Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
Order_002376662-579588_Date 24082022.exe
|
PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
|
initial sample
|
 |
|
|
C:\Users\user\AppData\Local\Temp\nsb3C99.tmp\System.dll
|
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
|
modified
|
||
|
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Sigtelinjens\Tvtningerne\Forhaanet.Nab
|
ASCII text, with very long lines, with no line terminators
|
dropped
|
||
|
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Sigtelinjens\Tvtningerne\Holograph\Towy\Dgnrytmers\GPUPowerSavingConfigEditor.dll
|
PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
|
dropped
|
||
|
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Sigtelinjens\Tvtningerne\Holograph\Towy\Dgnrytmers\face-cool.png
|
PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
|
dropped
|
||
|
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Sigtelinjens\Tvtningerne\Kalligraferendes\Quantisers\Aqua_20.bmp
|
JPEG image data, JFIF standard 1.01, resolution (DPI), density 100x100, segment length 16, Exif Standard: [TIFF image data,
big-endian, direntries=3], baseline, precision 8, 110x110, frames 3
|
dropped
|
||
|
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Sigtelinjens\Tvtningerne\Noneffervescently.Cre
|
data
|
dropped
|
||
|
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Sigtelinjens\Tvtningerne\Tilegnelserne\Suppegrydernes79\iso_3166-1.json
|
UTF-8 Unicode text
|
dropped
|
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Users\user\Desktop\Order_002376662-579588_Date 24082022.exe
|
"C:\Users\user\Desktop\Order_002376662-579588_Date 24082022.exe"
|
|
URLs
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
http://crl.certum.pl/ctnca2.crl0l
|
unknown
|
||
|
http://repository.certum.pl/ctnca2.cer09
|
unknown
|
||
|
http://crl.certum.pl/ctsca2021.crl0o
|
unknown
|
||
|
http://nsis.sf.net/NSIS_Error
|
unknown
|
||
|
http://repository.certum.pl/ctnca.cer09
|
unknown
|
||
|
http://nsis.sf.net/NSIS_ErrorError
|
unknown
|
||
|
http://repository.certum.pl/ctsca2021.cer0
|
unknown
|
||
|
http://crl.certum.pl/ctnca.crl0k
|
unknown
|
||
|
http://subca.ocsp-certum.com05
|
unknown
|
||
|
http://www.certum.pl/CPS0
|
unknown
|
||
|
http://subca.ocsp-certum.com02
|
unknown
|
||
|
http://subca.ocsp-certum.com01
|
unknown
|
There are 2 hidden URLs, click here to show them.
Registry
|
Path
|
Value
|
Malicious
|
|
|---|---|---|---|
|
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\Platooned\Ananthropism
|
Swithen
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Trakeotomis
|
Brndboringen
|
||
|
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\Fallalishly
|
Navigationsskoler
|
||
|
HKEY_CURRENT_USER\Software\Outsnores\Begre\Bonusernes\Skovdistrikts
|
Chold146
|
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
30C0000
|
direct allocation
|
page execute and read and write
|
|
|
|
7717B77000
|
stack
|
page read and write
|
||
|
1E962030000
|
heap
|
page read and write
|
||
|
13FFFA29000
|
heap
|
page read and write
|
||
|
7F8000
|
heap
|
page read and write
|
||
|
14000102000
|
heap
|
page read and write
|
||
|
24D2FB00000
|
heap
|
page read and write
|
||
|
7F2000
|
heap
|
page read and write
|
||
|
13FFF9F0000
|
trusted library allocation
|
page read and write
|
||
|
401000
|
unkown
|
page execute read
|
||
|
24D2FA53000
|
heap
|
page read and write
|
||
|
14004F02000
|
heap
|
page read and write
|
||
|
C6CE7A000
|
stack
|
page read and write
|
||
|
78E000
|
stack
|
page read and write
|
||
|
7F5000
|
heap
|
page read and write
|
||
|
400000
|
unkown
|
page readonly
|
||
|
1883A452000
|
heap
|
page read and write
|
||
|
14000118000
|
heap
|
page read and write
|
||
|
1883A44B000
|
heap
|
page read and write
|
||
|
14000015000
|
heap
|
page read and write
|
||
|
702E27F000
|
stack
|
page read and write
|
||
|
13FFFA13000
|
heap
|
page read and write
|
||
|
22F88254000
|
heap
|
page read and write
|
||
|
277A000
|
trusted library allocation
|
page read and write
|
||
|
702E577000
|
stack
|
page read and write
|
||
|
1883A421000
|
heap
|
page read and write
|
||
|
2424000
|
heap
|
page read and write
|
||
|
24D2F900000
|
heap
|
page read and write
|
||
|
401000
|
unkown
|
page execute read
|
||
|
13FFFA79000
|
heap
|
page read and write
|
||
|
13FFF9C0000
|
heap
|
page read and write
|
||
|
14004E3D000
|
heap
|
page read and write
|
||
|
13FFFAA1000
|
heap
|
page read and write
|
||
|
14004EB7000
|
heap
|
page read and write
|
||
|
40A000
|
unkown
|
page write copy
|
||
|
239F000
|
stack
|
page read and write
|
||
|
1B8AEF9000
|
stack
|
page read and write
|
||
|
14005024000
|
trusted library allocation
|
page read and write
|
||
|
1883A44D000
|
heap
|
page read and write
|
||
|
24D2FA29000
|
heap
|
page read and write
|
||
|
1883A488000
|
heap
|
page read and write
|
||
|
14004DC0000
|
trusted library allocation
|
page read and write
|
||
|
C6D07F000
|
stack
|
page read and write
|
||
|
1883A43C000
|
heap
|
page read and write
|
||
|
24D2FA4B000
|
heap
|
page read and write
|
||
|
690127D000
|
stack
|
page read and write
|
||
|
C6CCF9000
|
stack
|
page read and write
|
||
|
14000BF1000
|
trusted library allocation
|
page read and write
|
||
|
24D2FB08000
|
heap
|
page read and write
|
||
|
690117F000
|
stack
|
page read and write
|
||
|
14004DF0000
|
trusted library allocation
|
page read and write
|
||
|
13FFFAB3000
|
heap
|
page read and write
|
||
|
69009DB000
|
stack
|
page read and write
|
||
|
24D2FB02000
|
heap
|
page read and write
|
||
|
14005004000
|
trusted library allocation
|
page read and write
|
||
|
24D2FA82000
|
heap
|
page read and write
|
||
|
14004DD0000
|
trusted library allocation
|
page read and write
|
||
|
2420000
|
heap
|
page read and write
|
||
|
C6C4F7000
|
stack
|
page read and write
|
||
|
1883A44C000
|
heap
|
page read and write
|
||
|
43C000
|
unkown
|
page readonly
|
||
|
1E962052000
|
heap
|
page read and write
|
||
|
14004E00000
|
heap
|
page read and write
|
||
|
1E96201F000
|
heap
|
page read and write
|
||
|
13FFF950000
|
heap
|
page read and write
|
||
|
1E961F10000
|
heap
|
page read and write
|
||
|
1883A467000
|
heap
|
page read and write
|
||
|
14004EAD000
|
heap
|
page read and write
|
||
|
13FFFAFE000
|
heap
|
page read and write
|
||
|
14004EFB000
|
heap
|
page read and write
|
||
|
C6CB7F000
|
stack
|
page read and write
|
||
|
702DFBD000
|
stack
|
page read and write
|
||
|
13FFFFD0000
|
trusted library section
|
page read and write
|
||
|
1883A508000
|
heap
|
page read and write
|
||
|
22F87FF0000
|
heap
|
page read and write
|