Windows Analysis Report 8XMlaeHQXZ.exe

ID:	528756
Product:	CloudBasic
Start time:	18:41:33
Start date:	25.11.2021
Sample:	8XMlaeHQXZ.exe
Cookbook:	default.jbs
System description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Architecture:	WINDOWS
MD5:	5643bf734d793e845166a228f3df83b3
SHA1:	4415ad682fd64baedf5c209bc0c2a3b619cf03e2
SHA256:	db79e0c2243229f8ba6a52deede597287b93801aa182af42f278542f31fb3324
Filetype:	Win32 Executable (generic) a (10002005/4) 99.94%

Name	Type	MD5	SHA1	SHA256
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_8XMlaeHQXZ.exe_eef3a584e8e34ce43e333fc8ab4acb864824d3c_c1f65c8e_18866dcb\Report.wer	Little-endian UTF-16 Unicode text, with CRLF line terminators	F1DC039B554AB890258EC09467DB6C24	9DE682535714470077C857B83C0EE23239302C46	1141883D1E50A954C4DBB6B053069AE03E791D311B897BD966AB40F6684C0508
C:\ProgramData\Microsoft\Windows\WER\Temp\WER5561.tmp.dmp	Mini DuMP crash report, 14 streams, Thu Nov 25 17:42:36 2021, 0x1205a4 type	D8FEB31937852F9EE1C60A37EC4FC21D	05CECB87B4587ADB1845974F9D919263D82C6E7F	E1680A8D9A1AFD37519000F198FFC2F6D2EC049998CBD8995F014089F4FB7DA8
C:\ProgramData\Microsoft\Windows\WER\Temp\WER57B4.tmp.WERInternalMetadata.xml	XML 1.0 document, Little-endian UTF-16 Unicode text, with CRLF line terminators	A46B781979DC0E5691DFB61F9FBAF0C0	F4F732F491767AE66C5C19B781DF5C5758E0995A	8262F032BE88AE2D934DF2E18E973ED5E91C9FAE257412B4CB65490E3D6698A4
C:\ProgramData\Microsoft\Windows\WER\Temp\WER5A16.tmp.xml	XML 1.0 document, ASCII text, with CRLF line terminators	31D97342DF63ECDB23A535339416ADCF	18A56F887B7C70A5B417FF5E2C5B77F0FF637BBB	A6286CC1F02B83AD8A0F326E2DEAADD54D45F5167E92D1CC174F522A5D9EAEE7
C:\Windows\appcompat\Programs\Amcache.hve	MS Windows registry file, NT/2000 or above	518E34E6AF9A3C808A4F2997E1553053	AAB369444CE6E9C6A4BE56CA8DE4E4D26AB47171	93B9496270FBD85CAD54089F9C98A5547B9C32616716269CF5B8FB128238C23F
C:\Windows\appcompat\Programs\Amcache.hve.LOG1	MS Windows registry file, NT/2000 or above	578A8605EBFB68DE0665EEFB540C7A12	DA5A7C98CD2F07DF3F466736E24260BBA2029473	270BCDE1586464434CE203C339694E3C730974A218A8C61184E3C6868AF8E2BF

AV Detection:

Machine Learning detection for sample

Source: 8XMlaeHQXZ.exe

Joe Sandbox ML: detected

Compliance:

Uses 32bit PE files

Source: 8XMlaeHQXZ.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Binary contains paths to debug symbols

Source:	Binary string: wkernel32.pdb source: WerFault.exe, 00000004.00000003.677332982.0000000005501000.00000004.00000001.sdmp
Source:	Binary string: wkernelbase.pdb source: WerFault.exe, 00000004.00000003.677332982.0000000005501000.00000004.00000001.sdmp
Source:	Binary string: wntdll.pdb source: WerFault.exe, 00000004.00000003.677332982.0000000005501000.00000004.00000001.sdmp
Source:	Binary string: apphelp.pdb source: WerFault.exe, 00000004.00000003.677332982.0000000005501000.00000004.00000001.sdmp
Source:	Binary string: wntdll.pdbk source: WerFault.exe, 00000004.00000003.677332982.0000000005501000.00000004.00000001.sdmp

Networking:

URLs found in memory or binary data

Source: Amcache.hve.4.dr

String found in binary or memory: http://upx.sf.net

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Creates a DirectInput object (often for capturing keystrokes)

Source: 8XMlaeHQXZ.exe, 00000000.00000000.671939274.0000000000ABA000.00000004.00000020.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

System Summary:

PE file has nameless sections

Source: 8XMlaeHQXZ.exe	Static PE information: section name:
Source: 8XMlaeHQXZ.exe	Static PE information: section name:
Source: 8XMlaeHQXZ.exe	Static PE information: section name:
Source: 8XMlaeHQXZ.exe	Static PE information: section name:
Source: 8XMlaeHQXZ.exe	Static PE information: section name:
Source: 8XMlaeHQXZ.exe	Static PE information: section name:
Source: 8XMlaeHQXZ.exe	Static PE information: section name:

Uses 32bit PE files

Source: 8XMlaeHQXZ.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

PE file does not import any functions

Source: 8XMlaeHQXZ.exe

Static PE information: No import functions for PE file found

Sample file is different than original file name gathered from version info

Source: 8XMlaeHQXZ.exe, 00000000.00000000.669090161.0000000000426000.00000080.00020000.sdmp	Binary or memory string: OriginalFilenamePantsuits.exe4 vs 8XMlaeHQXZ.exe
Source: 8XMlaeHQXZ.exe, 00000000.00000000.669090161.0000000000426000.00000080.00020000.sdmp	Binary or memory string: OriginalFilenameGeForce Experience PermissionT vs 8XMlaeHQXZ.exe
Source: 8XMlaeHQXZ.exe	Binary or memory string: OriginalFilenamePantsuits.exe4 vs 8XMlaeHQXZ.exe
Source: 8XMlaeHQXZ.exe	Binary or memory string: OriginalFilenameGeForce Experience PermissionT vs 8XMlaeHQXZ.exe

One or more processes crash

Source: C:\Users\user\Desktop\8XMlaeHQXZ.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5476 -s 212

PE file overlay found

Source: 8XMlaeHQXZ.exe

Static PE information: Data appended to the last section found

PE file contains an invalid data directory

Source: 8XMlaeHQXZ.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESERVED size: 0x100000 address: 0x0

PE file has section (not .text) which is very likely to contain packed code (zlib compression ratio < 0.011)

Source: 8XMlaeHQXZ.exe	Static PE information: Section: ZLIB complexity 1.00057768486
Source: 8XMlaeHQXZ.exe	Static PE information: Section: ZLIB complexity 1.0107421875
Source: 8XMlaeHQXZ.exe	Static PE information: Section: ZLIB complexity 1.00716145833
Source: 8XMlaeHQXZ.exe	Static PE information: Section: ZLIB complexity 1.021484375
Source: 8XMlaeHQXZ.exe	Static PE information: Section: ZLIB complexity 1.00037704324

Reads software policies

Source: C:\Users\user\Desktop\8XMlaeHQXZ.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Spawns processes

Source: unknown	Process created: C:\Users\user\Desktop\8XMlaeHQXZ.exe "C:\Users\user\Desktop\8XMlaeHQXZ.exe"
Source: C:\Users\user\Desktop\8XMlaeHQXZ.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5476 -s 212

Creates mutexes

Source: C:\Windows\SysWOW64\WerFault.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess5476

Creates temporary files

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\WER5561.tmp

Jump to behavior

Classification label

Source: classification engine

Classification label: mal48.winEXE@2/6@0/0

Reads the hosts file

Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

PE file has a big raw section

Source: 8XMlaeHQXZ.exe

Static PE information: Raw size of is bigger than: 0x100000 < 0x104c00

Binary contains paths to debug symbols

Source:	Binary string: wkernel32.pdb source: WerFault.exe, 00000004.00000003.677332982.0000000005501000.00000004.00000001.sdmp
Source:	Binary string: wkernelbase.pdb source: WerFault.exe, 00000004.00000003.677332982.0000000005501000.00000004.00000001.sdmp
Source:	Binary string: wntdll.pdb source: WerFault.exe, 00000004.00000003.677332982.0000000005501000.00000004.00000001.sdmp
Source:	Binary string: apphelp.pdb source: WerFault.exe, 00000004.00000003.677332982.0000000005501000.00000004.00000001.sdmp
Source:	Binary string: wntdll.pdbk source: WerFault.exe, 00000004.00000003.677332982.0000000005501000.00000004.00000001.sdmp

Data Obfuscation:

PE file contains an invalid checksum

Source: 8XMlaeHQXZ.exe

Static PE information: real checksum: 0x122111 should be: 0x3a656

PE file contains sections with non-standard names

Source: 8XMlaeHQXZ.exe	Static PE information: section name:
Source: 8XMlaeHQXZ.exe	Static PE information: section name:
Source: 8XMlaeHQXZ.exe	Static PE information: section name:
Source: 8XMlaeHQXZ.exe	Static PE information: section name:
Source: 8XMlaeHQXZ.exe	Static PE information: section name:
Source: 8XMlaeHQXZ.exe	Static PE information: section name:
Source: 8XMlaeHQXZ.exe	Static PE information: section name:
Source: 8XMlaeHQXZ.exe	Static PE information: section name: .m8o02uE
Source: 8XMlaeHQXZ.exe	Static PE information: section name: .adata

Binary contains a suspicious time stamp

Source: 8XMlaeHQXZ.exe

Static PE information: 0xFBDADAB2 [Sun Nov 25 08:54:10 2103 UTC]

Binary may include packed or encrypted code

Source: initial sample	Static PE information: section name: entropy: 7.99485148323
Source: initial sample	Static PE information: section name: entropy: 7.80837604511
Source: initial sample	Static PE information: section name: entropy: 7.87119921588
Source: initial sample	Static PE information: section name: entropy: 7.59715435366
Source: initial sample	Static PE information: section name: entropy: 7.99861729183

Hooking and other Techniques for Hiding and Protection:

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Source: C:\Windows\SysWOW64\WerFault.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Jump to behavior

Disables application error messsages (SetErrorMode)

Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion:

May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)

Source: Amcache.hve.4.dr	Binary or memory string: VMware
Source: Amcache.hve.4.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/5&1ec51bf7&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: @scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/5&280b647&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.4.dr	Binary or memory string: VMware-42 35 9c fb 73 fa 4e 1b-fb a4 60 e7 7b e5 4a ed
Source: Amcache.hve.4.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.4.dr	Binary or memory string: VMware Virtual disk SCSI Disk Devicehbin
Source: Amcache.hve.4.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.4.dr	Binary or memory string: VMware7,1
Source: Amcache.hve.4.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.4.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.4.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW71.00V.13989454.B64.1906190538,BiosReleaseDate:06/19/2019,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware7,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.4.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.4.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.4.dr	Binary or memory string: VMware, Inc.me
Source: Amcache.hve.4.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/5&280b647&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/5&1ec51bf7&0&000000

Anti Debugging:

Checks if the current process is being debugged

Source: C:\Users\user\Desktop\8XMlaeHQXZ.exe

Process queried: DebugPort

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings:

AV process strings found (often used to terminate AV products)

Source: Amcache.hve.4.dr

Binary or memory string: c:\program files\windows defender\msmpeng.exe