Windows Analysis Report DOCUMENTS.exe

Overview

General Information

Sample Name:	DOCUMENTS.exe
Analysis ID:	483808
MD5:	f93324854461139c58e0e865ceb3c859
SHA1:	3deeda7cea856d0d45ee83aeb23e000101623c32
SHA256:	aaac6d698326e6fbbcd64057fbf591ef97bf143494ede008d41ab75e5a37db5a
Tags:	exe
Infos:
Most interesting Screenshot:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Yara detected AgentTesla

Yara detected AntiVM3

Multi AV Scanner detection for dropped file

Installs a global keyboard hook

Initial sample is a PE file and has a suspicious name

Writes to foreign memory regions

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal ftp login credentials

Modifies the hosts file

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Allocates memory in foreign processes

.NET source code contains potential unpacker

Found evasive API chain (trying to detect sleep duration tampering with parallel thread)

Injects a PE file into a foreign processes

.NET source code contains very large strings

Tries to steal Mail credentials (via file access)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Uses schtasks.exe or at.exe to add and modify task schedules

Tries to harvest and steal browser information (history, passwords, etc)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Antivirus or Machine Learning detection for unpacked file

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Internet Provider seen in connection with other malware

Detected potential crypto function

Sample execution stops while process was sleeping (likely an evasion)

Yara detected Credential Stealer

Contains functionality to call native functions

Contains long sleeps (>= 3 min)

Enables debug privileges

Sample file is different than original file name gathered from version info

PE file contains strange resources

Drops PE files

Uses a known web browser user agent for HTTP communication

Creates a window with clipboard capturing capabilities

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Creates a process in suspended mode (likely to inject code)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

Signatures

AV Detection:

Found malware configuration

Source: 0.2.DOCUMENTS.exe.a7c30b8.7.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "Http", "HTTP method": "Post", "Post URL": "http://161.129.64.49/webpanel-dawn2/mawa/0fcd1ef3ebe94dad1463.php", "User Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0"}

Multi AV Scanner detection for submitted file

Source: DOCUMENTS.exe

ReversingLabs: Detection: 17%

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\ncXzBAPDBtn.exe

ReversingLabs: Detection: 17%

Antivirus or Machine Learning detection for unpacked file

Source: 9.2.MSBuild.exe.400000.0.unpack

Avira: Label: TR/Spy.Gen8

Compliance:

Uses 32bit PE files

Source: DOCUMENTS.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: C:\Users\user\Desktop\DOCUMENTS.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9445_none_d08c58b4442ba54f\MSVCR80.dll

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49688
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49676
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49687
Source: unknown	Network traffic detected: HTTP traffic on port 49695 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49695
Source: unknown	Network traffic detected: HTTP traffic on port 49676 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49682
Source: unknown	Network traffic detected: HTTP traffic on port 49683 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49689 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49690 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49687 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49688 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49682 -> 443

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 161.129.64.49
Source: unknown	TCP traffic detected without corresponding DNS query: 161.129.64.49
Source: unknown	TCP traffic detected without corresponding DNS query: 161.129.64.49
Source: unknown	TCP traffic detected without corresponding DNS query: 161.129.64.49
Source: unknown	TCP traffic detected without corresponding DNS query: 161.129.64.49
Source: unknown	TCP traffic detected without corresponding DNS query: 161.129.64.49
Source: unknown	TCP traffic detected without corresponding DNS query: 161.129.64.49
Source: unknown	TCP traffic detected without corresponding DNS query: 161.129.64.49
Source: unknown	TCP traffic detected without corresponding DNS query: 161.129.64.49
Source: unknown	TCP traffic detected without corresponding DNS query: 161.129.64.49
Source: unknown	TCP traffic detected without corresponding DNS query: 161.129.64.49
Source: unknown	TCP traffic detected without corresponding DNS query: 161.129.64.49
Source: unknown	TCP traffic detected without corresponding DNS query: 161.129.64.49
Source: unknown	TCP traffic detected without corresponding DNS query: 161.129.64.49
Source: unknown	TCP traffic detected without corresponding DNS query: 161.129.64.49
Source: unknown	TCP traffic detected without corresponding DNS query: 161.129.64.49
Source: unknown	TCP traffic detected without corresponding DNS query: 161.129.64.49
Source: unknown	TCP traffic detected without corresponding DNS query: 161.129.64.49
Source: unknown	TCP traffic detected without corresponding DNS query: 161.129.64.49
Source: unknown	TCP traffic detected without corresponding DNS query: 161.129.64.49
Source: unknown	TCP traffic detected without corresponding DNS query: 161.129.64.49
Source: unknown	TCP traffic detected without corresponding DNS query: 161.129.64.49
Source: unknown	TCP traffic detected without corresponding DNS query: 161.129.64.49
Source: unknown	TCP traffic detected without corresponding DNS query: 23.203.69.124
Source: unknown	TCP traffic detected without corresponding DNS query: 23.203.69.124
Source: unknown	TCP traffic detected without corresponding DNS query: 161.129.64.49
Source: unknown	TCP traffic detected without corresponding DNS query: 161.129.64.49
Source: unknown	TCP traffic detected without corresponding DNS query: 161.129.64.49
Source: unknown	TCP traffic detected without corresponding DNS query: 161.129.64.49
Source: unknown	TCP traffic detected without corresponding DNS query: 23.55.161.167
Source: unknown	TCP traffic detected without corresponding DNS query: 23.55.161.167
Source: unknown	TCP traffic detected without corresponding DNS query: 161.129.64.49
Source: unknown	TCP traffic detected without corresponding DNS query: 161.129.64.49
Source: unknown	TCP traffic detected without corresponding DNS query: 161.129.64.49

Source: MSBuild.exe, 00000009.00000002.524239294.0000000003281000.00000004.00000001.sdmp	String found in binary or memory: http://127.0.0.1:HTTP/1.1
Source: MSBuild.exe, 00000009.00000002.525207312.00000000034F9000.00000004.00000001.sdmp	String found in binary or memory: http://161.129.64.49
Source: MSBuild.exe, 00000009.00000002.524239294.0000000003281000.00000004.00000001.sdmp	String found in binary or memory: http://161.129.64.49/webpanel-dawn2/mawa/0fcd1ef3ebe94dad1463.php
Source: MSBuild.exe, 00000009.00000002.524239294.0000000003281000.00000004.00000001.sdmp	String found in binary or memory: http://161.129.64.49/webpanel-dawn2/mawa/0fcd1ef3ebe94dad1463.php127.0.0.1POST
Source: MSBuild.exe, 00000009.00000002.524239294.0000000003281000.00000004.00000001.sdmp	String found in binary or memory: http://161.129.64.49x&
Source: MSBuild.exe, 00000009.00000002.524239294.0000000003281000.00000004.00000001.sdmp	String found in binary or memory: http://DynDns.comDynDNS
Source: MSBuild.exe, 00000009.00000002.525207312.00000000034F9000.00000004.00000001.sdmp, MSBuild.exe, 00000009.00000002.524239294.0000000003281000.00000004.00000001.sdmp	String found in binary or memory: http://cUpnXtBcsknsdD.com
Source: DOCUMENTS.exe, 00000000.00000002.292662207.0000000006CF2000.00000004.00000001.sdmp	String found in binary or memory: http://fontfabrik.com
Source: DOCUMENTS.exe, 00000000.00000002.292662207.0000000006CF2000.00000004.00000001.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: DOCUMENTS.exe, 00000000.00000002.292662207.0000000006CF2000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: DOCUMENTS.exe, 00000000.00000002.292662207.0000000006CF2000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: DOCUMENTS.exe, 00000000.00000003.260935512.0000000005AE9000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: DOCUMENTS.exe, 00000000.00000002.292662207.0000000006CF2000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: DOCUMENTS.exe, 00000000.00000002.292662207.0000000006CF2000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: DOCUMENTS.exe, 00000000.00000002.292662207.0000000006CF2000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: DOCUMENTS.exe, 00000000.00000002.292662207.0000000006CF2000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: DOCUMENTS.exe, 00000000.00000002.292662207.0000000006CF2000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: DOCUMENTS.exe, 00000000.00000002.292662207.0000000006CF2000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: DOCUMENTS.exe, 00000000.00000002.292439834.0000000005AE0000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.coma
Source: DOCUMENTS.exe, 00000000.00000002.292439834.0000000005AE0000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comasc
Source: DOCUMENTS.exe, 00000000.00000002.292439834.0000000005AE0000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.come.com$u
Source: DOCUMENTS.exe, 00000000.00000003.252497884.0000000005AFB000.00000004.00000001.sdmp	String found in binary or memory: http://www.fonts.com
Source: DOCUMENTS.exe, 00000000.00000003.252461730.0000000005AFB000.00000004.00000001.sdmp	String found in binary or memory: http://www.fonts.comc
Source: DOCUMENTS.exe, 00000000.00000003.252497884.0000000005AFB000.00000004.00000001.sdmp	String found in binary or memory: http://www.fonts.comx
Source: DOCUMENTS.exe, 00000000.00000003.254970840.0000000005AE4000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.c
Source: DOCUMENTS.exe, 00000000.00000003.254970840.0000000005AE4000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: DOCUMENTS.exe, 00000000.00000003.255313836.0000000005AE4000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/
Source: DOCUMENTS.exe, 00000000.00000002.292662207.0000000006CF2000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: DOCUMENTS.exe, 00000000.00000002.292662207.0000000006CF2000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: DOCUMENTS.exe, 00000000.00000003.254947083.0000000005B1D000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn6
Source: DOCUMENTS.exe, 00000000.00000003.254947083.0000000005B1D000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn8g
Source: DOCUMENTS.exe, 00000000.00000003.254947083.0000000005B1D000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cnhgN
Source: DOCUMENTS.exe, 00000000.00000003.254970840.0000000005AE4000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cnle:gKg
Source: DOCUMENTS.exe, 00000000.00000002.292662207.0000000006CF2000.00000004.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: DOCUMENTS.exe, 00000000.00000002.292439834.0000000005AE0000.00000004.00000001.sdmp, DOCUMENTS.exe, 00000000.00000002.292662207.0000000006CF2000.00000004.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: DOCUMENTS.exe, 00000000.00000002.292662207.0000000006CF2000.00000004.00000001.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: DOCUMENTS.exe, 00000000.00000002.292662207.0000000006CF2000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: DOCUMENTS.exe, 00000000.00000003.257338663.0000000005AE4000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/Yu
Source: DOCUMENTS.exe, 00000000.00000003.257338663.0000000005AE4000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/
Source: DOCUMENTS.exe, 00000000.00000003.257338663.0000000005AE4000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/osof
Source: DOCUMENTS.exe, 00000000.00000003.257338663.0000000005AE4000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/seb
Source: DOCUMENTS.exe, 00000000.00000002.292662207.0000000006CF2000.00000004.00000001.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: DOCUMENTS.exe, 00000000.00000003.252219497.0000000005AFB000.00000004.00000001.sdmp	String found in binary or memory: http://www.sajatypeworks.coma-d
Source: DOCUMENTS.exe, 00000000.00000003.252219497.0000000005AFB000.00000004.00000001.sdmp	String found in binary or memory: http://www.sajatypeworks.comibi_
Source: DOCUMENTS.exe, 00000000.00000003.252219497.0000000005AFB000.00000004.00000001.sdmp	String found in binary or memory: http://www.sajatypeworks.coms
Source: DOCUMENTS.exe, 00000000.00000002.292662207.0000000006CF2000.00000004.00000001.sdmp	String found in binary or memory: http://www.sakkal.com
Source: DOCUMENTS.exe, 00000000.00000003.254341564.0000000005AE6000.00000004.00000001.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: DOCUMENTS.exe, 00000000.00000003.254341564.0000000005AE6000.00000004.00000001.sdmp	String found in binary or memory: http://www.sandoll.co.krFeSi
Source: DOCUMENTS.exe, 00000000.00000003.254341564.0000000005AE6000.00000004.00000001.sdmp	String found in binary or memory: http://www.sandoll.co.krt
Source: DOCUMENTS.exe, 00000000.00000002.292662207.0000000006CF2000.00000004.00000001.sdmp	String found in binary or memory: http://www.tiro.com
Source: DOCUMENTS.exe, 00000000.00000003.253296632.0000000005AFB000.00000004.00000001.sdmp	String found in binary or memory: http://www.tiro.comn
Source: DOCUMENTS.exe, 00000000.00000002.292662207.0000000006CF2000.00000004.00000001.sdmp	String found in binary or memory: http://www.typography.netD
Source: DOCUMENTS.exe, 00000000.00000002.292662207.0000000006CF2000.00000004.00000001.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: DOCUMENTS.exe, 00000000.00000002.292662207.0000000006CF2000.00000004.00000001.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: MSBuild.exe, 00000009.00000002.524239294.0000000003281000.00000004.00000001.sdmp	String found in binary or memory: http://xJKvnt.com
Source: MSBuild.exe, 00000009.00000002.524239294.0000000003281000.00000004.00000001.sdmp	String found in binary or memory: https://api.ipify.org%(
Source: MSBuild.exe, 00000009.00000002.524239294.0000000003281000.00000004.00000001.sdmp	String found in binary or memory: https://api.ipify.org%GETMozilla/5.0
Source: DOCUMENTS.exe, 00000000.00000002.294334493.000000000A8E8000.00000004.00000001.sdmp, MSBuild.exe, 00000009.00000002.520256174.0000000000402000.00000040.00000001.sdmp	String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip
Source: MSBuild.exe, 00000009.00000002.524239294.0000000003281000.00000004.00000001.sdmp	String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha

Source: DOCUMENTS.exe, Form1.cs	Long String: Length: 38272
Source: ncXzBAPDBtn.exe.0.dr, Form1.cs	Long String: Length: 38272
Source: 0.0.DOCUMENTS.exe.e30000.0.unpack, Form1.cs	Long String: Length: 38272
Source: 0.2.DOCUMENTS.exe.e30000.0.unpack, Form1.cs	Long String: Length: 38272

Source: C:\Users\user\Desktop\DOCUMENTS.exe	Code function: 0_2_019EBBD0	0_2_019EBBD0
Source: C:\Users\user\Desktop\DOCUMENTS.exe	Code function: 0_2_019E5FC9	0_2_019E5FC9
Source: C:\Users\user\Desktop\DOCUMENTS.exe	Code function: 0_2_019E49C0	0_2_019E49C0
Source: C:\Users\user\Desktop\DOCUMENTS.exe	Code function: 0_2_019E69C0	0_2_019E69C0
Source: C:\Users\user\Desktop\DOCUMENTS.exe	Code function: 0_2_019E5948	0_2_019E5948
Source: C:\Users\user\Desktop\DOCUMENTS.exe	Code function: 0_2_019EED60	0_2_019EED60
Source: C:\Users\user\Desktop\DOCUMENTS.exe	Code function: 0_2_019E7880	0_2_019E7880
Source: C:\Users\user\Desktop\DOCUMENTS.exe	Code function: 0_2_019E40B8	0_2_019E40B8
Source: C:\Users\user\Desktop\DOCUMENTS.exe	Code function: 0_2_019E64C1	0_2_019E64C1
Source: C:\Users\user\Desktop\DOCUMENTS.exe	Code function: 0_2_019EE8F8	0_2_019EE8F8
Source: C:\Users\user\Desktop\DOCUMENTS.exe	Code function: 0_2_019E4608	0_2_019E4608
Source: C:\Users\user\Desktop\DOCUMENTS.exe	Code function: 0_2_019EE43C	0_2_019EE43C
Source: C:\Users\user\Desktop\DOCUMENTS.exe	Code function: 0_2_019EFC31	0_2_019EFC31
Source: C:\Users\user\Desktop\DOCUMENTS.exe	Code function: 0_2_019EC078	0_2_019EC078
Source: C:\Users\user\Desktop\DOCUMENTS.exe	Code function: 0_2_019E8580	0_2_019E8580
Source: C:\Users\user\Desktop\DOCUMENTS.exe	Code function: 0_2_019EC380	0_2_019EC380
Source: C:\Users\user\Desktop\DOCUMENTS.exe	Code function: 0_2_019E49B0	0_2_019E49B0
Source: C:\Users\user\Desktop\DOCUMENTS.exe	Code function: 0_2_019EB3B1	0_2_019EB3B1
Source: C:\Users\user\Desktop\DOCUMENTS.exe	Code function: 0_2_019EE5D6	0_2_019EE5D6
Source: C:\Users\user\Desktop\DOCUMENTS.exe	Code function: 0_2_019E4DC0	0_2_019E4DC0
Source: C:\Users\user\Desktop\DOCUMENTS.exe	Code function: 0_2_019EBBC0	0_2_019EBBC0
Source: C:\Users\user\Desktop\DOCUMENTS.exe	Code function: 0_2_019EADFF	0_2_019EADFF
Source: C:\Users\user\Desktop\DOCUMENTS.exe	Code function: 0_2_019E45F9	0_2_019E45F9
Source: C:\Users\user\Desktop\DOCUMENTS.exe	Code function: 0_2_019EB3F0	0_2_019EB3F0
Source: C:\Users\user\Desktop\DOCUMENTS.exe	Code function: 0_2_019E4318	0_2_019E4318
Source: C:\Users\user\Desktop\DOCUMENTS.exe	Code function: 0_2_019E9710	0_2_019E9710
Source: C:\Users\user\Desktop\DOCUMENTS.exe	Code function: 0_2_019E4309	0_2_019E4309
Source: C:\Users\user\Desktop\DOCUMENTS.exe	Code function: 0_2_019E9701	0_2_019E9701
Source: C:\Users\user\Desktop\DOCUMENTS.exe	Code function: 0_2_019E8F50	0_2_019E8F50
Source: C:\Users\user\Desktop\DOCUMENTS.exe	Code function: 0_2_019E9950	0_2_019E9950
Source: C:\Users\user\Desktop\DOCUMENTS.exe	Code function: 0_2_019EED51	0_2_019EED51
Source: C:\Users\user\Desktop\DOCUMENTS.exe	Code function: 0_2_019E8F40	0_2_019E8F40
Source: C:\Users\user\Desktop\DOCUMENTS.exe	Code function: 0_2_019E8570	0_2_019E8570
Source: C:\Users\user\Desktop\DOCUMENTS.exe	Code function: 0_2_019EC36F	0_2_019EC36F
Source: C:\Users\user\Desktop\DOCUMENTS.exe	Code function: 0_2_019E9960	0_2_019E9960
Source: C:\Users\user\Desktop\DOCUMENTS.exe	Code function: 0_2_019E5890	0_2_019E5890
Source: C:\Users\user\Desktop\DOCUMENTS.exe	Code function: 0_2_019ECAB2	0_2_019ECAB2
Source: C:\Users\user\Desktop\DOCUMENTS.exe	Code function: 0_2_019ECAC0	0_2_019ECAC0
Source: C:\Users\user\Desktop\DOCUMENTS.exe	Code function: 0_2_019E94F8	0_2_019E94F8
Source: C:\Users\user\Desktop\DOCUMENTS.exe	Code function: 0_2_019E94E8	0_2_019E94E8
Source: C:\Users\user\Desktop\DOCUMENTS.exe	Code function: 0_2_019EE8E8	0_2_019EE8E8
Source: C:\Users\user\Desktop\DOCUMENTS.exe	Code function: 0_2_019E9AE9	0_2_019E9AE9
Source: C:\Users\user\Desktop\DOCUMENTS.exe	Code function: 0_2_019E7832	0_2_019E7832
Source: C:\Users\user\Desktop\DOCUMENTS.exe	Code function: 0_2_019ED02E	0_2_019ED02E
Source: C:\Users\user\Desktop\DOCUMENTS.exe	Code function: 0_2_019ED048	0_2_019ED048
Source: C:\Users\user\Desktop\DOCUMENTS.exe	Code function: 0_2_019EAE68	0_2_019EAE68
Source: C:\Users\user\Desktop\DOCUMENTS.exe	Code function: 0_2_019EC069	0_2_019EC069
Source: C:\Users\user\Desktop\DOCUMENTS.exe	Code function: 0_2_0B9F0006	0_2_0B9F0006
Source: C:\Users\user\Desktop\DOCUMENTS.exe	Code function: 0_2_0B9F0070	0_2_0B9F0070
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Code function: 9_2_011FC301	9_2_011FC301
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Code function: 9_2_011F1F58	9_2_011F1F58
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Code function: 9_2_011F0070	9_2_011F0070
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Code function: 9_2_011F4088	9_2_011F4088
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Code function: 9_2_011F5C80	9_2_011F5C80
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Code function: 9_2_011F0024	9_2_011F0024
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Code function: 9_2_02EDF6FF	9_2_02EDF6FF
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Code function: 9_2_02EDAE68	9_2_02EDAE68
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Code function: 9_2_02EDD620	9_2_02EDD620
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Code function: 9_2_02EDDFB1	9_2_02EDDFB1
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Code function: 9_2_02EDAE08	9_2_02EDAE08
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Code function: 9_2_05AB0EE8	9_2_05AB0EE8
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Code function: 9_2_05AB76F8	9_2_05AB76F8
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Code function: 9_2_05AB0070	9_2_05AB0070
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Code function: 9_2_05AB1D90	9_2_05AB1D90
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Code function: 9_2_05AB6FF0	9_2_05AB6FF0

Source: C:\Users\user\Desktop\DOCUMENTS.exe	Code function: 0_2_058A0D72 NtQuerySystemInformation,	0_2_058A0D72
Source: C:\Users\user\Desktop\DOCUMENTS.exe	Code function: 0_2_058A0D41 NtQuerySystemInformation,	0_2_058A0D41
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Code function: 9_2_0122B0BA NtQuerySystemInformation,	9_2_0122B0BA
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Code function: 9_2_0122B089 NtQuerySystemInformation,	9_2_0122B089

Source: DOCUMENTS.exe	Binary or memory string: OriginalFilename vs DOCUMENTS.exe
Source: DOCUMENTS.exe, 00000000.00000002.292198643.00000000058C0000.00000004.00020000.sdmp	Binary or memory string: OriginalFilenameEnvoySinks.dll6 vs DOCUMENTS.exe
Source: DOCUMENTS.exe, 00000000.00000002.291041786.00000000046C1000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameCF_Secretaria.dll< vs DOCUMENTS.exe
Source: DOCUMENTS.exe, 00000000.00000000.250385953.0000000000E32000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameUnmanagedMemoryStre.exeh$ vs DOCUMENTS.exe
Source: DOCUMENTS.exe, 00000000.00000002.293912263.000000000A721000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameqJSTtDTISaCwBJDgVlmtSrlkDMdjFqgoqmoUWx.exe4 vs DOCUMENTS.exe
Source: DOCUMENTS.exe	Binary or memory string: OriginalFilenameUnmanagedMemoryStre.exeh$ vs DOCUMENTS.exe

Source: DOCUMENTS.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: DOCUMENTS.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: DOCUMENTS.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: ncXzBAPDBtn.exe.0.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: ncXzBAPDBtn.exe.0.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: ncXzBAPDBtn.exe.0.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: DOCUMENTS.exe	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: ncXzBAPDBtn.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: unknown	Process created: C:\Users\user\Desktop\DOCUMENTS.exe 'C:\Users\user\Desktop\DOCUMENTS.exe'
Source: C:\Users\user\Desktop\DOCUMENTS.exe	Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\ncXzBAPDBtn' /XML 'C:\Users\user\AppData\Local\Temp\tmp9BE9.tmp'
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\DOCUMENTS.exe	Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
Source: C:\Users\user\Desktop\DOCUMENTS.exe	Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\ncXzBAPDBtn' /XML 'C:\Users\user\AppData\Local\Temp\tmp9BE9.tmp'	Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe	Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Jump to behavior

Source: C:\Users\user\Desktop\DOCUMENTS.exe	Code function: 0_2_058A0BF6 AdjustTokenPrivileges,	0_2_058A0BF6
Source: C:\Users\user\Desktop\DOCUMENTS.exe	Code function: 0_2_058A0BBF AdjustTokenPrivileges,	0_2_058A0BBF
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Code function: 9_2_0122AF3E AdjustTokenPrivileges,	9_2_0122AF3E
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Code function: 9_2_0122AF07 AdjustTokenPrivileges,	9_2_0122AF07

Source: C:\Users\user\Desktop\DOCUMENTS.exe	Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9603718106bd57ecfbb18fefd769cab4\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp	Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9603718106bd57ecfbb18fefd769cab4\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp	Jump to behavior

Source: C:\Users\user\Desktop\DOCUMENTS.exe	Mutant created: \Sessions\1\BaseNamedObjects\RAjRPPJiBWcsEVV
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2028:120:WilError_01
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\.net clr networking

Source: DOCUMENTS.exe, Form1.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: ncXzBAPDBtn.exe.0.dr, Form1.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 0.0.DOCUMENTS.exe.e30000.0.unpack, Form1.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 0.2.DOCUMENTS.exe.e30000.0.unpack, Form1.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'

Source: DOCUMENTS.exe, Form1.cs	.Net Code: _X_X0FT_FT2 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: ncXzBAPDBtn.exe.0.dr, Form1.cs	.Net Code: _X_X0FT_FT2 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 0.0.DOCUMENTS.exe.e30000.0.unpack, Form1.cs	.Net Code: _X_X0FT_FT2 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 0.2.DOCUMENTS.exe.e30000.0.unpack, Form1.cs	.Net Code: _X_X0FT_FT2 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])

Source: C:\Users\user\Desktop\DOCUMENTS.exe	Code function: 0_2_00E3297F push 20000001h; retf	0_2_00E32992
Source: C:\Users\user\Desktop\DOCUMENTS.exe	Code function: 0_2_016E30E9 pushfd ; ret	0_2_016E30F2
Source: C:\Users\user\Desktop\DOCUMENTS.exe	Code function: 0_2_016E2EE5 push es; ret	0_2_016E2EE6
Source: C:\Users\user\Desktop\DOCUMENTS.exe	Code function: 0_2_016E2D42 push cs; ret	0_2_016E2D56
Source: C:\Users\user\Desktop\DOCUMENTS.exe	Code function: 0_2_019ECD6C push ebx; iretd	0_2_019ECD70
Source: C:\Users\user\Desktop\DOCUMENTS.exe	Code function: 0_2_019EA2D3 push ecx; retf	0_2_019EA2D6
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Code function: 9_2_01222948 push cs; ret	9_2_01222982

Source: initial sample	Static PE information: section name: .text entropy: 7.54267894462
Source: initial sample	Static PE information: section name: .text entropy: 7.54267894462

Source: C:\Users\user\Desktop\DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: Yara match	File source: 00000000.00000002.290373669.000000000370C000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: DOCUMENTS.exe PID: 1864, type: MEMORYSTR

Source: DOCUMENTS.exe, 00000000.00000002.290373669.000000000370C000.00000004.00000001.sdmp	Binary or memory string: WINE_GET_UNIX_FILE_NAME
Source: DOCUMENTS.exe, 00000000.00000002.290373669.000000000370C000.00000004.00000001.sdmp	Binary or memory string: SBIEDLL.DLL

Windows Analysis Report DOCUMENTS.exe

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection:

Compliance:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Spam, unwanted Advertisements and Ransom Demands:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Boot Survival:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Lowering of HIPS / PFW / Operating System Security Settings:

Stealing of Sensitive Information:

Remote Access Functionality:

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted URLs

Source: C:\Users\user\Desktop\DOCUMENTS.exe TID: 776	Thread sleep time: -37100s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe TID: 2600	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe TID: 6184	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe TID: 6184	Thread sleep count: 107 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe TID: 6184	Thread sleep time: -3210000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe TID: 6204	Thread sleep count: 37 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe TID: 6184	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe TID: 6184	Thread sleep time: -57064s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe TID: 6184	Thread sleep time: -55468s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Last function: Thread delayed
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\DOCUMENTS.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Users\user\Desktop\DOCUMENTS.exe	Thread delayed: delay time: 37100	Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Thread delayed: delay time: 30000	Jump to behavior

Source: DOCUMENTS.exe, 00000000.00000002.290373669.000000000370C000.00000004.00000001.sdmp	Binary or memory string: vmware
Source: DOCUMENTS.exe, 00000000.00000002.290373669.000000000370C000.00000004.00000001.sdmp	Binary or memory string: C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: DOCUMENTS.exe, 00000000.00000002.290373669.000000000370C000.00000004.00000001.sdmp	Binary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
Source: DOCUMENTS.exe, 00000000.00000002.290373669.000000000370C000.00000004.00000001.sdmp	Binary or memory string: VMWARE
Source: DOCUMENTS.exe, 00000000.00000002.290373669.000000000370C000.00000004.00000001.sdmp	Binary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: DOCUMENTS.exe, 00000000.00000002.290373669.000000000370C000.00000004.00000001.sdmp	Binary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
Source: DOCUMENTS.exe, 00000000.00000002.290373669.000000000370C000.00000004.00000001.sdmp	Binary or memory string: VMware SVGA II
Source: DOCUMENTS.exe, 00000000.00000002.290373669.000000000370C000.00000004.00000001.sdmp	Binary or memory string: vmwareNSYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000
Source: MSBuild.exe, 00000009.00000003.482957609.000000000113F000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: MSBuild.exe, 00000009.00000003.482957609.000000000113F000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAWtZ

Source: C:\Users\user\Desktop\DOCUMENTS.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\DOCUMENTS.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe base: 402000	Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe base: 438000	Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe base: 43A000	Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe base: DD7008	Jump to behavior

Source: MSBuild.exe, 00000009.00000002.523780074.00000000018B0000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd
Source: MSBuild.exe, 00000009.00000002.523780074.00000000018B0000.00000002.00020000.sdmp	Binary or memory string: Progman
Source: MSBuild.exe, 00000009.00000002.523780074.00000000018B0000.00000002.00020000.sdmp	Binary or memory string: SProgram Managerl
Source: MSBuild.exe, 00000009.00000002.523780074.00000000018B0000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd,
Source: MSBuild.exe, 00000009.00000002.523780074.00000000018B0000.00000002.00020000.sdmp	Binary or memory string: Progmanlock

Source: Yara match	File source: 0.2.DOCUMENTS.exe.a7c30b8.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DOCUMENTS.exe.a7c30b8.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.294334493.000000000A8E8000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.293912263.000000000A721000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.520256174.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.525207312.00000000034F9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.524239294.0000000003281000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: DOCUMENTS.exe PID: 1864, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 1488, type: MEMORYSTR

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites\Quick Connect\			Jump to behavior