Windows Analysis Report Shipping Document BL Copy.exe

AV Detection:

Found malware configuration

Source: 2.0.Shipping Document BL Copy.exe.400000.6.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Username": "finance@demo.jeninfo.com", "Password": "%e&qapQ3oNkx", "Host": "mail.demo.jeninfo.com"}

Multi AV Scanner detection for submitted file

Source: Shipping Document BL Copy.exe

ReversingLabs: Detection: 13%

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe

ReversingLabs: Detection: 13%

Antivirus or Machine Learning detection for unpacked file

Source: 2.0.Shipping Document BL Copy.exe.400000.6.unpack	Avira: Label: TR/Spy.Gen8
Source: 2.2.Shipping Document BL Copy.exe.400000.0.unpack	Avira: Label: TR/Spy.Gen8
Source: 12.0.tKZVPq.exe.400000.12.unpack	Avira: Label: TR/Spy.Gen8
Source: 9.0.tKZVPq.exe.400000.8.unpack	Avira: Label: TR/Spy.Gen8
Source: 12.0.tKZVPq.exe.400000.6.unpack	Avira: Label: TR/Spy.Gen8
Source: 12.0.tKZVPq.exe.400000.8.unpack	Avira: Label: TR/Spy.Gen8
Source: 12.0.tKZVPq.exe.400000.10.unpack	Avira: Label: TR/Spy.Gen8
Source: 9.0.tKZVPq.exe.400000.4.unpack	Avira: Label: TR/Spy.Gen8
Source: 9.0.tKZVPq.exe.400000.12.unpack	Avira: Label: TR/Spy.Gen8
Source: 9.0.tKZVPq.exe.400000.6.unpack	Avira: Label: TR/Spy.Gen8
Source: 2.0.Shipping Document BL Copy.exe.400000.8.unpack	Avira: Label: TR/Spy.Gen8
Source: 2.0.Shipping Document BL Copy.exe.400000.4.unpack	Avira: Label: TR/Spy.Gen8
Source: 2.0.Shipping Document BL Copy.exe.400000.12.unpack	Avira: Label: TR/Spy.Gen8
Source: 9.0.tKZVPq.exe.400000.10.unpack	Avira: Label: TR/Spy.Gen8
Source: 2.0.Shipping Document BL Copy.exe.400000.10.unpack	Avira: Label: TR/Spy.Gen8
Source: 12.2.tKZVPq.exe.400000.0.unpack	Avira: Label: TR/Spy.Gen8
Source: 9.2.tKZVPq.exe.400000.0.unpack	Avira: Label: TR/Spy.Gen8
Source: 12.0.tKZVPq.exe.400000.4.unpack	Avira: Label: TR/Spy.Gen8

Compliance:

Uses 32bit PE files

Source: Shipping Document BL Copy.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: Shipping Document BL Copy.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Networking:

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Source: Traffic

Snort IDS: 2030171 ET TROJAN AgentTesla Exfil Via SMTP 192.168.2.3:49802 -> 103.195.185.115:587

Internet Provider seen in connection with other malware

Source: Joe Sandbox View

ASN Name: PUBLIC-DOMAIN-REGISTRYUS PUBLIC-DOMAIN-REGISTRYUS

IP address seen in connection with other malware

Source: Joe Sandbox View

IP Address: 103.195.185.115 103.195.185.115

Detected TCP or UDP traffic on non-standard ports

Source: global traffic

TCP traffic: 192.168.2.3:49802 -> 103.195.185.115:587

Uses SMTP (mail sending)

Source: global traffic

TCP traffic: 192.168.2.3:49802 -> 103.195.185.115:587

URLs found in memory or binary data

Source: Shipping Document BL Copy.exe, 00000002.00000002.561404484.0000000002D21000.00000004.00000001.sdmp, tKZVPq.exe, 00000009.00000002.404740810.0000000002AD1000.00000004.00000001.sdmp, tKZVPq.exe, 0000000C.00000002.560842841.0000000002FB1000.00000004.00000001.sdmp	String found in binary or memory: http://127.0.0.1:HTTP/1.1
Source: tKZVPq.exe, 0000000C.00000002.560842841.0000000002FB1000.00000004.00000001.sdmp	String found in binary or memory: http://BmacPT.com
Source: tKZVPq.exe, 0000000C.00000002.560842841.0000000002FB1000.00000004.00000001.sdmp	String found in binary or memory: http://DynDns.comDynDNS
Source: Shipping Document BL Copy.exe, 00000002.00000002.562294886.000000000308B000.00000004.00000001.sdmp	String found in binary or memory: http://demo.jeninfo.com
Source: Shipping Document BL Copy.exe, 00000002.00000002.562294886.000000000308B000.00000004.00000001.sdmp	String found in binary or memory: http://mail.demo.jeninfo.com
Source: Shipping Document BL Copy.exe, 00000002.00000002.562294886.000000000308B000.00000004.00000001.sdmp, Shipping Document BL Copy.exe, 00000002.00000002.561404484.0000000002D21000.00000004.00000001.sdmp	String found in binary or memory: http://qXonUXHmaco.net
Source: Shipping Document BL Copy.exe, 00000000.00000002.302606282.0000000004249000.00000004.00000001.sdmp, Shipping Document BL Copy.exe, 00000002.00000000.298383826.0000000000402000.00000040.00000001.sdmp, Shipping Document BL Copy.exe, 00000002.00000002.557996705.0000000000402000.00000040.00000001.sdmp, tKZVPq.exe, 00000008.00000002.382185263.00000000037F9000.00000004.00000001.sdmp, tKZVPq.exe, 00000009.00000000.377270702.0000000000402000.00000040.00000001.sdmp, tKZVPq.exe, 00000009.00000000.376744796.0000000000402000.00000040.00000001.sdmp, tKZVPq.exe, 0000000A.00000002.404660056.0000000003FA9000.00000004.00000001.sdmp, tKZVPq.exe, 0000000C.00000000.395789636.0000000000402000.00000040.00000001.sdmp, tKZVPq.exe, 0000000C.00000000.393587407.0000000000402000.00000040.00000001.sdmp	String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip
Source: Shipping Document BL Copy.exe, 00000002.00000002.561404484.0000000002D21000.00000004.00000001.sdmp, tKZVPq.exe, 00000009.00000002.404740810.0000000002AD1000.00000004.00000001.sdmp, tKZVPq.exe, 0000000C.00000002.560842841.0000000002FB1000.00000004.00000001.sdmp	String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha

Performs DNS lookups

Source: unknown

DNS traffic detected: queries for: mail.demo.jeninfo.com

Spam, unwanted Advertisements and Ransom Demands:

Modifies the hosts file

Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe

File written: C:\Windows\System32\drivers\etc\hosts

Jump to behavior

System Summary:

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: Shipping Document BL Copy.exe

.NET source code contains very large array initializations

Source: 2.0.Shipping Document BL Copy.exe.400000.6.unpack, u003cPrivateImplementationDetailsu003eu007bC54C654Du002d1F0Bu002d446Bu002dAC5Du002d65F74970AA45u007d/B2F568B2u002d973Eu002d45AEu002dA54Fu002d2E80459E8E64.cs	Large array initialization: .cctor: array initializer size 11940
Source: 2.2.Shipping Document BL Copy.exe.400000.0.unpack, u003cPrivateImplementationDetailsu003eu007bC54C654Du002d1F0Bu002d446Bu002dAC5Du002d65F74970AA45u007d/B2F568B2u002d973Eu002d45AEu002dA54Fu002d2E80459E8E64.cs	Large array initialization: .cctor: array initializer size 11940
Source: 2.0.Shipping Document BL Copy.exe.400000.8.unpack, u003cPrivateImplementationDetailsu003eu007bC54C654Du002d1F0Bu002d446Bu002dAC5Du002d65F74970AA45u007d/B2F568B2u002d973Eu002d45AEu002dA54Fu002d2E80459E8E64.cs	Large array initialization: .cctor: array initializer size 11940
Source: 2.0.Shipping Document BL Copy.exe.400000.4.unpack, u003cPrivateImplementationDetailsu003eu007bC54C654Du002d1F0Bu002d446Bu002dAC5Du002d65F74970AA45u007d/B2F568B2u002d973Eu002d45AEu002dA54Fu002d2E80459E8E64.cs	Large array initialization: .cctor: array initializer size 11940

Uses 32bit PE files

Source: Shipping Document BL Copy.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Detected potential crypto function

Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe	Code function: 0_2_017CF770		0_2_017CF770
Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe	Code function: 0_2_017CE778		0_2_017CE778
Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe	Code function: 0_2_017CE76A		0_2_017CE76A
Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe	Code function: 0_2_017CBDC4		0_2_017CBDC4
Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe	Code function: 0_2_00E42050		0_2_00E42050
Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe	Code function: 2_2_01121140		2_2_01121140
Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe	Code function: 2_2_011211E2		2_2_011211E2
Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe	Code function: 2_2_01129BF0		2_2_01129BF0
Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe	Code function: 2_2_01125D38		2_2_01125D38
Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe	Code function: 2_2_01126578		2_2_01126578
Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe	Code function: 2_2_01126479		2_2_01126479
Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe	Code function: 2_2_02B747A0		2_2_02B747A0
Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe	Code function: 2_2_02B7477F		2_2_02B7477F
Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe	Code function: 2_2_02B7D820		2_2_02B7D820
Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe	Code function: 2_2_052B7100		2_2_052B7100
Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe	Code function: 2_2_052BBC68		2_2_052BBC68
Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe	Code function: 2_2_00822050		2_2_00822050
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Code function: 8_2_0263E76B		8_2_0263E76B
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Code function: 8_2_0263E778		8_2_0263E778
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Code function: 8_2_0263BDC4		8_2_0263BDC4
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Code function: 8_2_00392050		8_2_00392050
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Code function: 9_2_011947A0		9_2_011947A0
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Code function: 9_2_01193CCC		9_2_01193CCC
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Code function: 9_2_01194750		9_2_01194750
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Code function: 9_2_01194790		9_2_01194790
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Code function: 9_2_01195490		9_2_01195490
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Code function: 9_2_007B2050		9_2_007B2050
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Code function: 10_2_013BE778		10_2_013BE778
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Code function: 10_2_013BE76A		10_2_013BE76A
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Code function: 10_2_013BBDC4		10_2_013BBDC4
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Code function: 10_2_05484F50		10_2_05484F50
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Code function: 10_2_0548C1C8		10_2_0548C1C8
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Code function: 10_2_0548C1D8		10_2_0548C1D8
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Code function: 10_2_05484F41		10_2_05484F41
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Code function: 10_2_0548384F		10_2_0548384F
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Code function: 10_2_00B62050		10_2_00B62050

Sample file is different than original file name gathered from version info

Source: Shipping Document BL Copy.exe	Binary or memory string: OriginalFilename vs Shipping Document BL Copy.exe
Source: Shipping Document BL Copy.exe, 00000000.00000002.302606282.0000000004249000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameFyKnTqyFcfLHrgHTrTGrmHWnBuhJPDMQ.exe4 vs Shipping Document BL Copy.exe
Source: Shipping Document BL Copy.exe, 00000000.00000002.301906183.0000000003241000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameInnerException.dll" vs Shipping Document BL Copy.exe
Source: Shipping Document BL Copy.exe, 00000000.00000002.301906183.0000000003241000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameFyKnTqyFcfLHrgHTrTGrmHWnBuhJPDMQ.exe4 vs Shipping Document BL Copy.exe
Source: Shipping Document BL Copy.exe, 00000000.00000002.305927868.00000000064D0000.00000004.00020000.sdmp	Binary or memory string: OriginalFilenameUI.dllF vs Shipping Document BL Copy.exe
Source: Shipping Document BL Copy.exe	Binary or memory string: OriginalFilename vs Shipping Document BL Copy.exe
Source: Shipping Document BL Copy.exe, 00000002.00000003.511539186.00000000065B2000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameBadImageFormatExcepti.exeB vs Shipping Document BL Copy.exe
Source: Shipping Document BL Copy.exe, 00000002.00000002.557996705.0000000000402000.00000040.00000001.sdmp	Binary or memory string: OriginalFilenameFyKnTqyFcfLHrgHTrTGrmHWnBuhJPDMQ.exe4 vs Shipping Document BL Copy.exe
Source: Shipping Document BL Copy.exe, 00000002.00000002.559130828.0000000000CF8000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs Shipping Document BL Copy.exe
Source: Shipping Document BL Copy.exe	Binary or memory string: OriginalFilenameBadImageFormatExcepti.exeB vs Shipping Document BL Copy.exe

PE file has an executable .text section which is very likely to contain packed code (zlib compression ratio < 0.3)

Source: Shipping Document BL Copy.exe	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: tKZVPq.exe.2.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Sample is known by Antivirus

Source: Shipping Document BL Copy.exe

ReversingLabs: Detection: 13%

Sample reads its own file content

Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe

File read: C:\Users\user\Desktop\Shipping Document BL Copy.exe

Jump to behavior

PE file has an executable .text section and no other executable section

Source: Shipping Document BL Copy.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Reads software policies

Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Spawns processes

Source: unknown	Process created: C:\Users\user\Desktop\Shipping Document BL Copy.exe "C:\Users\user\Desktop\Shipping Document BL Copy.exe"
Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe	Process created: C:\Users\user\Desktop\Shipping Document BL Copy.exe C:\Users\user\Desktop\Shipping Document BL Copy.exe
Source: unknown	Process created: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe "C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe"
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process created: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe
Source: unknown	Process created: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe "C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe"
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process created: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe
Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe	Process created: C:\Users\user\Desktop\Shipping Document BL Copy.exe C:\Users\user\Desktop\Shipping Document BL Copy.exe			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process created: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process created: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe			Jump to behavior

Uses an in-process (OLE) Automation server

Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{172BDDF8-CEEA-11D1-8B05-00600806D9B6}\InProcServer32

Jump to behavior

Queries process information (via WMI, Win32_Process)

Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Creates files inside the user directory

Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Shipping Document BL Copy.exe.log

Jump to behavior

Classification label

Source: classification engine

Classification label: mal100.troj.adwa.spyw.evad.winEXE@9/5@2/2

Parts of this applications are using the .NET runtime (Probably coded in C#)

Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll			Jump to behavior
Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll			Jump to behavior

.NET source code contains calls to encryption/decryption functions

Source: 2.0.Shipping Document BL Copy.exe.400000.6.unpack, A/b2.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 2.0.Shipping Document BL Copy.exe.400000.6.unpack, A/b2.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 2.2.Shipping Document BL Copy.exe.400000.0.unpack, A/b2.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 2.2.Shipping Document BL Copy.exe.400000.0.unpack, A/b2.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 2.0.Shipping Document BL Copy.exe.400000.8.unpack, A/b2.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 2.0.Shipping Document BL Copy.exe.400000.8.unpack, A/b2.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'

Reads the hosts file

Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Uses Microsoft Silverlight

Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Checks if Microsoft Office is installed

Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

PE file contains a COM descriptor data directory

Source: Shipping Document BL Copy.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: Shipping Document BL Copy.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Data Obfuscation:

.NET source code contains potential unpacker

Source: Shipping Document BL Copy.exe, Views/MainForm.cs	.Net Code: CF234052 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 0.0.Shipping Document BL Copy.exe.e40000.0.unpack, Views/MainForm.cs	.Net Code: CF234052 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 0.2.Shipping Document BL Copy.exe.e40000.0.unpack, Views/MainForm.cs	.Net Code: CF234052 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: tKZVPq.exe.2.dr, Views/MainForm.cs	.Net Code: CF234052 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 2.0.Shipping Document BL Copy.exe.820000.7.unpack, Views/MainForm.cs	.Net Code: CF234052 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 2.0.Shipping Document BL Copy.exe.820000.9.unpack, Views/MainForm.cs	.Net Code: CF234052 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 2.0.Shipping Document BL Copy.exe.820000.2.unpack, Views/MainForm.cs	.Net Code: CF234052 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 2.0.Shipping Document BL Copy.exe.820000.3.unpack, Views/MainForm.cs	.Net Code: CF234052 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 2.0.Shipping Document BL Copy.exe.820000.1.unpack, Views/MainForm.cs	.Net Code: CF234052 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])

Uses code obfuscation techniques (call, push, ret)

Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe	Code function: 0_2_00E442DB push ss; iretd		0_2_00E442F6
Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe	Code function: 0_2_00E442B1 push cs; iretd		0_2_00E442CC
Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe	Code function: 0_2_00E44287 push cs; iretd		0_2_00E442B0
Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe	Code function: 0_2_00E4424F push es; iretd		0_2_00E4425C
Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe	Code function: 0_2_017CE768 pushfd ; ret		0_2_017CE769
Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe	Code function: 2_2_00824287 push cs; iretd		2_2_008242B0
Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe	Code function: 2_2_008242B1 push cs; iretd		2_2_008242CC
Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe	Code function: 2_2_008242DB push ss; iretd		2_2_008242F6
Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe	Code function: 2_2_0082424F push es; iretd		2_2_0082425C
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Code function: 8_2_0039424F push es; iretd		8_2_0039425C
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Code function: 8_2_003942B1 push cs; iretd		8_2_003942CC
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Code function: 8_2_00394287 push cs; iretd		8_2_003942B0
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Code function: 8_2_003942DB push ss; iretd		8_2_003942F6
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Code function: 8_2_0263421B push ebp; ret		8_2_02634222
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Code function: 8_2_02634219 push esi; ret		8_2_0263421A
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Code function: 8_2_026342D0 push edi; ret		8_2_026342DA
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Code function: 8_2_02634123 push edx; ret		8_2_02634126
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Code function: 8_2_02634120 push edx; ret		8_2_02634122
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Code function: 8_2_02634127 push edx; ret		8_2_0263412A
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Code function: 8_2_026341E1 push ebp; ret		8_2_026341E2
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Code function: 8_2_0263E768 pushfd ; ret		8_2_0263E769
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Code function: 8_2_0263B109 pushfd ; ret		8_2_0263B10A
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Code function: 8_2_0263B1AF pushfd ; ret		8_2_0263B1B2
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Code function: 9_2_007B424F push es; iretd		9_2_007B425C
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Code function: 9_2_007B42DB push ss; iretd		9_2_007B42F6
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Code function: 9_2_007B42B1 push cs; iretd		9_2_007B42CC
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Code function: 9_2_007B4287 push cs; iretd		9_2_007B42B0
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Code function: 10_2_00B642B1 push cs; iretd		10_2_00B642CC
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Code function: 10_2_00B64287 push cs; iretd		10_2_00B642B0
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Code function: 10_2_00B642DB push ss; iretd		10_2_00B642F6
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Code function: 10_2_00B6424F push es; iretd		10_2_00B6425C

Binary may include packed or encrypted code

Source: initial sample	Static PE information: section name: .text entropy: 7.85459508247
Source: initial sample	Static PE information: section name: .text entropy: 7.85459508247

Persistence and Installation Behavior:

Drops PE files

Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe

File created: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe

Jump to dropped file

Boot Survival:

Creates an autostart registry key

Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run tKZVPq			Jump to behavior
Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run tKZVPq			Jump to behavior

Hooking and other Techniques for Hiding and Protection:

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe

File opened: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe:Zone.Identifier read attributes | delete

Jump to behavior

Disables application error messsages (SetErrorMode)

Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion:

Yara detected AntiVM3

Source: Yara match	File source: 0.2.Shipping Document BL Copy.exe.32613ec.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.tKZVPq.exe.2fc13d0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.tKZVPq.exe.28113d0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.381266500.00000000027F1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.301906183.0000000003241000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.381339607.000000000282D000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.400436439.0000000002FA1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.400597276.0000000002FDD000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.301950347.000000000327D000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Shipping Document BL Copy.exe PID: 7068, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: tKZVPq.exe PID: 6556, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: tKZVPq.exe PID: 6832, type: MEMORYSTR

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: Shipping Document BL Copy.exe, 00000000.00000002.301906183.0000000003241000.00000004.00000001.sdmp, Shipping Document BL Copy.exe, 00000000.00000002.301950347.000000000327D000.00000004.00000001.sdmp, tKZVPq.exe, 00000008.00000002.381266500.00000000027F1000.00000004.00000001.sdmp, tKZVPq.exe, 00000008.00000002.381339607.000000000282D000.00000004.00000001.sdmp, tKZVPq.exe, 0000000A.00000002.400597276.0000000002FDD000.00000004.00000001.sdmp, tKZVPq.exe, 0000000A.00000002.400436439.0000000002FA1000.00000004.00000001.sdmp

Binary or memory string: SBIEDLL.DLL

Source: Shipping Document BL Copy.exe, 00000000.00000002.301906183.0000000003241000.00000004.00000001.sdmp, Shipping Document BL Copy.exe, 00000000.00000002.301950347.000000000327D000.00000004.00000001.sdmp, tKZVPq.exe, 00000008.00000002.381266500.00000000027F1000.00000004.00000001.sdmp, tKZVPq.exe, 00000008.00000002.381339607.000000000282D000.00000004.00000001.sdmp, tKZVPq.exe, 0000000A.00000002.400597276.0000000002FDD000.00000004.00000001.sdmp, tKZVPq.exe, 0000000A.00000002.400436439.0000000002FA1000.00000004.00000001.sdmp

Binary or memory string: KERNEL32.DLL.WINE_GET_UNIX_FILE_NAME

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

May sleep (evasive loops) to hinder dynamic analysis

Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe TID: 7072	Thread sleep time: -40901s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe TID: 7088	Thread sleep time: -922337203685477s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe TID: 4884	Thread sleep count: 33 > 30			Jump to behavior
Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe TID: 4884	Thread sleep time: -30437127721620741s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe TID: 4908	Thread sleep count: 2377 > 30			Jump to behavior
Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe TID: 4908	Thread sleep count: 7450 > 30			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe TID: 6564	Thread sleep time: -40389s >= -30000s			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe TID: 6288	Thread sleep time: -922337203685477s >= -30000s			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe TID: 6824	Thread sleep time: -40760s >= -30000s			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe TID: 6812	Thread sleep time: -922337203685477s >= -30000s			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe TID: 5392	Thread sleep time: -19369081277395017s >= -30000s			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe TID: 5748	Thread sleep count: 3219 > 30			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe TID: 5748	Thread sleep count: 6622 > 30			Jump to behavior

Contains long sleeps (>= 3 min)

Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe	Window / User API: threadDelayed 2377			Jump to behavior
Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe	Window / User API: threadDelayed 7450			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Window / User API: threadDelayed 3219			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Window / User API: threadDelayed 6622			Jump to behavior

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Queries a list of all running processes

Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe

Process information queried: ProcessInformation

Jump to behavior

Contains medium sleeps (>= 30s)

Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe	Thread delayed: delay time: 40901			Jump to behavior
Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Thread delayed: delay time: 40389			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Thread delayed: delay time: 40760			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)

Source: tKZVPq.exe, 0000000A.00000002.400436439.0000000002FA1000.00000004.00000001.sdmp	Binary or memory string: VMware SVGA IIBAdd-MpPreference -ExclusionPath "
Source: tKZVPq.exe, 0000000A.00000002.400436439.0000000002FA1000.00000004.00000001.sdmp	Binary or memory string: InstallPathJC:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: tKZVPq.exe, 0000000A.00000002.400436439.0000000002FA1000.00000004.00000001.sdmp	Binary or memory string: vmware
Source: tKZVPq.exe, 0000000A.00000002.400436439.0000000002FA1000.00000004.00000001.sdmp	Binary or memory string: VMWAREDSOFTWARE\VMware, Inc.\VMware Tools

Anti Debugging:

Enables debug privileges

Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe

Process token adjusted: Debug

Jump to behavior

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe

Code function: 2_2_0112B158 LdrInitializeThunk,

2_2_0112B158

Creates guard pages, often used to prevent reverse engineering and debugging

Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

Modifies the hosts file

Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe

File written: C:\Windows\System32\drivers\etc\hosts

Jump to behavior

Creates a process in suspended mode (likely to inject code)

Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe	Process created: C:\Users\user\Desktop\Shipping Document BL Copy.exe C:\Users\user\Desktop\Shipping Document BL Copy.exe			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process created: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process created: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe			Jump to behavior

May try to detect the Windows Explorer process (often used for injection)

Source: Shipping Document BL Copy.exe, 00000002.00000002.560894505.0000000001720000.00000002.00020000.sdmp, tKZVPq.exe, 0000000C.00000002.560281432.0000000001900000.00000002.00020000.sdmp	Binary or memory string: Program Manager
Source: Shipping Document BL Copy.exe, 00000002.00000002.560894505.0000000001720000.00000002.00020000.sdmp, tKZVPq.exe, 0000000C.00000002.560281432.0000000001900000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd
Source: Shipping Document BL Copy.exe, 00000002.00000002.560894505.0000000001720000.00000002.00020000.sdmp, tKZVPq.exe, 0000000C.00000002.560281432.0000000001900000.00000002.00020000.sdmp	Binary or memory string: Progman
Source: Shipping Document BL Copy.exe, 00000002.00000002.560894505.0000000001720000.00000002.00020000.sdmp, tKZVPq.exe, 0000000C.00000002.560281432.0000000001900000.00000002.00020000.sdmp	Binary or memory string: Progmanlock

Language, Device and Operating System Detection:

Queries the volume information (name, serial number etc) of a device

Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe	Queries volume information: C:\Users\user\Desktop\Shipping Document BL Copy.exe VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe	Queries volume information: C:\Users\user\Desktop\Shipping Document BL Copy.exe VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Queries volume information: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Queries volume information: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Queries volume information: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Queries volume information: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation			Jump to behavior

Queries the cryptographic machine GUID

Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings:

Modifies the hosts file

Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe

File written: C:\Windows\System32\drivers\etc\hosts

Jump to behavior

Stealing of Sensitive Information:

Yara detected AgentTesla

Source: Yara match	File source: 2.2.Shipping Document BL Copy.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.0.tKZVPq.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.tKZVPq.exe.4159aa0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.0.tKZVPq.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.0.tKZVPq.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.0.tKZVPq.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.0.tKZVPq.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.Shipping Document BL Copy.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.tKZVPq.exe.418fcc0.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.Shipping Document BL Copy.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.0.tKZVPq.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.tKZVPq.exe.39dfcc0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.0.tKZVPq.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.0.tKZVPq.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.Shipping Document BL Copy.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.tKZVPq.exe.39a9aa0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.tKZVPq.exe.39dfcc0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.0.tKZVPq.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.Shipping Document BL Copy.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.Shipping Document BL Copy.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.tKZVPq.exe.39a9aa0.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.tKZVPq.exe.418fcc0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Shipping Document BL Copy.exe.43f9aa0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.tKZVPq.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.tKZVPq.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.0.tKZVPq.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Shipping Document BL Copy.exe.442fcc0.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Shipping Document BL Copy.exe.442fcc0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.tKZVPq.exe.4159aa0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Shipping Document BL Copy.exe.43f9aa0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000000.298383826.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000000.377270702.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000000.395789636.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000000.393587407.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000000.378517305.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.402190166.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000000.377815268.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.302606282.0000000004249000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000000.395273418.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000000.396352645.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.557996705.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.557983586.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000000.376744796.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000000.299280557.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000000.298778595.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000000.299813727.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.404660056.0000000003FA9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.382185263.00000000037F9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.560842841.0000000002FB1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.404740810.0000000002AD1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.561404484.0000000002D21000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Shipping Document BL Copy.exe PID: 7068, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Shipping Document BL Copy.exe PID: 7136, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: tKZVPq.exe PID: 6556, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: tKZVPq.exe PID: 6240, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: tKZVPq.exe PID: 6832, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: tKZVPq.exe PID: 2256, type: MEMORYSTR

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini			Jump to behavior
Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini			Jump to behavior
Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676			Jump to behavior
Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities			Jump to behavior

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites\Quick Connect\			Jump to behavior
Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe	File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml			Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini			Jump to behavior
Source: C:\Users\user\Desktop\Shipping Document BL Copy.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data			Jump to behavior

Yara detected Credential Stealer

Source: Yara match	File source: 0000000C.00000002.560842841.0000000002FB1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.404740810.0000000002AD1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.561404484.0000000002D21000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Shipping Document BL Copy.exe PID: 7136, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: tKZVPq.exe PID: 6240, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: tKZVPq.exe PID: 2256, type: MEMORYSTR

Remote Access Functionality:

Yara detected AgentTesla

Source: Yara match	File source: 2.2.Shipping Document BL Copy.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.0.tKZVPq.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.tKZVPq.exe.4159aa0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.0.tKZVPq.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.0.tKZVPq.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.0.tKZVPq.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.0.tKZVPq.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.Shipping Document BL Copy.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.tKZVPq.exe.418fcc0.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.Shipping Document BL Copy.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.0.tKZVPq.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.tKZVPq.exe.39dfcc0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.0.tKZVPq.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.0.tKZVPq.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.Shipping Document BL Copy.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.tKZVPq.exe.39a9aa0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.tKZVPq.exe.39dfcc0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.0.tKZVPq.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.Shipping Document BL Copy.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.Shipping Document BL Copy.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.tKZVPq.exe.39a9aa0.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.tKZVPq.exe.418fcc0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Shipping Document BL Copy.exe.43f9aa0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.tKZVPq.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.tKZVPq.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.0.tKZVPq.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Shipping Document BL Copy.exe.442fcc0.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Shipping Document BL Copy.exe.442fcc0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.tKZVPq.exe.4159aa0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Shipping Document BL Copy.exe.43f9aa0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000000.298383826.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000000.377270702.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000000.395789636.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000000.393587407.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000000.378517305.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.402190166.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000000.377815268.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.302606282.0000000004249000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000000.395273418.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000000.396352645.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.557996705.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.557983586.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000000.376744796.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000000.299280557.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000000.298778595.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000000.299813727.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.404660056.0000000003FA9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.382185263.00000000037F9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.560842841.0000000002FB1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.404740810.0000000002AD1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.561404484.0000000002D21000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Shipping Document BL Copy.exe PID: 7068, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Shipping Document BL Copy.exe PID: 7136, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: tKZVPq.exe PID: 6556, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: tKZVPq.exe PID: 6240, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: tKZVPq.exe PID: 6832, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: tKZVPq.exe PID: 2256, type: MEMORYSTR