Play interactive tour

Edit tour

Windows Analysis Report PHvqpLRfRl.exe

Overview

General Information

Sample Name:	PHvqpLRfRl.exe
Analysis ID:	463765
MD5:	d8e003f1443fd417bff275f2ce89330c
SHA1:	9489e8b85d2531b256f60803a8716a6efec34a97
SHA256:	e234948d52b71a636aeb6d54c77620910456db6a65202710fed85d19246601cb
Infos:
Most interesting Screenshot:

Detection

Emotet

Score:	88
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Multi AV Scanner detection for submitted file

Yara detected Emotet

C2 URLs / IPs found in malware configuration

Changes security center settings (notifications, updates, antivirus, firewall)

Drops executables to the windows directory (C:\Windows) and starts them

Hides that the sample has been downloaded from the Internet (zone.identifier)

AV process strings found (often used to terminate AV products)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Connects to several IPs in different countries

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a DirectInput object (often for capturing keystrokes)

Creates files inside the system directory

Deletes files inside the Windows folder

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files to the windows directory (C:\Windows)

Extensive use of GetProcAddress (often used to hide API calls)

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Tries to load missing DLLs

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

PHvqpLRfRl.exe (PID: 3176 cmdline: 'C:\Users\user\Desktop\PHvqpLRfRl.exe' MD5: D8E003F1443FD417BFF275F2CE89330C)

ipsmsnap.exe (PID: 2328 cmdline: C:\Windows\SysWOW64\BackgroundTransferHost\ipsmsnap.exe MD5: D8E003F1443FD417BFF275F2CE89330C)

svchost.exe (PID: 6020 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 5948 cmdline: C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 592 cmdline: c:\windows\system32\svchost.exe -k localservice -p -s CDPSvc MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 5452 cmdline: c:\windows\system32\svchost.exe -k unistacksvcgroup MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 4068 cmdline: c:\windows\system32\svchost.exe -k networkservice -p -s DoSvc MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 5084 cmdline: C:\Windows\System32\svchost.exe -k NetworkService -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

SgrmBroker.exe (PID: 1836 cmdline: C:\Windows\system32\SgrmBroker.exe MD5: D3170A3F3A9626597EEE1888686E3EA6)

svchost.exe (PID: 5912 cmdline: c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s wscsvc MD5: 32569E403279B3FD2EDB7EBD036273FA)

MpCmdRun.exe (PID: 4908 cmdline: 'C:\Program Files\Windows Defender\mpcmdrun.exe' -wdenable MD5: A267555174BFA53844371226F482B86B)

conhost.exe (PID: 5188 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

svchost.exe (PID: 3868 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 5080 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 5576 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

cleanup

Malware Configuration

Threatname: Emotet

{"RSA Public Key": "MHwwDQYJKoZIhvcNAQEBBQADawAwaAJhANQOcBKvh5xEW7VcJ9totsjdBwuAclxS\nQ0e09fk8V053lktpW3TRrzAW63yt6j1KWnyxMrU3igFXypBoI4lVNmkje4UPtIIS\nfkzjEIvG1v/ZNn1k0J0PfFTxbFFeUEs3AwIDAQAB", "C2 list": ["74.219.172.26:80", "134.209.36.254:8080", "104.156.59.7:8080", "120.138.30.150:8080", "194.187.133.160:443", "104.236.246.93:8080", "74.208.45.104:8080", "78.187.156.31:80", "187.161.206.24:80", "94.23.216.33:80", "172.91.208.86:80", "91.211.88.52:7080", "50.91.114.38:80", "200.123.150.89:443", "121.124.124.40:7080", "62.75.141.82:80", "5.196.74.210:8080", "24.137.76.62:80", "85.105.205.77:8080", "139.130.242.43:80", "82.225.49.121:80", "110.145.77.103:80", "195.251.213.56:80", "46.105.131.79:8080", "87.106.136.232:8080", "75.139.38.211:80", "124.41.215.226:80", "203.153.216.189:7080", "162.241.242.173:8080", "219.74.18.66:443", "174.45.13.118:80", "68.188.112.97:80", "200.114.213.233:8080", "213.196.135.145:80", "61.92.17.12:80", "61.19.246.238:443", "219.75.128.166:80", "120.150.60.189:80", "123.176.25.234:80", "1.221.254.82:80", "137.119.36.33:80", "94.23.237.171:443", "74.120.55.163:80", "62.30.7.67:443", "104.131.11.150:443", "139.59.67.118:443", "209.141.54.221:8080", "79.137.83.50:443", "84.39.182.7:80", "97.82.79.83:80", "87.106.139.101:8080", "94.1.108.190:443", "37.187.72.193:8080", "139.162.108.71:8080", "93.147.212.206:80", "74.134.41.124:80", "103.86.49.11:8080", "75.80.124.4:80", "109.74.5.95:8080", "153.232.188.106:80", "168.235.67.138:7080", "50.35.17.13:80", "42.200.107.142:80", "82.80.155.43:80", "78.24.219.147:8080", "24.43.99.75:80", "107.5.122.110:80", "156.155.166.221:80", "83.169.36.251:8080", "47.144.21.12:443", "79.98.24.39:8080", "181.169.34.190:80", "139.59.60.244:8080", "85.152.162.105:80", "185.94.252.104:443", "110.5.16.198:80", "174.102.48.180:443", "140.186.212.146:80", "95.179.229.244:8080", "104.32.141.43:80", "169.239.182.217:8080", "121.7.127.163:80", "94.200.114.161:80", "201.173.217.124:443", "104.131.44.150:8080", "137.59.187.107:8080", "5.39.91.110:7080", "203.117.253.142:80", "157.245.99.39:8080", "176.111.60.55:8080", "95.213.236.64:8080", "220.245.198.194:80", "37.139.21.175:8080", "89.216.122.92:80", "139.99.158.11:443", "24.179.13.119:80", "188.219.31.12:80"]}

Yara Overview

Memory Dumps

Source	Rule	Description	Author
00000001.00000002.467934925.0000000000E50000.00000040.00000001.sdmp	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
00000001.00000002.467384235.0000000000401000.00000020.00000001.sdmp	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
00000000.00000002.202006890.00000000003F0000.00000040.00000001.sdmp	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
00000000.00000002.202145856.0000000000814000.00000004.00000001.sdmp	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
00000000.00000002.202173410.0000000000981000.00000020.00000001.sdmp	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
00000001.00000002.467972344.0000000000E64000.00000004.00000001.sdmp	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
Click to see the 1 entries

Unpacked PEs

Source	Rule	Description	Author
1.2.ipsmsnap.exe.400000.0.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
1.2.ipsmsnap.exe.e5279e.2.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
1.2.ipsmsnap.exe.e5052e.1.raw.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
0.2.PHvqpLRfRl.exe.3f279e.0.raw.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
0.2.PHvqpLRfRl.exe.3f052e.1.raw.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
0.2.PHvqpLRfRl.exe.980000.2.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
1.2.ipsmsnap.exe.e5052e.1.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
0.2.PHvqpLRfRl.exe.3f279e.0.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
1.2.ipsmsnap.exe.e5279e.2.raw.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
0.2.PHvqpLRfRl.exe.3f052e.1.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
Click to see the 5 entries

Sigma Overview

No Sigma rule has matched

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Antivirus / Scanner detection for submitted sample

Show sources

Source: PHvqpLRfRl.exe

Avira: detected

Found malware configuration

Show sources

Source: 0.2.PHvqpLRfRl.exe.3f279e.0.raw.unpack

Malware Configuration Extractor: Emotet {"RSA Public Key": "MHwwDQYJKoZIhvcNAQEBBQADawAwaAJhANQOcBKvh5xEW7VcJ9totsjdBwuAclxS\nQ0e09fk8V053lktpW3TRrzAW63yt6j1KWnyxMrU3igFXypBoI4lVNmkje4UPtIIS\nfkzjEIvG1v/ZNn1k0J0PfFTxbFFeUEs3AwIDAQAB", "C2 list": ["74.219.172.26:80", "134.209.36.254:8080", "104.156.59.7:8080", "120.138.30.150:8080", "194.187.133.160:443", "104.236.246.93:8080", "74.208.45.104:8080", "78.187.156.31:80", "187.161.206.24:80", "94.23.216.33:80", "172.91.208.86:80", "91.211.88.52:7080", "50.91.114.38:80", "200.123.150.89:443", "121.124.124.40:7080", "62.75.141.82:80", "5.196.74.210:8080", "24.137.76.62:80", "85.105.205.77:8080", "139.130.242.43:80", "82.225.49.121:80", "110.145.77.103:80", "195.251.213.56:80", "46.105.131.79:8080", "87.106.136.232:8080", "75.139.38.211:80", "124.41.215.226:80", "203.153.216.189:7080", "162.241.242.173:8080", "219.74.18.66:443", "174.45.13.118:80", "68.188.112.97:80", "200.114.213.233:8080", "213.196.135.145:80", "61.92.17.12:80", "61.19.246.238:443", "219.75.128.166:80", "120.150.60.189:80", "123.176.25.234:80", "1.221.254.82:80", "137.119.36.33:80", "94.23.237.171:443", "74.120.55.163:80", "62.30.7.67:443", "104.131.11.150:443", "139.59.67.118:443", "209.141.54.221:8080", "79.137.83.50:443", "84.39.182.7:80", "97.82.79.83:80", "87.106.139.101:8080", "94.1.108.190:443", "37.187.72.193:8080", "139.162.108.71:8080", "93.147.212.206:80", "74.134.41.124:80", "103.86.49.11:8080", "75.80.124.4:80", "109.74.5.95:8080", "153.232.188.106:80", "168.235.67.138:7080", "50.35.17.13:80", "42.200.107.142:80", "82.80.155.43:80", "78.24.219.147:8080", "24.43.99.75:80", "107.5.122.110:80", "156.155.166.221:80", "83.169.36.251:8080", "47.144.21.12:443", "79.98.24.39:8080", "181.169.34.190:80", "139.59.60.244:8080", "85.152.162.105:80", "185.94.252.104:443", "110.5.16.198:80", "174.102.48.180:443", "140.186.212.146:80", "95.179.229.244:8080", "104.32.141.43:80", "169.239.182.217:8080", "121.7.127.163:80", "94.200.114.161:80", "201.173.217.124:443", "104.131.44.150:8080", "137.59.187.107:8080", "5.39.91.110:7080", "203.117.253.142:80", "157.245.99.39:8080", "176.111.60.55:8080", "95.213.236.64:8080", "220.245.198.194:80", "37.139.21.175:8080", "89.216.122.92:80", "139.99.158.11:443", "24.179.13.119:80", "188.219.31.12:80"]}

Multi AV Scanner detection for submitted file

Show sources

Source: PHvqpLRfRl.exe	Virustotal: Detection: 77%	Perma Link
Source: PHvqpLRfRl.exe	Metadefender: Detection: 51%	Perma Link
Source: PHvqpLRfRl.exe	ReversingLabs: Detection: 89%

Source: C:\Users\user\Desktop\PHvqpLRfRl.exe	Code function: 0_2_01144C40 CryptAcquireContextA,CryptAcquireContextA,
Source: C:\Windows\SysWOW64\BackgroundTransferHost\ipsmsnap.exe	Code function: 1_2_01144C40 CryptAcquireContextA,CryptAcquireContextA,
Source: C:\Windows\SysWOW64\BackgroundTransferHost\ipsmsnap.exe	Code function: 1_2_00402210 CryptDestroyHash,CryptExportKey,CryptDuplicateHash,CryptGetHashParam,CryptEncrypt,memcpy,GetProcessHeap,HeapFree,
Source: C:\Windows\SysWOW64\BackgroundTransferHost\ipsmsnap.exe	Code function: 1_2_004025A0 CryptAcquireContextW,CryptImportKey,LocalFree,CryptCreateHash,CryptDecodeObjectEx,CryptDecodeObjectEx,CryptGenKey,
Source: C:\Windows\SysWOW64\BackgroundTransferHost\ipsmsnap.exe	Code function: 1_2_00401FA0 CryptDuplicateHash,CryptDestroyHash,memcpy,

Source: PHvqpLRfRl.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: PHvqpLRfRl.exe

Static PE information: TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source: C:\Windows\SysWOW64\BackgroundTransferHost\ipsmsnap.exe

Code function: 1_2_004038B0 _snwprintf,_snwprintf,GetProcessHeap,HeapFree,FindFirstFileW,FindFirstFileW,FindNextFileW,FindNextFileW,FindClose,FindClose,

Networking:

C2 URLs / IPs found in malware configuration

Show sources

Source: Malware configuration extractor	IPs: 74.219.172.26:80
Source: Malware configuration extractor	IPs: 134.209.36.254:8080
Source: Malware configuration extractor	IPs: 104.156.59.7:8080
Source: Malware configuration extractor	IPs: 120.138.30.150:8080
Source: Malware configuration extractor	IPs: 194.187.133.160:443
Source: Malware configuration extractor	IPs: 104.236.246.93:8080
Source: Malware configuration extractor	IPs: 74.208.45.104:8080
Source: Malware configuration extractor	IPs: 78.187.156.31:80
Source: Malware configuration extractor	IPs: 187.161.206.24:80
Source: Malware configuration extractor	IPs: 94.23.216.33:80
Source: Malware configuration extractor	IPs: 172.91.208.86:80
Source: Malware configuration extractor	IPs: 91.211.88.52:7080
Source: Malware configuration extractor	IPs: 50.91.114.38:80
Source: Malware configuration extractor	IPs: 200.123.150.89:443
Source: Malware configuration extractor	IPs: 121.124.124.40:7080
Source: Malware configuration extractor	IPs: 62.75.141.82:80
Source: Malware configuration extractor	IPs: 5.196.74.210:8080
Source: Malware configuration extractor	IPs: 24.137.76.62:80
Source: Malware configuration extractor	IPs: 85.105.205.77:8080
Source: Malware configuration extractor	IPs: 139.130.242.43:80
Source: Malware configuration extractor	IPs: 82.225.49.121:80
Source: Malware configuration extractor	IPs: 110.145.77.103:80
Source: Malware configuration extractor	IPs: 195.251.213.56:80
Source: Malware configuration extractor	IPs: 46.105.131.79:8080
Source: Malware configuration extractor	IPs: 87.106.136.232:8080
Source: Malware configuration extractor	IPs: 75.139.38.211:80
Source: Malware configuration extractor	IPs: 124.41.215.226:80
Source: Malware configuration extractor	IPs: 203.153.216.189:7080
Source: Malware configuration extractor	IPs: 162.241.242.173:8080
Source: Malware configuration extractor	IPs: 219.74.18.66:443
Source: Malware configuration extractor	IPs: 174.45.13.118:80
Source: Malware configuration extractor	IPs: 68.188.112.97:80
Source: Malware configuration extractor	IPs: 200.114.213.233:8080
Source: Malware configuration extractor	IPs: 213.196.135.145:80
Source: Malware configuration extractor	IPs: 61.92.17.12:80
Source: Malware configuration extractor	IPs: 61.19.246.238:443
Source: Malware configuration extractor	IPs: 219.75.128.166:80
Source: Malware configuration extractor	IPs: 120.150.60.189:80
Source: Malware configuration extractor	IPs: 123.176.25.234:80
Source: Malware configuration extractor	IPs: 1.221.254.82:80
Source: Malware configuration extractor	IPs: 137.119.36.33:80
Source: Malware configuration extractor	IPs: 94.23.237.171:443
Source: Malware configuration extractor	IPs: 74.120.55.163:80
Source: Malware configuration extractor	IPs: 62.30.7.67:443
Source: Malware configuration extractor	IPs: 104.131.11.150:443
Source: Malware configuration extractor	IPs: 139.59.67.118:443
Source: Malware configuration extractor	IPs: 209.141.54.221:8080
Source: Malware configuration extractor	IPs: 79.137.83.50:443
Source: Malware configuration extractor	IPs: 84.39.182.7:80
Source: Malware configuration extractor	IPs: 97.82.79.83:80
Source: Malware configuration extractor	IPs: 87.106.139.101:8080
Source: Malware configuration extractor	IPs: 94.1.108.190:443
Source: Malware configuration extractor	IPs: 37.187.72.193:8080
Source: Malware configuration extractor	IPs: 139.162.108.71:8080
Source: Malware configuration extractor	IPs: 93.147.212.206:80
Source: Malware configuration extractor	IPs: 74.134.41.124:80
Source: Malware configuration extractor	IPs: 103.86.49.11:8080
Source: Malware configuration extractor	IPs: 75.80.124.4:80
Source: Malware configuration extractor	IPs: 109.74.5.95:8080
Source: Malware configuration extractor	IPs: 153.232.188.106:80
Source: Malware configuration extractor	IPs: 168.235.67.138:7080
Source: Malware configuration extractor	IPs: 50.35.17.13:80
Source: Malware configuration extractor	IPs: 42.200.107.142:80
Source: Malware configuration extractor	IPs: 82.80.155.43:80
Source: Malware configuration extractor	IPs: 78.24.219.147:8080
Source: Malware configuration extractor	IPs: 24.43.99.75:80
Source: Malware configuration extractor	IPs: 107.5.122.110:80
Source: Malware configuration extractor	IPs: 156.155.166.221:80
Source: Malware configuration extractor	IPs: 83.169.36.251:8080
Source: Malware configuration extractor	IPs: 47.144.21.12:443
Source: Malware configuration extractor	IPs: 79.98.24.39:8080
Source: Malware configuration extractor	IPs: 181.169.34.190:80
Source: Malware configuration extractor	IPs: 139.59.60.244:8080
Source: Malware configuration extractor	IPs: 85.152.162.105:80
Source: Malware configuration extractor	IPs: 185.94.252.104:443
Source: Malware configuration extractor	IPs: 110.5.16.198:80
Source: Malware configuration extractor	IPs: 174.102.48.180:443
Source: Malware configuration extractor	IPs: 140.186.212.146:80
Source: Malware configuration extractor	IPs: 95.179.229.244:8080
Source: Malware configuration extractor	IPs: 104.32.141.43:80
Source: Malware configuration extractor	IPs: 169.239.182.217:8080
Source: Malware configuration extractor	IPs: 121.7.127.163:80
Source: Malware configuration extractor	IPs: 94.200.114.161:80
Source: Malware configuration extractor	IPs: 201.173.217.124:443
Source: Malware configuration extractor	IPs: 104.131.44.150:8080
Source: Malware configuration extractor	IPs: 137.59.187.107:8080
Source: Malware configuration extractor	IPs: 5.39.91.110:7080
Source: Malware configuration extractor	IPs: 203.117.253.142:80
Source: Malware configuration extractor	IPs: 157.245.99.39:8080
Source: Malware configuration extractor	IPs: 176.111.60.55:8080
Source: Malware configuration extractor	IPs: 95.213.236.64:8080
Source: Malware configuration extractor	IPs: 220.245.198.194:80
Source: Malware configuration extractor	IPs: 37.139.21.175:8080
Source: Malware configuration extractor	IPs: 89.216.122.92:80
Source: Malware configuration extractor	IPs: 139.99.158.11:443
Source: Malware configuration extractor	IPs: 24.179.13.119:80
Source: Malware configuration extractor	IPs: 188.219.31.12:80

Source: unknown

Network traffic detected: IP country count 33

Source: global traffic	TCP traffic: 192.168.2.3:49726 -> 134.209.36.254:8080
Source: global traffic	TCP traffic: 192.168.2.3:49736 -> 104.156.59.7:8080
Source: global traffic	TCP traffic: 192.168.2.3:49737 -> 120.138.30.150:8080
Source: global traffic	TCP traffic: 192.168.2.3:49746 -> 104.236.246.93:8080

Source: Joe Sandbox View	IP Address: 94.200.114.161 94.200.114.161
Source: Joe Sandbox View	IP Address: 174.102.48.180 174.102.48.180

Source: Joe Sandbox View	ASN Name: DU-AS1AE DU-AS1AE
Source: Joe Sandbox View	ASN Name: TELECABLESpainES TELECABLESpainES
Source: Joe Sandbox View	ASN Name: TWC-10796-MIDWESTUS TWC-10796-MIDWESTUS

Source: unknown	TCP traffic detected without corresponding DNS query: 74.219.172.26
Source: unknown	TCP traffic detected without corresponding DNS query: 74.219.172.26
Source: unknown	TCP traffic detected without corresponding DNS query: 74.219.172.26
Source: unknown	TCP traffic detected without corresponding DNS query: 134.209.36.254
Source: unknown	TCP traffic detected without corresponding DNS query: 134.209.36.254
Source: unknown	TCP traffic detected without corresponding DNS query: 134.209.36.254
Source: unknown	TCP traffic detected without corresponding DNS query: 104.156.59.7
Source: unknown	TCP traffic detected without corresponding DNS query: 104.156.59.7
Source: unknown	TCP traffic detected without corresponding DNS query: 104.156.59.7
Source: unknown	TCP traffic detected without corresponding DNS query: 120.138.30.150
Source: unknown	TCP traffic detected without corresponding DNS query: 120.138.30.150
Source: unknown	TCP traffic detected without corresponding DNS query: 120.138.30.150
Source: unknown	TCP traffic detected without corresponding DNS query: 194.187.133.160
Source: unknown	TCP traffic detected without corresponding DNS query: 194.187.133.160
Source: unknown	TCP traffic detected without corresponding DNS query: 194.187.133.160
Source: unknown	TCP traffic detected without corresponding DNS query: 104.236.246.93
Source: unknown	TCP traffic detected without corresponding DNS query: 104.236.246.93
Source: unknown	TCP traffic detected without corresponding DNS query: 104.236.246.93

Source: ipsmsnap.exe, 00000001.00000002.468016701.0000000000E9A000.00000004.00000020.sdmp	String found in binary or memory: http://104.156.59.7:8080/3x1oIXeY
Source: ipsmsnap.exe, 00000001.00000002.468016701.0000000000E9A000.00000004.00000020.sdmp	String found in binary or memory: http://104.156.59.7:8080/3x1oIXewHYdNlV01/MCzATjJI1I/RPBsOTo7qERajOZz1lh/LN3m/MNxh/
Source: ipsmsnap.exe, 00000001.00000002.468016701.0000000000E9A000.00000004.00000020.sdmp	String found in binary or memory: http://104.156.59.7:8080/3x1oIXewHYdNlV01/MCzATjJI1I/RPBsOTo7qERajOZz1lh/LN3m/MNxh/#?
Source: ipsmsnap.exe, 00000001.00000002.468016701.0000000000E9A000.00000004.00000020.sdmp	String found in binary or memory: http://104.156.59.7:8080/3x1oIXewHYdNlV01/MCzATjJI1I/RPBsOTo7qERajOZz1lh/LN3m/MNxh/3
Source: ipsmsnap.exe, 00000001.00000002.468016701.0000000000E9A000.00000004.00000020.sdmp	String found in binary or memory: http://104.156.59.7:8080/3x1oIXewHYdNlV01/MCzATjJI1I/RPBsOTo7qERajOZz1lh/LN3m/MNxh/m
Source: ipsmsnap.exe, 00000001.00000002.470677696.00000000030B0000.00000004.00000001.sdmp	String found in binary or memory: http://104.236.246.93:8080/nNKoq5kK/
Source: ipsmsnap.exe, 00000001.00000002.470792566.00000000030DE000.00000004.00000001.sdmp	String found in binary or memory: http://104.236.246.93:8080/nNKoq5kK/=
Source: ipsmsnap.exe, 00000001.00000002.470677696.00000000030B0000.00000004.00000001.sdmp	String found in binary or memory: http://104.236.246.93:8080/nNKoq5kK/n
Source: ipsmsnap.exe, 00000001.00000002.468016701.0000000000E9A000.00000004.00000020.sdmp	String found in binary or memory: http://120.138.30.150:8080/2aF5ml4oR/WXLdIdZGpJmXIp5/
Source: ipsmsnap.exe, 00000001.00000002.468016701.0000000000E9A000.00000004.00000020.sdmp	String found in binary or memory: http://120.138.30.150:8080/2aF5ml4oR/WXLdIdZGpJmXIp5/PBsOTo7qERajOZz1lh/LN3m/MNxh/5?
Source: ipsmsnap.exe, 00000001.00000002.468016701.0000000000E9A000.00000004.00000020.sdmp	String found in binary or memory: http://120.138.30.150:8080/2aF5ml4oR/WXLdIdZGpJmXIp5/c8
Source: ipsmsnap.exe, 00000001.00000002.468016701.0000000000E9A000.00000004.00000020.sdmp	String found in binary or memory: http://134.209.36.254:8080/tWwU/w3xB1Bhz7yaslBgJS/q49F3NAtj1IqnXaW2A/GIQOEsdbSxikR6wT/lMJv8yE/
Source: ipsmsnap.exe, 00000001.00000002.468016701.0000000000E9A000.00000004.00000020.sdmp	String found in binary or memory: http://194.187.133.160:443/rRPAuzYPI/PCfjdWIpUQcAD/TNhKcjKj/nadJLloIjR2s5GA9b/NUnsi05bbdpoKVYXGgn/R8
Source: ipsmsnap.exe, 00000001.00000003.276535300.00000000030C4000.00000004.00000001.sdmp	String found in binary or memory: http://74.219.172.26/3vre0AbvHoC/72zolH2gtmnbq3QOxa/GmI2ntvI/3wNRQ8Motcr5/
Source: svchost.exe, 00000004.00000002.470968831.0000025BE688D000.00000004.00000001.sdmp	String found in binary or memory: http://crl3.digicert.com/Omniroot2025.crl0
Source: svchost.exe, 00000004.00000002.470968831.0000025BE688D000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.digicert.com0:
Source: svchost.exe, 00000004.00000002.470968831.0000025BE688D000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.msocsp.com0
Source: svchost.exe, 00000004.00000002.470303423.0000025BE66A0000.00000002.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous.
Source: svchost.exe, 00000009.00000002.309127915.00000184DC213000.00000004.00000001.sdmp	String found in binary or memory: http://www.bingmapsportal.com
Source: svchost.exe, 00000006.00000002.467720725.0000025C8183D000.00000004.00000001.sdmp	String found in binary or memory: https://%s.dnet.xboxlive.com
Source: svchost.exe, 00000006.00000002.467720725.0000025C8183D000.00000004.00000001.sdmp	String found in binary or memory: https://%s.xboxlive.com
Source: svchost.exe, 00000006.00000002.467720725.0000025C8183D000.00000004.00000001.sdmp	String found in binary or memory: https://activity.windows.com
Source: svchost.exe, 00000009.00000003.308854579.00000184DC261000.00000004.00000001.sdmp	String found in binary or memory: https://appexmapsappupdate.blob.core.windows.net
Source: svchost.exe, 00000006.00000002.467720725.0000025C8183D000.00000004.00000001.sdmp	String found in binary or memory: https://bn2.notify.windows.com/v2/register/xplatform/device
Source: svchost.exe, 00000006.00000002.467720725.0000025C8183D000.00000004.00000001.sdmp	String found in binary or memory: https://co4-df.notify.windows.com/v2/register/xplatform/device
Source: svchost.exe, 00000009.00000003.308869309.00000184DC249000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Imagery/Copyright/
Source: svchost.exe, 00000009.00000003.308869309.00000184DC249000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/JsonFilter/VenueMaps/data/
Source: svchost.exe, 00000009.00000003.308854579.00000184DC261000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Locations
Source: svchost.exe, 00000009.00000002.309161825.00000184DC23D000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Routes/
Source: svchost.exe, 00000009.00000003.308869309.00000184DC249000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Traffic/Incidents/
Source: svchost.exe, 00000009.00000003.308854579.00000184DC261000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/mapcontrol/logging.ashx
Source: svchost.exe, 00000009.00000003.308835499.00000184DC250000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/mapcontrol/mapconfiguration.ashx?name=native&v=
Source: svchost.exe, 00000009.00000003.308869309.00000184DC249000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/JsonFilter/VenueMaps/data/
Source: svchost.exe, 00000009.00000003.308854579.00000184DC261000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Locations
Source: svchost.exe, 00000009.00000002.309161825.00000184DC23D000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/
Source: svchost.exe, 00000009.00000003.308854579.00000184DC261000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Driving
Source: svchost.exe, 00000009.00000003.308854579.00000184DC261000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Transit
Source: svchost.exe, 00000009.00000003.308854579.00000184DC261000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Walking
Source: svchost.exe, 00000009.00000003.287207473.00000184DC230000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Traffic/Incidents/
Source: svchost.exe, 00000009.00000002.309167893.00000184DC242000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Transit/Schedules/
Source: svchost.exe, 00000009.00000002.309167893.00000184DC242000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/mapcontrol/HumanScaleServices/GetBubbles.ashx?n=
Source: svchost.exe, 00000009.00000003.308854579.00000184DC261000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/mapcontrol/logging.ashx
Source: svchost.exe, 00000009.00000003.308864231.00000184DC24C000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/webservices/v1/LoggingService/LoggingService.svc/Log?
Source: svchost.exe, 00000009.00000003.287207473.00000184DC230000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/webservices/v1/LoggingService/LoggingService.svc/Log?entry=
Source: svchost.exe, 00000009.00000003.308869309.00000184DC249000.00000004.00000001.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gd?pv=1&r=
Source: svchost.exe, 00000009.00000003.308864231.00000184DC24C000.00000004.00000001.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gdi?pv=1&r=
Source: svchost.exe, 00000009.00000003.308864231.00000184DC24C000.00000004.00000001.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gdv?pv=1&r=
Source: svchost.exe, 00000009.00000002.309195425.00000184DC265000.00000004.00000001.sdmp	String found in binary or memory: https://dynamic.t
Source: svchost.exe, 00000009.00000003.308854579.00000184DC261000.00000004.00000001.sdmp	String found in binary or memory: https://dynamic.t0.tiles.ditu.live.com/comp/gen.ashx
Source: svchost.exe, 00000009.00000002.309161825.00000184DC23D000.00000004.00000001.sdmp	String found in binary or memory: https://ecn.dev.virtualearth.net/REST/v1/Imagery/Copyright/
Source: svchost.exe, 00000009.00000003.287207473.00000184DC230000.00000004.00000001.sdmp	String found in binary or memory: https://ecn.dev.virtualearth.net/mapcontrol/mapconfiguration.ashx?name=native&v=
Source: svchost.exe, 00000009.00000002.309161825.00000184DC23D000.00000004.00000001.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/comp/gen.ashx
Source: svchost.exe, 00000009.00000002.309161825.00000184DC23D000.00000004.00000001.sdmp, svchost.exe, 00000009.00000002.309127915.00000184DC213000.00000004.00000001.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gd?pv=1&r=
Source: svchost.exe, 00000009.00000003.287207473.00000184DC230000.00000004.00000001.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdi?pv=1&r=
Source: svchost.exe, 00000009.00000003.308892949.00000184DC245000.00000004.00000001.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdv?pv=1&r=
Source: svchost.exe, 00000009.00000003.287207473.00000184DC230000.00000004.00000001.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gri?pv=1&r=
Source: svchost.exe, 00000009.00000002.309155756.00000184DC239000.00000004.00000001.sdmp	String found in binary or memory: https://t0.ssl.ak.tiles.virtualearth.net/tiles/gen
Source: svchost.exe, 00000009.00000003.308835499.00000184DC250000.00000004.00000001.sdmp	String found in binary or memory: https://t0.tiles.ditu.live.com/tiles/gen

Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: PHvqpLRfRl.exe, 00000000.00000002.202194536.0000000000A2A000.00000004.00000020.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

E-Banking Fraud:

Yara detected Emotet

Show sources

Source: Yara match	File source: 1.2.ipsmsnap.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.ipsmsnap.exe.e5279e.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.ipsmsnap.exe.e5052e.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PHvqpLRfRl.exe.3f279e.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PHvqpLRfRl.exe.3f052e.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PHvqpLRfRl.exe.980000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.ipsmsnap.exe.e5052e.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PHvqpLRfRl.exe.3f279e.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.ipsmsnap.exe.e5279e.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PHvqpLRfRl.exe.3f052e.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.467934925.0000000000E50000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.467384235.0000000000401000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.202006890.00000000003F0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.202145856.0000000000814000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.202173410.0000000000981000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.467972344.0000000000E64000.00000004.00000001.sdmp, type: MEMORY

Source: C:\Windows\SysWOW64\BackgroundTransferHost\ipsmsnap.exe

Code function: 1_2_004025A0 CryptAcquireContextW,CryptImportKey,LocalFree,CryptCreateHash,CryptDecodeObjectEx,CryptDecodeObjectEx,CryptGenKey,

Source: C:\Users\user\Desktop\PHvqpLRfRl.exe

File created: C:\Windows\SysWOW64\BackgroundTransferHost\

Jump to behavior

Source: C:\Users\user\Desktop\PHvqpLRfRl.exe

File deleted: C:\Windows\SysWOW64\BackgroundTransferHost\ipsmsnap.exe:Zone.Identifier

Jump to behavior

Source: C:\Users\user\Desktop\PHvqpLRfRl.exe	Code function: 0_2_01159723
Source: C:\Users\user\Desktop\PHvqpLRfRl.exe	Code function: 0_2_0114AFA8
Source: C:\Users\user\Desktop\PHvqpLRfRl.exe	Code function: 0_2_0115A181
Source: C:\Users\user\Desktop\PHvqpLRfRl.exe	Code function: 0_2_01154057
Source: C:\Users\user\Desktop\PHvqpLRfRl.exe	Code function: 0_2_0115D060
Source: C:\Users\user\Desktop\PHvqpLRfRl.exe	Code function: 0_2_011533D5
Source: C:\Users\user\Desktop\PHvqpLRfRl.exe	Code function: 0_2_0114DBCA
Source: C:\Users\user\Desktop\PHvqpLRfRl.exe	Code function: 0_2_011572CB
Source: C:\Users\user\Desktop\PHvqpLRfRl.exe	Code function: 0_2_01153C22
Source: C:\Users\user\Desktop\PHvqpLRfRl.exe	Code function: 0_2_011537ED
Source: C:\Users\user\Desktop\PHvqpLRfRl.exe	Code function: 0_2_01158660
Source: C:\Users\user\Desktop\PHvqpLRfRl.exe	Code function: 0_2_01152EE1
Source: C:\Users\user\Desktop\PHvqpLRfRl.exe	Code function: 0_2_003F380E
Source: C:\Users\user\Desktop\PHvqpLRfRl.exe	Code function: 0_2_003F98FE
Source: C:\Users\user\Desktop\PHvqpLRfRl.exe	Code function: 0_2_003F90CE
Source: C:\Users\user\Desktop\PHvqpLRfRl.exe	Code function: 0_2_003F9C6E
Source: C:\Users\user\Desktop\PHvqpLRfRl.exe	Code function: 0_2_003F7F8E
Source: C:\Windows\SysWOW64\BackgroundTransferHost\ipsmsnap.exe	Code function: 1_2_01159723
Source: C:\Windows\SysWOW64\BackgroundTransferHost\ipsmsnap.exe	Code function: 1_2_0114AFA8
Source: C:\Windows\SysWOW64\BackgroundTransferHost\ipsmsnap.exe	Code function: 1_2_0115A181
Source: C:\Windows\SysWOW64\BackgroundTransferHost\ipsmsnap.exe	Code function: 1_2_01154057
Source: C:\Windows\SysWOW64\BackgroundTransferHost\ipsmsnap.exe	Code function: 1_2_0115D060
Source: C:\Windows\SysWOW64\BackgroundTransferHost\ipsmsnap.exe	Code function: 1_2_011533D5
Source: C:\Windows\SysWOW64\BackgroundTransferHost\ipsmsnap.exe	Code function: 1_2_0114DBCA
Source: C:\Windows\SysWOW64\BackgroundTransferHost\ipsmsnap.exe	Code function: 1_2_011572CB
Source: C:\Windows\SysWOW64\BackgroundTransferHost\ipsmsnap.exe	Code function: 1_2_01153C22
Source: C:\Windows\SysWOW64\BackgroundTransferHost\ipsmsnap.exe	Code function: 1_2_011537ED
Source: C:\Windows\SysWOW64\BackgroundTransferHost\ipsmsnap.exe	Code function: 1_2_01158660
Source: C:\Windows\SysWOW64\BackgroundTransferHost\ipsmsnap.exe	Code function: 1_2_01152EE1
Source: C:\Windows\SysWOW64\BackgroundTransferHost\ipsmsnap.exe	Code function: 1_2_004080D0
Source: C:\Windows\SysWOW64\BackgroundTransferHost\ipsmsnap.exe	Code function: 1_2_004063F0
Source: C:\Windows\SysWOW64\BackgroundTransferHost\ipsmsnap.exe	Code function: 1_2_00401C70
Source: C:\Windows\SysWOW64\BackgroundTransferHost\ipsmsnap.exe	Code function: 1_2_00407D60
Source: C:\Windows\SysWOW64\BackgroundTransferHost\ipsmsnap.exe	Code function: 1_2_00407530
Source: C:\Windows\SysWOW64\BackgroundTransferHost\ipsmsnap.exe	Code function: 1_2_00E598FE
Source: C:\Windows\SysWOW64\BackgroundTransferHost\ipsmsnap.exe	Code function: 1_2_00E590CE
Source: C:\Windows\SysWOW64\BackgroundTransferHost\ipsmsnap.exe	Code function: 1_2_00E59C6E
Source: C:\Windows\SysWOW64\BackgroundTransferHost\ipsmsnap.exe	Code function: 1_2_00E5380E
Source: C:\Windows\SysWOW64\BackgroundTransferHost\ipsmsnap.exe	Code function: 1_2_00E57F8E

Source: C:\Users\user\Desktop\PHvqpLRfRl.exe	Code function: String function: 0114B2A0 appears 39 times
Source: C:\Windows\SysWOW64\BackgroundTransferHost\ipsmsnap.exe	Code function: String function: 0114B2A0 appears 39 times

Source: PHvqpLRfRl.exe, 00000000.00000002.202478074.00000000010F0000.00000002.00000001.sdmp	Binary or memory string: originalfilename vs PHvqpLRfRl.exe
Source: PHvqpLRfRl.exe, 00000000.00000002.202478074.00000000010F0000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamepropsys.dll.mui@ vs PHvqpLRfRl.exe
Source: PHvqpLRfRl.exe, 00000000.00000002.202436609.0000000001090000.00000002.00000001.sdmp	Binary or memory string: System.OriginalFileName vs PHvqpLRfRl.exe

Source: C:\Windows\System32\svchost.exe	Section loaded: xboxlivetitleid.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cdpsgshims.dll

Source: PHvqpLRfRl.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: classification engine

Classification label: mal88.troj.evad.winEXE@17/11@0/98

Source: C:\Windows\SysWOW64\BackgroundTransferHost\ipsmsnap.exe

Code function: 1_2_00404B90 CreateToolhelp32Snapshot,CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,Process32NextW,CloseHandle,FindCloseChangeNotification,

Source: C:\Users\user\Desktop\PHvqpLRfRl.exe

Code function: 0_2_011488A0 CoCreateInstance,VariantInit,VariantClear,

Source: C:\Users\user\Desktop\PHvqpLRfRl.exe

Code function: 0_2_01141850 CreateDCW,GetLastError,StartDocW,GetLastError,StartPage,GetLastError,ExtEscape,GetLastError,FindResourceW,SizeofResource,LoadResource,LockResource,GetLastError,ExtEscape,GetLastError,ExtEscape,GetLastError,EndPage,EndDoc,LocalFree,CoTaskMemFree,DeleteDC,

Source: C:\Users\user\Desktop\PHvqpLRfRl.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Crypto

Jump to behavior

Source: C:\Windows\System32\conhost.exe

Mutant created: \BaseNamedObjects\Local\SM0:5188:120:WilError_01

Source: C:\Users\user\Desktop\PHvqpLRfRl.exe	Command line argument: Virtua
Source: C:\Users\user\Desktop\PHvqpLRfRl.exe	Command line argument: lAlloc
Source: C:\Users\user\Desktop\PHvqpLRfRl.exe	Command line argument: kernel32.dll
Source: C:\Users\user\Desktop\PHvqpLRfRl.exe	Command line argument: 8192
Source: C:\Windows\SysWOW64\BackgroundTransferHost\ipsmsnap.exe	Command line argument: Virtua
Source: C:\Windows\SysWOW64\BackgroundTransferHost\ipsmsnap.exe	Command line argument: lAlloc
Source: C:\Windows\SysWOW64\BackgroundTransferHost\ipsmsnap.exe	Command line argument: kernel32.dll
Source: C:\Windows\SysWOW64\BackgroundTransferHost\ipsmsnap.exe	Command line argument: 8192

Source: PHvqpLRfRl.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\PHvqpLRfRl.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\PHvqpLRfRl.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: C:\Windows\System32\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Windows\System32\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Source: PHvqpLRfRl.exe	Virustotal: Detection: 77%
Source: PHvqpLRfRl.exe	Metadefender: Detection: 51%
Source: PHvqpLRfRl.exe	ReversingLabs: Detection: 89%

Source: unknown	Process created: C:\Users\user\Desktop\PHvqpLRfRl.exe 'C:\Users\user\Desktop\PHvqpLRfRl.exe'
Source: C:\Users\user\Desktop\PHvqpLRfRl.exe	Process created: C:\Windows\SysWOW64\BackgroundTransferHost\ipsmsnap.exe C:\Windows\SysWOW64\BackgroundTransferHost\ipsmsnap.exe
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
Source: unknown	Process created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k localservice -p -s CDPSvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k unistacksvcgroup
Source: unknown	Process created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k networkservice -p -s DoSvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k NetworkService -p
Source: unknown	Process created: C:\Windows\System32\SgrmBroker.exe C:\Windows\system32\SgrmBroker.exe
Source: unknown	Process created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s wscsvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: C:\Windows\System32\svchost.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe 'C:\Program Files\Windows Defender\mpcmdrun.exe' -wdenable
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: C:\Users\user\Desktop\PHvqpLRfRl.exe	Process created: C:\Windows\SysWOW64\BackgroundTransferHost\ipsmsnap.exe C:\Windows\SysWOW64\BackgroundTransferHost\ipsmsnap.exe
Source: C:\Windows\System32\svchost.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe 'C:\Program Files\Windows Defender\mpcmdrun.exe' -wdenable

Source: C:\Users\user\Desktop\PHvqpLRfRl.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Source: PHvqpLRfRl.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: PHvqpLRfRl.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: PHvqpLRfRl.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: PHvqpLRfRl.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: PHvqpLRfRl.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: PHvqpLRfRl.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: PHvqpLRfRl.exe

Static PE information: TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source: PHvqpLRfRl.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: PHvqpLRfRl.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: PHvqpLRfRl.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: PHvqpLRfRl.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: PHvqpLRfRl.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: PHvqpLRfRl.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\PHvqpLRfRl.exe

Code function: 0_2_00811030 LoadLibraryW,GetProcAddress,SetLastError,SetLastError,SetLastError,SetLastError,GetNativeSystemInfo,SetLastError,SetLastError,GetProcessHeap,RtlAllocateHeap,SetLastError,

Source: C:\Users\user\Desktop\PHvqpLRfRl.exe	Code function: 0_2_01156216 push ecx; ret
Source: C:\Users\user\Desktop\PHvqpLRfRl.exe	Code function: 0_2_0114B2E5 push ecx; ret
Source: C:\Users\user\Desktop\PHvqpLRfRl.exe	Code function: 0_2_003F782E push ecx; mov dword ptr [esp], 00002224h
Source: C:\Users\user\Desktop\PHvqpLRfRl.exe	Code function: 0_2_003FE015 push 0000003Bh; ret
Source: C:\Users\user\Desktop\PHvqpLRfRl.exe	Code function: 0_2_003F786E push ecx; mov dword ptr [esp], 0000A465h
Source: C:\Users\user\Desktop\PHvqpLRfRl.exe	Code function: 0_2_003F78BE push ecx; mov dword ptr [esp], 0000C239h
Source: C:\Users\user\Desktop\PHvqpLRfRl.exe	Code function: 0_2_003F788E push ecx; mov dword ptr [esp], 00000E88h
Source: C:\Users\user\Desktop\PHvqpLRfRl.exe	Code function: 0_2_003F790E push ecx; mov dword ptr [esp], 0000B4A4h
Source: C:\Users\user\Desktop\PHvqpLRfRl.exe	Code function: 0_2_003F797E push ecx; mov dword ptr [esp], 0000272Ah
Source: C:\Users\user\Desktop\PHvqpLRfRl.exe	Code function: 0_2_003F794E push ecx; mov dword ptr [esp], 00001190h
Source: C:\Users\user\Desktop\PHvqpLRfRl.exe	Code function: 0_2_003F79DE push ecx; mov dword ptr [esp], 0000C126h
Source: C:\Users\user\Desktop\PHvqpLRfRl.exe	Code function: 0_2_003F7A3E push ecx; mov dword ptr [esp], 00008285h
Source: C:\Users\user\Desktop\PHvqpLRfRl.exe	Code function: 0_2_003F7A7E push ecx; mov dword ptr [esp], 00006DE4h
Source: C:\Users\user\Desktop\PHvqpLRfRl.exe	Code function: 0_2_003FD76E push ecx; retf
Source: C:\Users\user\Desktop\PHvqpLRfRl.exe	Code function: 0_2_003F77EE push ecx; mov dword ptr [esp], 00008F8Eh
Source: C:\Windows\SysWOW64\BackgroundTransferHost\ipsmsnap.exe	Code function: 1_2_01156216 push ecx; ret
Source: C:\Windows\SysWOW64\BackgroundTransferHost\ipsmsnap.exe	Code function: 1_2_0114B2E5 push ecx; ret
Source: C:\Windows\SysWOW64\BackgroundTransferHost\ipsmsnap.exe	Code function: 1_2_00405C50 push ecx; mov dword ptr [esp], 00008F8Eh
Source: C:\Windows\SysWOW64\BackgroundTransferHost\ipsmsnap.exe	Code function: 1_2_00405CD0 push ecx; mov dword ptr [esp], 0000A465h
Source: C:\Windows\SysWOW64\BackgroundTransferHost\ipsmsnap.exe	Code function: 1_2_00405CF0 push ecx; mov dword ptr [esp], 00000E88h
Source: C:\Windows\SysWOW64\BackgroundTransferHost\ipsmsnap.exe	Code function: 1_2_00405C90 push ecx; mov dword ptr [esp], 00002224h
Source: C:\Windows\SysWOW64\BackgroundTransferHost\ipsmsnap.exe	Code function: 1_2_00405D70 push ecx; mov dword ptr [esp], 0000B4A4h
Source: C:\Windows\SysWOW64\BackgroundTransferHost\ipsmsnap.exe	Code function: 1_2_00405D20 push ecx; mov dword ptr [esp], 0000C239h
Source: C:\Windows\SysWOW64\BackgroundTransferHost\ipsmsnap.exe	Code function: 1_2_00405DE0 push ecx; mov dword ptr [esp], 0000272Ah
Source: C:\Windows\SysWOW64\BackgroundTransferHost\ipsmsnap.exe	Code function: 1_2_00405DB0 push ecx; mov dword ptr [esp], 00001190h
Source: C:\Windows\SysWOW64\BackgroundTransferHost\ipsmsnap.exe	Code function: 1_2_00405E40 push ecx; mov dword ptr [esp], 0000C126h
Source: C:\Windows\SysWOW64\BackgroundTransferHost\ipsmsnap.exe	Code function: 1_2_00405EE0 push ecx; mov dword ptr [esp], 00006DE4h
Source: C:\Windows\SysWOW64\BackgroundTransferHost\ipsmsnap.exe	Code function: 1_2_00405EA0 push ecx; mov dword ptr [esp], 00008285h
Source: C:\Windows\SysWOW64\BackgroundTransferHost\ipsmsnap.exe	Code function: 1_2_00E578BE push ecx; mov dword ptr [esp], 0000C239h
Source: C:\Windows\SysWOW64\BackgroundTransferHost\ipsmsnap.exe	Code function: 1_2_00E5788E push ecx; mov dword ptr [esp], 00000E88h
Source: C:\Windows\SysWOW64\BackgroundTransferHost\ipsmsnap.exe	Code function: 1_2_00E5786E push ecx; mov dword ptr [esp], 0000A465h

Persistence and Installation Behavior:

Drops executables to the windows directory (C:\Windows) and starts them

Show sources

Source: C:\Users\user\Desktop\PHvqpLRfRl.exe

Executable created and started: C:\Windows\SysWOW64\BackgroundTransferHost\ipsmsnap.exe

Source: C:\Users\user\Desktop\PHvqpLRfRl.exe

PE file moved: C:\Windows\SysWOW64\BackgroundTransferHost\ipsmsnap.exe

Jump to behavior

Hooking and other Techniques for Hiding and Protection:

Hides that the sample has been downloaded from the Internet (zone.identifier)

Show sources

Source: C:\Users\user\Desktop\PHvqpLRfRl.exe

File opened: C:\Windows\SysWOW64\BackgroundTransferHost\ipsmsnap.exe:Zone.Identifier read attributes | delete

Source: C:\Users\user\Desktop\PHvqpLRfRl.exe

Code function: 0_2_0114AFA8 RtlEncodePointer,__initp_misc_winsig,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Windows\System32\svchost.exe TID: 2348

Thread sleep time: -30000s >= -30000s

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\PHvqpLRfRl.exe

File Volume queried: C:\ FullSizeInformation

Source: C:\Windows\SysWOW64\BackgroundTransferHost\ipsmsnap.exe

Code function: 1_2_004038B0 _snwprintf,_snwprintf,GetProcessHeap,HeapFree,FindFirstFileW,FindFirstFileW,FindNextFileW,FindNextFileW,FindClose,FindClose,

Source: svchost.exe, 00000004.00000002.468125375.0000025BE102A000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW@`
Source: svchost.exe, 00000006.00000002.470048622.0000025C82540000.00000002.00000001.sdmp, svchost.exe, 00000011.00000002.406272493.000002D9E9EB0000.00000002.00000001.sdmp, svchost.exe, 0000001A.00000002.442538315.0000020D20460000.00000002.00000001.sdmp	Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: ipsmsnap.exe, 00000001.00000002.468016701.0000000000E9A000.00000004.00000020.sdmp, svchost.exe, 00000004.00000002.470829364.0000025BE6861000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW
Source: svchost.exe, 00000005.00000002.467871912.000001431E402000.00000004.00000001.sdmp	Binary or memory string: HvHostWdiSystemHostScDeviceEnumWiaRpctrkwksAudioEndpointBuilderhidservdot3svcDsSvcfhsvcWPDBusEnumsvsvcwlansvcEmbeddedModeirmonSensorServicevmicvssNgcSvcsysmainDevQueryBrokerStorSvcvmickvpexchangevmicshutdownvmicguestinterfacevmicvmsessionNcbServiceNetmanDeviceAssociationServiceTabletInputServicePcaSvcIPxlatCfgSvcCscServiceUmRdpService
Source: svchost.exe, 00000006.00000002.470048622.0000025C82540000.00000002.00000001.sdmp, svchost.exe, 00000011.00000002.406272493.000002D9E9EB0000.00000002.00000001.sdmp, svchost.exe, 0000001A.00000002.442538315.0000020D20460000.00000002.00000001.sdmp	Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: ipsmsnap.exe, 00000001.00000002.470677696.00000000030B0000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW '
Source: svchost.exe, 00000006.00000002.470048622.0000025C82540000.00000002.00000001.sdmp, svchost.exe, 00000011.00000002.406272493.000002D9E9EB0000.00000002.00000001.sdmp, svchost.exe, 0000001A.00000002.442538315.0000020D20460000.00000002.00000001.sdmp	Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: svchost.exe, 00000005.00000002.467943438.000001431E429000.00000004.00000001.sdmp, svchost.exe, 00000006.00000002.467809094.0000025C8186A000.00000004.00000001.sdmp, svchost.exe, 00000008.00000002.468178940.00000224C302A000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: svchost.exe, 00000006.00000002.470048622.0000025C82540000.00000002.00000001.sdmp, svchost.exe, 00000011.00000002.406272493.000002D9E9EB0000.00000002.00000001.sdmp, svchost.exe, 0000001A.00000002.442538315.0000020D20460000.00000002.00000001.sdmp	Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.

Source: C:\Users\user\Desktop\PHvqpLRfRl.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\Desktop\PHvqpLRfRl.exe	API call chain: ExitProcess graph end node
Source: C:\Windows\SysWOW64\BackgroundTransferHost\ipsmsnap.exe	API call chain: ExitProcess graph end node
Source: C:\Windows\SysWOW64\BackgroundTransferHost\ipsmsnap.exe	API call chain: ExitProcess graph end node

Source: C:\Windows\SysWOW64\BackgroundTransferHost\ipsmsnap.exe

Process information queried: ProcessInformation

Source: C:\Users\user\Desktop\PHvqpLRfRl.exe

Code function: 0_2_0114A9FD IsDebuggerPresent,

Source: C:\Users\user\Desktop\PHvqpLRfRl.exe

Code function: 0_2_01155B25 EncodePointer,EncodePointer,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

Source: C:\Users\user\Desktop\PHvqpLRfRl.exe

Code function: 0_2_00811030 LoadLibraryW,GetProcAddress,SetLastError,SetLastError,SetLastError,SetLastError,GetNativeSystemInfo,SetLastError,SetLastError,GetProcessHeap,RtlAllocateHeap,SetLastError,

Source: C:\Users\user\Desktop\PHvqpLRfRl.exe	Code function: 0_2_003F689E mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PHvqpLRfRl.exe	Code function: 0_2_003F095E mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PHvqpLRfRl.exe	Code function: 0_2_003F59DE mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PHvqpLRfRl.exe	Code function: 0_2_003F0456 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PHvqpLRfRl.exe	Code function: 0_2_00811030 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\BackgroundTransferHost\ipsmsnap.exe	Code function: 1_2_00404D00 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\BackgroundTransferHost\ipsmsnap.exe	Code function: 1_2_00403E40 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\BackgroundTransferHost\ipsmsnap.exe	Code function: 1_2_00E5689E mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\BackgroundTransferHost\ipsmsnap.exe	Code function: 1_2_00E50456 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\BackgroundTransferHost\ipsmsnap.exe	Code function: 1_2_00E559DE mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\BackgroundTransferHost\ipsmsnap.exe	Code function: 1_2_00E5095E mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\BackgroundTransferHost\ipsmsnap.exe	Code function: 1_2_00E61030 mov eax, dword ptr fs:[00000030h]

Source: C:\Users\user\Desktop\PHvqpLRfRl.exe

Code function: 0_2_0114D5D3 GetProcessHeap,

Source: C:\Users\user\Desktop\PHvqpLRfRl.exe	Code function: 0_2_01150719 SetUnhandledExceptionFilter,
Source: C:\Users\user\Desktop\PHvqpLRfRl.exe	Code function: 0_2_0115074A SetUnhandledExceptionFilter,UnhandledExceptionFilter,
Source: C:\Windows\SysWOW64\BackgroundTransferHost\ipsmsnap.exe	Code function: 1_2_01150719 SetUnhandledExceptionFilter,
Source: C:\Windows\SysWOW64\BackgroundTransferHost\ipsmsnap.exe	Code function: 1_2_0115074A SetUnhandledExceptionFilter,UnhandledExceptionFilter,

Source: ipsmsnap.exe, 00000001.00000002.468782451.0000000001760000.00000002.00000001.sdmp, svchost.exe, 00000007.00000002.468409509.0000026BD2060000.00000002.00000001.sdmp	Binary or memory string: Program Manager
Source: ipsmsnap.exe, 00000001.00000002.468782451.0000000001760000.00000002.00000001.sdmp, svchost.exe, 00000007.00000002.468409509.0000026BD2060000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: ipsmsnap.exe, 00000001.00000002.468782451.0000000001760000.00000002.00000001.sdmp, svchost.exe, 00000007.00000002.468409509.0000026BD2060000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: ipsmsnap.exe, 00000001.00000002.468782451.0000000001760000.00000002.00000001.sdmp, svchost.exe, 00000007.00000002.468409509.0000026BD2060000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\Desktop\PHvqpLRfRl.exe

Code function: 0_2_0114A7BC cpuid

Source: C:\Users\user\Desktop\PHvqpLRfRl.exe	Code function: EnumSystemLocalesW,
Source: C:\Users\user\Desktop\PHvqpLRfRl.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,
Source: C:\Users\user\Desktop\PHvqpLRfRl.exe	Code function: GetLocaleInfoW,
Source: C:\Users\user\Desktop\PHvqpLRfRl.exe	Code function: EnumSystemLocalesW,
Source: C:\Users\user\Desktop\PHvqpLRfRl.exe	Code function: EnumSystemLocalesW,
Source: C:\Users\user\Desktop\PHvqpLRfRl.exe	Code function: GetLocaleInfoW,
Source: C:\Users\user\Desktop\PHvqpLRfRl.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,
Source: C:\Users\user\Desktop\PHvqpLRfRl.exe	Code function: EnumSystemLocalesW,
Source: C:\Users\user\Desktop\PHvqpLRfRl.exe	Code function: GetLocaleInfoW,
Source: C:\Users\user\Desktop\PHvqpLRfRl.exe	Code function: GetLocaleInfoW,
Source: C:\Users\user\Desktop\PHvqpLRfRl.exe	Code function: _GetLcidFromLangCountry,_GetLcidFromLangCountry,GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,
Source: C:\Users\user\Desktop\PHvqpLRfRl.exe	Code function: _GetLocaleNameFromLangCountry,_GetLocaleNameFromLanguage,_GetLocaleNameFromLangCountry,_GetLocaleNameFromLanguage,IsValidCodePage,GetLocaleInfoW,
Source: C:\Windows\SysWOW64\BackgroundTransferHost\ipsmsnap.exe	Code function: EnumSystemLocalesW,
Source: C:\Windows\SysWOW64\BackgroundTransferHost\ipsmsnap.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,
Source: C:\Windows\SysWOW64\BackgroundTransferHost\ipsmsnap.exe	Code function: GetLocaleInfoW,
Source: C:\Windows\SysWOW64\BackgroundTransferHost\ipsmsnap.exe	Code function: EnumSystemLocalesW,
Source: C:\Windows\SysWOW64\BackgroundTransferHost\ipsmsnap.exe	Code function: EnumSystemLocalesW,
Source: C:\Windows\SysWOW64\BackgroundTransferHost\ipsmsnap.exe	Code function: GetLocaleInfoW,
Source: C:\Windows\SysWOW64\BackgroundTransferHost\ipsmsnap.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,
Source: C:\Windows\SysWOW64\BackgroundTransferHost\ipsmsnap.exe	Code function: EnumSystemLocalesW,
Source: C:\Windows\SysWOW64\BackgroundTransferHost\ipsmsnap.exe	Code function: GetLocaleInfoW,
Source: C:\Windows\SysWOW64\BackgroundTransferHost\ipsmsnap.exe	Code function: GetLocaleInfoW,
Source: C:\Windows\SysWOW64\BackgroundTransferHost\ipsmsnap.exe	Code function: _GetLcidFromLangCountry,_GetLcidFromLangCountry,GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,
Source: C:\Windows\SysWOW64\BackgroundTransferHost\ipsmsnap.exe	Code function: _GetLocaleNameFromLangCountry,_GetLocaleNameFromLanguage,_GetLocaleNameFromLangCountry,_GetLocaleNameFromLanguage,IsValidCodePage,GetLocaleInfoW,

Source: C:\Windows\SysWOW64\BackgroundTransferHost\ipsmsnap.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\Desktop\PHvqpLRfRl.exe

Code function: 0_2_01150216 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

Source: C:\Windows\SysWOW64\BackgroundTransferHost\ipsmsnap.exe

Code function: 1_2_004052E0 RtlGetVersion,GetNativeSystemInfo,GetNativeSystemInfo,

Source: C:\Users\user\Desktop\PHvqpLRfRl.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Lowering of HIPS / PFW / Operating System Security Settings:

Changes security center settings (notifications, updates, antivirus, firewall)

Show sources

Source: C:\Windows\System32\svchost.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center cval

Jump to behavior

Source: svchost.exe, 0000000B.00000002.468110144.0000026AEC03D000.00000004.00000001.sdmp	Binary or memory string: @V%ProgramFiles%\Windows Defender\MsMpeng.exe
Source: svchost.exe, 0000000B.00000002.468195529.0000026AEC102000.00000004.00000001.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecNotificationQuery - ROOT\SecurityCenter : SELECT * FROM __InstanceOperationEvent WHERE TargetInstance ISA 'AntiVirusProduct' OR TargetInstance ISA 'FirewallProduct' OR TargetInstance ISA 'AntiSpywareProduct'
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter2 : FirewallProduct
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter2 : AntiVirusProduct
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter2 : AntiSpywareProduct

Stealing of Sensitive Information:

Yara detected Emotet

Show sources

Source: Yara match	File source: 1.2.ipsmsnap.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.ipsmsnap.exe.e5279e.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.ipsmsnap.exe.e5052e.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PHvqpLRfRl.exe.3f279e.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PHvqpLRfRl.exe.3f052e.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PHvqpLRfRl.exe.980000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.ipsmsnap.exe.e5052e.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PHvqpLRfRl.exe.3f279e.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.ipsmsnap.exe.e5279e.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PHvqpLRfRl.exe.3f052e.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.467934925.0000000000E50000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.467384235.0000000000401000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.202006890.00000000003F0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.202145856.0000000000814000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.202173410.0000000000981000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.467972344.0000000000E64000.00000004.00000001.sdmp, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation1	DLL Side-Loading1	Process Injection2	Masquerading121	Input Capture1	System Time Discovery1	Remote Services	Input Capture1	Exfiltration Over Other Network Medium	Encrypted Channel22	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Data Encrypted for Impact1
Default Accounts	Command and Scripting Interpreter2	Application Shimming1	DLL Side-Loading1	Disable or Modify Tools1	LSASS Memory	Security Software Discovery61	Remote Desktop Protocol	Archive Collected Data11	Exfiltration Over Bluetooth	Non-Standard Port1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	Native API1	Logon Script (Windows)	Application Shimming1	Virtualization/Sandbox Evasion2	Security Account Manager	Virtualization/Sandbox Evasion2	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Application Layer Protocol11	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Process Injection2	NTDS	Process Discovery3	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Deobfuscate/Decode Files or Information1	LSA Secrets	Remote System Discovery1	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Hidden Files and Directories1	Cached Domain Credentials	File and Directory Discovery2	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Obfuscated Files or Information2	DCSync	System Information Discovery45	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	DLL Side-Loading1	Proc Filesystem	Network Service Scanning	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	File Deletion1	/etc/passwd and /etc/shadow	System Network Connections Discovery	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
PHvqpLRfRl.exe	77%	Virustotal		Browse
PHvqpLRfRl.exe	54%	Metadefender		Browse
PHvqpLRfRl.exe	89%	ReversingLabs	Win32.Trojan.Emotet
PHvqpLRfRl.exe	100%	Avira	HEUR/AGEN.1138888

Dropped Files

No Antivirus matches

Unpacked PE Files

Source	Detection	Scanner	Label	Download
1.2.ipsmsnap.exe.e5052e.1.unpack	100%	Avira	HEUR/AGEN.1142428	Download File
1.0.ipsmsnap.exe.1140000.0.unpack	100%	Avira	HEUR/AGEN.1138888	Download File
1.2.ipsmsnap.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
1.2.ipsmsnap.exe.e5279e.2.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
0.2.PHvqpLRfRl.exe.980000.2.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
0.2.PHvqpLRfRl.exe.3f279e.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
1.2.ipsmsnap.exe.1140000.3.unpack	100%	Avira	HEUR/AGEN.1138888	Download File
0.2.PHvqpLRfRl.exe.3f052e.1.unpack	100%	Avira	HEUR/AGEN.1142428	Download File
0.0.PHvqpLRfRl.exe.1140000.0.unpack	100%	Avira	HEUR/AGEN.1138888	Download File
0.2.PHvqpLRfRl.exe.1140000.4.unpack	100%	Avira	HEUR/AGEN.1138888	Download File

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://120.138.30.150:8080/2aF5ml4oR/WXLdIdZGpJmXIp5/PBsOTo7qERajOZz1lh/LN3m/MNxh/5?	0%	Avira URL Cloud	safe
http://74.219.172.26/3vre0AbvHoC/72zolH2gtmnbq3QOxa/GmI2ntvI/3wNRQ8Motcr5/	0%	Avira URL Cloud	safe
http://104.156.59.7:8080/3x1oIXewHYdNlV01/MCzATjJI1I/RPBsOTo7qERajOZz1lh/LN3m/MNxh/#?	0%	Avira URL Cloud	safe
http://194.187.133.160:443/rRPAuzYPI/PCfjdWIpUQcAD/TNhKcjKj/nadJLloIjR2s5GA9b/NUnsi05bbdpoKVYXGgn/R8	0%	Avira URL Cloud	safe
http://120.138.30.150:8080/2aF5ml4oR/WXLdIdZGpJmXIp5/c8	0%	Avira URL Cloud	safe
http://104.156.59.7:8080/3x1oIXewHYdNlV01/MCzATjJI1I/RPBsOTo7qERajOZz1lh/LN3m/MNxh/m	0%	Avira URL Cloud	safe
http://120.138.30.150:8080/2aF5ml4oR/WXLdIdZGpJmXIp5/	0%	Avira URL Cloud	safe
http://104.236.246.93:8080/nNKoq5kK/=	0%	Avira URL Cloud	safe
http://104.156.59.7:8080/3x1oIXewHYdNlV01/MCzATjJI1I/RPBsOTo7qERajOZz1lh/LN3m/MNxh/	0%	Avira URL Cloud	safe
http://104.236.246.93:8080/nNKoq5kK/	0%	Avira URL Cloud	safe
https://%s.xboxlive.com	0%	URL Reputation	safe
http://134.209.36.254:8080/tWwU/w3xB1Bhz7yaslBgJS/q49F3NAtj1IqnXaW2A/GIQOEsdbSxikR6wT/lMJv8yE/	0%	Avira URL Cloud	safe
http://104.156.59.7:8080/3x1oIXeY	0%	Avira URL Cloud	safe
http://104.236.246.93:8080/nNKoq5kK/n	0%	Avira URL Cloud	safe
http://104.156.59.7:8080/3x1oIXewHYdNlV01/MCzATjJI1I/RPBsOTo7qERajOZz1lh/LN3m/MNxh/3	0%	Avira URL Cloud	safe
https://dynamic.t	0%	URL Reputation	safe
https://%s.dnet.xboxlive.com	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

No contacted domains info

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://120.138.30.150:8080/2aF5ml4oR/WXLdIdZGpJmXIp5/PBsOTo7qERajOZz1lh/LN3m/MNxh/5?	ipsmsnap.exe, 00000001.00000002.468016701.0000000000E9A000.00000004.00000020.sdmp	false	Avira URL Cloud: safe	unknown
https://dev.ditu.live.com/REST/v1/Routes/	svchost.exe, 00000009.00000002.309161825.00000184DC23D000.00000004.00000001.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Routes/Driving	svchost.exe, 00000009.00000003.308854579.00000184DC261000.00000004.00000001.sdmp	false		high
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/comp/gen.ashx	svchost.exe, 00000009.00000002.309161825.00000184DC23D000.00000004.00000001.sdmp	false		high
https://dev.ditu.live.com/REST/v1/Traffic/Incidents/	svchost.exe, 00000009.00000003.308869309.00000184DC249000.00000004.00000001.sdmp	false		high
https://t0.tiles.ditu.live.com/tiles/gen	svchost.exe, 00000009.00000003.308835499.00000184DC250000.00000004.00000001.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Routes/Walking	svchost.exe, 00000009.00000003.308854579.00000184DC261000.00000004.00000001.sdmp	false		high
http://74.219.172.26/3vre0AbvHoC/72zolH2gtmnbq3QOxa/GmI2ntvI/3wNRQ8Motcr5/	ipsmsnap.exe, 00000001.00000003.276535300.00000000030C4000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://104.156.59.7:8080/3x1oIXewHYdNlV01/MCzATjJI1I/RPBsOTo7qERajOZz1lh/LN3m/MNxh/#?	ipsmsnap.exe, 00000001.00000002.468016701.0000000000E9A000.00000004.00000020.sdmp	false	Avira URL Cloud: safe	unknown
https://dev.virtualearth.net/mapcontrol/HumanScaleServices/GetBubbles.ashx?n=	svchost.exe, 00000009.00000002.309167893.00000184DC242000.00000004.00000001.sdmp	false		high
https://dev.ditu.live.com/mapcontrol/logging.ashx	svchost.exe, 00000009.00000003.308854579.00000184DC261000.00000004.00000001.sdmp	false		high
http://194.187.133.160:443/rRPAuzYPI/PCfjdWIpUQcAD/TNhKcjKj/nadJLloIjR2s5GA9b/NUnsi05bbdpoKVYXGgn/R8	ipsmsnap.exe, 00000001.00000002.468016701.0000000000E9A000.00000004.00000020.sdmp	false	Avira URL Cloud: safe	unknown
https://dev.ditu.live.com/REST/v1/Imagery/Copyright/	svchost.exe, 00000009.00000003.308869309.00000184DC249000.00000004.00000001.sdmp	false		high
https://dev.virtualearth.net/webservices/v1/LoggingService/LoggingService.svc/Log?entry=	svchost.exe, 00000009.00000003.287207473.00000184DC230000.00000004.00000001.sdmp	false		high
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gri?pv=1&r=	svchost.exe, 00000009.00000003.287207473.00000184DC230000.00000004.00000001.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Transit/Schedules/	svchost.exe, 00000009.00000002.309167893.00000184DC242000.00000004.00000001.sdmp	false		high
http://120.138.30.150:8080/2aF5ml4oR/WXLdIdZGpJmXIp5/c8	ipsmsnap.exe, 00000001.00000002.468016701.0000000000E9A000.00000004.00000020.sdmp	false	Avira URL Cloud: safe	unknown
http://104.156.59.7:8080/3x1oIXewHYdNlV01/MCzATjJI1I/RPBsOTo7qERajOZz1lh/LN3m/MNxh/m	ipsmsnap.exe, 00000001.00000002.468016701.0000000000E9A000.00000004.00000020.sdmp	false	Avira URL Cloud: safe	unknown
https://appexmapsappupdate.blob.core.windows.net	svchost.exe, 00000009.00000003.308854579.00000184DC261000.00000004.00000001.sdmp	false		high
http://120.138.30.150:8080/2aF5ml4oR/WXLdIdZGpJmXIp5/	ipsmsnap.exe, 00000001.00000002.468016701.0000000000E9A000.00000004.00000020.sdmp	false	Avira URL Cloud: safe	unknown
http://104.236.246.93:8080/nNKoq5kK/=	ipsmsnap.exe, 00000001.00000002.470792566.00000000030DE000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.bingmapsportal.com	svchost.exe, 00000009.00000002.309127915.00000184DC213000.00000004.00000001.sdmp	false		high
https://ecn.dev.virtualearth.net/REST/v1/Imagery/Copyright/	svchost.exe, 00000009.00000002.309161825.00000184DC23D000.00000004.00000001.sdmp	false		high
https://dynamic.t0.tiles.ditu.live.com/comp/gen.ashx	svchost.exe, 00000009.00000003.308854579.00000184DC261000.00000004.00000001.sdmp	false		high
http://104.156.59.7:8080/3x1oIXewHYdNlV01/MCzATjJI1I/RPBsOTo7qERajOZz1lh/LN3m/MNxh/	ipsmsnap.exe, 00000001.00000002.468016701.0000000000E9A000.00000004.00000020.sdmp	false	Avira URL Cloud: safe	unknown
http://104.236.246.93:8080/nNKoq5kK/	ipsmsnap.exe, 00000001.00000002.470677696.00000000030B0000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdv?pv=1&r=	svchost.exe, 00000009.00000003.308892949.00000184DC245000.00000004.00000001.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Routes/	svchost.exe, 00000009.00000002.309161825.00000184DC23D000.00000004.00000001.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Traffic/Incidents/	svchost.exe, 00000009.00000003.287207473.00000184DC230000.00000004.00000001.sdmp	false		high
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdi?pv=1&r=	svchost.exe, 00000009.00000003.287207473.00000184DC230000.00000004.00000001.sdmp	false		high
https://dev.virtualearth.net/webservices/v1/LoggingService/LoggingService.svc/Log?	svchost.exe, 00000009.00000003.308864231.00000184DC24C000.00000004.00000001.sdmp	false		high
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gd?pv=1&r=	svchost.exe, 00000009.00000002.309161825.00000184DC23D000.00000004.00000001.sdmp, svchost.exe, 00000009.00000002.309127915.00000184DC213000.00000004.00000001.sdmp	false		high
https://%s.xboxlive.com	svchost.exe, 00000006.00000002.467720725.0000025C8183D000.00000004.00000001.sdmp	false	URL Reputation: safe	low
https://dev.ditu.live.com/mapcontrol/mapconfiguration.ashx?name=native&v=	svchost.exe, 00000009.00000003.308835499.00000184DC250000.00000004.00000001.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Locations	svchost.exe, 00000009.00000003.308854579.00000184DC261000.00000004.00000001.sdmp	false		high
https://ecn.dev.virtualearth.net/mapcontrol/mapconfiguration.ashx?name=native&v=	svchost.exe, 00000009.00000003.287207473.00000184DC230000.00000004.00000001.sdmp	false		high
http://134.209.36.254:8080/tWwU/w3xB1Bhz7yaslBgJS/q49F3NAtj1IqnXaW2A/GIQOEsdbSxikR6wT/lMJv8yE/	ipsmsnap.exe, 00000001.00000002.468016701.0000000000E9A000.00000004.00000020.sdmp	false	Avira URL Cloud: safe	unknown
https://dev.virtualearth.net/mapcontrol/logging.ashx	svchost.exe, 00000009.00000003.308854579.00000184DC261000.00000004.00000001.sdmp	false		high
http://104.156.59.7:8080/3x1oIXeY	ipsmsnap.exe, 00000001.00000002.468016701.0000000000E9A000.00000004.00000020.sdmp	false	Avira URL Cloud: safe	unknown
http://104.236.246.93:8080/nNKoq5kK/n	ipsmsnap.exe, 00000001.00000002.470677696.00000000030B0000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://104.156.59.7:8080/3x1oIXewHYdNlV01/MCzATjJI1I/RPBsOTo7qERajOZz1lh/LN3m/MNxh/3	ipsmsnap.exe, 00000001.00000002.468016701.0000000000E9A000.00000004.00000020.sdmp	false	Avira URL Cloud: safe	unknown
https://dynamic.api.tiles.ditu.live.com/odvs/gdi?pv=1&r=	svchost.exe, 00000009.00000003.308864231.00000184DC24C000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous.	svchost.exe, 00000004.00000002.470303423.0000025BE66A0000.00000002.00000001.sdmp	false		high
https://dev.virtualearth.net/REST/v1/JsonFilter/VenueMaps/data/	svchost.exe, 00000009.00000003.308869309.00000184DC249000.00000004.00000001.sdmp	false		high
https://dynamic.t	svchost.exe, 00000009.00000002.309195425.00000184DC265000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://dev.virtualearth.net/REST/v1/Routes/Transit	svchost.exe, 00000009.00000003.308854579.00000184DC261000.00000004.00000001.sdmp	false		high
https://t0.ssl.ak.tiles.virtualearth.net/tiles/gen	svchost.exe, 00000009.00000002.309155756.00000184DC239000.00000004.00000001.sdmp	false		high
https://dynamic.api.tiles.ditu.live.com/odvs/gdv?pv=1&r=	svchost.exe, 00000009.00000003.308864231.00000184DC24C000.00000004.00000001.sdmp	false		high
https://activity.windows.com	svchost.exe, 00000006.00000002.467720725.0000025C8183D000.00000004.00000001.sdmp	false		high
https://dev.ditu.live.com/REST/v1/Locations	svchost.exe, 00000009.00000003.308854579.00000184DC261000.00000004.00000001.sdmp	false		high
https://%s.dnet.xboxlive.com	svchost.exe, 00000006.00000002.467720725.0000025C8183D000.00000004.00000001.sdmp	false	URL Reputation: safe	low
https://dev.ditu.live.com/REST/v1/JsonFilter/VenueMaps/data/	svchost.exe, 00000009.00000003.308869309.00000184DC249000.00000004.00000001.sdmp	false		high
https://dynamic.api.tiles.ditu.live.com/odvs/gd?pv=1&r=	svchost.exe, 00000009.00000003.308869309.00000184DC249000.00000004.00000001.sdmp	false		high

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	ASN	ASN Name	Malicious
94.200.114.161	unknown	United Arab Emirates	15802	DU-AS1AE	true
85.152.162.105	unknown	Spain	12946	TELECABLESpainES	true
174.102.48.180	unknown	United States	10796	TWC-10796-MIDWESTUS	true
169.239.182.217	unknown	South Africa	37153	xneeloZA	true
200.123.150.89	unknown	Argentina	16814	NSSSAAR	true
220.245.198.194	unknown	Australia	7545	TPG-INTERNET-APTPGTelecomLimitedAU	true
104.131.11.150	unknown	United States	14061	DIGITALOCEAN-ASNUS	true
176.111.60.55	unknown	Ukraine	24703	UN-UKRAINE-ASKievUkraineUA	true
94.23.237.171	unknown	France	16276	OVHFR	true
187.161.206.24	unknown	Mexico	11888	TelevisionInternacionalSAdeCVMX	true
139.162.108.71	unknown	Netherlands	63949	LINODE-APLinodeLLCUS	true
156.155.166.221	unknown	South Africa	37611	AfrihostZA	true
104.32.141.43	unknown	United States	20001	TWC-20001-PACWESTUS	true
94.1.108.190	unknown	United Kingdom	5607	BSKYB-BROADBAND-ASGB	true
87.106.139.101	unknown	Germany	8560	ONEANDONE-ASBrauerstrasse48DE	true
213.196.135.145	unknown	Switzerland	21040	DATAPARKCH	true
62.30.7.67	unknown	United Kingdom	5089	NTLGB	true
79.98.24.39	unknown	Lithuania	62282	RACKRAYUABRakrejusLT	true
107.5.122.110	unknown	United States	7922	COMCAST-7922US	true
75.139.38.211	unknown	United States	20115	CHARTER-20115US	true
87.106.136.232	unknown	Germany	8560	ONEANDONE-ASBrauerstrasse48DE	true
110.5.16.198	unknown	Japan	4685	ASAHI-NETAsahiNetJP	true
104.131.44.150	unknown	United States	14061	DIGITALOCEAN-ASNUS	true
62.75.141.82	unknown	Germany	8972	GD-EMEA-DC-SXB1DE	true
124.41.215.226	unknown	Nepal	17501	WLINK-NEPAL-AS-APWorldLinkCommunicationsPvtLtdNP	true
172.91.208.86	unknown	United States	20001	TWC-20001-PACWESTUS	true
37.139.21.175	unknown	Netherlands	14061	DIGITALOCEAN-ASNUS	true
194.187.133.160	unknown	Bulgaria	13124	IBGCBG	true
24.43.99.75	unknown	United States	20001	TWC-20001-PACWESTUS	true
95.213.236.64	unknown	Russian Federation	49505	SELECTELRU	true
46.105.131.79	unknown	France	16276	OVHFR	true
139.130.242.43	unknown	Australia	1221	ASN-TELSTRATelstraCorporationLtdAU	true
82.80.155.43	unknown	Israel	8551	BEZEQ-INTERNATIONAL-ASBezeqintInternetBackboneIL	true
110.145.77.103	unknown	Australia	1221	ASN-TELSTRATelstraCorporationLtdAU	true
61.92.17.12	unknown	Hong Kong	9269	HKBN-AS-APHongKongBroadbandNetworkLtdHK	true
120.150.60.189	unknown	Australia	1221	ASN-TELSTRATelstraCorporationLtdAU	true
93.147.212.206	unknown	Italy	30722	VODAFONE-IT-ASNIT	true
91.211.88.52	unknown	Ukraine	206638	HOSTFORYUA	true
68.188.112.97	unknown	United States	20115	CHARTER-20115US	true
153.232.188.106	unknown	Japan	4713	OCNNTTCommunicationsCorporationJP	true
140.186.212.146	unknown	United States	11232	MIDCO-NETUS	true
121.7.127.163	unknown	Singapore	9506	SINGTEL-FIBRESingtelFibreBroadbandSG	true
50.35.17.13	unknown	United States	27017	ZIPLY-FIBER-LEGACY-ASNUS	true
157.245.99.39	unknown	United States	14061	DIGITALOCEAN-ASNUS	true
203.153.216.189	unknown	Indonesia	45291	SURF-IDPTSurfindoNetworkID	true
174.45.13.118	unknown	United States	33588	BRESNAN-33588US	true
162.241.242.173	unknown	United States	46606	UNIFIEDLAYER-AS-1US	true
85.105.205.77	unknown	Turkey	9121	TTNETTR	true
123.176.25.234	unknown	Maldives	7642	DHIRAAGU-MV-APDHIVEHIRAAJJEYGEGULHUNPLCMV	true
74.120.55.163	unknown	Canada	32315	WJBTN-ASCA	true
50.91.114.38	unknown	United States	33363	BHN-33363US	true
200.114.213.233	unknown	Argentina	10318	TelecomArgentinaSAAR	true
78.24.219.147	unknown	Russian Federation	29182	THEFIRST-ASRU	true
24.179.13.119	unknown	United States	20115	CHARTER-20115US	true
104.156.59.7	unknown	United States	29802	HVC-ASUS	true
203.117.253.142	unknown	Singapore	9874	STARHUB-MOBILEStarHubLtdSG	true
201.173.217.124	unknown	Mexico	11888	TelevisionInternacionalSAdeCVMX	true
139.99.158.11	unknown	Canada	16276	OVHFR	true
134.209.36.254	unknown	United States	14061	DIGITALOCEAN-ASNUS	true
195.251.213.56	unknown	Greece	12364	UOMGR	true
75.80.124.4	unknown	United States	20001	TWC-20001-PACWESTUS	true
121.124.124.40	unknown	Korea Republic of	9318	SKB-ASSKBroadbandCoLtdKR	true
47.144.21.12	unknown	United States	5650	FRONTIER-FRTRUS	true
139.59.60.244	unknown	Singapore	14061	DIGITALOCEAN-ASNUS	true
61.19.246.238	unknown	Thailand	9335	CAT-CLOUD-APCATTelecomPublicCompanyLimitedTH	true
168.235.67.138	unknown	United States	3842	RAMNODEUS	true
139.59.67.118	unknown	Singapore	14061	DIGITALOCEAN-ASNUS	true
137.59.187.107	unknown	Hong Kong	18106	VIEWQWEST-SG-APViewqwestPteLtdSG	true
219.74.18.66	unknown	Singapore	9506	SINGTEL-FIBRESingtelFibreBroadbandSG	true
78.187.156.31	unknown	Turkey	9121	TTNETTR	true
188.219.31.12	unknown	Italy	30722	VODAFONE-IT-ASNIT	true
83.169.36.251	unknown	Germany	20773	GODADDYDE	true
74.134.41.124	unknown	United States	10796	TWC-10796-MIDWESTUS	true
5.196.74.210	unknown	France	16276	OVHFR	true
42.200.107.142	unknown	Hong Kong	4760	HKTIMS-APHKTLimitedHK	true
1.221.254.82	unknown	Korea Republic of	3786	LGDACOMLGDACOMCorporationKR	true
74.208.45.104	unknown	United States	8560	ONEANDONE-ASBrauerstrasse48DE	true
120.138.30.150	unknown	New Zealand	45179	SITEHOST-AS-APSiteHostNewZealandNZ	true
84.39.182.7	unknown	Spain	15704	AS15704ES	true
97.82.79.83	unknown	United States	20115	CHARTER-20115US	true
24.137.76.62	unknown	Canada	11260	EASTLINK-HSICA	true
82.225.49.121	unknown	France	12322	PROXADFR	true
37.187.72.193	unknown	France	16276	OVHFR	true
181.169.34.190	unknown	Argentina	10318	TelecomArgentinaSAAR	true
95.179.229.244	unknown	Netherlands	20473	AS-CHOOPAUS	true
109.74.5.95	unknown	Sweden	43948	GLESYS-ASSE	true
74.219.172.26	unknown	United States	5787	SNAPONSBSUS	true
79.137.83.50	unknown	France	16276	OVHFR	true
103.86.49.11	unknown	Thailand	58955	BANGMODENTERPRISE-THBangmodEnterpriseCoLtdTH	true
209.141.54.221	unknown	United States	53667	PONYNETUS	true
89.216.122.92	unknown	Serbia	31042	SERBIA-BROADBAND-ASSerbiaBroadBand-SrpskeKablovskemreze	true
185.94.252.104	unknown	Germany	197890	MEGASERVERS-DE	true
5.39.91.110	unknown	France	16276	OVHFR	true
137.119.36.33	unknown	United States	11426	TWC-11426-CAROLINASUS	true
104.236.246.93	unknown	United States	14061	DIGITALOCEAN-ASNUS	true
94.23.216.33	unknown	France	16276	OVHFR	true
219.75.128.166	unknown	Japan	17511	OPTAGEOPTAGEIncJP	true

Private

IP
127.0.0.1

General Information

Joe Sandbox Version:	33.0.0 White Diamond
Analysis ID:	463765
Start date:	12.08.2021
Start time:	03:40:36
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 7m 55s
Hypervisor based Inspection enabled:	false
Report type:	light
Sample file name:	PHvqpLRfRl.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	29
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal88.troj.evad.winEXE@17/11@0/98
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 55.8% (good quality ratio 53.1%) Quality average: 73.7% Quality standard deviation: 28.1%
HCA Information:	Successful, ratio: 79% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Exclude process from analysis (whitelisted): taskhostw.exe, BackgroundTransferHost.exe, backgroundTaskHost.exe, UsoClient.exe Excluded IPs from analysis (whitelisted): 20.42.65.92, 20.189.173.21, 20.82.209.183, 23.211.4.86, 173.222.108.226, 173.222.108.210, 20.82.210.154, 80.67.82.211, 80.67.82.235, 40.112.88.60, 23.211.6.115 Excluded domains from analysis (whitelisted): au.download.windowsupdate.com.edgesuite.net, store-images.s-microsoft.com-c.edgekey.net, iris-de-prod-azsc-neu-b.northeurope.cloudapp.azure.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, a1449.dscg2.akamai.net, arc.msn.com, e12564.dspb.akamaiedge.net, audownload.windowsupdate.nsatc.net, onedsblobprdwus16.westus.cloudapp.azure.com, arc.trafficmanager.net, watson.telemetry.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, prod.fs.microsoft.com.akadns.net, au-bg-shim.trafficmanager.net, iris-de-prod-azsc-neu.northeurope.cloudapp.azure.com, fs.microsoft.com, ris-prod.trafficmanager.net, asf-ris-prod-neu.northeurope.cloudapp.azure.com, e1723.g.akamaiedge.net, ctldl.windowsupdate.com, a767.dscg3.akamai.net, ris.api.iris.microsoft.com, onedsblobprdeus17.eastus.cloudapp.azure.com, store-images.s-microsoft.com, blobcollector.events.data.trafficmanager.net Not all processes where analyzed, report is missing behavior information Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
03:41:50	API Interceptor	2x Sleep call for process: svchost.exe modified
03:43:06	API Interceptor	1x Sleep call for process: MpCmdRun.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
174.102.48.180	5lBz4O8bUN.doc	Get hash	malicious	Browse	174.102.48.180/jtyr8mFvYGYj/H7grRXk4w1o/4MuF3bMLq0cKl/CVHw/GjS2/
	4fCoc3EWF8.doc	Get hash	malicious	Browse	174.102.48.180/0uZBOtzp5ZZuqTEU/p5ZQlt/7irz8wZhDmQ/
	eB05tZUpsh.doc	Get hash	malicious	Browse	174.102.48.180/vcurP8/cEWPW3fXnFVIv4/l8rn5A4EoN/
	CZmyxawolk.doc	Get hash	malicious	Browse	174.102.48.180/P1SbvFpN1rlbe/sLIF0OsTIidIbo7/LaR1t/XZ97OQ/
	HgTBiPyQ0i.doc	Get hash	malicious	Browse	174.102.48.180/Pp0yU5lAl1Cby9r7v/cejVzM1rIL/7jc2lZ8uA6/YYE64/
	dkA9HMvth0.doc	Get hash	malicious	Browse	174.102.48.180/E9A3e/k8LVL3u3nyETISGp7XJ/
	cvk4bdf6kV.doc	Get hash	malicious	Browse	174.102.48.180/RVMVbOJikCEq5F/2AF8xs/dKSb/
	lug9AAmZ27.doc	Get hash	malicious	Browse	174.102.48.180/fOogpStFjuFENYz/ehFarEKXgKAwlw4sP48/
	URwKSHvdeS.doc	Get hash	malicious	Browse	174.102.48.180/p0FHz/OPfgrgr/nsrmIVANjaJPLm/ZZjqrVzXZJTnN9/
	9aeq4p0CrS.doc	Get hash	malicious	Browse	174.102.48.180/0mOKsBvKx0b4KK/uPzMsiW9/2SjqY9AGEjxcuXfS/
	cvk4bdf6kV.doc	Get hash	malicious	Browse	174.102.48.180/yYqfz97/FA8Z6n7Fde3jQ/e4pPuASo8u3y1vl/mloUKV7wzhYq/sy6lIW/2yVFHAVuWj9s0PyPS/
	lKJxKSdIy4.doc	Get hash	malicious	Browse	174.102.48.180/SNXMsYvg/phKE/zl4BpkbmfCIpju0R/Bzmtx4R3jk/bID0URsKDigHO/
	pgJzEMBQ3v.doc	Get hash	malicious	Browse	174.102.48.180/Bm5W77/
	UcYAnzcuLw.doc	Get hash	malicious	Browse	174.102.48.180/tnW0pFxvi3jcsLuVal/
	Aq8q0n63D4.doc	Get hash	malicious	Browse	174.102.48.180/nCed3Y2wxhWyzv/KaZmMua2Fiehlk/pl0iadsZMVl/
	pgJzEMBQ3v.doc	Get hash	malicious	Browse	174.102.48.180/oaJmJZPXoIq/lYF5su/i8zdxWzfR11Xc5oR8pu/BjvTN9UYdBdCPzV/
	6LrCTq9XRL.doc	Get hash	malicious	Browse	174.102.48.180/btt1Pei5RlrPz8rt0wo/mrxg9KPxTEXkPld6TJ/
	B1Qx9hGmL1.doc	Get hash	malicious	Browse	174.102.48.180/M0PWhEPvT/0qHu0ayQcHUsRIr/YNysMpWaMK9/Im9kWV98EkdTud/QzlJEEkC/GHPhKTebx0X8IEVERw/
	VMpO7ctkCN.doc	Get hash	malicious	Browse	174.102.48.180/daht480rCxBFtzfye/ycNSOFzC0YSRgt5lj/
	qC8xQnshQT.doc	Get hash	malicious	Browse	174.102.48.180/k1tnm5/m9z40ZgIZfJ9Y/SlpBbwCoKsnTcrQZu/qVmMdRk52NoYEiwJHbn/aNcR98ch/
94.200.114.161	test-emotet.exe	Get hash	malicious	Browse	94.200.114.161/
85.152.162.105	NWMEaRqF7s.exe	Get hash	malicious	Browse
	ZaI35eo6u9.exe	Get hash	malicious	Browse
	vvx4kLOlAb.exe	Get hash	malicious	Browse
	http://ehitusest.eu/marketplacel/sites/r5zmfubb2b/	Get hash	malicious	Browse

Domains

No context

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
TWC-10796-MIDWESTUS	J4C5IXCvD9	Get hash	malicious	Browse	69.135.6.237
	F6gc9bMj46	Get hash	malicious	Browse	71.74.142.87
	7NuxE5BCX7	Get hash	malicious	Browse	71.79.22.9
	8kNgpvKpMy	Get hash	malicious	Browse	74.218.30.81
	8JcGfEg1D8	Get hash	malicious	Browse	74.62.104.65
	Ck4BThYsDw	Get hash	malicious	Browse	174.101.182.235
	l6zn4I2gR0	Get hash	malicious	Browse	192.181.50.193
	PbVMrewfKY	Get hash	malicious	Browse	74.131.166.186
	d5reZjGi2R	Get hash	malicious	Browse	75.187.158.160
	SUsQqSw8ip	Get hash	malicious	Browse	162.152.25.92
	aysg3ZHrSn	Get hash	malicious	Browse	75.186.5.45
	DgPSz8yXHm	Get hash	malicious	Browse	70.62.23.74
	HWixtKQtDD	Get hash	malicious	Browse	71.73.0.77
	UMiTH6VAAm	Get hash	malicious	Browse	75.178.242.100
	gCt2Uvhj67	Get hash	malicious	Browse	76.190.50.144
	leMKuKe7Ou	Get hash	malicious	Browse	104.230.229.119
	d71jxmnvUx	Get hash	malicious	Browse	70.92.228.6
	oukOm1BrrT	Get hash	malicious	Browse	74.138.178.162
	ffbjLmdIN9	Get hash	malicious	Browse	147.19.123.241
	4ymeL7ChN7	Get hash	malicious	Browse	74.134.17.101
TELECABLESpainES	l9Ix5r5wGZ	Get hash	malicious	Browse	85.152.66.234
	5tNstyTOAF	Get hash	malicious	Browse	188.171.41.165
	4xObcnCGsB	Get hash	malicious	Browse	85.152.9.22
	kb5IbEJU8c	Get hash	malicious	Browse	85.152.156.228
	NWMEaRqF7s.exe	Get hash	malicious	Browse	85.152.162.105
	project-a.exe	Get hash	malicious	Browse	93.156.9.212
	project-a.exe	Get hash	malicious	Browse	93.156.9.212
	9cf2c56e_by_Libranalysis.exe	Get hash	malicious	Browse	85.152.174.56
	ZaI35eo6u9.exe	Get hash	malicious	Browse	85.152.162.105
	vvx4kLOlAb.exe	Get hash	malicious	Browse	85.152.162.105
	http://ehitusest.eu/marketplacel/sites/r5zmfubb2b/	Get hash	malicious	Browse	85.152.162.105
	newage	Get hash	malicious	Browse	188.171.41.194
	http://gondan.thinkaweb.com/sites/US/DOC/Direct-Deposit-Notice	Get hash	malicious	Browse	212.89.13.71
	http://galeona.com/soberno.bin	Get hash	malicious	Browse	212.89.16.142
	I2363059224.js	Get hash	malicious	Browse	212.89.16.142
	I2363059224.js	Get hash	malicious	Browse	212.89.16.142
	693336902_11_07_2017_36_92_50.doc	Get hash	malicious	Browse	212.89.16.142
DU-AS1AE	Vjeta9CbXg	Get hash	malicious	Browse	94.204.106.205
	5XMSrYsmRW	Get hash	malicious	Browse	91.72.218.214
	6K8zK2czTn	Get hash	malicious	Browse	94.204.216.53
	LDit8hIL8X	Get hash	malicious	Browse	94.204.154.134
	tMA66IeqHu	Get hash	malicious	Browse	91.74.61.63
	KoknEiNL8U	Get hash	malicious	Browse	91.75.105.97
	leMKuKe7Ou	Get hash	malicious	Browse	213.132.40.74
	wqdheN4fHE	Get hash	malicious	Browse	5.31.102.66
	w9trNTvSN6	Get hash	malicious	Browse	94.204.241.42
	ZIB8Eu6SUW	Get hash	malicious	Browse	80.227.203.45
	EXWofBp7D3	Get hash	malicious	Browse	94.204.106.215
	FcS2LLgnCT	Get hash	malicious	Browse	94.204.75.39
	3etkq3iOPQ	Get hash	malicious	Browse	94.204.253.54
	vw23PmQlqG	Get hash	malicious	Browse	87.200.54.76
	cUfweIWt2x	Get hash	malicious	Browse	94.204.14.84
	GSJ1vGT2WQ	Get hash	malicious	Browse	91.72.178.118
	N5YMd8tYgj	Get hash	malicious	Browse	94.204.241.73
	MPjc1ARjq2	Get hash	malicious	Browse	80.227.151.230
	uUeNOJKD3h	Get hash	malicious	Browse	80.227.203.25
	8xVa4UKUer	Get hash	malicious	Browse	80.227.203.11

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	0.5967038728698416
Encrypted:	false
SSDEEP:	6:bmHXEk1GaD0JOCEfMuaaD0JOCEfMKQmD2HitAl/gz2cE0fMbhEZolrRSQ2hyYIIT:bmbGaD0JcaaD0JwQQhtAg/0bjSQJ
MD5:	09C1EEA4E082E5FC05E6818DE719DFEE
SHA1:	18E7C6F8112484E8F110532D85D49D6D77A148BF
SHA-256:	30BD994B38AE48605586B6B24BCC996E6D8E067C7733EB645E6A2FCB86828FC4
SHA-512:	8A3E3B0EAD63D5C950F3A125A6BD6A59BC3353B3560C2792BBDCD44001C1CB7680A5DAFBF054A402F129C05977B79A03AB12402BE5A5C1D04F5E9D9AA3E90109
Malicious:	false
Preview:	....E..h..(.....2)...y).............. ..1C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@...................2)...y)...........&......e.f.3...w.......................3...w..................h..C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b...G............................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x0efe33c8, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.09548928066021656
Encrypted:	false
SSDEEP:	12:iKoc0+yO4blxQDwKcKoc0+yO4blxQDwK:iKoTR8wKoTR8
MD5:	E0C8DBEBC76DF1DF7081C38AD66AF73C
SHA1:	14E8ED9262FE4D9D185E1BCF1DF69618CD0A4248
SHA-256:	37A8266CC7DB18AF2665F0AE27C3AA624EF87F90638351F2C1735E8A85075068
SHA-512:	A58E971F5417AB7FD6B35DF05B49399D8BD108E4BA7D3D54E136C97D51BECEE514936A87E252BD10332C19E900734ECD44B3D4455EF2CF7971EC7C027515558B
Malicious:	false
Preview:	..3.... ................e.f.3...w........................&..........w..2)...y).h.(..............................3...w...........................................................................................................B...........@...................................................................................................... ........3...w......................................................................................................................................................................................................................................w...2)...y.m................X...2)...y).........................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.10998204414275213
Encrypted:	false
SSDEEP:	3:nNl/7EvXuDLkl/bJdAtizvDLXlall:PiKLkt4gDLXA
MD5:	48491BD81AF18F93199F4C0BEB283A18
SHA1:	41DD71F329D4D59ED504269DDA4DC42CC3B33817
SHA-256:	E156206280F795CD096C35660B5F53D0E1CB1114C200D9A0E9AFE4FAC7D8F3F3
SHA-512:	4D0436EB7DD43F6688A86261D67B111266E25C46C64334DEE955924F12320225042BB86B44BEEFD213D9204FD92AC775204B8214018FD8E2BC76C56C3DC25AAC
Malicious:	false
Preview:	~........................................3...w..2)...y)......w...............w.......w....:O.....w..................X...2)...y).........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Packages\ActiveSync\LocalState\DiagOutputDir\SyncVerbose.etl Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.11006616252470452
Encrypted:	false
SSDEEP:	12:26XhXm/Ey6q99959kq3qQ10nMCldimE8eawHjclQa3:26cl68RLyMCldzE9BHjclQ6
MD5:	9181DD55F1C0BBAC930CC1A58606C942
SHA1:	4AB034AB1751F0AC17992F6CBE95B81D4D58BF96
SHA-256:	1133A76F073B741EA310314AECC06F3BB03269DBC5C064D7267575B489B572FC
SHA-512:	58B9C40EB10B70E44E89B035010F97E7A84BFF2AAA05729699F61109F466640AF46DB7428B3622E737113A41DECA76C68389AD5E6D2502AD648E1A5858EBDD21
Malicious:	false
Preview:	................................................................................d...L......M.....................B..............Zb..................................................@.t.z.r.e.s...d.l.l.,.-.2.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.2.1.1............................................................[5G0..... .........f...........S.y.n.c.V.e.r.b.o.s.e...C.:.\.U.s.e.r.s.\.h.a.r.d.z.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.p.a.c.k.a.g.e.s.\.A.c.t.i.v.e.S.y.n.c.\.L.o.c.a.l.S.t.a.t.e.\.D.i.a.g.O.u.t.p.u.t.D.i.r.\.S.y.n.c.V.e.r.b.o.s.e...e.t.l...........P.P.d...L......M....................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Packages\ActiveSync\LocalState\DiagOutputDir\UnistackCircular.etl Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.11274936236517538
Encrypted:	false
SSDEEP:	12:HSjXm/Ey6q99959gj1miM3qQ10nMCldimE8eawHza1miIjP:H3l68gj1tMLyMCldzE9BHza1tIr
MD5:	B2FD6C3CBCF7A90C1FC9D970387AA06B
SHA1:	449EFE720E57770A6C974BFE5C4E5C4019854742
SHA-256:	3EFEAB1C0C6492736DC5FFDDBF6879CF15AF0B26BA7EDB7489D7AE4D774529EB
SHA-512:	42C2C35569F5705003AABEA54039B28BA539803367EE22D95004668259D1AD6400628C047221498D0409670ACE0E83643254131D9E9178499A1F01B0A778A61B
Malicious:	false
Preview:	................................................................................d...L.....M.....................B..............Zb..................................................@.t.z.r.e.s...d.l.l.,.-.2.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.2.1.1............................................................[5G0..... .....;..f...........U.n.i.s.t.a.c.k.C.i.r.c.u.l.a.r...C.:.\.U.s.e.r.s.\.h.a.r.d.z.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.p.a.c.k.a.g.e.s.\.A.c.t.i.v.e.S.y.n.c.\.L.o.c.a.l.S.t.a.t.e.\.D.i.a.g.O.u.t.p.u.t.D.i.r.\.U.n.i.s.t.a.c.k.C.i.r.c.u.l.a.r...e.t.l.......P.P.d...L......M....................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Packages\ActiveSync\LocalState\DiagOutputDir\UnistackCritical.etl Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.11259598149770064
Encrypted:	false
SSDEEP:	12:BRjXm/Ey6q99959gj1mK2P3qQ10nMCldimE8eawHza1mKzM/6P:Gl68gj1iPLyMCldzE9BHza18/a
MD5:	9C5A372DCA863E523F39E09A91FEF938
SHA1:	17A313FD73DBEC87D9F1BA1E19E54F508EC9A7DE
SHA-256:	6999A4EF9C1F5B80141F3F36F45254D23EB20F586CC92C99ACD3FAF80CCFC9A5
SHA-512:	DA5BE3856203A73AD8E8546C018FC047946249F37495736D989477999A50A3B8FB5C91218067C9E4E7D0219137C0D5BC6D9CEA1EE12E30D33427840E3550AD21
Malicious:	false
Preview:	................................................................................d...L...,b.M.....................B..............Zb..................................................@.t.z.r.e.s...d.l.l.,.-.2.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.2.1.1............................................................[5G0..... .....;..f...........U.n.i.s.t.a.c.k.C.r.i.t.i.c.a.l...C.:.\.U.s.e.r.s.\.h.a.r.d.z.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.p.a.c.k.a.g.e.s.\.A.c.t.i.v.e.S.y.n.c.\.L.o.c.a.l.S.t.a.t.e.\.D.i.a.g.O.u.t.p.u.t.D.i.r.\.U.n.i.s.t.a.c.k.C.r.i.t.i.c.a.l...e.t.l.......P.P.d...L...2j.M....................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\packages\ActiveSync\LocalState\DiagOutputDir\SyncVerbose.etl.0001@. (copy) Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.11006616252470452
Encrypted:	false
SSDEEP:	12:26XhXm/Ey6q99959kq3qQ10nMCldimE8eawHjclQa3:26cl68RLyMCldzE9BHjclQ6
MD5:	9181DD55F1C0BBAC930CC1A58606C942
SHA1:	4AB034AB1751F0AC17992F6CBE95B81D4D58BF96
SHA-256:	1133A76F073B741EA310314AECC06F3BB03269DBC5C064D7267575B489B572FC
SHA-512:	58B9C40EB10B70E44E89B035010F97E7A84BFF2AAA05729699F61109F466640AF46DB7428B3622E737113A41DECA76C68389AD5E6D2502AD648E1A5858EBDD21
Malicious:	false
Preview:	................................................................................d...L......M.....................B..............Zb..................................................@.t.z.r.e.s...d.l.l.,.-.2.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.2.1.1............................................................[5G0..... .........f...........S.y.n.c.V.e.r.b.o.s.e...C.:.\.U.s.e.r.s.\.h.a.r.d.z.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.p.a.c.k.a.g.e.s.\.A.c.t.i.v.e.S.y.n.c.\.L.o.c.a.l.S.t.a.t.e.\.D.i.a.g.O.u.t.p.u.t.D.i.r.\.S.y.n.c.V.e.r.b.o.s.e...e.t.l...........P.P.d...L......M....................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\packages\ActiveSync\LocalState\DiagOutputDir\UnistackCircular.etl.0001 (copy) Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.11274936236517538
Encrypted:	false
SSDEEP:	12:HSjXm/Ey6q99959gj1miM3qQ10nMCldimE8eawHza1miIjP:H3l68gj1tMLyMCldzE9BHza1tIr
MD5:	B2FD6C3CBCF7A90C1FC9D970387AA06B
SHA1:	449EFE720E57770A6C974BFE5C4E5C4019854742
SHA-256:	3EFEAB1C0C6492736DC5FFDDBF6879CF15AF0B26BA7EDB7489D7AE4D774529EB
SHA-512:	42C2C35569F5705003AABEA54039B28BA539803367EE22D95004668259D1AD6400628C047221498D0409670ACE0E83643254131D9E9178499A1F01B0A778A61B
Malicious:	false
Preview:	................................................................................d...L.....M.....................B..............Zb..................................................@.t.z.r.e.s...d.l.l.,.-.2.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.2.1.1............................................................[5G0..... .....;..f...........U.n.i.s.t.a.c.k.C.i.r.c.u.l.a.r...C.:.\.U.s.e.r.s.\.h.a.r.d.z.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.p.a.c.k.a.g.e.s.\.A.c.t.i.v.e.S.y.n.c.\.L.o.c.a.l.S.t.a.t.e.\.D.i.a.g.O.u.t.p.u.t.D.i.r.\.U.n.i.s.t.a.c.k.C.i.r.c.u.l.a.r...e.t.l.......P.P.d...L......M....................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\packages\ActiveSync\LocalState\DiagOutputDir\UnistackCritical.etl.0001.k (copy) Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.11259598149770064
Encrypted:	false
SSDEEP:	12:BRjXm/Ey6q99959gj1mK2P3qQ10nMCldimE8eawHza1mKzM/6P:Gl68gj1iPLyMCldzE9BHza18/a
MD5:	9C5A372DCA863E523F39E09A91FEF938
SHA1:	17A313FD73DBEC87D9F1BA1E19E54F508EC9A7DE
SHA-256:	6999A4EF9C1F5B80141F3F36F45254D23EB20F586CC92C99ACD3FAF80CCFC9A5
SHA-512:	DA5BE3856203A73AD8E8546C018FC047946249F37495736D989477999A50A3B8FB5C91218067C9E4E7D0219137C0D5BC6D9CEA1EE12E30D33427840E3550AD21
Malicious:	false
Preview:	................................................................................d...L...,b.M.....................B..............Zb..................................................@.t.z.r.e.s...d.l.l.,.-.2.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.2.1.1............................................................[5G0..... .....;..f...........U.n.i.s.t.a.c.k.C.r.i.t.i.c.a.l...C.:.\.U.s.e.r.s.\.h.a.r.d.z.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.p.a.c.k.a.g.e.s.\.A.c.t.i.v.e.S.y.n.c.\.L.o.c.a.l.S.t.a.t.e.\.D.i.a.g.O.u.t.p.u.t.D.i.r.\.U.n.i.s.t.a.c.k.C.r.i.t.i.c.a.l...e.t.l.......P.P.d...L...2j.M....................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\MpCmdRun.log Download File
Process:	C:\Program Files\Windows Defender\MpCmdRun.exe
File Type:	data
Category:	modified
Size (bytes):	906
Entropy (8bit):	3.1605599587363233
Encrypted:	false
SSDEEP:	12:58KRBubdpkoF1AG3rbGTk9+MlWlLehB4yAq7ejCAG+:OaqdmuF3rZ+kWReH4yJ7Mr
MD5:	685AC3CE7ED30521D16D92028433D9FE
SHA1:	F9DFFE4DCA66001A6DECDB883AC305BFB628B5EB
SHA-256:	D28C8B36252AD2C2D1E4A3BAF71AEDA1DBA937E86B972A790F5E66877F346128
SHA-512:	F8558185D94806CE43D5928F631B481EBBAF24D20FF94A39814858A97E3D4C5013EB131BA4B69339531E7B30BC3D5D69BBB1E273AE8AE652B587DBFFE245B73D
Malicious:	false
Preview:	........-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.....M.p.C.m.d.R.u.n.:. .C.o.m.m.a.n.d. .L.i.n.e.:. .".C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.\.m.p.c.m.d.r.u.n...e.x.e.". .-.w.d.e.n.a.b.l.e..... .S.t.a.r.t. .T.i.m.e.:. .. T.h.u. .. A.u.g. .. 1.2. .. 2.0.2.1. .0.3.:.4.3.:.0.6.........M.p.E.n.s.u.r.e.P.r.o.c.e.s.s.M.i.t.i.g.a.t.i.o.n.P.o.l.i.c.y.:. .h.r. .=. .0.x.1.....W.D.E.n.a.b.l.e.....E.R.R.O.R.:. .M.p.W.D.E.n.a.b.l.e.(.T.R.U.E.). .f.a.i.l.e.d. .(.8.0.0.7.0.4.E.C.).....M.p.C.m.d.R.u.n.:. .E.n.d. .T.i.m.e.:. .. T.h.u. .. A.u.g. .. 1.2. .. 2.0.2.1. .0.3.:.4.3.:.0.6.....-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.....

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.068612593699838
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	PHvqpLRfRl.exe
File size:	270848
MD5:	d8e003f1443fd417bff275f2ce89330c
SHA1:	9489e8b85d2531b256f60803a8716a6efec34a97
SHA256:	e234948d52b71a636aeb6d54c77620910456db6a65202710fed85d19246601cb
SHA512:	591babd25118682cd7eb79f6ba50ee258cdd496d137acceed5f400bea8ff1885bd37b0e04d93849fffe29a02c03308fbc9f016c7ef32e4c406717e7b12023b2c
SSDEEP:	6144:++t9slXRgrofl8ClmHBU9PTyXpuXc5SkY2Bkp3:+E+lBgrod8nWhy149xp
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......[.'...II..II..II...I].II...I..II...I..II.&.I..II.&.I..II..HIn.II.G.I..II.G.I..II...I..II...I..II.G.I..IIRich..II........PE..L..

File Icon


Icon Hash:	00828e8e8686b000

Static PE Info

General
Entrypoint:	0x40a63b
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE
DLL Characteristics:	TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x5F626E57 [Wed Sep 16 19:58:15 2020 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	affe87f73dbd3b817a718b43c2e37fc2

Entrypoint Preview

Instruction
call 00007F9A8C756C4Bh
jmp 00007F9A8C751075h
push 00000014h
push 00427410h
call 00007F9A8C751CC4h
call 00007F9A8C756E1Ch
movzx esi, ax
push 00000002h
call 00007F9A8C756BDEh
pop ecx
mov eax, 00005A4Dh
cmp word ptr [00400000h], ax
je 00007F9A8C751076h
xor ebx, ebx
jmp 00007F9A8C7510A5h
mov eax, dword ptr [0040003Ch]
cmp dword ptr [eax+00400000h], 00004550h
jne 00007F9A8C75105Dh
mov ecx, 0000010Bh
cmp word ptr [eax+00400018h], cx
jne 00007F9A8C75104Fh
sub ebx, ebx
cmp dword ptr [eax+00400074h], 0Eh
jbe 00007F9A8C75107Bh
cmp dword ptr [eax+004000E8h], ebx
setne bl
mov dword ptr [ebp-1Ch], ebx
call 00007F9A8C753F9Ah
or eax, eax
jne 00007F9A8C75107Ah
push 0000001Ch
call 00007F9A8C751151h
pop ecx
call 00007F9A8C752D4Fh
or eax, eax
jne 00007F9A8C75107Ah
push 00000010h
call 00007F9A8C751140h
pop ecx
call 00007F9A8C756C57h
and dword ptr [ebp-04h], 00000000h
call 00007F9A8C7565A1h
or eax, eax
jns 00007F9A8C75107Ah
push 0000001Bh
call 00007F9A8C751126h
pop ecx
call dword ptr [0041F0BCh]
mov dword ptr [0042CC3Ch], eax
call 00007F9A8C756C72h
mov dword ptr [0042AA6Ch], eax
call 00007F9A8C75682Fh
test eax, eax
jns 00007F9A8C75107Ah

Rich Headers

Programming Language:

[C++] VS2013 UPD5 build 40629
[ C ] VS2013 build 21005
[LNK] VS2013 UPD5 build 40629
[EXP] VS2013 UPD5 build 40629
[C++] VS2013 build 21005
[ASM] VS2013 build 21005
[RES] VS2013 build 21005

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x27bb0	0x58	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x27c08	0xb4	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x2d000	0x16e10	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x44000	0x1da4	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x1f240	0x38	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x263e0	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1f000	0x1b0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x1ddcf	0x1de00	False	0.537158407427	data	6.59248625396	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rdata	0x1f000	0x9512	0x9600	False	0.377630208333	data	4.65797079282	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x29000	0x3c40	0x1c00	False	0.310128348214	data	3.64999781996	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0x2d000	0x16e10	0x17000	False	0.918127972147	data	7.78538698258	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x44000	0x1da4	0x1e00	False	0.755338541667	data	6.58235102943	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
JPGIMAGE	0x2d180	0x7332	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=10, orientation=upper-left, xresolution=134, yresolution=142, resolutionunit=2, datetime=2006:02:17 11:46:11], baseline, precision 8, 400x300, frames 3	English	United States
RT_STRING	0x42ff0	0xc0c	data	English	United States
RT_STRING	0x43c00	0x8a	data	English	United States
RT_MANIFEST	0x43c90	0x17d	XML 1.0 document text	English	United States
None	0x344b8	0xeb33	data	English	United States

Imports

DLL	Import
prntvpt.dll
KERNEL32.dll	LocalFree, FindResourceW, GetStdHandle, GetModuleHandleW, SizeofResource, WriteConsoleA, ReadConsoleW, WriteConsoleW, SetFilePointerEx, LockResource, LoadResource, LocalAlloc, GetLastError, CloseHandle, CreateFileW, ReadFile, WideCharToMultiByte, SetStdHandle, GetConsoleMode, GetConsoleCP, FlushFileBuffers, IsValidCodePage, OutputDebugStringW, GetStringTypeW, HeapReAlloc, LoadLibraryExW, LeaveCriticalSection, EnterCriticalSection, EnumSystemLocalesW, GetUserDefaultLCID, EncodePointer, DecodePointer, HeapFree, HeapAlloc, RaiseException, RtlUnwind, GetCommandLineA, IsProcessorFeaturePresent, IsDebuggerPresent, ExitProcess, GetModuleHandleExW, GetProcAddress, MultiByteToWideChar, HeapSize, GetACP, GetOEMCP, GetCPInfo, SetLastError, GetCurrentThreadId, GetProcessHeap, WriteFile, GetModuleFileNameW, GetFileType, DeleteCriticalSection, GetStartupInfoW, GetModuleFileNameA, QueryPerformanceCounter, GetCurrentProcessId, GetSystemTimeAsFileTime, GetEnvironmentStringsW, FreeEnvironmentStringsW, UnhandledExceptionFilter, SetUnhandledExceptionFilter, InitializeCriticalSectionAndSpinCount, Sleep, GetCurrentProcess, TerminateProcess, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, LCMapStringW, GetLocaleInfoW, IsValidLocale
USER32.dll	LoadStringW
GDI32.dll	EndPage, StartPage, EndDoc, StartDocW, DeleteDC, CreateDCW, ExtEscape, TextOutW
WINSPOOL.DRV	OpenPrinterW, DocumentPropertiesW, ClosePrinter
ADVAPI32.dll	CryptAcquireContextA
ole32.dll	CreateStreamOnHGlobal, CoTaskMemAlloc, CoCreateInstance, CoTaskMemFree
OLEAUT32.dll	VariantClear, VariantInit, SysFreeString, SysAllocString

Exports

Name	Ordinal	Address
XAdsfcghjdYUTWTFyFSGSFGH	1	0x4042e0

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source IP	Dest IP
08/12/21-03:42:23.986365	ICMP	486	ICMP Destination Unreachable Communication with Destination Host is Administratively Prohibited	104.156.59.7	192.168.2.3
08/12/21-03:42:26.992190	ICMP	486	ICMP Destination Unreachable Communication with Destination Host is Administratively Prohibited	104.156.59.7	192.168.2.3
08/12/21-03:42:33.008920	ICMP	486	ICMP Destination Unreachable Communication with Destination Host is Administratively Prohibited	104.156.59.7	192.168.2.3
08/12/21-03:42:49.488243	ICMP	399	ICMP Destination Unreachable Host Unreachable	120.138.31.131	192.168.2.3
08/12/21-03:43:01.445741	ICMP	399	ICMP Destination Unreachable Host Unreachable	120.138.31.131	192.168.2.3
08/12/21-03:43:01.445786	ICMP	399	ICMP Destination Unreachable Host Unreachable	120.138.31.131	192.168.2.3

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 12, 2021 03:41:35.519666910 CEST	49719	80	192.168.2.3	74.219.172.26
Aug 12, 2021 03:41:38.522355080 CEST	49719	80	192.168.2.3	74.219.172.26
Aug 12, 2021 03:41:44.522910118 CEST	49719	80	192.168.2.3	74.219.172.26
Aug 12, 2021 03:41:59.708889961 CEST	49726	8080	192.168.2.3	134.209.36.254
Aug 12, 2021 03:42:02.711874962 CEST	49726	8080	192.168.2.3	134.209.36.254
Aug 12, 2021 03:42:08.712327003 CEST	49726	8080	192.168.2.3	134.209.36.254
Aug 12, 2021 03:42:23.847101927 CEST	49736	8080	192.168.2.3	104.156.59.7
Aug 12, 2021 03:42:26.854458094 CEST	49736	8080	192.168.2.3	104.156.59.7
Aug 12, 2021 03:42:32.870639086 CEST	49736	8080	192.168.2.3	104.156.59.7
Aug 12, 2021 03:42:48.135271072 CEST	49737	8080	192.168.2.3	120.138.30.150
Aug 12, 2021 03:42:51.137895107 CEST	49737	8080	192.168.2.3	120.138.30.150
Aug 12, 2021 03:42:57.138266087 CEST	49737	8080	192.168.2.3	120.138.30.150
Aug 12, 2021 03:43:12.784043074 CEST	49745	443	192.168.2.3	194.187.133.160
Aug 12, 2021 03:43:12.845926046 CEST	443	49745	194.187.133.160	192.168.2.3
Aug 12, 2021 03:43:13.358505011 CEST	49745	443	192.168.2.3	194.187.133.160
Aug 12, 2021 03:43:13.420268059 CEST	443	49745	194.187.133.160	192.168.2.3
Aug 12, 2021 03:43:13.921128988 CEST	49745	443	192.168.2.3	194.187.133.160
Aug 12, 2021 03:43:13.985340118 CEST	443	49745	194.187.133.160	192.168.2.3
Aug 12, 2021 03:43:16.842665911 CEST	49746	8080	192.168.2.3	104.236.246.93
Aug 12, 2021 03:43:19.843348980 CEST	49746	8080	192.168.2.3	104.236.246.93
Aug 12, 2021 03:43:25.859476089 CEST	49746	8080	192.168.2.3	104.236.246.93

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 12, 2021 03:41:15.971901894 CEST	57544	53	192.168.2.3	8.8.8.8
Aug 12, 2021 03:41:16.004633904 CEST	53	57544	8.8.8.8	192.168.2.3
Aug 12, 2021 03:41:16.597446918 CEST	55984	53	192.168.2.3	8.8.8.8
Aug 12, 2021 03:41:16.625785112 CEST	53	55984	8.8.8.8	192.168.2.3
Aug 12, 2021 03:41:17.620563984 CEST	64185	53	192.168.2.3	8.8.8.8
Aug 12, 2021 03:41:17.647793055 CEST	53	64185	8.8.8.8	192.168.2.3
Aug 12, 2021 03:41:18.305031061 CEST	65110	53	192.168.2.3	8.8.8.8
Aug 12, 2021 03:41:18.333103895 CEST	53	65110	8.8.8.8	192.168.2.3
Aug 12, 2021 03:41:18.925791025 CEST	58361	53	192.168.2.3	8.8.8.8
Aug 12, 2021 03:41:18.952505112 CEST	53	58361	8.8.8.8	192.168.2.3
Aug 12, 2021 03:41:19.905530930 CEST	63492	53	192.168.2.3	8.8.8.8
Aug 12, 2021 03:41:19.939954996 CEST	53	63492	8.8.8.8	192.168.2.3
Aug 12, 2021 03:41:20.658904076 CEST	60831	53	192.168.2.3	8.8.8.8
Aug 12, 2021 03:41:20.693347931 CEST	53	60831	8.8.8.8	192.168.2.3
Aug 12, 2021 03:41:21.410543919 CEST	60100	53	192.168.2.3	8.8.8.8
Aug 12, 2021 03:41:21.446603060 CEST	53	60100	8.8.8.8	192.168.2.3
Aug 12, 2021 03:41:22.163188934 CEST	53195	53	192.168.2.3	8.8.8.8
Aug 12, 2021 03:41:22.196541071 CEST	53	53195	8.8.8.8	192.168.2.3
Aug 12, 2021 03:41:23.299995899 CEST	50141	53	192.168.2.3	8.8.8.8
Aug 12, 2021 03:41:23.334172964 CEST	53	50141	8.8.8.8	192.168.2.3
Aug 12, 2021 03:41:24.083755970 CEST	53023	53	192.168.2.3	8.8.8.8
Aug 12, 2021 03:41:24.119446993 CEST	53	53023	8.8.8.8	192.168.2.3
Aug 12, 2021 03:41:24.810017109 CEST	49563	53	192.168.2.3	8.8.8.8
Aug 12, 2021 03:41:24.836983919 CEST	53	49563	8.8.8.8	192.168.2.3
Aug 12, 2021 03:41:26.181569099 CEST	51352	53	192.168.2.3	8.8.8.8
Aug 12, 2021 03:41:26.210449934 CEST	53	51352	8.8.8.8	192.168.2.3
Aug 12, 2021 03:41:26.884033918 CEST	59349	53	192.168.2.3	8.8.8.8
Aug 12, 2021 03:41:26.909451008 CEST	53	59349	8.8.8.8	192.168.2.3
Aug 12, 2021 03:41:27.560306072 CEST	57084	53	192.168.2.3	8.8.8.8
Aug 12, 2021 03:41:27.590297937 CEST	53	57084	8.8.8.8	192.168.2.3
Aug 12, 2021 03:41:28.282663107 CEST	58823	53	192.168.2.3	8.8.8.8
Aug 12, 2021 03:41:28.318605900 CEST	53	58823	8.8.8.8	192.168.2.3
Aug 12, 2021 03:41:28.968744993 CEST	57568	53	192.168.2.3	8.8.8.8
Aug 12, 2021 03:41:28.997011900 CEST	53	57568	8.8.8.8	192.168.2.3
Aug 12, 2021 03:41:43.925251961 CEST	50540	53	192.168.2.3	8.8.8.8
Aug 12, 2021 03:41:43.969712019 CEST	53	50540	8.8.8.8	192.168.2.3
Aug 12, 2021 03:41:54.065295935 CEST	54366	53	192.168.2.3	8.8.8.8
Aug 12, 2021 03:41:54.119997025 CEST	53	54366	8.8.8.8	192.168.2.3
Aug 12, 2021 03:42:10.524096966 CEST	53034	53	192.168.2.3	8.8.8.8
Aug 12, 2021 03:42:10.561891079 CEST	53	53034	8.8.8.8	192.168.2.3
Aug 12, 2021 03:42:17.753806114 CEST	57762	53	192.168.2.3	8.8.8.8
Aug 12, 2021 03:42:17.796921015 CEST	53	57762	8.8.8.8	192.168.2.3
Aug 12, 2021 03:42:19.660054922 CEST	55435	53	192.168.2.3	8.8.8.8
Aug 12, 2021 03:42:19.704071999 CEST	53	55435	8.8.8.8	192.168.2.3
Aug 12, 2021 03:42:51.800534964 CEST	50713	53	192.168.2.3	8.8.8.8
Aug 12, 2021 03:42:51.834017992 CEST	53	50713	8.8.8.8	192.168.2.3
Aug 12, 2021 03:42:58.593950987 CEST	56132	53	192.168.2.3	8.8.8.8
Aug 12, 2021 03:42:58.636552095 CEST	53	56132	8.8.8.8	192.168.2.3
Aug 12, 2021 03:42:59.078012943 CEST	58987	53	192.168.2.3	8.8.8.8
Aug 12, 2021 03:42:59.112729073 CEST	53	58987	8.8.8.8	192.168.2.3
Aug 12, 2021 03:43:34.175939083 CEST	56579	53	192.168.2.3	8.8.8.8
Aug 12, 2021 03:43:34.226703882 CEST	53	56579	8.8.8.8	192.168.2.3
Aug 12, 2021 03:43:34.457361937 CEST	60633	53	192.168.2.3	8.8.8.8
Aug 12, 2021 03:43:34.499125957 CEST	53	60633	8.8.8.8	192.168.2.3

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Aug 12, 2021 03:42:23.986365080 CEST	104.156.59.7	192.168.2.3	636b	(Unknown)	Destination Unreachable
Aug 12, 2021 03:42:26.992189884 CEST	104.156.59.7	192.168.2.3	636b	(Unknown)	Destination Unreachable
Aug 12, 2021 03:42:33.008919954 CEST	104.156.59.7	192.168.2.3	636b	(Unknown)	Destination Unreachable

Code Manipulations

Statistics

Behavior

Click to jump to process

System Behavior

Analysis Process: PHvqpLRfRl.exe PID: 3176 Parent PID: 5732

General

Start time:	03:41:22
Start date:	12/08/2021
Path:	C:\Users\user\Desktop\PHvqpLRfRl.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\PHvqpLRfRl.exe'
Imagebase:	0x1140000
File size:	270848 bytes
MD5 hash:	D8E003F1443FD417BFF275F2CE89330C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Emotet, Description: Yara detected Emotet, Source: 00000000.00000002.202006890.00000000003F0000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet, Description: Yara detected Emotet, Source: 00000000.00000002.202145856.0000000000814000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet, Description: Yara detected Emotet, Source: 00000000.00000002.202173410.0000000000981000.00000020.00000001.sdmp, Author: Joe Security
Reputation:	low

Analysis Process: ipsmsnap.exe PID: 2328 Parent PID: 3176

General

Start time:	03:41:23
Start date:	12/08/2021
Path:	C:\Windows\SysWOW64\BackgroundTransferHost\ipsmsnap.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\BackgroundTransferHost\ipsmsnap.exe
Imagebase:	0x1140000
File size:	270848 bytes
MD5 hash:	D8E003F1443FD417BFF275F2CE89330C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Emotet, Description: Yara detected Emotet, Source: 00000001.00000002.467934925.0000000000E50000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet, Description: Yara detected Emotet, Source: 00000001.00000002.467384235.0000000000401000.00000020.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet, Description: Yara detected Emotet, Source: 00000001.00000002.467972344.0000000000E64000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	low

Analysis Process: svchost.exe PID: 6020 Parent PID: 568

General

Start time:	03:41:50
Start date:	12/08/2021
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7488e0000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: svchost.exe PID: 5948 Parent PID: 568

General

Start time:	03:42:01
Start date:	12/08/2021
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
Imagebase:	0x7ff7488e0000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: svchost.exe PID: 592 Parent PID: 568

General

Start time:	03:42:02
Start date:	12/08/2021
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	c:\windows\system32\svchost.exe -k localservice -p -s CDPSvc
Imagebase:	0x7ff7488e0000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: svchost.exe PID: 5452 Parent PID: 568

General

Start time:	03:42:02
Start date:	12/08/2021
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	c:\windows\system32\svchost.exe -k unistacksvcgroup
Imagebase:	0x7ff7488e0000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: svchost.exe PID: 4068 Parent PID: 568

General

Start time:	03:42:03
Start date:	12/08/2021
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	c:\windows\system32\svchost.exe -k networkservice -p -s DoSvc
Imagebase:	0x7ff7488e0000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: svchost.exe PID: 5084 Parent PID: 568

General

Start time:	03:42:03
Start date:	12/08/2021
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k NetworkService -p
Imagebase:	0x7ff7488e0000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: SgrmBroker.exe PID: 1836 Parent PID: 568

General

Start time:	03:42:04
Start date:	12/08/2021
Path:	C:\Windows\System32\SgrmBroker.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\SgrmBroker.exe
Imagebase:	0x7ff79e380000
File size:	163336 bytes
MD5 hash:	D3170A3F3A9626597EEE1888686E3EA6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: svchost.exe PID: 5912 Parent PID: 568

General

Start time:	03:42:04
Start date:	12/08/2021
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s wscsvc
Imagebase:	0x7ff7488e0000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: svchost.exe PID: 3868 Parent PID: 568

General

Start time:	03:42:53
Start date:	12/08/2021
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p
Imagebase:	0x7ff7488e0000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: MpCmdRun.exe PID: 4908 Parent PID: 5912

General

Start time:	03:43:05
Start date:	12/08/2021
Path:	C:\Program Files\Windows Defender\MpCmdRun.exe
Wow64 process (32bit):	false
Commandline:	'C:\Program Files\Windows Defender\mpcmdrun.exe' -wdenable
Imagebase:	0x7ff6bc720000
File size:	455656 bytes
MD5 hash:	A267555174BFA53844371226F482B86B
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Analysis Process: conhost.exe PID: 5188 Parent PID: 4908

General

Start time:	03:43:05
Start date:	12/08/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6b2800000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Analysis Process: svchost.exe PID: 5080 Parent PID: 568

General

Start time:	03:43:09
Start date:	12/08/2021
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p
Imagebase:	0x7ff7488e0000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Analysis Process: svchost.exe PID: 5576 Parent PID: 568

General

Start time:	03:43:25
Start date:	12/08/2021
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p
Imagebase:	0x7ff7488e0000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Disassembly

Code Analysis

Reset < >

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims. The Microsoft Windows Application Compatibility Infrastructure/Framework (Application Shim) was created to allow for backward compatibility of software as the operating system codebase changes over time. For example, the application shimming feature allows developers to apply fixes to applications (without rewriting code) that were created for Windows XP so that it will work with Windows 10.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report PHvqpLRfRl.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Emotet

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

Jbx Signature Overview

AV Detection:

Cryptography:

Compliance:

Spreading:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

E-Banking Fraud:

Spam, unwanted Advertisements and Ransom Demands:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Lowering of HIPS / PFW / Operating System Security Settings:

Stealing of Sensitive Information:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

Contacted IPs

Public

Private

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Exports

Possible Origin

Network Behavior

Snort IDS Alerts

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources. They can attempt to render stored data inaccessible by encrypting files or data on local and remote drives and withholding access to a decryption key. This may be done in order to extract monetary compensation from a victim in exchange for decryption or a decryption key (ransomware) or to render data permanently inaccessible in cases where the key is not saved or transmitted.In the case of ransomware, it is typical that common user files like Office documents, PDFs, images, videos, audio, text, and source code files will be encrypted. In some cases, adversaries may encrypt critical system files, disk partitions, and the MBR.
Tactics:	Impact
Data Sources:	File monitoring, Kernel drivers, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre