Play interactive tour

Edit tour

Windows Analysis Report iexplore.exe

Overview

General Information

Sample Name:	iexplore.exe
Analysis ID:	530482
MD5:	aa094de5b8ef17848a5926c13eb67e26
SHA1:	72df0e64ad124ef9bdfa0ed66b3afe62d4364192
SHA256:	9c530f1306aa1312fda938169e208a033341bc49ff956695c7616ad6c5d4bc94
Infos:
Most interesting Screenshot:

Detection

Score:	3
Range:	0 - 100
Whitelisted:	false
Confidence:	60%

Signatures

PE file contains strange resources

Contains functionality to check if a debugger is running (IsDebuggerPresent)

PE file contains sections with non-standard names

Binary contains a suspicious time stamp

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to search for IE or Outlook window (often done to steal information)

Classification

Analysis Advice

Sample has a GUI, but Joe Sandbox has not found any clickable buttons, likely more UI automation may extend behavior

Sample may offer command line options, please run it with the 'Execute binary with arguments' cookbook (it's possible that the command line switches require additional characters like: "-", "/", "--")

Process Tree

System is w10x64

iexplore.exe (PID: 4524 cmdline: "C:\Users\user\Desktop\iexplore.exe" MD5: AA094DE5B8EF17848A5926C13EB67E26)

cleanup

Malware Configuration

No configs have been found

Yara Overview

No yara matches

Sigma Overview

No Sigma rule has matched

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: iexplore.exe

Static PE information: certificate valid

Source: iexplore.exe

Static PE information: GUARD_CF, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT, HIGH_ENTROPY_VA

Source:	Binary string: iexplore.pdbUGP source: iexplore.exe
Source:	Binary string: iexplore.pdb source: iexplore.exe

Source: iexplore.exe, 00000000.00000003.302461542.00000234392E1000.00000004.00000001.sdmp, iexplore.exe, 00000000.00000002.302823869.00000234392FB000.00000004.00000001.sdmp, iexplore.exe, 00000000.00000002.302816826.00000234392E1000.00000004.00000001.sdmp, iexplore.exe, 00000000.00000003.301339553.00000234392FB000.00000004.00000001.sdmp	String found in binary or memory: https://login.live.com
Source: iexplore.exe, 00000000.00000003.302357533.0000023439306000.00000004.00000001.sdmp, iexplore.exe, 00000000.00000003.301196574.0000023439306000.00000004.00000001.sdmp, iexplore.exe, 00000000.00000002.302834850.0000023439306000.00000004.00000001.sdmp	String found in binary or memory: https://login.live.coml%

Source: iexplore.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: iexplore.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: iexplore.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: iexplore.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: iexplore.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: iexplore.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: iexplore.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: iexplore.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: iexplore.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: iexplore.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: iexplore.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: iexplore.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: iexplore.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: iexplore.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: iexplore.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: iexplore.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: iexplore.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: iexplore.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: iexplore.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: iexplore.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: iexplore.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: iexplore.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: iexplore.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: iexplore.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: iexplore.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: iexplore.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: iexplore.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: iexplore.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: iexplore.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: iexplore.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: iexplore.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: iexplore.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: iexplore.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: iexplore.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: iexplore.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: iexplore.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: iexplore.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: iexplore.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: iexplore.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: iexplore.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: iexplore.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: iexplore.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: iexplore.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: iexplore.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: iexplore.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: iexplore.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: iexplore.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: iexplore.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: iexplore.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: iexplore.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: iexplore.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: iexplore.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: iexplore.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: iexplore.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: iexplore.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: iexplore.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: iexplore.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: iexplore.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: iexplore.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: iexplore.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: iexplore.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: iexplore.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\iexplore.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\iexplore.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\iexplore.exe

File created: C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High

Jump to behavior

Source: C:\Users\user\Desktop\iexplore.exe

File created: C:\Users\user\AppData\Local\Temp\~DFBABF6BC7DA4D719B.TMP

Jump to behavior

Source: iexplore.exe	String found in binary or memory: -startmanager
Source: iexplore.exe	String found in binary or memory: kernelbase.dllRaiseFailFastExceptionwilonecore\internal\sdk\inc\wil\opensource\wil\resource.hWilError_03ntdll.dllRtlDisownModuleHeapAllocationRtlRegisterFeatureConfigurationChangeNotificationRtlUnregisterFeatureConfigurationChangeNotificationRtlNotifyFeatureUsageNtQueryWnfStateDataNtUpdateWnfStateDataRtlSubscribeWnfStateChangeNotificationRtlUnsubscribeWnfNotificationWaitForCompletiononecore\internal\sdk\inc\wil\Staging.hWilStaging_02SCODEF:CREDAT:-newtabIEFrame{28fb17e0-d393-439d-9a21-9474a070473a} -eval-new-nowaitkernel32.dllSetSearchPathModeInternet Explorer-ResetDestinationListResetDestinationList-embedding-startmanagerTerminateOnShutdownSoftware\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iexplore.exeLocal\SM0:%d:%d:%hsm
Source: iexplore.exe	String found in binary or memory: Application-Addon-Event-ProviderOPCOT

Source: classification engine

Classification label: clean3.winEXE@1/4@0/0

Source: C:\Users\user\Desktop\iexplore.exe

File read: C:\Windows\System32\drivers\etc\hosts

Jump to behavior

Source: initial sample

Static PE information: Valid certificate with Microsoft Issuer

Source: iexplore.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: iexplore.exe

Static PE information: certificate valid

Source: iexplore.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: iexplore.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: iexplore.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: iexplore.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: iexplore.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: iexplore.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: iexplore.exe

Static PE information: GUARD_CF, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT, HIGH_ENTROPY_VA

Source: iexplore.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: iexplore.pdbUGP source: iexplore.exe
Source:	Binary string: iexplore.pdb source: iexplore.exe

Source: iexplore.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: iexplore.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: iexplore.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: iexplore.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: iexplore.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: iexplore.exe

Static PE information: section name: .didat

Source: iexplore.exe

Static PE information: 0xD40E0FD9 [Sat Sep 26 23:35:53 2082 UTC]

Source: C:\Users\user\Desktop\iexplore.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Source: iexplore.exe, 00000000.00000003.302390030.0000023439270000.00000004.00000001.sdmp, iexplore.exe, 00000000.00000002.302757863.0000023439270000.00000004.00000001.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dlloo

Source: C:\Users\user\Desktop\iexplore.exe

Code function: 0_2_00007FF7AB3320F0 InitializeCriticalSection,#798,CoCreateGuid,IsDebuggerPresent,#796,#797,#701,GetModuleHandleW,GetProcAddress,SetDllDirectoryW,SetErrorMode,GetCommandLineW,wcsncmp,LocalAlloc,StrStrIW,StrStrIW,StrStrIW,HeapSetInformation,#791,SetCurrentProcessExplicitAppUserModelID,StrStrIW,StrStrIW,FindWindowExW,GetWindowThreadProcessId,AllowSetForegroundWindow,StrStrIW,wcsncmp,iswspace,iswspace,iswspace,iswspace,wcsncmp,#796,StrStrIW,LocalFree,#650,#650,DeleteCriticalSection,RegGetValueW,GetCurrentProcess,TerminateProcess,

0_2_00007FF7AB3320F0

Source: C:\Users\user\Desktop\iexplore.exe

Code function: 0_2_00007FF7AB338858 GetProcessHeap,HeapFree,

0_2_00007FF7AB338858

Source: C:\Users\user\Desktop\iexplore.exe

Code function: 0_2_00007FF7AB332C20 DelayLoadFailureHook,LdrResolveDelayLoadedAPI,

0_2_00007FF7AB332C20

Source: C:\Users\user\Desktop\iexplore.exe	Code function: 0_2_00007FF7AB3335F0 SetUnhandledExceptionFilter,		0_2_00007FF7AB3335F0
Source: C:\Users\user\Desktop\iexplore.exe	Code function: 0_2_00007FF7AB333324 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_00007FF7AB333324

Source: C:\Users\user\Desktop\iexplore.exe

Code function: 0_2_00007FF7AB3337C4 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,GetTickCount,QueryPerformanceCounter,

0_2_00007FF7AB3337C4

Source: C:\Users\user\Desktop\iexplore.exe

0_2_00007FF7AB3320F0

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Command and Scripting Interpreter2	Path Interception	Path Interception	Masquerading1	OS Credential Dumping	System Time Discovery1	Remote Services	Email Collection1	Exfiltration Over Other Network Medium	Data Obfuscation	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Timestomp1	LSASS Memory	Security Software Discovery21	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Junk Data	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	System Information Discovery2	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Steganography	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Binary Padding	NTDS	Remote System Discovery1	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
iexplore.exe	0%	Metadefender		Browse
iexplore.exe	0%	ReversingLabs

Dropped Files

No Antivirus matches

Unpacked PE Files

No Antivirus matches

Domains

No Antivirus matches

URLs

No Antivirus matches

Domains and IPs

Contacted Domains

No contacted domains info

Contacted IPs

No contacted IP infos

General Information

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	530482
Start date:	29.11.2021
Start time:	16:40:53
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 3m 8s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	iexplore.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	5
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	CLEAN
Classification:	clean3.winEXE@1/4@0/0
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 100% (good quality ratio 58.6%) Quality average: 41.8% Quality standard deviation: 40.1%
HCA Information:	Failed
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe Stop behavior analysis, all processes terminated
Warnings:	Show All Exclude process from analysis (whitelisted): BackgroundTransferHost.exe, backgroundTaskHost.exe, svchost.exe Excluded IPs from analysis (whitelisted): 23.211.6.115, 23.203.70.208, 20.82.210.154 Excluded domains from analysis (whitelisted): e11290.dspg.akamaiedge.net, e12564.dspb.akamaiedge.net, go.microsoft.com, store-images.s-microsoft.com, go.microsoft.com.edgekey.net, store-images.s-microsoft.com-c.edgekey.net, arc.trafficmanager.net, iris-de-prod-azsc-neu-b.northeurope.cloudapp.azure.com, arc.msn.com Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtQueryValueKey calls found. VT rate limit hit for: /opt/package/joesandbox/database/analysis/530482/sample/iexplore.exe

Simulations

Behavior and APIs

No simulations

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

No context

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{500588E2-5176-11EC-90E9-ECF4BB862DED}.dat Download File
Process:	C:\Users\user\Desktop\iexplore.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	5120
Entropy (8bit):	2.017921290260243
Encrypted:	false
SSDEEP:	24:rNGo/QC/pGo/G/f879lWRB9RsZQ9lWRB9RsZo:rNGo4SGohCRBfsZdRBfsZo
MD5:	095527D85A729FBE92013FA6C3E3D0B9
SHA1:	4700748ECA5E5BDD6617ED7CB9ADC745CC48CBDC
SHA-256:	B04CA94AB4CEA285CAFD33B01FF4CEDB63DD144E713EEF30B3A638F2F414282C
SHA-512:	791D67923510DD27D5082D75279CE57779A307F136145F3C98DF2954829751F22B1440ED5679015E5FE319568402776CA110FC97D9E73269FDDF99F01FC8B3BB
Malicious:	false
Reputation:	low
Preview:	......................>.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.........................................................................................pC....................K.j.j.a.q.f.a.j.N.2.c.0.u.z.g.v.1.l.4.q.y.5.n.f.W.e...........8...............................................................F.r.a.m.e.L.i.s.t.......................................................................................................0.......O._.T.S.4.4.g.F.U.H.Z.R.7.B.G.Q.6.e.z.0.u.4.Y.t.7.Q.=.=.........:.......................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{500588E4-5176-11EC-90E9-ECF4BB862DED}.dat Download File
Process:	C:\Users\user\Desktop\iexplore.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	4608
Entropy (8bit):	1.6057063769354987
Encrypted:	false
SSDEEP:	12:rl0ZGFSCDrEgm8GL76Fk7rEgm8GT7qk9lYf0F9lQ8vjRYCDA1:r5G8E7G8m9lRF9lbjOB
MD5:	00350B7C1B4B2C765362DCB0DCACA387
SHA1:	CAEFE4CF3B0108E15EDB3EC19ECA6E6C0D0B2992
SHA-256:	C5E5DE633DD965897BD6D31FBEBB7D3CDE994808A864D98CCB4596E241AEADFC
SHA-512:	F6CE8CECE2F94FC0A4B3C5DDB6D501C5245A199DB032A558384DE0E8901609BAE15D694F6832F9AC88B5B8950B35D1430AFDA9A211BDEFA2E498925667BD2CDE
Malicious:	false
Reputation:	low
Preview:	......................>.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.........................................................................................pC....................K.j.j.a.q.f.a.j.N.2.c.0.u.z.g.v.1.l.4.q.y.5.n.f.W.e...........8.......................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DF185F14192541A715.TMP Download File
Process:	C:\Users\user\Desktop\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08156071711048025
Encrypted:	false
SSDEEP:	3:alFXEAUolll/4llclllv/ntrl9l+ll1lRslkhlEkllM/llQllblRfReClRRly++Y:a/vllQ/UvlkxMGVEBf5YCDA1
MD5:	47F4A552CB0EDD210EDA62B1DB0CE011
SHA1:	7086A121D01FDC86CE09B1072C2250C1A922A8A4
SHA-256:	FA911E9BD6FBC808026640A943278E2AD5BD7F431DA57F4A7FD67C7A0E8FC7CC
SHA-512:	A21227E4DAED18386391E5E625D578FA5714438EEA009A15226EBFE638828A327F42FC0CB183BE2BE73FD53DC1BA627CE857DBCB78011F4FE9A22F03B27400DB
Malicious:	false
Reputation:	low
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DFBABF6BC7DA4D719B.TMP Download File
Process:	C:\Users\user\Desktop\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.06992407246571296
Encrypted:	false
SSDEEP:	3:bDese0uollV//ll4kAt/6/lclllv/nt+lybltll1lRslkhlEkllAT0ese0w7se0I:acP/okAoUFAlkxIPB
MD5:	11B49D0DFAC19978FEDB67F3BFEE45F9
SHA1:	04CE73CA21F36C431D7AEA8B080DD7824CD92671
SHA-256:	1D5A35C2E3A1D134EF5D73F0B12E8530715643ECADE1B3ADF5CA09DE17907289
SHA-512:	7A9286A5F8A19D1E138040A5F08C228593D99492C923E97A1D2CC8F1C7B36C41AF53879BCD01CDF71616CF6F54BAAEFD5F93AE10A2D98B9A8E84A4BE06EFEC10
Malicious:	false
Reputation:	low
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General
File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	6.502025712772339
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	iexplore.exe
File size:	842208
MD5:	aa094de5b8ef17848a5926c13eb67e26
SHA1:	72df0e64ad124ef9bdfa0ed66b3afe62d4364192
SHA256:	9c530f1306aa1312fda938169e208a033341bc49ff956695c7616ad6c5d4bc94
SHA512:	c2fa9b5141efbba11345e3e4565ddf63b3c9446bb711267a69abeb52117b0eb35ce6c563d97cf0ced03c3c3c9ea8dbd94c2a31d579d4888f03654a75bd5e3b7b
SSDEEP:	24576:SUf4lGLbMMHMMMvMMZMMMKzb6XmMMMiMMMz8JMMHMMM6MMZMMMeXNMMzMMMUMMVW:SKMMHMMMvMMZMMMlmMMMiMMMYJMMHMMM
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......EQ...0.L.0.L.0.L.HdL.0.L.[.M.0.L.[.M.0.L.[.M.0.L.[.M.0.L.0.L.0.L.[.M.0.L.[.L.0.L.[.M.0.LRich.0.L................PE..d..........

File Icon


Icon Hash:	e1e8ccdecccdf136

Static PE Info

General
Entrypoint:	0x1400032d0
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	GUARD_CF, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT, HIGH_ENTROPY_VA
Time Stamp:	0xD40E0FD9 [Sat Sep 26 23:35:53 2082 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	10
OS Version Minor:	0
File Version Major:	10
File Version Minor:	0
Subsystem Version Major:	10
Subsystem Version Minor:	0
Import Hash:	8d62b7253079493d3b3cc9d2d3d32a62

Authenticode Signature

Signature Valid:	true
Signature Issuer:	CN=Microsoft Code Signing PCA 2010, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
Signature Validation Error:	The operation completed successfully
Error Number:	0
Not Before, Not After	12/15/2020 1:24:20 PM 12/2/2021 1:24:20 PM
Subject Chain	CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
Version:	3
Thumbprint MD5:	4068B1B0494EFA79F5A751DCCA8111CD
Thumbprint SHA-1:	914A09C2E02C696AF394048BCB8D95449BCD5B9E
Thumbprint SHA-256:	4A838904E732A380E2856A9D6FEE926E5C57EB59336292AC5D9E47C9B2C1ED13
Serial:	33000003DFFB6AE3F427ECB6A30000000003DF

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007FBE94AF5C00h
dec eax
add esp, 28h
jmp 00007FBE94AF5493h
int3
int3
int3
int3
int3
int3
jmp dword ptr [000081F2h]
int3
int3
int3
int3
int3
int3
int3
int3
nop word ptr [eax+eax+00000000h]
dec eax
cmp ecx, dword ptr [0000BDF1h]
jne 00007FBE94AF5722h
dec eax
rol ecx, 10h
test cx, FFFFh
jne 00007FBE94AF5713h
ret
dec eax
ror ecx, 10h
jmp 00007FBE94AF5757h
int3
int3
int3
int3
int3
int3
inc eax
push ebx
dec eax
sub esp, 20h
dec eax
mov ebx, ecx
xor ecx, ecx
call dword ptr [00007F2Bh]
dec eax
mov ecx, ebx
call dword ptr [00007F2Ah]
call dword ptr [00007FD4h]
dec eax
mov ecx, eax
mov edx, C0000409h
dec eax
add esp, 20h
pop ebx
dec eax
jmp dword ptr [00007FD8h]
int3
int3
int3
int3
int3
int3
int3
int3
dec eax
mov dword ptr [esp+08h], ecx
dec eax
sub esp, 00000088h
dec eax
lea ecx, dword ptr [0000BE8Dh]
call dword ptr [00007F07h]
dec eax
mov eax, dword ptr [0000BF78h]
dec eax
mov dword ptr [esp+48h], eax
inc ebp
xor eax, eax
dec eax
lea edx, dword ptr [esp+50h]
dec eax
mov ecx, dword ptr [esp+48h]
call dword ptr [00007EE0h]

Rich Headers

Programming Language:

[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xd740	0xc8	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x12000	0xbd5a0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x10000	0xabc	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0xcb800	0x21e0	.rsrc
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xd0000	0x88	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xbed0	0x54	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xb1a8	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xb080	0x118	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xb1d0	0x3c0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0xd670	0x60	.rdata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x9544	0x9600	False	0.535572916667	data	6.0486724667	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rdata	0xb000	0x3410	0x3600	False	0.399377893519	data	4.86753322026	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xf000	0xb8c	0x200	False	0.1640625	data	0.986135754532	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.pdata	0x10000	0xabc	0xc00	False	0.460286458333	data	4.16749125611	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.didat	0x11000	0x38	0x200	False	0.06640625	PGP\011Secret Key -	0.345827309422	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0x12000	0xbd5a0	0xbd600	False	0.621480507426	data	6.46723549077	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xd0000	0x88	0x200	False	0.251953125	data	1.64589807886	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
EDPENLIGHTENEDAPPINFOID	0x2e4a0	0x2	data	English	United States
EDPPERMISSIVEAPPINFOID	0x2e4a8	0x2	data	English	United States
MUI	0xcf448	0x158	data	English	United States
WEVT_TEMPLATE	0x15130	0x1936a	data	English	United States
RT_ICON	0x2e4b0	0x668	data	English	United States
RT_ICON	0x2eb18	0x2e8	dBase IV DBT of @.DBF, block length 512, next free block index 40, next free block 4008635955, next used block 770286	English	United States
RT_ICON	0x2ee00	0x1e8	data	English	United States
RT_ICON	0x2efe8	0x128	GLS_BINARY_LSB_FIRST	English	United States
RT_ICON	0x2f110	0xea8	data	English	United States
RT_ICON	0x2ffb8	0x8a8	dBase IV DBT of @.DBF, block length 1024, next free block index 40, next free block 16182429, next used block 16773761	English	United States
RT_ICON	0x30860	0x6c8	data	English	United States
RT_ICON	0x30f28	0x568	GLS_BINARY_LSB_FIRST	English	United States
RT_ICON	0x31490	0xcbf1	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States
RT_ICON	0x3e088	0x25a8	data	English	United States
RT_ICON	0x40630	0x10a8	data	English	United States
RT_ICON	0x416d8	0x988	data	English	United States
RT_ICON	0x42060	0x468	GLS_BINARY_LSB_FIRST	English	United States
RT_ICON	0x42588	0x668	data	English	United States
RT_ICON	0x42bf0	0x2e8	dBase IV DBT of @.DBF, block length 512, next free block index 40, next free block 3096152115, next used block 7829367	English	United States
RT_ICON	0x42ed8	0x1e8	data	English	United States
RT_ICON	0x430c0	0x128	GLS_BINARY_LSB_FIRST	English	United States
RT_ICON	0x431e8	0xea8	data	English	United States
RT_ICON	0x44090	0x8a8	dBase IV DBT of @.DBF, block length 1024, next free block index 40, next free block 16251127, next used block 16185593	English	United States
RT_ICON	0x44938	0x6c8	data	English	United States
RT_ICON	0x45000	0x568	GLS_BINARY_LSB_FIRST	English	United States
RT_ICON	0x45568	0x97d2	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States
RT_ICON	0x4ed40	0x25a8	data	English	United States
RT_ICON	0x512e8	0x10a8	data	English	United States
RT_ICON	0x52390	0x988	data	English	United States
RT_ICON	0x52d18	0x468	GLS_BINARY_LSB_FIRST	English	United States
RT_ICON	0x53240	0x2e8	dBase IV DBT of @.DBF, block length 512, next free block index 40, next free block 4160290815, next used block 0	English	United States
RT_ICON	0x53528	0x8a8	dBase IV DBT of @.DBF, block length 1024, next free block index 40, next free block 0, next used block 0	English	United States
RT_ICON	0x53dd0	0x10a8	data	English	United States
RT_ICON	0x54ea8	0x2e8	dBase IV DBT of @.DBF, block length 512, next free block index 40, next free block 2004318071, next used block 32888	English	United States
RT_ICON	0x551a8	0x2e8	dBase IV DBT of @.DBF, block length 512, next free block index 40, next free block 3096152115, next used block 7829367	English	United States
RT_ICON	0x55490	0x128	GLS_BINARY_LSB_FIRST	English	United States
RT_ICON	0x555b8	0x8a8	dBase IV DBT of @.DBF, block length 1024, next free block index 40, next free block 16120058, next used block 16120572	English	United States
RT_ICON	0x55e60	0x568	GLS_BINARY_LSB_FIRST	English	United States
RT_ICON	0x563c8	0x10a8	data	English	United States
RT_ICON	0x57470	0x468	GLS_BINARY_LSB_FIRST	English	United States
RT_ICON	0x57938	0x2e8	dBase IV DBT of @.DBF, block length 512, next free block index 40, next free block 1953286086, next used block 128	English	United States
RT_ICON	0x57c20	0x128	GLS_BINARY_LSB_FIRST	English	United States
RT_ICON	0x57d48	0x8a8	dBase IV DBT of @.DBF, block length 1024, next free block index 40, next free block 15265516, next used block 14937073	English	United States
RT_ICON	0x585f0	0x568	GLS_BINARY_LSB_FIRST	English	United States
RT_ICON	0x58b58	0x10a8	data	English	United States
RT_ICON	0x59c00	0x468	GLS_BINARY_LSB_FIRST	English	United States
RT_ICON	0x5a0c8	0x2e8	dBase IV DBT of @.DBF, block length 512, next free block index 40, next free block 4177497999, next used block 7374984	English	United States
RT_ICON	0x5a3b0	0x8a8	dBase IV DBT of @.DBF, block length 1024, next free block index 40, next free block 0, next used block 0	English	United States
RT_ICON	0x5ac58	0x10a8	data	English	United States
RT_ICON	0x5bd30	0x2e8	dBase IV DBT of @.DBF, block length 512, next free block index 40, next free block 4287627263, next used block 8947847	English	United States
RT_ICON	0x5c018	0x8a8	dBase IV DBT of @.DBF, block length 1024, next free block index 40, next free block 15724527, next used block 14870778	English	United States
RT_ICON	0x5c8c0	0x10a8	data	English	United States
RT_ICON	0x5d998	0x2e8	dBase IV DBT of @.DBF, block length 512, next free block index 40, next free block 4177526783, next used block 15792376	English	United States
RT_ICON	0x5dc80	0x128	GLS_BINARY_LSB_FIRST	English	United States
RT_ICON	0x5dda8	0x8a8	dBase IV DBT of @.DBF, block length 1024, next free block index 40, next free block 14808529, next used block 15399129	English	United States
RT_ICON	0x5e650	0x568	GLS_BINARY_LSB_FIRST	English	United States
RT_ICON	0x5ebb8	0x10a8	data	English	United States
RT_ICON	0x5fc60	0x468	GLS_BINARY_LSB_FIRST	English	United States
RT_ICON	0x60128	0x2e8	dBase IV DBT of @.DBF, block length 512, next free block index 40, next free block 248, next used block 52302	English	United States
RT_ICON	0x60410	0x128	GLS_BINARY_LSB_FIRST	English	United States
RT_ICON	0x60560	0x128	GLS_BINARY_LSB_FIRST	English	United States
RT_ICON	0x60688	0x568	GLS_BINARY_LSB_FIRST	English	United States
RT_ICON	0x60bf0	0x468	GLS_BINARY_LSB_FIRST	English	United States
RT_ICON	0x61088	0x128	GLS_BINARY_LSB_FIRST	English	United States
RT_ICON	0x611b0	0x568	GLS_BINARY_LSB_FIRST	English	United States
RT_ICON	0x61718	0x468	GLS_BINARY_LSB_FIRST	English	United States
RT_ICON	0x61bb0	0x128	GLS_BINARY_LSB_FIRST	English	United States
RT_ICON	0x61cd8	0x568	GLS_BINARY_LSB_FIRST	English	United States
RT_ICON	0x62240	0x468	GLS_BINARY_LSB_FIRST	English	United States
RT_ICON	0x626d8	0x668	data	English	United States
RT_ICON	0x62d40	0x2e8	dBase IV DBT of @.DBF, block length 512, next free block index 40, next free block 3096152115, next used block 7829367	English	United States
RT_ICON	0x63028	0x128	GLS_BINARY_LSB_FIRST	English	United States
RT_ICON	0x63150	0xea8	data	English	United States
RT_ICON	0x63ff8	0x8a8	dBase IV DBT of @.DBF, block length 1024, next free block index 40, next free block 16251127, next used block 16185593	English	United States
RT_ICON	0x648a0	0x568	GLS_BINARY_LSB_FIRST	English	United States
RT_ICON	0x64e08	0x25a8	data	English	United States
RT_ICON	0x673b0	0x10a8	data	English	United States
RT_ICON	0x68458	0x468	GLS_BINARY_LSB_FIRST	English	United States
RT_ICON	0x68948	0x2e8	dBase IV DBT of @.DBF, block length 512, next free block index 40, next free block 4177497999, next used block 7374984	English	United States
RT_ICON	0x68c30	0x128	GLS_BINARY_LSB_FIRST	English	United States
RT_ICON	0x68d58	0x8a8	dBase IV DBT of @.DBF, block length 1024, next free block index 40, next free block 0, next used block 0	English	United States
RT_ICON	0x69600	0x568	GLS_BINARY_LSB_FIRST	English	United States
RT_ICON	0x69b68	0x10a8	data	English	United States
RT_ICON	0x6ac10	0x468	GLS_BINARY_LSB_FIRST	English	United States
RT_ICON	0x6b0d8	0x2e8	dBase IV DBT of @.DBF, block length 512, next free block index 40, next free block 3096152115, next used block 7829367	English	United States
RT_ICON	0x6b3c0	0x128	GLS_BINARY_LSB_FIRST	English	United States
RT_ICON	0x6b4e8	0x8a8	dBase IV DBT of @.DBF, block length 1024, next free block index 40, next free block 16709604, next used block 16118257	English	United States
RT_ICON	0x6bd90	0x568	GLS_BINARY_LSB_FIRST	English	United States
RT_ICON	0x6c2f8	0x10a8	data	English	United States
RT_ICON	0x6d3a0	0x468	GLS_BINARY_LSB_FIRST	English	United States
RT_ICON	0x6d868	0x2e8	dBase IV DBT of @.DBF, block length 512, next free block index 40, next free block 3096152115, next used block 7829367	English	United States
RT_ICON	0x6db50	0x128	GLS_BINARY_LSB_FIRST	English	United States
RT_ICON	0x6dc78	0x8a8	dBase IV DBT of @.DBF, block length 1024, next free block index 40, next free block 16709604, next used block 16118257	English	United States
RT_ICON	0x6e520	0x568	GLS_BINARY_LSB_FIRST	English	United States
RT_ICON	0x6ea88	0x10a8	data	English	United States
RT_ICON	0x6fb30	0x468	GLS_BINARY_LSB_FIRST	English	United States
RT_ICON	0x6fff8	0x2e8	dBase IV DBT of @.DBF, block length 512, next free block index 40, next free block 3096152115, next used block 7829367	English	United States
RT_ICON	0x702e0	0x128	GLS_BINARY_LSB_FIRST	English	United States
RT_ICON	0x70408	0x8a8	dBase IV DBT of @.DBF, block length 1024, next free block index 40, next free block 16709604, next used block 16118257	English	United States
RT_ICON	0x70cb0	0x568	GLS_BINARY_LSB_FIRST	English	United States
RT_ICON	0x71218	0x10a8	data	English	United States
RT_ICON	0x722c0	0x468	GLS_BINARY_LSB_FIRST	English	United States
RT_ICON	0x72788	0x2e8	dBase IV DBT of @.DBF, block length 512, next free block index 40, next free block 3337062286, next used block 28791	English	United States
RT_ICON	0x72a70	0x128	GLS_BINARY_LSB_FIRST	English	United States
RT_ICON	0x72b98	0x8a8	dBase IV DBT of @.DBF, block length 1024, next free block index 40, next free block 13036186, next used block 16055484	English	United States
RT_ICON	0x73440	0x568	GLS_BINARY_LSB_FIRST	English	United States
RT_ICON	0x739a8	0x10a8	data	English	United States
RT_ICON	0x74a50	0x468	GLS_BINARY_LSB_FIRST	English	United States
RT_ICON	0x74f18	0x2e8	dBase IV DBT of @.DBF, block length 512, next free block index 40, next free block 51, next used block 0	English	United States
RT_ICON	0x75200	0x128	GLS_BINARY_LSB_FIRST	English	United States
RT_ICON	0x75328	0x8a8	dBase IV DBT of @.DBF, block length 1024, next free block index 40, next free block 0, next used block 0	English	United States
RT_ICON	0x75bd0	0x568	GLS_BINARY_LSB_FIRST	English	United States
RT_ICON	0x76138	0x10a8	data	English	United States
RT_ICON	0x771e0	0x468	GLS_BINARY_LSB_FIRST	English	United States
RT_ICON	0x776a8	0x2e8	dBase IV DBT of @.DBF, block length 512, next free block index 40, next free block 16287887, next used block 0	English	United States
RT_ICON	0x77990	0x8a8	dBase IV DBT of @.DBF, block length 1024, next free block index 40, next free block 16184819, next used block 16185078	English	United States
RT_ICON	0x78238	0x10a8	data	English	United States
RT_ICON	0x79310	0x2e8	dBase IV DBT of @.DBF, block length 512, next free block index 40, next free block 4294967295, next used block 7899271	English	United States
RT_ICON	0x795f8	0x8a8	dBase IV DBT of @.DBF, block length 1024, next free block index 40, next free block 0, next used block 0	English	United States
RT_ICON	0x79ea0	0x10a8	data	English	United States
RT_ICON	0x7af78	0x668	data	English	United States
RT_ICON	0x7b5e0	0x2e8	dBase IV DBT of @.DBF, block length 512, next free block index 40, next free block 4160749567, next used block 8423559	English	United States
RT_ICON	0x7b8c8	0x128	GLS_BINARY_LSB_FIRST	English	United States
RT_ICON	0x7b9f0	0xea8	data	English	United States
RT_ICON	0x7c898	0x8a8	dBase IV DBT of @.DBF, block length 1024, next free block index 40, next free block 0, next used block 0	English	United States
RT_ICON	0x7d140	0x568	GLS_BINARY_LSB_FIRST	English	United States
RT_ICON	0x7d6a8	0x414c	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States
RT_ICON	0x817f8	0x25a8	data	English	United States
RT_ICON	0x83da0	0x10a8	data	English	United States
RT_ICON	0x84e48	0x468	GLS_BINARY_LSB_FIRST	English	United States
RT_ICON	0x85348	0x668	data	English	United States
RT_ICON	0x859b0	0x2e8	dBase IV DBT of @.DBF, block length 512, next free block index 40, next free block 4008635955, next used block 770286	English	United States
RT_ICON	0x85c98	0x1e8	data	English	United States
RT_ICON	0x85e80	0x128	GLS_BINARY_LSB_FIRST	English	United States
RT_ICON	0x85fa8	0xea8	data	English	United States
RT_ICON	0x86e50	0x8a8	dBase IV DBT of @.DBF, block length 1024, next free block index 40, next free block 16182429, next used block 16773761	English	United States
RT_ICON	0x876f8	0x6c8	data	English	United States
RT_ICON	0x87dc0	0x568	GLS_BINARY_LSB_FIRST	English	United States
RT_ICON	0x88328	0xcbf1	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States
RT_ICON	0x94f20	0x25a8	data	English	United States
RT_ICON	0x974c8	0x10a8	data	English	United States
RT_ICON	0x98570	0x988	data	English	United States
RT_ICON	0x98ef8	0x468	GLS_BINARY_LSB_FIRST	English	United States
RT_ICON	0x99420	0x668	data	English	United States
RT_ICON	0x99a88	0x2e8	dBase IV DBT of @.DBF, block length 512, next free block index 40, next free block 3096152115, next used block 7829367	English	United States
RT_ICON	0x99d70	0x1e8	data	English	United States
RT_ICON	0x99f58	0x128	GLS_BINARY_LSB_FIRST	English	United States
RT_ICON	0x9a080	0xea8	data	English	United States
RT_ICON	0x9af28	0x8a8	dBase IV DBT of @.DBF, block length 1024, next free block index 40, next free block 16251127, next used block 16185593	English	United States
RT_ICON	0x9b7d0	0x6c8	data	English	United States
RT_ICON	0x9be98	0x568	GLS_BINARY_LSB_FIRST	English	United States
RT_ICON	0x9c400	0x97d2	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States
RT_ICON	0xa5bd8	0x25a8	data	English	United States
RT_ICON	0xa8180	0x10a8	data	English	United States
RT_ICON	0xa9228	0x988	data	English	United States
RT_ICON	0xa9bb0	0x468	GLS_BINARY_LSB_FIRST	English	United States
RT_ICON	0xaa0d8	0x668	data	English	United States
RT_ICON	0xaa740	0x2e8	dBase IV DBT of @.DBF, block length 512, next free block index 40, next free block 4008635955, next used block 770286	English	United States
RT_ICON	0xaaa28	0x1e8	data	English	United States
RT_ICON	0xaac10	0x128	GLS_BINARY_LSB_FIRST	English	United States
RT_ICON	0xaad38	0xea8	data	English	United States
RT_ICON	0xabbe0	0x8a8	dBase IV DBT of @.DBF, block length 1024, next free block index 40, next free block 16182429, next used block 16773761	English	United States
RT_ICON	0xac488	0x6c8	data	English	United States
RT_ICON	0xacb50	0x568	GLS_BINARY_LSB_FIRST	English	United States
RT_ICON	0xad0b8	0xcbf1	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States
RT_ICON	0xb9cb0	0x25a8	data	English	United States
RT_ICON	0xbc258	0x10a8	data	English	United States
RT_ICON	0xbd300	0x988	data	English	United States
RT_ICON	0xbdc88	0x468	GLS_BINARY_LSB_FIRST	English	United States
RT_ICON	0xbe1b0	0x668	data	English	United States
RT_ICON	0xbe818	0x2e8	dBase IV DBT of @.DBF, block length 512, next free block index 40, next free block 3096152115, next used block 7829367	English	United States
RT_ICON	0xbeb00	0x1e8	data	English	United States
RT_ICON	0xbece8	0x128	GLS_BINARY_LSB_FIRST	English	United States
RT_ICON	0xbee10	0xea8	data	English	United States
RT_ICON	0xbfcb8	0x8a8	dBase IV DBT of @.DBF, block length 1024, next free block index 40, next free block 16251127, next used block 16185593	English	United States
RT_ICON	0xc0560	0x6c8	data	English	United States
RT_ICON	0xc0c28	0x568	GLS_BINARY_LSB_FIRST	English	United States
RT_ICON	0xc1190	0x97d2	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States
RT_ICON	0xca968	0x25a8	data	English	United States
RT_ICON	0xccf10	0x10a8	data	English	United States
RT_ICON	0xcdfb8	0x988	data	English	United States
RT_ICON	0xce940	0x468	GLS_BINARY_LSB_FIRST	English	United States
RT_GROUP_ICON	0xbe0f0	0xbc	data	English	United States
RT_GROUP_ICON	0x99360	0xbc	data	English	United States
RT_GROUP_ICON	0xceda8	0xbc	data	English	United States
RT_GROUP_ICON	0xaa018	0xbc	data	English	United States
RT_GROUP_ICON	0x424c8	0xbc	data	English	United States
RT_GROUP_ICON	0x53180	0xbc	data	English	United States
RT_GROUP_ICON	0x54e78	0x30	data	English	United States
RT_GROUP_ICON	0x55190	0x14	data	English	United States
RT_GROUP_ICON	0x5a068	0x5a	data	English	United States
RT_GROUP_ICON	0x578d8	0x5a	data	English	United States
RT_GROUP_ICON	0x5bd00	0x30	data	English	United States
RT_GROUP_ICON	0x5d968	0x30	data	English	United States
RT_GROUP_ICON	0x60538	0x22	data	English	United States
RT_GROUP_ICON	0x600c8	0x5a	data	English	United States
RT_GROUP_ICON	0x74eb8	0x5a	data	English	United States
RT_GROUP_ICON	0x61058	0x30	data	English	United States
RT_GROUP_ICON	0x61b80	0x30	data	English	United States
RT_GROUP_ICON	0x626a8	0x30	data	English	United States
RT_GROUP_ICON	0x77648	0x5a	data	English	United States
RT_GROUP_ICON	0x688c0	0x84	data	English	United States
RT_GROUP_ICON	0x6b078	0x5a	data	English	United States
RT_GROUP_ICON	0x6d808	0x5a	data	English	United States
RT_GROUP_ICON	0x6ff98	0x5a	data	English	United States
RT_GROUP_ICON	0x72728	0x5a	data	English	United States
RT_GROUP_ICON	0x792e0	0x30	data	English	United States
RT_GROUP_ICON	0x7af48	0x30	data	English	United States
RT_GROUP_ICON	0x852b0	0x92	data	English	United States
RT_VERSION	0xcee68	0x5e0	data	English	United States
RT_MANIFEST	0x14960	0x7c9	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States

Imports

DLL	Import
USER32.dll	GetWindowThreadProcessId, AllowSetForegroundWindow, FindWindowExW, SendMessageTimeoutW, IsWindowVisible, SetUserObjectInformationW, IsWindowEnabled
msvcrt.dll	_onexit, __dllonexit, _unlock, _lock, memset, _commode, __C_specific_handler, _vsnwprintf, memcpy_s, iswspace, ?terminate@@YAXXZ, _purecall, memmove_s, _fmode, _wcmdln, _initterm, __setusermatherr, _cexit, _exit, exit, __set_app_type, wcsncmp, free, _XcptFilter, _amsg_exit, __wgetmainargs, memcmp
KERNEL32.dll	CreateThreadpoolTimer, ReleaseSRWLockShared, SetThreadpoolTimer, CloseHandle, HeapSetInformation, WaitForSingleObjectEx, DelayLoadFailureHook, ResolveDelayLoadedAPI, GetProcAddress, HeapAlloc, OpenSemaphoreW, SetDllDirectoryW, AcquireSRWLockExclusive, GetTickCount, GetSystemTimeAsFileTime, QueryPerformanceCounter, SetUnhandledExceptionFilter, UnhandledExceptionFilter, RtlVirtualUnwind, RtlLookupFunctionEntry, RtlCaptureContext, GetStartupInfoW, Sleep, IsDebuggerPresent, InitOnceComplete, DebugBreak, GetModuleHandleW, GetProcessHeap, GetCurrentProcessId, DeleteCriticalSection, AcquireSRWLockShared, LocalFree, GetModuleFileNameA, InitOnceBeginInitialize, CreateSemaphoreExW, HeapFree, SetLastError, EnterCriticalSection, GetCommandLineW, GetCurrentProcess, ReleaseSemaphore, GetModuleHandleExW, TerminateProcess, LeaveCriticalSection, InitializeCriticalSection, SetErrorMode, InitializeCriticalSectionEx, WaitForThreadpoolTimerCallbacks, WaitForSingleObject, LocalAlloc, GetCurrentThreadId, ReleaseMutex, FormatMessageW, GetLastError, ReleaseSRWLockExclusive, OutputDebugStringW, CloseThreadpoolTimer, CreateMutexExW
api-ms-win-downlevel-advapi32-l1-1-0.dll	RegGetValueW, EventRegister, EventWriteTransfer, EventWriteEx, EventUnregister
api-ms-win-downlevel-shell32-l1-1-0.dll	SetCurrentProcessExplicitAppUserModelID
ADVAPI32.dll	EventSetInformation
iertutil.dll
api-ms-win-downlevel-shlwapi-l1-1-0.dll	StrStrIW
api-ms-win-downlevel-ole32-l1-1-0.dll	CoCreateGuid

Version Infos

Description	Data
LegalCopyright	Microsoft Corporation. All rights reserved.
InternalName	iexplore
FileVersion	11.00.19041.1202 (WinBuild.160101.0800)
CompanyName	Microsoft Corporation
ProductName	Internet Explorer
ProductVersion	11.00.19041.1202
FileDescription	Internet Explorer
OriginalFilename	IEXPLORE.EXE
LegalCopyright	Microsoft Corporation. All rights reserved.
InternalName	iexplore
FileVersion	11.00.19041.1202
CompanyName	Microsoft Corporation
ProductName	Internet Explorer
ProductVersion	11.00.19041.1202
FileDescription	Internet Explorer
OriginalFilename	IEXPLORE.EXE
Translation	0x0409 0x04b0

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

No network behavior found

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

System Behavior

Analysis Process: iexplore.exe PID: 4524 Parent PID: 3452

General

Start time:	16:41:53
Start date:	29/11/2021
Path:	C:\Users\user\Desktop\iexplore.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\iexplore.exe"
Imagebase:	0x7ff7ab330000
File size:	842208 bytes
MD5 hash:	AA094DE5B8EF17848A5926C13EB67E26
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: iexplore.exe PID: 4524 Parent PID: 3452 iexplore.exeCOMMON

Execution Graph

Execution Coverage:	6.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	11%
Total number of Nodes:	826
Total number of Limit Nodes:	3

Executed Functions

Function 00007FF7AB3320F0, Relevance: 103.9, APIs: 41, Strings: 18, Instructions: 634memoryregistrylibraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7AB337BA4: EventRegister.API-MS-WIN-DOWNLEVEL-ADVAPI32-L1-1-0(?,?,?,?,00007FF7AB33210F), ref: 00007FF7AB337BCB

InitializeCriticalSection.KERNEL32 ref: 00007FF7AB332134
#798.IERTUTIL ref: 00007FF7AB332150
CoCreateGuid.API-MS-WIN-DOWNLEVEL-OLE32-L1-1-0 ref: 00007FF7AB332170
IsDebuggerPresent.KERNEL32 ref: 00007FF7AB3321B0
#796.IERTUTIL ref: 00007FF7AB33221F
#797.IERTUTIL ref: 00007FF7AB332270
#701.IERTUTIL ref: 00007FF7AB3322B3
GetModuleHandleW.KERNEL32 ref: 00007FF7AB3322E7
GetProcAddress.KERNEL32 ref: 00007FF7AB332302
SetDllDirectoryW.KERNEL32 ref: 00007FF7AB332325
SetErrorMode.KERNEL32 ref: 00007FF7AB332336
GetCommandLineW.KERNEL32 ref: 00007FF7AB332342
wcsncmp.MSVCRT ref: 00007FF7AB332361
LocalAlloc.KERNEL32 ref: 00007FF7AB332409
StrStrIW.API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0 ref: 00007FF7AB3324AC
StrStrIW.API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0 ref: 00007FF7AB33250C
StrStrIW.API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0 ref: 00007FF7AB332569
HeapSetInformation.KERNEL32 ref: 00007FF7AB3325EB
#791.IERTUTIL ref: 00007FF7AB332601
SetCurrentProcessExplicitAppUserModelID.API-MS-WIN-DOWNLEVEL-SHELL32-L1-1-0 ref: 00007FF7AB332621
StrStrIW.API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0 ref: 00007FF7AB332646
StrStrIW.API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0 ref: 00007FF7AB3326F0
FindWindowExW.USER32 ref: 00007FF7AB33274F
GetWindowThreadProcessId.USER32 ref: 00007FF7AB33276A
AllowSetForegroundWindow.USER32 ref: 00007FF7AB332779
StrStrIW.API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0 ref: 00007FF7AB3327B7
wcsncmp.MSVCRT ref: 00007FF7AB332839
iswspace.MSVCRT ref: 00007FF7AB332855
iswspace.MSVCRT ref: 00007FF7AB332873
iswspace.MSVCRT ref: 00007FF7AB332886
iswspace.MSVCRT ref: 00007FF7AB33289E
wcsncmp.MSVCRT ref: 00007FF7AB3328BE
#796.IERTUTIL ref: 00007FF7AB33291F
LocalFree.KERNEL32 ref: 00007FF7AB332A29
#650.IERTUTIL ref: 00007FF7AB332A8D
#650.IERTUTIL ref: 00007FF7AB332ABE
DeleteCriticalSection.KERNEL32 ref: 00007FF7AB332AF7
RegGetValueW.KERNEL32 ref: 00007FF7AB332B51
GetCurrentProcess.KERNEL32 ref: 00007FF7AB332B73
TerminateProcess.KERNEL32 ref: 00007FF7AB332B85

Strings

-startmanager, xrefs: 00007FF7AB3329D3
-new, xrefs: 00007FF7AB332502
-nowait, xrefs: 00007FF7AB33255F
{28fb17e0-d393-439d-9a21-9474a070473a} , xrefs: 00007FF7AB332354
Microsoft.InternetExplorer.Preview, xrefs: 00007FF7AB332616
kernel32.dll, xrefs: 00007FF7AB3322E0
SetSearchPathMode, xrefs: 00007FF7AB3322F8
-embedding, xrefs: 00007FF7AB332995
CREDAT:, xrefs: 00007FF7AB3328B4
TerminateOnShutdown, xrefs: 00007FF7AB332B21
SCODEF:, xrefs: 00007FF7AB33282F
-newtab, xrefs: 00007FF7AB3326E6, 00007FF7AB3327AA
IEFrame, xrefs: 00007FF7AB332743
Internet Explorer, xrefs: 00007FF7AB332265
-ResetDestinationList, xrefs: 00007FF7AB33263A
Microsoft.InternetExplorer.Default, xrefs: 00007FF7AB33260F
Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iexplore.exe, xrefs: 00007FF7AB332B38
-eval, xrefs: 00007FF7AB3324A2

Memory Dump Source

Source File: 00000000.00000002.303888721.00007FF7AB331000.00000020.00020000.sdmp, Offset: 00007FF7AB330000, based on PE: true

Associated: 00000000.00000002.303884753.00007FF7AB330000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303903109.00007FF7AB33B000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303915158.00007FF7AB33F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303921541.00007FF7AB340000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303927069.00007FF7AB342000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ab330000_iexplore.jbxd

Similarity

API ID: Processiswspace$Windowwcsncmp$#650#796CriticalCurrentLocalSection$#701#791#797#798AddressAllocAllowCommandCreateDebuggerDeleteDirectoryErrorEventExplicitFindForegroundFreeGuidHandleHeapInformationInitializeLineModeModelModulePresentProcRegisterTerminateThreadUserValue
String ID: -ResetDestinationList$-embedding$-eval$-new$-newtab$-nowait$-startmanager$CREDAT:$IEFrame$Internet Explorer$Microsoft.InternetExplorer.Default$Microsoft.InternetExplorer.Preview$SCODEF:$SetSearchPathMode$Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iexplore.exe$TerminateOnShutdown$kernel32.dll${28fb17e0-d393-439d-9a21-9474a070473a}
API String ID: 1949848870-2116736064
Opcode ID: 5cbf7e3b62b0e1b2dd0339fa934ce8da59108eb7c585c4458d5ad134622346d7
Instruction ID: 15120eb97e55223d8a971591a682dbd3d922d9f4ba94c244a9f82d985e686366
Opcode Fuzzy Hash: 5cbf7e3b62b0e1b2dd0339fa934ce8da59108eb7c585c4458d5ad134622346d7
Instruction Fuzzy Hash: 64526625A0AE4286E7586B18E4102BAF7A0FF45B45FC68139CA5E437B4EF3DE45DC720

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AB332C20, Relevance: 1.5, APIs: 1, Instructions: 12
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrResolveDelayLoadedAPI.NTDLL ref: 00007FF7AB332C4B

Memory Dump Source

Source File: 00000000.00000002.303888721.00007FF7AB331000.00000020.00020000.sdmp, Offset: 00007FF7AB330000, based on PE: true

Associated: 00000000.00000002.303884753.00007FF7AB330000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303903109.00007FF7AB33B000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303915158.00007FF7AB33F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303921541.00007FF7AB340000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303927069.00007FF7AB342000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ab330000_iexplore.jbxd

Similarity

API ID: DelayLoadedResolve
String ID:
API String ID: 841769287-0
Opcode ID: eea864d283906364419ae6e519fdaa41bf6c95a093a1099331d4b2ad11d967b4
Instruction ID: 3ea78e8685a88538be67e633f9d95eef38453e7dfe87bb9e662a9b7ba7ec9cea
Opcode Fuzzy Hash: eea864d283906364419ae6e519fdaa41bf6c95a093a1099331d4b2ad11d967b4
Instruction Fuzzy Hash: 35E0ECB4909E41D6D614AF09E84016AFBA0FB49784FC1423ADD4C87330DF3CE119CB20

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AB3335F0, Relevance: 1.5, APIs: 1, Instructions: 6
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF7AB3335FB

Memory Dump Source

Source File: 00000000.00000002.303888721.00007FF7AB331000.00000020.00020000.sdmp, Offset: 00007FF7AB330000, based on PE: true

Associated: 00000000.00000002.303884753.00007FF7AB330000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303903109.00007FF7AB33B000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303915158.00007FF7AB33F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303921541.00007FF7AB340000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303927069.00007FF7AB342000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ab330000_iexplore.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 6001aa6e275cb08d08a7307cc9a0546da0be092fc9bf1e545be47e08ac8f896d
Instruction ID: 9a8882f9af7548b62f4117541b5c6d7c792c14f61085bccf8dbe49154a423ac1
Opcode Fuzzy Hash: 6001aa6e275cb08d08a7307cc9a0546da0be092fc9bf1e545be47e08ac8f896d
Instruction Fuzzy Hash: 57B09210E2A846C1E608BB25DCC506652A0BB58300FC20474C00DC1130EF6C919F8710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AB333060, Relevance: 10.6, APIs: 7, Instructions: 143
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStartupInfoW.KERNEL32 ref: 00007FF7AB333088
Sleep.KERNEL32 ref: 00007FF7AB3330BF
_amsg_exit.MSVCRT ref: 00007FF7AB3330DD
_initterm.MSVCRT ref: 00007FF7AB333168
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF7AB333195
exit.KERNELBASE ref: 00007FF7AB33323A
_cexit.MSVCRT ref: 00007FF7AB333249

Memory Dump Source

Source File: 00000000.00000002.303888721.00007FF7AB331000.00000020.00020000.sdmp, Offset: 00007FF7AB330000, based on PE: true

Associated: 00000000.00000002.303884753.00007FF7AB330000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303903109.00007FF7AB33B000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303915158.00007FF7AB33F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303921541.00007FF7AB340000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303927069.00007FF7AB342000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ab330000_iexplore.jbxd

Similarity

API ID: CurrentImageInfoNonwritableSleepStartup_amsg_exit_cexit_inittermexit
String ID:
API String ID: 642454821-0
Opcode ID: bb44e4616eb5c65ff88db3840147a3e2a0d5ed5ed27fd7d857889ee307af0b61
Instruction ID: 7663b1b09a135fa5f988470e16b5bf3a952b71e4ba0680743dcd3b3886ea149d
Opcode Fuzzy Hash: bb44e4616eb5c65ff88db3840147a3e2a0d5ed5ed27fd7d857889ee307af0b61
Instruction Fuzzy Hash: 67612E25E0AE4282F768BB19E54023BB2A1FF44740FD6907DDA4D972B4DF3DE8498720

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AB332BB0, Relevance: 4.5, APIs: 3, Instructions: 38
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#701.IERTUTIL ref: 00007FF7AB332BCA

Memory Dump Source

Source File: 00000000.00000002.303888721.00007FF7AB331000.00000020.00020000.sdmp, Offset: 00007FF7AB330000, based on PE: true

Associated: 00000000.00000002.303884753.00007FF7AB330000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303903109.00007FF7AB33B000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303915158.00007FF7AB33F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303921541.00007FF7AB340000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303927069.00007FF7AB342000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ab330000_iexplore.jbxd

Similarity

API ID: #701
String ID:
API String ID: 1014962704-0
Opcode ID: 375732511076648e0a83a30ea8489711de65745c5fbe41c3a49013bee76c81e9
Instruction ID: 11e09f650584ac5a6ef24ec82d1d5885dee3cc981524fcc2b1a29b79e7844fb8
Opcode Fuzzy Hash: 375732511076648e0a83a30ea8489711de65745c5fbe41c3a49013bee76c81e9
Instruction Fuzzy Hash: 9E012535A0AE4287E718AF1DA84027AF6A0FB48740FC6813DD65D83270DF3DE54C9660

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AB333010, Relevance: 1.5, APIs: 1, Instructions: 13
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__wgetmainargs.KERNELBASE ref: 00007FF7AB333048

Memory Dump Source

Source File: 00000000.00000002.303888721.00007FF7AB331000.00000020.00020000.sdmp, Offset: 00007FF7AB330000, based on PE: true

Associated: 00000000.00000002.303884753.00007FF7AB330000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303903109.00007FF7AB33B000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303915158.00007FF7AB33F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303921541.00007FF7AB340000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303927069.00007FF7AB342000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ab330000_iexplore.jbxd

Similarity

API ID: __wgetmainargs
String ID:
API String ID: 1709950718-0
Opcode ID: 84a41f47b81593a0fce2650ce5227a3a3db9e5ba608a78087453a4b2b347f97e
Instruction ID: e59df67772dbf6425c8c880c20509d826661525e85410dd48af037a3b9167852
Opcode Fuzzy Hash: 84a41f47b81593a0fce2650ce5227a3a3db9e5ba608a78087453a4b2b347f97e
Instruction Fuzzy Hash: 15E07574E0AE43D6EA08AB19F9448AAB7B0FB54314FC2013AD40C52330DE7CA18ECB20

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00007FF7AB3337C4, Relevance: 9.0, APIs: 6, Instructions: 49
timethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF7AB3337F4
GetCurrentProcessId.KERNEL32 ref: 00007FF7AB333802
GetCurrentThreadId.KERNEL32 ref: 00007FF7AB33380E
GetTickCount.KERNEL32 ref: 00007FF7AB33381A
GetTickCount.KERNEL32 ref: 00007FF7AB33382A
QueryPerformanceCounter.KERNEL32 ref: 00007FF7AB333845

Memory Dump Source

Source File: 00000000.00000002.303888721.00007FF7AB331000.00000020.00020000.sdmp, Offset: 00007FF7AB330000, based on PE: true

Associated: 00000000.00000002.303884753.00007FF7AB330000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303903109.00007FF7AB33B000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303915158.00007FF7AB33F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303921541.00007FF7AB340000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303927069.00007FF7AB342000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ab330000_iexplore.jbxd

Similarity

API ID: CountCurrentTickTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 4104442557-0
Opcode ID: 9c0ad25faf5b7ff3877069055f39c091cdf0618391105c93fa88f110419690c0
Instruction ID: f3948bb20edebf75636f01d938430f52dad7e54ac62b4459a06f9e88ddba3bd2
Opcode Fuzzy Hash: 9c0ad25faf5b7ff3877069055f39c091cdf0618391105c93fa88f110419690c0
Instruction Fuzzy Hash: 3C115421A05F4186EB04EF74E8441A973A4FB48758F810B39EA6D87774EF7CD1A98350

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AB338858, Relevance: 1.3, APIs: 1, Instructions: 11memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF7AB332F15), ref: 00007FF7AB338861

Memory Dump Source

Source File: 00000000.00000002.303888721.00007FF7AB331000.00000020.00020000.sdmp, Offset: 00007FF7AB330000, based on PE: true

Associated: 00000000.00000002.303884753.00007FF7AB330000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303903109.00007FF7AB33B000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303915158.00007FF7AB33F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303921541.00007FF7AB340000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303927069.00007FF7AB342000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ab330000_iexplore.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: e456fe8bafceeb06a2a5256b0ef70a585623336f29cce5542d887ee989b1686f
Instruction ID: 29abb7f1388adbb05262cd94fd441bf61302d0ac2ca5aa81c2652a9637836012
Opcode Fuzzy Hash: e456fe8bafceeb06a2a5256b0ef70a585623336f29cce5542d887ee989b1686f
Instruction Fuzzy Hash: E0C01211A45E46C2E61857976440079D691E74EB50B4A9234CE1D49331AD3D50D64700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AB338A20, Relevance: 26.4, APIs: 2, Strings: 13, Instructions: 153
windowthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FormatMessageW.KERNEL32 ref: 00007FF7AB338B07
GetCurrentThreadId.KERNEL32 ref: 00007FF7AB338B8B

Strings

%hs(%u)\%hs!%p: , xrefs: 00007FF7AB338B33
Exception, xrefs: 00007FF7AB338AD3
ReturnHr, xrefs: 00007FF7AB338ACA
(caller: %p) , xrefs: 00007FF7AB338B76
FailFast, xrefs: 00007FF7AB338AB8
[%hs], xrefs: 00007FF7AB338C5F
CallContext:[%hs] , xrefs: 00007FF7AB338C1F
LogHr, xrefs: 00007FF7AB338AC1
, xrefs: 00007FF7AB338BE9
%hs(%d) tid(%x) %08X %ws, xrefs: 00007FF7AB338BA4
Msg:[%ws] , xrefs: 00007FF7AB338C04
%hs!%p: , xrefs: 00007FF7AB338B53
[%hs(%hs)], xrefs: 00007FF7AB338C46

Memory Dump Source

Source File: 00000000.00000002.303888721.00007FF7AB331000.00000020.00020000.sdmp, Offset: 00007FF7AB330000, based on PE: true

Associated: 00000000.00000002.303884753.00007FF7AB330000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303903109.00007FF7AB33B000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303915158.00007FF7AB33F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303921541.00007FF7AB340000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303927069.00007FF7AB342000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ab330000_iexplore.jbxd

Similarity

API ID: CurrentFormatMessageThread
String ID: $%hs!%p: $%hs(%d) tid(%x) %08X %ws$%hs(%u)\%hs!%p: $(caller: %p) $CallContext:[%hs] $Exception$FailFast$LogHr$Msg:[%ws] $ReturnHr$[%hs(%hs)]$[%hs]
API String ID: 2411632146-3173542853
Opcode ID: 9fc4017353fe67f11798250c32e7db4edb151911d2ec7257e57637a89284ec48
Instruction ID: 470c6dc440923a639520153588517d67ef27d873d456e6f374d3eaa8db9b8f04
Opcode Fuzzy Hash: 9fc4017353fe67f11798250c32e7db4edb151911d2ec7257e57637a89284ec48
Instruction Fuzzy Hash: 1D61A265A0AE82C5EB58EF59A4142BAE7A0FF48B84F86013AD94D077B4DF3DE548C710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AB3390F0, Relevance: 12.1, APIs: 8, Instructions: 102
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WaitForSingleObject.KERNEL32(?,?,00000000,00007FF7AB33A17C), ref: 00007FF7AB339102

Memory Dump Source

Source File: 00000000.00000002.303888721.00007FF7AB331000.00000020.00020000.sdmp, Offset: 00007FF7AB330000, based on PE: true

Associated: 00000000.00000002.303884753.00007FF7AB330000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303903109.00007FF7AB33B000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303915158.00007FF7AB33F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303921541.00007FF7AB340000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303927069.00007FF7AB342000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ab330000_iexplore.jbxd

Similarity

API ID: ObjectSingleWait
String ID:
API String ID: 24740636-0
Opcode ID: 0c1801d4bfbbe64a610bb6b346ba12615d999605ac4b3a98c56ddeb84a1ca479
Instruction ID: 1e1d1784035f16ba1f65aceb9edb94f25609cca8baf792062e1a43636c32d1b0
Opcode Fuzzy Hash: 0c1801d4bfbbe64a610bb6b346ba12615d999605ac4b3a98c56ddeb84a1ca479
Instruction Fuzzy Hash: 4441A531A0DE46C6E7686B19D4802BBF661EF89750F968339E90F826B4DF3CD44C8621

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AB335194, Relevance: 9.1, APIs: 6, Instructions: 76
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

AcquireSRWLockShared.KERNEL32(?,?,?,?,?,00007FF7AB3352CE,?,?,?,?,00007FF7AB333A4C), ref: 00007FF7AB3351B5
ReleaseSRWLockShared.KERNEL32(?,?,?,?,?,00007FF7AB3352CE,?,?,?,?,00007FF7AB333A4C), ref: 00007FF7AB3351D5
EnterCriticalSection.KERNEL32(?,?,?,?,?,00007FF7AB3352CE,?,?,?,?,00007FF7AB333A4C), ref: 00007FF7AB3351F5
AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,00007FF7AB3352CE,?,?,?,?,00007FF7AB333A4C), ref: 00007FF7AB335204
ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,00007FF7AB3352CE,?,?,?,?,00007FF7AB333A4C), ref: 00007FF7AB33525C
LeaveCriticalSection.KERNEL32(?,?,?,?,?,00007FF7AB3352CE,?,?,?,?,00007FF7AB333A4C), ref: 00007FF7AB335281

Memory Dump Source

Source File: 00000000.00000002.303888721.00007FF7AB331000.00000020.00020000.sdmp, Offset: 00007FF7AB330000, based on PE: true

Associated: 00000000.00000002.303884753.00007FF7AB330000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303903109.00007FF7AB33B000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303915158.00007FF7AB33F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303921541.00007FF7AB340000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303927069.00007FF7AB342000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ab330000_iexplore.jbxd

Similarity

API ID: Lock$AcquireCriticalExclusiveReleaseSectionShared$EnterLeave
String ID:
API String ID: 3221859647-0
Opcode ID: b74106ef34727cbeeb8ca6eac2aa107dbfef2bfc16bafddf444444188dfa1644
Instruction ID: e62b6f0023d605ea1525df2b817fe53b6f15991a8d5c6d6ecbc92d3be8c5996c
Opcode Fuzzy Hash: b74106ef34727cbeeb8ca6eac2aa107dbfef2bfc16bafddf444444188dfa1644
Instruction Fuzzy Hash: FC318432B0AE5186EA199F15A54417EE760FB89FD0B8B9138DE4E07B34DF3CD5498710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AB3376A4, Relevance: 9.0, APIs: 7, Instructions: 208
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00007FF7AB3376E2

Part of subcall function 00007FF7AB337264: GetProcAddress.KERNEL32 ref: 00007FF7AB33728F

GetProcessHeap.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF7AB337210), ref: 00007FF7AB337781
HeapFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF7AB337210), ref: 00007FF7AB337795
GetProcessHeap.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF7AB337210), ref: 00007FF7AB3377A1
HeapAlloc.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF7AB337210), ref: 00007FF7AB3377B5
GetProcessHeap.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF7AB337210), ref: 00007FF7AB337969
HeapFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF7AB337210), ref: 00007FF7AB33797D

Memory Dump Source

Source File: 00000000.00000002.303888721.00007FF7AB331000.00000020.00020000.sdmp, Offset: 00007FF7AB330000, based on PE: true

Associated: 00000000.00000002.303884753.00007FF7AB330000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303903109.00007FF7AB33B000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303915158.00007FF7AB33F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303921541.00007FF7AB340000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303927069.00007FF7AB342000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ab330000_iexplore.jbxd

Similarity

API ID: Heap$Process$Free$AddressAllocProcmemset
String ID:
API String ID: 2515388404-0
Opcode ID: 77dd1b63861ac2c121acc4bc35a2e1d272bb385a75f5ea7bfda7dd15e39da4ae
Instruction ID: 03d54849c2b8a8a42c13b9e0dbc6abd0ca41ea208c446b53dfece7d6df06af57
Opcode Fuzzy Hash: 77dd1b63861ac2c121acc4bc35a2e1d272bb385a75f5ea7bfda7dd15e39da4ae
Instruction Fuzzy Hash: 06916F32A05B51CAEB24DF69E4409BEB7A0FB48B48B854239DE8E53775DF38D158C710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AB33A050, Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 173COMMON

Download Yara Rule

APIs

OpenSemaphoreW.KERNEL32 ref: 00007FF7AB33A123
GetLastError.KERNEL32 ref: 00007FF7AB33A139
OpenSemaphoreW.KERNEL32 ref: 00007FF7AB33A229

Strings

_p0, xrefs: 00007FF7AB33A0D4

Memory Dump Source

Source File: 00000000.00000002.303888721.00007FF7AB331000.00000020.00020000.sdmp, Offset: 00007FF7AB330000, based on PE: true

Associated: 00000000.00000002.303884753.00007FF7AB330000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303903109.00007FF7AB33B000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303915158.00007FF7AB33F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303921541.00007FF7AB340000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303927069.00007FF7AB342000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ab330000_iexplore.jbxd

Similarity

API ID: OpenSemaphore$ErrorLast
String ID: _p0
API String ID: 3042991519-2437413317
Opcode ID: f1557c01e47004c206fddc2ff79dcc276a62b6e2d5fe048c7d4d16b74e49add2
Instruction ID: 03ceec36f56291b043f15e222e3b58a24d2c046f818163190b53d696adefa12d
Opcode Fuzzy Hash: f1557c01e47004c206fddc2ff79dcc276a62b6e2d5fe048c7d4d16b74e49add2
Instruction Fuzzy Hash: DA616322A0AF8182EA24EB59D4501BFB2A0EF85780F964239DA4E43775EF3DD509C710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AB338360, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 81synchronizationCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 00007FF7AB33838C
CreateMutexExW.KERNEL32 ref: 00007FF7AB3383D7

Part of subcall function 00007FF7AB33708C: GetLastError.KERNEL32 ref: 00007FF7AB3370AE

Strings

Local\SM0:%d:%d:%hs, xrefs: 00007FF7AB33839D
x, xrefs: 00007FF7AB3383A7

Memory Dump Source

Source File: 00000000.00000002.303888721.00007FF7AB331000.00000020.00020000.sdmp, Offset: 00007FF7AB330000, based on PE: true

Associated: 00000000.00000002.303884753.00007FF7AB330000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303903109.00007FF7AB33B000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303915158.00007FF7AB33F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303921541.00007FF7AB340000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303927069.00007FF7AB342000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ab330000_iexplore.jbxd

Similarity

API ID: CreateCurrentErrorLastMutexProcess
String ID: Local\SM0:%d:%d:%hs$x
API String ID: 3298007088-4178846994
Opcode ID: eed129f301d97677bb2cf519e8c9fed1401f1f4c784b69d40b472d6bc9c183bf
Instruction ID: becd1eb281292be6eefe9b9bb4c3f7bd218ae2eba7a874220a1a56da1f420e79
Opcode Fuzzy Hash: eed129f301d97677bb2cf519e8c9fed1401f1f4c784b69d40b472d6bc9c183bf
Instruction Fuzzy Hash: F7313F3261DE8286EB54AB18E4943ABE7A0FB84780F815139E64E87AB5DF7DD44CC710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AB336AD0, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 25libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF7AB336AEF
GetProcAddress.KERNEL32 ref: 00007FF7AB336B05

Strings

kernelbase.dll, xrefs: 00007FF7AB336AE5
RaiseFailFastException, xrefs: 00007FF7AB336AFE

Memory Dump Source

Source File: 00000000.00000002.303888721.00007FF7AB331000.00000020.00020000.sdmp, Offset: 00007FF7AB330000, based on PE: true

Associated: 00000000.00000002.303884753.00007FF7AB330000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303903109.00007FF7AB33B000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303915158.00007FF7AB33F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303921541.00007FF7AB340000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303927069.00007FF7AB342000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ab330000_iexplore.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: RaiseFailFastException$kernelbase.dll
API String ID: 1646373207-919018592
Opcode ID: 703b9dd24187f84f0de25b2be785225a5ba47570205fcf22a8756aecd0cb3ac2
Instruction ID: d04f8f31ddd3dbf88ee5621bdc8ab62d066f75c4b5e584d3d96ba624267641be
Opcode Fuzzy Hash: 703b9dd24187f84f0de25b2be785225a5ba47570205fcf22a8756aecd0cb3ac2
Instruction Fuzzy Hash: 53F0DA21A1AA9582EA08AB06F48407AEB60FB4DBC0B859179DA4E47B34DF3DD4498710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AB333300, Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF7AB333373
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF7AB333392
RtlVirtualUnwind.KERNEL32 ref: 00007FF7AB3333DF
__raise_securityfailure.LIBCMT ref: 00007FF7AB3334C4

Memory Dump Source

Source File: 00000000.00000002.303888721.00007FF7AB331000.00000020.00020000.sdmp, Offset: 00007FF7AB330000, based on PE: true

Associated: 00000000.00000002.303884753.00007FF7AB330000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303903109.00007FF7AB33B000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303915158.00007FF7AB33F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303921541.00007FF7AB340000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303927069.00007FF7AB342000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ab330000_iexplore.jbxd

Similarity

API ID: CaptureContextEntryFunctionLookupUnwindVirtual__raise_securityfailure
String ID:
API String ID: 140117192-0
Opcode ID: c3605477168591f32072404740094eeac01a539d823a42f8c0cbe2a5677cf524
Instruction ID: fb391ea05062a593811eb8afd222d0cc1328f72f270764a7ea946e0abd8aaadc
Opcode Fuzzy Hash: c3605477168591f32072404740094eeac01a539d823a42f8c0cbe2a5677cf524
Instruction Fuzzy Hash: F941A739A0AF0681EB58AB1CF48036AA3A4FB88754FD25139D98D83774EF3DD459C710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AB3367B4, Relevance: 6.0, APIs: 4, Instructions: 39COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,00007FF7AB336878,?,?,?,?,?,?,?,?,00007FF7AB332F15), ref: 00007FF7AB3367D5
AcquireSRWLockExclusive.KERNEL32(?,?,?,00007FF7AB336878,?,?,?,?,?,?,?,?,00007FF7AB332F15), ref: 00007FF7AB3367E4
ReleaseSRWLockExclusive.KERNEL32(?,?,?,00007FF7AB336878,?,?,?,?,?,?,?,?,00007FF7AB332F15), ref: 00007FF7AB33681B
LeaveCriticalSection.KERNEL32(?,?,?,00007FF7AB336878,?,?,?,?,?,?,?,?,00007FF7AB332F15), ref: 00007FF7AB33682F

Memory Dump Source

Source File: 00000000.00000002.303888721.00007FF7AB331000.00000020.00020000.sdmp, Offset: 00007FF7AB330000, based on PE: true

Associated: 00000000.00000002.303884753.00007FF7AB330000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303903109.00007FF7AB33B000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303915158.00007FF7AB33F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303921541.00007FF7AB340000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303927069.00007FF7AB342000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ab330000_iexplore.jbxd

Similarity

API ID: CriticalExclusiveLockSection$AcquireEnterLeaveRelease
String ID:
API String ID: 1115728412-0
Opcode ID: 8391a76983001ce7ec0c0613e5031f26ca276cef02c7e08464134f76d5270d2b
Instruction ID: 808d79db14996fcdc85b0c8687bea51c6f40b3029097ac922c5acff82a9173f5
Opcode Fuzzy Hash: 8391a76983001ce7ec0c0613e5031f26ca276cef02c7e08464134f76d5270d2b
Instruction Fuzzy Hash: 76019262A09F8287DA189F1AA14007AEB60FB8DFC07999234DE4F07734DF3CE4858300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AB334198, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 89synchronizationCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 00007FF7AB3341CD
CreateMutexExW.KERNEL32 ref: 00007FF7AB334215

Part of subcall function 00007FF7AB33708C: GetLastError.KERNEL32 ref: 00007FF7AB3370AE

Strings

Local\SM0:%d:%d:%hs, xrefs: 00007FF7AB3341DE

Memory Dump Source

Source File: 00000000.00000002.303888721.00007FF7AB331000.00000020.00020000.sdmp, Offset: 00007FF7AB330000, based on PE: true

Associated: 00000000.00000002.303884753.00007FF7AB330000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303903109.00007FF7AB33B000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303915158.00007FF7AB33F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303921541.00007FF7AB340000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303927069.00007FF7AB342000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ab330000_iexplore.jbxd

Similarity

API ID: CreateCurrentErrorLastMutexProcess
String ID: Local\SM0:%d:%d:%hs
API String ID: 3298007088-4162240545
Opcode ID: 57e6b2b6b536e6cb3a11466b4c63530b0d15f79a4f948366dd0a4cc071021c69
Instruction ID: c276879704d0b6659d56898d1cbe4d39330e7b44e59baf84a3aeaa4b6ab6eedc
Opcode Fuzzy Hash: 57e6b2b6b536e6cb3a11466b4c63530b0d15f79a4f948366dd0a4cc071021c69
Instruction Fuzzy Hash: 51419432619F4696EB54AF19E4807ABA3A0FB88780FC15139EA4E87779DF3CD548C710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AB3384CC, Relevance: 5.0, APIs: 4, Instructions: 44memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(?,?,00000000,00007FF7AB3382B0,?,?,?,00007FF7AB3396AF), ref: 00007FF7AB338501
HeapFree.KERNEL32(?,?,00000000,00007FF7AB3382B0,?,?,?,00007FF7AB3396AF), ref: 00007FF7AB338515
GetProcessHeap.KERNEL32(?,?,00000000,00007FF7AB3382B0,?,?,?,00007FF7AB3396AF), ref: 00007FF7AB338539
HeapFree.KERNEL32(?,?,00000000,00007FF7AB3382B0,?,?,?,00007FF7AB3396AF), ref: 00007FF7AB33854D

Memory Dump Source

Source File: 00000000.00000002.303888721.00007FF7AB331000.00000020.00020000.sdmp, Offset: 00007FF7AB330000, based on PE: true

Associated: 00000000.00000002.303884753.00007FF7AB330000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303903109.00007FF7AB33B000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303915158.00007FF7AB33F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303921541.00007FF7AB340000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303927069.00007FF7AB342000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ab330000_iexplore.jbxd

Similarity

API ID: Heap$FreeProcess
String ID:
API String ID: 3859560861-0
Opcode ID: 27b511609f7e960dede6fe8eae7d8f684c03b10bcf8c944611764fd804f379c4
Instruction ID: d36991308593199a7a9b7821b114ba75f8bdcff58a71fb0a2570a4fd394fd11e
Opcode Fuzzy Hash: 27b511609f7e960dede6fe8eae7d8f684c03b10bcf8c944611764fd804f379c4
Instruction Fuzzy Hash: A5110A72A05F51C6E7049F56E4400ADBBA0F749F94B9A8229DF4D47728EF38E496C740

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Authentication logs, Email gateway, File monitoring, Mail server, Office 365 trace logs, Process monitoring, Process use of network
Platforms:	Office 365, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report iexplore.exe

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

Process Tree

Malware Configuration

Yara Overview

Sigma Overview

Jbx Signature Overview

Compliance:

Networking:

System Summary:

Data Obfuscation:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted IPs

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Version Infos

Possible Origin

Network Behavior

Code Manipulations

Statistics

CPU Usage

Memory Usage

System Behavior

Analysis Process: iexplore.exe PID: 4524 Parent PID: 3452

General

Chronological Activities

Disassembly

Code Analysis

Analysis Process: iexplore.exe PID: 4524 Parent PID: 3452 iexplore.exeCOMMON

Execution Graph

Graph

Executed Functions

Function 00007FF7AB332C20, Relevance: 1.5, APIs: 1, Instructions: 12
libraryCOMMON

Function 00007FF7AB3335F0, Relevance: 1.5, APIs: 1, Instructions: 6
COMMON

Function 00007FF7AB333060, Relevance: 10.6, APIs: 7, Instructions: 143
sleepCOMMON

Function 00007FF7AB332BB0, Relevance: 4.5, APIs: 3, Instructions: 38
COMMON

Function 00007FF7AB333010, Relevance: 1.5, APIs: 1, Instructions: 13
COMMON

Function 00007FF7AB3337C4, Relevance: 9.0, APIs: 6, Instructions: 49
timethreadCOMMON

Function 00007FF7AB338A20, Relevance: 26.4, APIs: 2, Strings: 13, Instructions: 153
windowthreadCOMMON

Function 00007FF7AB3390F0, Relevance: 12.1, APIs: 8, Instructions: 102
synchronizationCOMMON

Function 00007FF7AB335194, Relevance: 9.1, APIs: 6, Instructions: 76
COMMON

Function 00007FF7AB3376A4, Relevance: 9.0, APIs: 7, Instructions: 208
memoryCOMMON