -1.00%

Function 011D14F0, Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.943425174.00000000011D0000.00000040.00000001.sdmp, Offset: 011D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c15d953bf15bad2984019aed852e1c732e95ff7ca0ffd210b17a108f09563501
Instruction ID: fad8c2f51cbe77b80c305758f61f49d7a22cbc9b1d24287b3743997d455aa966
Opcode Fuzzy Hash: c15d953bf15bad2984019aed852e1c732e95ff7ca0ffd210b17a108f09563501
Instruction Fuzzy Hash: 82315236200109AFDF0AAF59E884AAE7BB6FB4A311F444019FD06C7255DB39CD62DB91

Uniqueness

Uniqueness Score: -1.00%

Function 011D3C10, Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.943425174.00000000011D0000.00000040.00000001.sdmp, Offset: 011D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82a91a652fe3de909e135154bd4e4086d3313e769c1f62a70cf766dcd90c5741
Instruction ID: 195bd1b808ad75032b9488b0c872ed6f5c5e24e7f3d117ca84c34938c7de7aa8
Opcode Fuzzy Hash: 82a91a652fe3de909e135154bd4e4086d3313e769c1f62a70cf766dcd90c5741
Instruction Fuzzy Hash: D42191B13152559FEB18CE6B98446BB7BE6FB85210B06442BE926C7340D735C940D7A2

Uniqueness

Uniqueness Score: -1.00%

Function 011D19EA, Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.943425174.00000000011D0000.00000040.00000001.sdmp, Offset: 011D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da3c7067136235f56ee9c5e8dede45b12c6d974f2a588e314283a604c3095039
Instruction ID: aab701aed8b76104e695cdcf9e220eddeac85426664c3d4e504c6869f1dcd500
Opcode Fuzzy Hash: da3c7067136235f56ee9c5e8dede45b12c6d974f2a588e314283a604c3095039
Instruction Fuzzy Hash: 4621D136301A219FD329AA29D89496BB7E6FFC8655B04816AE907CB354DF34DC4287C1

Uniqueness

Uniqueness Score: -1.00%

Function 011D5458, Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.943425174.00000000011D0000.00000040.00000001.sdmp, Offset: 011D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7299f3cb2da4cdd871895b3f08c3703668654b96d971d0d61299837d4528b0f5
Instruction ID: 1fa83ce6872e295ca9c9baeeca1f904d17e835d33c9c53c82ac420d476917216
Opcode Fuzzy Hash: 7299f3cb2da4cdd871895b3f08c3703668654b96d971d0d61299837d4528b0f5
Instruction Fuzzy Hash: FB113D75E0111A9BCB14EF99E8446AFBBBAFB88311F10402AE915E3340E7749A15CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 011D544A, Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.943425174.00000000011D0000.00000040.00000001.sdmp, Offset: 011D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b3fddbf53ec70751a4c5d95436b9e9815cfc873b06c1285b21e84486b61c659
Instruction ID: 325986345fdff5ce61154685430fe0cf0b3e00eb5423108af28624a6b0bf03dc
Opcode Fuzzy Hash: 8b3fddbf53ec70751a4c5d95436b9e9815cfc873b06c1285b21e84486b61c659
Instruction Fuzzy Hash: 0D114F71E0121A9FCB55DFA9D8446BFBBBAEF48211F10442AE915E3341E7348A15CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 011D14EA, Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.943425174.00000000011D0000.00000040.00000001.sdmp, Offset: 011D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5a065cfd7f7d1fabc67f1374aa145414e0fc00b2ade547c9dc98102d38c9079
Instruction ID: 6812db55798fd9dcb4ca04f360657078e5bd76425ae30b12c03fb8cc2164e4f4
Opcode Fuzzy Hash: f5a065cfd7f7d1fabc67f1374aa145414e0fc00b2ade547c9dc98102d38c9079
Instruction Fuzzy Hash: 7211A536600119AFDF199F18E984AAF7BA6EB4A311F444029FD0AC7311D738CD65DBD0

Uniqueness

Uniqueness Score: -1.00%

Function 011D1628, Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.943425174.00000000011D0000.00000040.00000001.sdmp, Offset: 011D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb49bfa04b7bf14161ac6178ed79d762845eed955544347f3022b1fed7ef96fe
Instruction ID: 9734e57ada6487fa4a2af1ef2660b1fcd5244ad6af9a7fe7e32f93fcc002ed6c
Opcode Fuzzy Hash: cb49bfa04b7bf14161ac6178ed79d762845eed955544347f3022b1fed7ef96fe
Instruction Fuzzy Hash: B30124367001546FDB0AAE68AC10AAF3FABEBC8740B09805AF505D7290CB70C921C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 011D1AC2, Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.943425174.00000000011D0000.00000040.00000001.sdmp, Offset: 011D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99752220d0e4d34caad6e297c593c764509148705497f37ada78dec1af16f1e4
Instruction ID: c408ef511b832cf12ea248f9cfee8add19cb64bd5f03fcfec46d55cd198fa8d0
Opcode Fuzzy Hash: 99752220d0e4d34caad6e297c593c764509148705497f37ada78dec1af16f1e4
Instruction Fuzzy Hash: CBF0C03A70A5A16BDB3A02A9B900197BB75D7C11B2F010667D466C3700C330484483E3

Uniqueness

Uniqueness Score: -1.00%

Function 011D1D70, Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.943425174.00000000011D0000.00000040.00000001.sdmp, Offset: 011D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 427b476160650f2d2cea653082c5500b3ee9aea4a2a447a80c136e325243e706
Instruction ID: de8c8ced4bd4fe477a7e90468abd35495f973a92124f745b773087bc7cf04571
Opcode Fuzzy Hash: 427b476160650f2d2cea653082c5500b3ee9aea4a2a447a80c136e325243e706
Instruction Fuzzy Hash: 74E0CD3010D7864BF301EB7099404557F264A43546306CC8AD0CD8B562C6745D1A8765

Uniqueness

Uniqueness Score: -1.00%

Function 011D1D80, Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.943425174.00000000011D0000.00000040.00000001.sdmp, Offset: 011D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eaa67d033f49a7ec6fac85e8a59049216254b7490885381a91c0cda206674860
Instruction ID: 5e6ce7ddb8f39512737dc8a396644637d272f44120766642ba262135b20bf0fc
Opcode Fuzzy Hash: eaa67d033f49a7ec6fac85e8a59049216254b7490885381a91c0cda206674860
Instruction Fuzzy Hash: 07C0123001820947F640FF70F980519731F96C068A341C925A5CD4B364EFB86D258B89

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 065C6C68, Relevance: .3, Instructions: 281COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.946242978.00000000065C0000.00000040.00000001.sdmp, Offset: 065C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: befd3c41ea7b8a5b215b1374bf49aa092432bb57871e12fb51a07478f5f8b625
Instruction ID: 9b82d741182f22364db225cfb59899538cd91e5b1b2d856641c4346d9f236334
Opcode Fuzzy Hash: befd3c41ea7b8a5b215b1374bf49aa092432bb57871e12fb51a07478f5f8b625
Instruction Fuzzy Hash: 9CB12A71E002098FDB50CFA9C8857DEBBF2BF88324F14852DE815A7254DB749945CF81

Uniqueness

Uniqueness Score: -1.00%

Function 01ACD2E0, Relevance: .3, Instructions: 267COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.944116977.0000000001AC0000.00000040.00000001.sdmp, Offset: 01AC0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e5ef5ddfd86083edf645da76703136f2eb8700b26ad9c6602cab1e0c1793e38
Instruction ID: 258a2f090c771d58fdf4db3f26bcf7a0a80adf2036f815e38e50cd84f34613b8
Opcode Fuzzy Hash: 5e5ef5ddfd86083edf645da76703136f2eb8700b26ad9c6602cab1e0c1793e38
Instruction Fuzzy Hash: 4191A175B142188FDB18EFB49C5567E76B3AFD8604B09883DE406EB388DF38D8128791

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report ENQUIRY_101.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Agenttesla

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

Jbx Signature Overview

AV Detection:

Compliance:

Networking:

System Summary:

Data Obfuscation:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

Contacted IPs

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Network Behavior

Code Manipulations

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

Behavior

System Behavior

Analysis Process: ENQUIRY_101.exe PID: 6796 Parent PID: 5812

General

Chronological Activities