Windows Analysis Report g3r7OOQiri.exe

ID:	528755
Product:	CloudBasic
Start time:	18:41:55
Start date:	25.11.2021
Sample:	g3r7OOQiri.exe
Cookbook:	default.jbs
System description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Architecture:	WINDOWS
MD5:	523928f18d5110ae858049b3e8e7ffe1
SHA1:	741c67937cc564d2d0bb989ab09997ffd6be1296
SHA256:	aef6752333e99c747f01eb9345f03ccbc6a162054dfb705afd7c3040e8219e45
Filetype:	Win32 Executable (generic) a (10002005/4) 99.96%

Name	Type	MD5	SHA1	SHA256
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_g3r7OOQiri.exe_6fba63fe01877644fdd43b959d3cffddf565b3_997a46bd_19e22886\Report.wer	Little-endian UTF-16 Unicode text, with CRLF line terminators	B784AACD43F79C49A57EC46983BE0019	EAD3F19D6ACD6B372CF087C40E82CB37BCFFF689	C943ADD758E4C4746CB2058CE29CAF15C643D2E50601C383DEE34F07E518C54A
C:\ProgramData\Microsoft\Windows\WER\Temp\WER1108.tmp.WERInternalMetadata.xml	XML 1.0 document, Little-endian UTF-16 Unicode text, with CRLF line terminators	14EC749862F0329718E02BF66F378BB1	6176C03E85D0E000CCF2BB1F6BE1B2D09A7E9E45	A1FA8E54918F5006D7B6A912B285E9C953DE8DE9F5E8BBEF587F0479623366BE
C:\ProgramData\Microsoft\Windows\WER\Temp\WER1435.tmp.xml	XML 1.0 document, ASCII text, with CRLF line terminators	3DB1275D4EB50E5389ED057C99B628E9	9F8F3C50BB81571FBCB135A43566D1CF6F85FED4	5303785AD746A58F565F7CC9D46244472093F7ABAE342A3DDCA1318279DE9D17
C:\ProgramData\Microsoft\Windows\WER\Temp\WEREE4.tmp.dmp	Mini DuMP crash report, 14 streams, Fri Nov 26 02:42:55 2021, 0x1205a4 type	2973008C3464AE66CCEC3BA9DD8A97EC	6E00C8E0D090C1ED347DF49FDE2022DBE394399D	FD8D203E1AFC12FE0B776F6E757EDE43A9CD3C1DB0600E21239CDEF7BFC623DD
C:\Windows\appcompat\Programs\Amcache.hve	MS Windows registry file, NT/2000 or above	F48A7268FA38A81C30F2F9CE74EF1985	3F77B27E0FE3A74D414871952BDE353C440602A8	6555E612399340EF23D73E46EA986DEDDA059C9A716A22F89DF12B0EF172BBD8
C:\Windows\appcompat\Programs\Amcache.hve.LOG1	MS Windows registry file, NT/2000 or above	08587182DC2B50DAEA202633D1565982	4F69E6018756534971FEE4EF523B4DB70B8EBB4A	A1C8DCB43B205EAF612BBF7FCD8DEC4BDBA8247D83D9C2C5E383B2133DF57E8F

AV Detection:

Multi AV Scanner detection for submitted file

Source: g3r7OOQiri.exe

Virustotal: Detection: 15%

Perma Link

Machine Learning detection for sample

Source: g3r7OOQiri.exe

Joe Sandbox ML: detected

Compliance:

Uses 32bit PE files

Source: g3r7OOQiri.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Binary contains paths to debug symbols

Source:	Binary string: wkernel32.pdb source: WerFault.exe, 00000004.00000003.246560840.0000000000FBD000.00000004.00000001.sdmp, WerFault.exe, 00000004.00000003.247748945.0000000005231000.00000004.00000001.sdmp, WerFault.exe, 00000004.00000003.246619265.0000000000FA5000.00000004.00000001.sdmp, WerFault.exe, 00000004.00000003.246580863.0000000000FA5000.00000004.00000001.sdmp
Source:	Binary string: wkernelbase.pdb source: WerFault.exe, 00000004.00000003.247748945.0000000005231000.00000004.00000001.sdmp, WerFault.exe, 00000004.00000003.246623632.0000000000FAB000.00000004.00000001.sdmp, WerFault.exe, 00000004.00000003.246585158.0000000000FAB000.00000004.00000001.sdmp
Source:	Binary string: wkernelbase.pdb( source: WerFault.exe, 00000004.00000003.246623632.0000000000FAB000.00000004.00000001.sdmp, WerFault.exe, 00000004.00000003.246585158.0000000000FAB000.00000004.00000001.sdmp
Source:	Binary string: wntdll.pdb source: WerFault.exe, 00000004.00000003.247748945.0000000005231000.00000004.00000001.sdmp, WerFault.exe, 00000004.00000003.246576679.0000000000F9F000.00000004.00000001.sdmp, WerFault.exe, 00000004.00000003.246615405.0000000000F9F000.00000004.00000001.sdmp
Source:	Binary string: wkernel32.pdb( source: WerFault.exe, 00000004.00000003.246619265.0000000000FA5000.00000004.00000001.sdmp, WerFault.exe, 00000004.00000003.246580863.0000000000FA5000.00000004.00000001.sdmp
Source:	Binary string: apphelp.pdb source: WerFault.exe, 00000004.00000003.247748945.0000000005231000.00000004.00000001.sdmp
Source:	Binary string: wntdll.pdbk source: WerFault.exe, 00000004.00000003.247748945.0000000005231000.00000004.00000001.sdmp
Source:	Binary string: wntdll.pdb( source: WerFault.exe, 00000004.00000003.246576679.0000000000F9F000.00000004.00000001.sdmp, WerFault.exe, 00000004.00000003.246615405.0000000000F9F000.00000004.00000001.sdmp

Networking:

URLs found in memory or binary data

Source: Amcache.hve.4.dr

String found in binary or memory: http://upx.sf.net

System Summary:

PE file has nameless sections

Source: g3r7OOQiri.exe	Static PE information: section name:
Source: g3r7OOQiri.exe	Static PE information: section name:
Source: g3r7OOQiri.exe	Static PE information: section name:
Source: g3r7OOQiri.exe	Static PE information: section name:
Source: g3r7OOQiri.exe	Static PE information: section name:
Source: g3r7OOQiri.exe	Static PE information: section name:
Source: g3r7OOQiri.exe	Static PE information: section name:
Source: g3r7OOQiri.exe	Static PE information: section name:
Source: g3r7OOQiri.exe	Static PE information: section name:
Source: g3r7OOQiri.exe	Static PE information: section name:
Source: g3r7OOQiri.exe	Static PE information: section name:

Uses 32bit PE files

Source: g3r7OOQiri.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

PE file does not import any functions

Source: g3r7OOQiri.exe

Static PE information: No import functions for PE file found

One or more processes crash

Source: C:\Users\user\Desktop\g3r7OOQiri.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6240 -s 212

PE file contains more sections than normal

Source: g3r7OOQiri.exe

Static PE information: Number of sections : 14 > 10

PE file overlay found

Source: g3r7OOQiri.exe

Static PE information: Data appended to the last section found

PE file contains an invalid data directory

Source: g3r7OOQiri.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESERVED size: 0x100000 address: 0x0

PE file has section (not .text) which is very likely to contain packed code (zlib compression ratio < 0.011)

Source: g3r7OOQiri.exe	Static PE information: Section: ZLIB complexity 1.00042941046
Source: g3r7OOQiri.exe	Static PE information: Section: ZLIB complexity 1.004296875
Source: g3r7OOQiri.exe	Static PE information: Section: ZLIB complexity 1.00097595599

Sample is known by Antivirus

Source: g3r7OOQiri.exe

Virustotal: Detection: 15%

Reads software policies

Source: C:\Users\user\Desktop\g3r7OOQiri.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Spawns processes

Source: unknown	Process created: C:\Users\user\Desktop\g3r7OOQiri.exe "C:\Users\user\Desktop\g3r7OOQiri.exe"
Source: C:\Users\user\Desktop\g3r7OOQiri.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6240 -s 212

Creates mutexes

Source: C:\Windows\SysWOW64\WerFault.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6240

Creates temporary files

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\WEREE4.tmp

Jump to behavior

Classification label

Source: classification engine

Classification label: mal56.winEXE@2/6@0/0

Reads the hosts file

Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

PE file contains a debug data directory

Source: g3r7OOQiri.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Binary contains paths to debug symbols

Source:	Binary string: wkernel32.pdb source: WerFault.exe, 00000004.00000003.246560840.0000000000FBD000.00000004.00000001.sdmp, WerFault.exe, 00000004.00000003.247748945.0000000005231000.00000004.00000001.sdmp, WerFault.exe, 00000004.00000003.246619265.0000000000FA5000.00000004.00000001.sdmp, WerFault.exe, 00000004.00000003.246580863.0000000000FA5000.00000004.00000001.sdmp
Source:	Binary string: wkernelbase.pdb source: WerFault.exe, 00000004.00000003.247748945.0000000005231000.00000004.00000001.sdmp, WerFault.exe, 00000004.00000003.246623632.0000000000FAB000.00000004.00000001.sdmp, WerFault.exe, 00000004.00000003.246585158.0000000000FAB000.00000004.00000001.sdmp
Source:	Binary string: wkernelbase.pdb( source: WerFault.exe, 00000004.00000003.246623632.0000000000FAB000.00000004.00000001.sdmp, WerFault.exe, 00000004.00000003.246585158.0000000000FAB000.00000004.00000001.sdmp
Source:	Binary string: wntdll.pdb source: WerFault.exe, 00000004.00000003.247748945.0000000005231000.00000004.00000001.sdmp, WerFault.exe, 00000004.00000003.246576679.0000000000F9F000.00000004.00000001.sdmp, WerFault.exe, 00000004.00000003.246615405.0000000000F9F000.00000004.00000001.sdmp
Source:	Binary string: wkernel32.pdb( source: WerFault.exe, 00000004.00000003.246619265.0000000000FA5000.00000004.00000001.sdmp, WerFault.exe, 00000004.00000003.246580863.0000000000FA5000.00000004.00000001.sdmp
Source:	Binary string: apphelp.pdb source: WerFault.exe, 00000004.00000003.247748945.0000000005231000.00000004.00000001.sdmp
Source:	Binary string: wntdll.pdbk source: WerFault.exe, 00000004.00000003.247748945.0000000005231000.00000004.00000001.sdmp
Source:	Binary string: wntdll.pdb( source: WerFault.exe, 00000004.00000003.246576679.0000000000F9F000.00000004.00000001.sdmp, WerFault.exe, 00000004.00000003.246615405.0000000000F9F000.00000004.00000001.sdmp

Data Obfuscation:

PE file contains an invalid checksum

Source: g3r7OOQiri.exe

Static PE information: real checksum: 0x14efe5 should be: 0x1c55f

PE file contains sections with non-standard names

Source: g3r7OOQiri.exe	Static PE information: section name:
Source: g3r7OOQiri.exe	Static PE information: section name:
Source: g3r7OOQiri.exe	Static PE information: section name:
Source: g3r7OOQiri.exe	Static PE information: section name:
Source: g3r7OOQiri.exe	Static PE information: section name:
Source: g3r7OOQiri.exe	Static PE information: section name:
Source: g3r7OOQiri.exe	Static PE information: section name:
Source: g3r7OOQiri.exe	Static PE information: section name:
Source: g3r7OOQiri.exe	Static PE information: section name:
Source: g3r7OOQiri.exe	Static PE information: section name:
Source: g3r7OOQiri.exe	Static PE information: section name:
Source: g3r7OOQiri.exe	Static PE information: section name: .ShqA6WN
Source: g3r7OOQiri.exe	Static PE information: section name: .adata

Binary may include packed or encrypted code

Source: initial sample	Static PE information: section name: entropy: 7.9974253827
Source: initial sample	Static PE information: section name: entropy: 7.92908677458
Source: initial sample	Static PE information: section name: entropy: 7.98297122027

Hooking and other Techniques for Hiding and Protection:

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Source: C:\Windows\SysWOW64\WerFault.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Jump to behavior

Disables application error messsages (SetErrorMode)

Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion:

May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)

Source: Amcache.hve.4.dr	Binary or memory string: VMware
Source: Amcache.hve.4.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/5&1ec51bf7&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: @scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/5&280b647&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.4.dr	Binary or memory string: VMware, Inc.
Source: WerFault.exe, 00000004.00000003.258827345.0000000000FB2000.00000004.00000001.sdmp, WerFault.exe, 00000004.00000003.258988957.0000000000FB3000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllP
Source: Amcache.hve.4.dr	Binary or memory string: VMware Virtual disk SCSI Disk Devicehbin
Source: Amcache.hve.4.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.4.dr	Binary or memory string: VMware7,1
Source: Amcache.hve.4.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.4.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.4.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW71.00V.13989454.B64.1906190538,BiosReleaseDate:06/19/2019,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware7,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.4.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.4.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.4.dr	Binary or memory string: VMware, Inc.me
Source: Amcache.hve.4.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/5&280b647&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: VMware-42 35 bb 32 33 75 d2 27-52 00 3c e2 4b d4 32 71
Source: Amcache.hve.4.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/5&1ec51bf7&0&000000

Anti Debugging:

Checks if the current process is being debugged

Source: C:\Users\user\Desktop\g3r7OOQiri.exe

Process queried: DebugPort

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings:

AV process strings found (often used to terminate AV products)

Source: Amcache.hve.4.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.4.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe