Windows Analysis Report SecuriteInfo.com.MachineLearning.Anomalous.94.14541.14773

Overview

General Information

Sample Name: SecuriteInfo.com.MachineLearning.Anomalous.94.14541.14773 (renamed file extension from 14773 to exe)
Analysis ID: 528564
MD5: 4ce54eda7650ff0f8062189f089b162e
SHA1: 0eaa03d538e574a17ac685b3356816f696e47f4b
SHA256: 9246176ddd535c1d48514759ef33e8a129dc6881f685580484a8291940ea5e85
Tags: exe
Infos:

Most interesting Screenshot:

Detection

AgentTesla
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Found malware configuration
Multi AV Scanner detection for submitted file
Yara detected AgentTesla
Yara detected AntiVM3
Tries to steal Mail credentials (via file / registry access)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
.NET source code contains potential unpacker
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Sigma detected: Powershell Defender Exclusion
.NET source code contains very large array initializations
Adds a directory exclusion to Windows Defender
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to harvest and steal browser information (history, passwords, etc)
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Uses 32bit PE files
Queries the volume information (name, serial number etc) of a device
Antivirus or Machine Learning detection for unpacked file
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
Detected potential crypto function
Yara detected Credential Stealer
Contains long sleeps (>= 3 min)
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Sample file is different than original file name gathered from version info
Contains capabilities to detect virtual machines
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Creates a process in suspended mode (likely to inject code)
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

AV Detection:

barindex
Found malware configuration
Source: 3.0.SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe.400000.10.unpack Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Username": "m@huiijingco.com", "Password": "lNLUrZT2", "Host": "smtp.huiijingco.com"}
Multi AV Scanner detection for submitted file
Source: SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Virustotal: Detection: 15% Perma Link
Source: SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe ReversingLabs: Detection: 15%
Antivirus or Machine Learning detection for unpacked file
Source: 3.0.SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe.400000.10.unpack Avira: Label: TR/Spy.Gen8
Source: 3.0.SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe.400000.8.unpack Avira: Label: TR/Spy.Gen8
Source: 3.2.SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe.400000.0.unpack Avira: Label: TR/Spy.Gen8
Source: 3.0.SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe.400000.6.unpack Avira: Label: TR/Spy.Gen8
Source: 3.0.SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe.400000.12.unpack Avira: Label: TR/Spy.Gen8
Source: 3.0.SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe.400000.4.unpack Avira: Label: TR/Spy.Gen8

Compliance:

barindex
Uses 32bit PE files
Source: SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
Source: SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Source: SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe, 00000003.00000002.561540935.00000000029F1000.00000004.00000001.sdmp String found in binary or memory: http://127.0.0.1:HTTP/1.1
Source: SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe, 00000003.00000002.561540935.00000000029F1000.00000004.00000001.sdmp String found in binary or memory: http://DynDns.comDynDNS
Source: SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe, 00000003.00000002.561540935.00000000029F1000.00000004.00000001.sdmp String found in binary or memory: http://XYJLds.com
Source: SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe, 00000000.00000002.306897551.00000000026CB000.00000004.00000001.sdmp, SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe, 00000000.00000002.306734942.0000000002601000.00000004.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe, 00000003.00000002.561606326.0000000002A9E000.00000004.00000001.sdmp String found in binary or memory: https://api.ipify.org%
Source: SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe, 00000003.00000002.561540935.00000000029F1000.00000004.00000001.sdmp String found in binary or memory: https://api.ipify.org%GETMozilla/5.0
Source: SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe, 00000000.00000002.307311514.000000000360D000.00000004.00000001.sdmp, SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe, 00000003.00000000.302889154.0000000000402000.00000040.00000001.sdmp String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip
Source: SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe, 00000003.00000002.561540935.00000000029F1000.00000004.00000001.sdmp String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha

System Summary:

barindex
.NET source code contains very large array initializations
Source: 3.0.SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe.400000.10.unpack, u003cPrivateImplementationDetailsu003eu007b4ABBB2DBu002dDC5Fu002d4430u002d976Au002dBB4790921822u007d/DA284AAAu002dF83Fu002d465Au002dA43Bu002d53A7D878247B.cs Large array initialization: .cctor: array initializer size 11772
Source: 3.0.SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe.400000.8.unpack, u003cPrivateImplementationDetailsu003eu007b4ABBB2DBu002dDC5Fu002d4430u002d976Au002dBB4790921822u007d/DA284AAAu002dF83Fu002d465Au002dA43Bu002d53A7D878247B.cs Large array initialization: .cctor: array initializer size 11772
Source: 3.2.SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe.400000.0.unpack, u003cPrivateImplementationDetailsu003eu007b4ABBB2DBu002dDC5Fu002d4430u002d976Au002dBB4790921822u007d/DA284AAAu002dF83Fu002d465Au002dA43Bu002d53A7D878247B.cs Large array initialization: .cctor: array initializer size 11772
Source: 3.0.SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe.400000.6.unpack, u003cPrivateImplementationDetailsu003eu007b4ABBB2DBu002dDC5Fu002d4430u002d976Au002dBB4790921822u007d/DA284AAAu002dF83Fu002d465Au002dA43Bu002d53A7D878247B.cs Large array initialization: .cctor: array initializer size 11772
Uses 32bit PE files
Source: SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
Detected potential crypto function
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Code function: 0_2_00928250 0_2_00928250
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Code function: 0_2_0092D2E8 0_2_0092D2E8
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Code function: 0_2_04C28918 0_2_04C28918
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Code function: 0_2_04C284F4 0_2_04C284F4
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Code function: 3_2_00D1AB88 3_2_00D1AB88
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Code function: 3_2_00D12400 3_2_00D12400
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Code function: 3_2_00D14D00 3_2_00D14D00
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Code function: 3_2_00D117F0 3_2_00D117F0
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Code function: 3_2_00D1DE48 3_2_00D1DE48
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Code function: 3_2_00D1BFD8 3_2_00D1BFD8
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Code function: 3_2_00FC46A0 3_2_00FC46A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Code function: 3_2_00FC45B0 3_2_00FC45B0
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Code function: 3_2_05B67540 3_2_05B67540
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Code function: 3_2_05B694F8 3_2_05B694F8
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Code function: 3_2_05B66928 3_2_05B66928
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Code function: 3_2_05B66C70 3_2_05B66C70
Sample file is different than original file name gathered from version info
Source: SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Binary or memory string: OriginalFilename vs SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe
Source: SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe, 00000000.00000002.310317327.0000000005890000.00000004.00020000.sdmp Binary or memory string: OriginalFilenameUI.dll@ vs SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe
Source: SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe, 00000000.00000002.307311514.000000000360D000.00000004.00000001.sdmp Binary or memory string: OriginalFilenameHWxEDVqDRWLfvlztRLwemdtqgYZsGrtZFgpKLP.exe4 vs SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe
Source: SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe, 00000000.00000002.307311514.000000000360D000.00000004.00000001.sdmp Binary or memory string: OriginalFilenameUI.dll@ vs SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe
Source: SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe, 00000000.00000002.309864020.00000000052D0000.00000004.00020000.sdmp Binary or memory string: OriginalFilenameInnerException.dll" vs SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe
Source: SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe, 00000000.00000002.306897551.00000000026CB000.00000004.00000001.sdmp Binary or memory string: OriginalFilenameInnerException.dll" vs SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe
Source: SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe, 00000000.00000002.306734942.0000000002601000.00000004.00000001.sdmp Binary or memory string: OriginalFilenameInnerException.dll" vs SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe
Source: SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe, 00000000.00000002.306734942.0000000002601000.00000004.00000001.sdmp Binary or memory string: OriginalFilenameHWxEDVqDRWLfvlztRLwemdtqgYZsGrtZFgpKLP.exe4 vs SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe
Source: SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Binary or memory string: OriginalFilename vs SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe
Source: SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe, 00000003.00000002.558898538.00000000007A8000.00000004.00000001.sdmp Binary or memory string: OriginalFilenameUNKNOWN_FILET vs SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe
Source: SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe, 00000003.00000002.558712793.0000000000438000.00000040.00000001.sdmp Binary or memory string: OriginalFilenameHWxEDVqDRWLfvlztRLwemdtqgYZsGrtZFgpKLP.exe4 vs SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe
Source: SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Binary or memory string: OriginalFilenameKeyValuePairTypeIn.exe. vs SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe
Source: SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Virustotal: Detection: 15%
Source: SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe ReversingLabs: Detection: 15%
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe File read: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe:Zone.Identifier Jump to behavior
Source: SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe "C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Process created: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Process created: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\InProcServer32 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File created: C:\Users\user\Documents\20211125 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_f0qsiy5n.jol.ps1 Jump to behavior
Source: classification engine Classification label: mal100.troj.spyw.evad.winEXE@6/4@0/0
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe File read: C:\Users\user\Desktop\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6120:120:WilError_01
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Mutant created: \Sessions\1\BaseNamedObjects\Global\.net data provider for sqlserver
Source: SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe String found in binary or memory: /KeyValuePairTypeIn;component/views/addbook.xaml
Source: SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe String found in binary or memory: views/addbook.baml
Source: SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe String found in binary or memory: views/addcustomer.baml
Source: SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe String found in binary or memory: /KeyValuePairTypeIn;component/views/addcustomer.xaml
Source: SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe String found in binary or memory: /KeyValuePairTypeIn;component/views/addbook.xaml
Source: SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe String found in binary or memory: views/addcustomer.baml
Source: SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe String found in binary or memory: views/addbook.baml
Source: SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe String found in binary or memory: /KeyValuePairTypeIn;component/views/addcustomer.xaml
Source: SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe String found in binary or memory: a/KeyValuePairTypeIn;component/views/addbook.xamlw/KeyValuePairTypeIn;component/views/borrowfrombookview.xamlm/KeyValuePairTypeIn;component/views/borrowingview.xamlg/KeyValuePairTypeIn;component/views/changebook.xamlo/KeyValuePairTypeIn;component/views/changecustomer.xamlk/KeyValuePairTypeIn;component/views/customerview.xamlo/KeyValuePairTypeIn;component/views/deletecustomer.xamle/KeyValuePairTypeIn;component/views/errorview.xamli/KeyValuePairTypeIn;component/views/smallextras.xamli/KeyValuePairTypeIn;component/views/addcustomer.xaml
Source: SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe String found in binary or memory: *images/booksimage.jpg$views/addbook.baml1J,views/addcustomer.baml
Source: 3.0.SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe.400000.10.unpack, A/b2.cs Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 3.0.SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe.400000.10.unpack, A/b2.cs Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 3.0.SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe.400000.8.unpack, A/b2.cs Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 3.0.SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe.400000.8.unpack, A/b2.cs Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 3.2.SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe.400000.0.unpack, A/b2.cs Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 3.2.SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe.400000.0.unpack, A/b2.cs Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Jump to behavior
Source: SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Data Obfuscation:

barindex
.NET source code contains potential unpacker
Source: SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe, Biblan/Views/MainWindow.cs .Net Code: ObjectIdentifier System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 0.0.SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe.a0000.0.unpack, Biblan/Views/MainWindow.cs .Net Code: ObjectIdentifier System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 0.2.SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe.a0000.0.unpack, Biblan/Views/MainWindow.cs .Net Code: ObjectIdentifier System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 3.0.SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe.5a0000.0.unpack, Biblan/Views/MainWindow.cs .Net Code: ObjectIdentifier System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 3.0.SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe.5a0000.5.unpack, Biblan/Views/MainWindow.cs .Net Code: ObjectIdentifier System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 3.0.SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe.5a0000.9.unpack, Biblan/Views/MainWindow.cs .Net Code: ObjectIdentifier System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 3.0.SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe.5a0000.3.unpack, Biblan/Views/MainWindow.cs .Net Code: ObjectIdentifier System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 3.0.SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe.5a0000.11.unpack, Biblan/Views/MainWindow.cs .Net Code: ObjectIdentifier System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 3.2.SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe.5a0000.1.unpack, Biblan/Views/MainWindow.cs .Net Code: ObjectIdentifier System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Code function: 0_2_000A9347 push ds; ret 0_2_000A934C
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Code function: 0_2_000A9361 push ds; retf 0_2_000A9364
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Code function: 0_2_000A92F5 push ds; ret 0_2_000A9340
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Code function: 3_2_005A9347 push ds; ret 3_2_005A934C
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Code function: 3_2_005A92F5 push ds; ret 3_2_005A9340
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Code function: 3_2_005A9361 push ds; retf 3_2_005A9364
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Code function: 3_2_00D1EB90 push eax; retf 3_2_00D1EB91
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Code function: 3_2_05B60402 push E801035Eh; ret 3_2_05B60409
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Code function: 3_2_05B603F7 push E802005Eh; retf 3_2_05B60401
Source: initial sample Static PE information: section name: .text entropy: 7.8787752496
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion:

barindex
Yara detected AntiVM3
Source: Yara match File source: 0.2.SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe.2669094.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe.26fc110.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000002.306897551.00000000026CB000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.306734942.0000000002601000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe PID: 6176, type: MEMORYSTR
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Source: SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe, 00000000.00000002.306897551.00000000026CB000.00000004.00000001.sdmp Binary or memory string: WINE_GET_UNIX_FILE_NAME
Source: SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe, 00000000.00000002.306897551.00000000026CB000.00000004.00000001.sdmp, SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe, 00000000.00000002.306734942.0000000002601000.00000004.00000001.sdmp Binary or memory string: SBIEDLL.DLL
Source: SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe, 00000000.00000002.306897551.00000000026CB000.00000004.00000001.sdmp, SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe, 00000000.00000002.306734942.0000000002601000.00000004.00000001.sdmp Binary or memory string: KERNEL32.DLL.WINE_GET_UNIX_FILE_NAME
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe WMI Queries: IWbemServices::ExecQuery - ROOT\cimv2 : SELECT * FROM Win32_VideoController
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe TID: 6288 Thread sleep time: -6456360425798339s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe TID: 6288 Thread sleep time: -240000s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe TID: 6260 Thread sleep count: 1553 > 30 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe TID: 6288 Thread sleep time: -239843s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe TID: 6276 Thread sleep time: -38337s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe TID: 6288 Thread sleep time: -239733s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe TID: 6260 Thread sleep count: 2179 > 30 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe TID: 6288 Thread sleep time: -239621s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe TID: 6288 Thread sleep time: -239499s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe TID: 6288 Thread sleep time: -239390s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe TID: 6288 Thread sleep time: -239281s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe TID: 6288 Thread sleep time: -239171s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe TID: 6288 Thread sleep time: -239000s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe TID: 6288 Thread sleep time: -238875s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe TID: 6288 Thread sleep time: -238765s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe TID: 6288 Thread sleep time: -238623s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe TID: 6288 Thread sleep time: -238515s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe TID: 6288 Thread sleep time: -238406s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe TID: 6288 Thread sleep time: -238296s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe TID: 6288 Thread sleep time: -238185s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe TID: 6288 Thread sleep time: -238077s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe TID: 6288 Thread sleep time: -237953s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe TID: 6288 Thread sleep time: -237843s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe TID: 6288 Thread sleep time: -237733s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe TID: 6288 Thread sleep time: -237623s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe TID: 6288 Thread sleep time: -237514s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe TID: 6288 Thread sleep time: -237385s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe TID: 6288 Thread sleep time: -237249s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe TID: 6288 Thread sleep time: -237109s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe TID: 6288 Thread sleep time: -236946s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe TID: 6288 Thread sleep time: -236821s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe TID: 6288 Thread sleep time: -236406s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe TID: 6288 Thread sleep time: -235406s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe TID: 6288 Thread sleep time: -234406s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe TID: 6288 Thread sleep time: -234264s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4024 Thread sleep time: -8301034833169293s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe TID: 6236 Thread sleep time: -16602069666338586s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe TID: 6240 Thread sleep count: 1350 > 30 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe TID: 6240 Thread sleep count: 8475 > 30 Jump to behavior
Contains long sleeps (>= 3 min)
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Thread delayed: delay time: 240000 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Thread delayed: delay time: 239843 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Thread delayed: delay time: 239733 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Thread delayed: delay time: 239621 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Thread delayed: delay time: 239499 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Thread delayed: delay time: 239390 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Thread delayed: delay time: 239281 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Thread delayed: delay time: 239171 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Thread delayed: delay time: 239000 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Thread delayed: delay time: 238875 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Thread delayed: delay time: 238765 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Thread delayed: delay time: 238623 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Thread delayed: delay time: 238515 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Thread delayed: delay time: 238406 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Thread delayed: delay time: 238296 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Thread delayed: delay time: 238185 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Thread delayed: delay time: 238077 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Thread delayed: delay time: 237953 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Thread delayed: delay time: 237843 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Thread delayed: delay time: 237733 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Thread delayed: delay time: 237623 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Thread delayed: delay time: 237514 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Thread delayed: delay time: 237385 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Thread delayed: delay time: 237249 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Thread delayed: delay time: 237109 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Thread delayed: delay time: 236946 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Thread delayed: delay time: 236821 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Thread delayed: delay time: 236406 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Thread delayed: delay time: 235406 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Thread delayed: delay time: 234406 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Thread delayed: delay time: 234264 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Window / User API: threadDelayed 1553 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Window / User API: threadDelayed 2179 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 5548 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 2922 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Window / User API: threadDelayed 1350 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Window / User API: threadDelayed 8475 Jump to behavior
Contains capabilities to detect virtual machines
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DEVICEMAP\Scsi\Scsi Port 0\Scsi Bus 0\Target Id 0\Logical Unit Id 0 name: Identifier Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum name: 0 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion Jump to behavior
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information queried: ProcessInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Thread delayed: delay time: 240000 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Thread delayed: delay time: 239843 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Thread delayed: delay time: 38337 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Thread delayed: delay time: 239733 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Thread delayed: delay time: 239621 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Thread delayed: delay time: 239499 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Thread delayed: delay time: 239390 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Thread delayed: delay time: 239281 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Thread delayed: delay time: 239171 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Thread delayed: delay time: 239000 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Thread delayed: delay time: 238875 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Thread delayed: delay time: 238765 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Thread delayed: delay time: 238623 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Thread delayed: delay time: 238515 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Thread delayed: delay time: 238406 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Thread delayed: delay time: 238296 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Thread delayed: delay time: 238185 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Thread delayed: delay time: 238077 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Thread delayed: delay time: 237953 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Thread delayed: delay time: 237843 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Thread delayed: delay time: 237733 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Thread delayed: delay time: 237623 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Thread delayed: delay time: 237514 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Thread delayed: delay time: 237385 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Thread delayed: delay time: 237249 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Thread delayed: delay time: 237109 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Thread delayed: delay time: 236946 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Thread delayed: delay time: 236821 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Thread delayed: delay time: 236406 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Thread delayed: delay time: 235406 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Thread delayed: delay time: 234406 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Thread delayed: delay time: 234264 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe, 00000000.00000002.306734942.0000000002601000.00000004.00000001.sdmp Binary or memory string: VMware SVGA IIBAdd-MpPreference -ExclusionPath "
Source: SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe, 00000000.00000002.310715504.0000000006AD0000.00000004.00000001.sdmp Binary or memory string: VMware
Source: SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe, 00000000.00000002.306734942.0000000002601000.00000004.00000001.sdmp Binary or memory string: InstallPathJC:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe, 00000000.00000002.306897551.00000000026CB000.00000004.00000001.sdmp Binary or memory string: pl"SOFTWARE\VMware, Inc.\VMware T<
Source: SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe, 00000000.00000002.306734942.0000000002601000.00000004.00000001.sdmp Binary or memory string: vmware
Source: SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe, 00000000.00000002.306897551.00000000026CB000.00000004.00000001.sdmp Binary or memory string: pl"SOFTWARE\VMware, Inc.\VMware T
Source: SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe, 00000000.00000002.306897551.00000000026CB000.00000004.00000001.sdmp Binary or memory string: VMWARE
Source: SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe, 00000000.00000002.306897551.00000000026CB000.00000004.00000001.sdmp Binary or memory string: pl"SOFTWARE\VMware, Inc.\VMware Tools
Source: SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe, 00000000.00000002.310715504.0000000006AD0000.00000004.00000001.sdmp Binary or memory string: Win32_VideoController(Standard display types)VMwareUCTT_MD9Win32_VideoController4GALLHDCVideoController120060621000000.000000-00066824200display.infMSBDA1R4STXWMPCI\VEN_15AD&DEV_0405&SUBSYS_040515AD&REV_00\3&61AAA01&0&78OKWin32_ComputerSystemcomputer1280 x 1024 x 4294967296 colorsS2_48PSX]
Source: SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe, 00000000.00000002.306897551.00000000026CB000.00000004.00000001.sdmp Binary or memory string: pl%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe, 00000000.00000002.306897551.00000000026CB000.00000004.00000001.sdmp Binary or memory string: VMware SVGA II
Source: SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe, 00000000.00000002.306734942.0000000002601000.00000004.00000001.sdmp Binary or memory string: VMWAREDSOFTWARE\VMware, Inc.\VMware Tools

Anti Debugging:

barindex
Enables debug privileges
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Process token adjusted: Debug Jump to behavior
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Code function: 3_2_00D1ECC0 LdrInitializeThunk, 3_2_00D1ECC0
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

barindex
Adds a directory exclusion to Windows Defender
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Process created: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Jump to behavior
Source: SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe, 00000003.00000002.561005106.0000000001380000.00000002.00020000.sdmp Binary or memory string: Program Manager
Source: SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe, 00000003.00000002.561005106.0000000001380000.00000002.00020000.sdmp Binary or memory string: Shell_TrayWnd
Source: SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe, 00000003.00000002.561005106.0000000001380000.00000002.00020000.sdmp Binary or memory string: Progman
Source: SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe, 00000003.00000002.561005106.0000000001380000.00000002.00020000.sdmp Binary or memory string: Progmanlock

Language, Device and Operating System Detection:

barindex
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Data.Linq\v4.0_4.0.0.0__b77a5c561934e089\System.Data.Linq.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-ds-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-base-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-base-Package~31bf3856ad364e35~amd64~en-US~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration.Install\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Code function: 3_2_05B65D44 GetUserNameW, 3_2_05B65D44

Stealing of Sensitive Information:

barindex
Yara detected AgentTesla
Source: Yara match File source: 0.2.SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe.3730f20.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.0.SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.0.SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.0.SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.0.SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe.36fb900.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe.36fb900.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.0.SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe.3730f20.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000003.00000000.302889154.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000000.302163969.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000000.303645199.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.558585999.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000000.304322848.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.307311514.000000000360D000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.561614573.0000000002AA6000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.561540935.00000000029F1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe PID: 6176, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe PID: 4396, type: MEMORYSTR
Tries to steal Mail credentials (via file / registry access)
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities Jump to behavior
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data Jump to behavior
Yara detected Credential Stealer
Source: Yara match File source: 00000003.00000002.561540935.00000000029F1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe PID: 4396, type: MEMORYSTR

Remote Access Functionality:

barindex
Yara detected AgentTesla
Source: Yara match File source: 0.2.SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe.3730f20.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.0.SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.0.SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.0.SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.0.SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe.36fb900.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe.36fb900.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.0.SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe.3730f20.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000003.00000000.302889154.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000000.302163969.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000000.303645199.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.558585999.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000000.304322848.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.307311514.000000000360D000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.561614573.0000000002AA6000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.561540935.00000000029F1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe PID: 6176, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe PID: 4396, type: MEMORYSTR