Windows Analysis Report 1.2.javaw.exe.22e0000.2.unpack

ID:	537742
Product:	CloudBasic
Start time:	12:09:32
Start date:	10.12.2021
Sample:	1.2.javaw.exe.22e0000.2.unpack
Cookbook:	default.jbs
System description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Architecture:	WINDOWS
MD5:	c47bfe4e43d258b87c6cece9de90c89f
SHA1:	eb2c417a29d2f08e37d63f3b75cdc61b42855e91
SHA256:	f4d742d82698f532e0215832cb484619a4e84547d8a1ca8dc8f2e9f791a6f27d
Filetype:	Win32 Executable (generic) a (10002005/4) 99.96%

Name	Type	MD5	SHA1	SHA256
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_1.2.javaw.exe.22_e816a0737e58b9c4a7ce791273f8931c044f28_358f4505_17179e01\Report.wer	Little-endian UTF-16 Unicode text, with CRLF line terminators	54310057441A752B51A6EEBDEC727CD3	F6D401D63835A6238B8DA1B76D3B722BD248B5F2	0DC9D41649580D49E61EB61E6F6AC57F7E1CBE3E9055C4416F2FA0613FF5A93C
C:\ProgramData\Microsoft\Windows\WER\Temp\WER173D.tmp.dmp	Mini DuMP crash report, 14 streams, Fri Dec 10 20:10:31 2021, 0x1205a4 type	ECDD07BB2E662BF9271BE42A216F1A85	C2CA81ADF4E89DD234BAC7CEFB253A4E0704A983	93DE7584D41A63CEA55F9BCB5571C904D30EA287F5750BEDAC265F8120D087B8
C:\ProgramData\Microsoft\Windows\WER\Temp\WER1961.tmp.WERInternalMetadata.xml	XML 1.0 document, Little-endian UTF-16 Unicode text, with CRLF line terminators	2EE68E172F90C667180318D9CA2C711F	13D151A5BCAD54552A684C73F3ED15342F0D6B9D	0964010B7ED62433C1FA3B61029FE5C1F3DF0BF8D2C274C4183A2769E40302F3
C:\ProgramData\Microsoft\Windows\WER\Temp\WER1B95.tmp.xml	XML 1.0 document, ASCII text, with CRLF line terminators	E394B1F4E2F42BA574E7B6B595F71057	13AFF3D7C6C76446E94F37D26C1895959961A82A	B1F68B71C540E7961BF7CF54EE7D2363F0436C65760372601F7C2A141975E331
C:\Windows\appcompat\Programs\Amcache.hve	MS Windows registry file, NT/2000 or above	602AA249D83967922316C18750C6EAC4	56CD1D74EF0CC49C4697D53843EC6A2A6CC2D426	B072FE5E511EBBF42E5D6A09B826AF898FECF072855417850CE1C0063C951AD5
C:\Windows\appcompat\Programs\Amcache.hve.LOG1	MS Windows registry file, NT/2000 or above	5A748B8B32E99DC16D4DDD27D4F837EA	82D7A09EBF405A3D344CDDA5A6BD3728D7EF3A65	FE17718EF6ED2869E26B6E054377BFEFCCA714F95D32C7B58534F98E27A295E7

AV Detection:

Antivirus / Scanner detection for submitted sample

Source: 1.2.javaw.exe.22e0000.2.exe

Avira: detected

Machine Learning detection for sample

Source: 1.2.javaw.exe.22e0000.2.exe

Joe Sandbox ML: detected

Compliance:

Uses 32bit PE files

Source: 1.2.javaw.exe.22e0000.2.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Binary contains paths to debug symbols

Source:	Binary string: wkernel32.pdb source: WerFault.exe, 00000009.00000003.295282834.00000000049D1000.00000004.00000001.sdmp
Source:	Binary string: wkernelbase.pdb source: WerFault.exe, 00000009.00000003.295282834.00000000049D1000.00000004.00000001.sdmp
Source:	Binary string: nCReportStore::Prune: MaxReportCount=%d MaxSizeInMb=%dRSDSwkernel32.pdb source: WerFault.exe, 00000009.00000002.305125543.0000000000312000.00000004.00000001.sdmp
Source:	Binary string: wntdll.pdb source: WerFault.exe, 00000009.00000003.295282834.00000000049D1000.00000004.00000001.sdmp
Source:	Binary string: apphelp.pdb source: WerFault.exe, 00000009.00000003.295282834.00000000049D1000.00000004.00000001.sdmp
Source:	Binary string: wntdll.pdbk source: WerFault.exe, 00000009.00000003.295282834.00000000049D1000.00000004.00000001.sdmp

Networking:

URLs found in memory or binary data

Source: Amcache.hve.9.dr

String found in binary or memory: http://upx.sf.net

System Summary:

Uses 32bit PE files

Source: 1.2.javaw.exe.22e0000.2.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

PE file does not import any functions

Source: 1.2.javaw.exe.22e0000.2.exe

Static PE information: No import functions for PE file found

One or more processes crash

Source: C:\Users\user\Desktop\1.2.javaw.exe.22e0000.2.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6196 -s 212

Detected potential crypto function

Source: C:\Users\user\Desktop\1.2.javaw.exe.22e0000.2.exe	Code function: 3_2_022E19B0		3_2_022E19B0
Source: C:\Users\user\Desktop\1.2.javaw.exe.22e0000.2.exe	Code function: 3_2_022E8D70		3_2_022E8D70
Source: C:\Users\user\Desktop\1.2.javaw.exe.22e0000.2.exe	Code function: 3_2_022E37F0		3_2_022E37F0
Source: C:\Users\user\Desktop\1.2.javaw.exe.22e0000.2.exe	Code function: 3_2_022E50C0		3_2_022E50C0

PE file has section (not .text) which is very likely to contain packed code (zlib compression ratio < 0.011)

Source: 1.2.javaw.exe.22e0000.2.exe

Static PE information: Section: .data ZLIB complexity 1.021484375

Creates temporary files

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\WER173D.tmp

Jump to behavior

Reads software policies

Source: C:\Users\user\Desktop\1.2.javaw.exe.22e0000.2.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Classification label

Source: classification engine

Classification label: mal56.winEXE@2/6@0/1

Spawns processes

Source: unknown	Process created: C:\Users\user\Desktop\1.2.javaw.exe.22e0000.2.exe "C:\Users\user\Desktop\1.2.javaw.exe.22e0000.2.exe"
Source: C:\Users\user\Desktop\1.2.javaw.exe.22e0000.2.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6196 -s 212

Creates mutexes

Source: C:\Windows\SysWOW64\WerFault.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6196

Reads the hosts file

Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Binary contains paths to debug symbols

Source:	Binary string: wkernel32.pdb source: WerFault.exe, 00000009.00000003.295282834.00000000049D1000.00000004.00000001.sdmp
Source:	Binary string: wkernelbase.pdb source: WerFault.exe, 00000009.00000003.295282834.00000000049D1000.00000004.00000001.sdmp
Source:	Binary string: nCReportStore::Prune: MaxReportCount=%d MaxSizeInMb=%dRSDSwkernel32.pdb source: WerFault.exe, 00000009.00000002.305125543.0000000000312000.00000004.00000001.sdmp
Source:	Binary string: wntdll.pdb source: WerFault.exe, 00000009.00000003.295282834.00000000049D1000.00000004.00000001.sdmp
Source:	Binary string: apphelp.pdb source: WerFault.exe, 00000009.00000003.295282834.00000000049D1000.00000004.00000001.sdmp
Source:	Binary string: wntdll.pdbk source: WerFault.exe, 00000009.00000003.295282834.00000000049D1000.00000004.00000001.sdmp

PE file contains a valid data directory to section mapping

Source: 1.2.javaw.exe.22e0000.2.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: 1.2.javaw.exe.22e0000.2.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: 1.2.javaw.exe.22e0000.2.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: 1.2.javaw.exe.22e0000.2.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: 1.2.javaw.exe.22e0000.2.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Data Obfuscation:

PE file contains sections with non-standard names

Source: 1.2.javaw.exe.22e0000.2.exe

Static PE information: section name: .teslaX

Boot Survival:

Creates autostart registry keys to launch java

Source: C:\Windows\SysWOW64\WerFault.exe	Registry value created or modified: \REGISTRY\A\{ff6a568b-cc7a-5e80-36a9-d30ff46fc7a9}\Root\InventoryApplicationFile\1.2.javaw.exe.22|d0d8f4f4 LowerCaseLongPath c:\users\user\desktop\1.2.javaw.exe.22e0000.2.exe			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Registry value created or modified: \REGISTRY\A\{ff6a568b-cc7a-5e80-36a9-d30ff46fc7a9}\Root\InventoryApplicationFile\1.2.javaw.exe.22|d0d8f4f4 LongPathHash 1.2.javaw.exe.22|d0d8f4f4			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Registry value created or modified: \REGISTRY\A\{ff6a568b-cc7a-5e80-36a9-d30ff46fc7a9}\Root\InventoryApplicationFile\1.2.javaw.exe.22|d0d8f4f4 Name 1.2.javaw.exe.22e0000.2.exe			Jump to behavior

Hooking and other Techniques for Hiding and Protection:

Disables application error messsages (SetErrorMode)

Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion:

May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)

Source: Amcache.hve.9.dr	Binary or memory string: VMware
Source: Amcache.hve.9.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/5&1ec51bf7&0&000000
Source: Amcache.hve.9.dr	Binary or memory string: @scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/5&280b647&0&000000
Source: Amcache.hve.9.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.9.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.9.dr	Binary or memory string: VMware Virtual disk SCSI Disk Devicehbin
Source: Amcache.hve.9.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.9.dr	Binary or memory string: VMware7,1
Source: Amcache.hve.9.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.9.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.9.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW71.00V.13989454.B64.1906190538,BiosReleaseDate:06/19/2019,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware7,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.9.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.9.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.9.dr	Binary or memory string: VMware, Inc.me
Source: Amcache.hve.9.dr	Binary or memory string: VMware-42 35 d8 20 48 cb c7 ff-aa 5e d0 37 a0 49 53 d7
Source: Amcache.hve.9.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/5&280b647&0&000000
Source: Amcache.hve.9.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/5&1ec51bf7&0&000000

Anti Debugging:

Contains functionality to read the PEB

Source: C:\Users\user\Desktop\1.2.javaw.exe.22e0000.2.exe

Code function: 3_2_022E3E40 mov eax, dword ptr fs:[00000030h]

3_2_022E3E40

Checks if the current process is being debugged

Source: C:\Users\user\Desktop\1.2.javaw.exe.22e0000.2.exe

Process queried: DebugPort

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings:

AV process strings found (often used to terminate AV products)

Source: Amcache.hve.9.dr, Amcache.hve.LOG1.9.dr	Binary or memory string: c:\users\user\desktop\procexp.exe
Source: Amcache.hve.9.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.9.dr, Amcache.hve.LOG1.9.dr	Binary or memory string: procexp.exe