|
C:\Users\user\Desktop\cmdline.out
|
ASCII text, with CRLF line terminators
|
modified
|
|
|
|
| File: |
C:\Users\user\Desktop\cmdline.out
|
| Category: |
modified
|
| Dump: |
cmdline.out.0.dr
|
| ID: |
dr_0
|
| Target ID: |
0
|
| Process: |
C:\Windows\SysWOW64\cmd.exe
|
| Type: |
ASCII text, with CRLF line terminators
|
| Entropy: |
2.189471291564133
|
| Encrypted: |
false
|
| Ssdeep: |
1536:dK8QXYaJk+N2Ryy1WS9MQ3JnGsxc2REiLDsKZIAMFd8JDhuWsfLlDhCS/ciSuHz1:sxdEzJae61
|
| Size: |
560894
|
| Whitelisted: |
false
|
| Reputation: |
low
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Creates files inside the user directory |
System Summary |
|
|
|
C:\Users\user\Desktop\download\camtasia.exe
|
PE32 executable (GUI) Intel 80386, for MS Windows
|
dropped
|
|
|
|
| File: |
C:\Users\user\Desktop\download\camtasia.exe
|
| Category: |
dropped
|
| Dump: |
camtasia.exe.2.dr
|
| ID: |
dr_1
|
| Target ID: |
2
|
| Process: |
C:\Windows\SysWOW64\wget.exe
|
| Type: |
PE32 executable (GUI) Intel 80386, for MS Windows
|
| Entropy: |
7.99971960397624
|
| Encrypted: |
true
|
| Ssdeep: |
6291456:j6ZqpwjIuzjEinRLMtQRBj4xfEXPuaoZhPNEyvpYORwtpG2SepZlmkxe49WvMBqD:j6cuXzjEoRWCjDQvEGY9pG2v3lLwBvMC
|
| Size: |
368315368
|
| Whitelisted: |
false
|
| Reputation: |
low
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Contains functionality to check if a debugger is running (IsDebuggerPresent) |
Anti Debugging |
Security Software Discovery
|
| Contains functionality to read the PEB |
Anti Debugging |
|
| Contains functionality which may be used to detect a debugger (GetProcessHeap) |
Anti Debugging |
Security Software Discovery
|
| Creates a process in suspended mode (likely to inject code) |
HIPS / PFW / Operating System Protection Evasion |
|
| Drops PE files |
Persistence and Installation Behavior |
|
| Drops PE files to the windows directory (C:\Windows) |
Persistence and Installation Behavior |
|
| Found evasive API chain checking for process token information |
Malware Analysis System Evasion |
|
| Found potential string decryption / allocating functions |
System Summary |
Obfuscated Files or Information
Deobfuscate/Decode Files or Information
|
| Uses Microsoft's Enhanced Cryptographic Provider |
Cryptography |
|
| Uses the system / local time for branch decision (may execute only at specific dates) |
Malware Analysis System Evasion |
|
| Contains functionality for error logging |
System Summary |
|
| Contains functionality to adjust token privileges (e.g. debug / backup) |
System Summary |
Access Token Manipulation
|
| Contains functionality to create pipes for IPC |
Language, Device and Operating System Detection |
|
| Contains functionality to enumerate / list files inside a directory |
Spreading, Malware Analysis System Evasion |
File and Directory Discovery
|
| Contains functionality to instantiate COM classes |
System Summary |
|
| Contains functionality to query local / system time |
Language, Device and Operating System Detection |
System Information Discovery
|
| Contains functionality to query time zone information |
Language, Device and Operating System Detection |
|
| Contains functionality to query windows version |
Language, Device and Operating System Detection |
System Information Discovery
|
| Contains functionality to register its own exception handler |
Anti Debugging |
|
| Creates temporary files |
System Summary |
|
| Program exit points |
Malware Analysis System Evasion |
|
| Spawns processes |
System Summary |
|
| URLs found in memory or binary data |
Networking |
|
| Uses an in-process (OLE) Automation server |
System Summary |
|
|
|
C:\Windows\Temp\{7E66493E-A433-47D4-9045-EEADE201F171}\.ba\1028\mbapreq.wxl
|
XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Windows\Temp\{7E66493E-A433-47D4-9045-EEADE201F171}\.ba\1028\mbapreq.wxl
|
| Category: |
dropped
|
| Dump: |
mbapreq.wxl3.6.dr
|
| ID: |
dr_35
|
| Target ID: |
6
|
| Process: |
C:\Windows\Temp\{CB5AD3D6-270A-4AB0-A898-D5E0F7C2252B}\.cr\camtasia.exe
|
| Type: |
XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
|
| Entropy: |
6.231406644010833
|
| Encrypted: |
false
|
| Ssdeep: |
48:cxX7DTAT8tMBCus9T3FVWmHdniarRFeOrw8Nhv2VyfN3mKNWFP44SBWWW1GyfiPq:8L4T2RJhfHP8+VYuTmQUc2mE
|
| Size: |
2025
|
| Whitelisted: |
true
|
| Reputation: |
low
|
|
|
C:\Windows\Temp\{7E66493E-A433-47D4-9045-EEADE201F171}\.ba\1029\mbapreq.wxl
|
XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Windows\Temp\{7E66493E-A433-47D4-9045-EEADE201F171}\.ba\1029\mbapreq.wxl
|
| Category: |
dropped
|
| Dump: |
mbapreq.wxl4.6.dr
|
| ID: |
dr_36
|
| Target ID: |
6
|
| Process: |
C:\Windows\Temp\{CB5AD3D6-270A-4AB0-A898-D5E0F7C2252B}\.cr\camtasia.exe
|
| Type: |
XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
|
| Entropy: |
5.36165936198009
|
| Encrypted: |
false
|
| Ssdeep: |
48:cxX7DTZT8u9cktosM6re4mSTcIIyfI7sh/DMNwIHWAoN3mepNRfKPnWZ0hqAQZfC:8LxTK23f33AwIViRrRynRuZfiMS
|
| Size: |
2458
|
| Whitelisted: |
true
|
| Reputation: |
low
|
|
|
C:\Windows\Temp\{7E66493E-A433-47D4-9045-EEADE201F171}\.ba\1030\mbapreq.wxl
|
XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Windows\Temp\{7E66493E-A433-47D4-9045-EEADE201F171}\.ba\1030\mbapreq.wxl
|
| Category: |
dropped
|
| Dump: |
mbapreq.wxl5.6.dr
|
| ID: |
dr_37
|
| Target ID: |
6
|
| Process: |
C:\Windows\Temp\{CB5AD3D6-270A-4AB0-A898-D5E0F7C2252B}\.cr\camtasia.exe
|
| Type: |
XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
|
| Entropy: |
5.061915970731254
|
| Encrypted: |
false
|
| Ssdeep: |
48:cxX7DCrT81tbzjamsjFq7LhzqGgdRDJNbqoN3mpN+ELPnfyOwYxPyzraXnAF:8LaTOkaEOiGd/BwF
|
| Size: |
2286
|
| Whitelisted: |
true
|
| Reputation: |
low
|
|
|
C:\Windows\Temp\{7E66493E-A433-47D4-9045-EEADE201F171}\.ba\1031\mbapreq.wxl
|
XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Windows\Temp\{7E66493E-A433-47D4-9045-EEADE201F171}\.ba\1031\mbapreq.wxl
|
| Category: |
dropped
|
| Dump: |
mbapreq.wxl6.6.dr
|
| ID: |
dr_38
|
| Target ID: |
6
|
| Process: |
C:\Windows\Temp\{CB5AD3D6-270A-4AB0-A898-D5E0F7C2252B}\.cr\camtasia.exe
|
| Type: |
XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
|
| Entropy: |
5.094465051245675
|
| Encrypted: |
false
|
| Ssdeep: |
48:cxX7DASTcCwit/soJy9hkVByUZN+29N3mfN65PS9CvZwZi7uuASD:8LxT8itGeVB97+gyC9BdaSD
|
| Size: |
2442
|
| Whitelisted: |
true
|
| Reputation: |
low
|
|
|
C:\Windows\Temp\{7E66493E-A433-47D4-9045-EEADE201F171}\.ba\1032\mbapreq.wxl
|
XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Windows\Temp\{7E66493E-A433-47D4-9045-EEADE201F171}\.ba\1032\mbapreq.wxl
|
| Category: |
dropped
|
| Dump: |
mbapreq.wxl7.6.dr
|
| ID: |
dr_39
|
| Target ID: |
6
|
| Process: |
C:\Windows\Temp\{CB5AD3D6-270A-4AB0-A898-D5E0F7C2252B}\.cr\camtasia.exe
|
| Type: |
XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
|
| Entropy: |
5.279888750092028
|
| Encrypted: |
false
|
| Ssdeep: |
48:cxX7D8jVT8dUk9Ug/usOo2pNSBIbESvR2drdESPzghC76DeN2hL0eLoN3mOLSNIx:8L45TCyop5riGzH7xgJit8IqSsBwqk
|
| Size: |
3400
|
| Whitelisted: |
true
|
| Reputation: |
low
|
|
|
C:\Windows\Temp\{7E66493E-A433-47D4-9045-EEADE201F171}\.ba\1035\mbapreq.wxl
|
XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Windows\Temp\{7E66493E-A433-47D4-9045-EEADE201F171}\.ba\1035\mbapreq.wxl
|
| Category: |
dropped
|
| Dump: |
mbapreq.wxl8.6.dr
|
| ID: |
dr_40
|
| Target ID: |
6
|
| Process: |
C:\Windows\Temp\{CB5AD3D6-270A-4AB0-A898-D5E0F7C2252B}\.cr\camtasia.exe
|
| Type: |
XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
|
| Entropy: |
5.142592159444541
|
| Encrypted: |
false
|
| Ssdeep: |
48:cxX7DE+T8Z+bm5snwETMAoQEATN27uNBDReq4N3mJeNHNP64NsFKJJem4vyAs:8LZTDkZ7+2IBCht6J8neHs
|
| Size: |
2235
|
| Whitelisted: |
true
|
| Reputation: |
low
|
|
|
C:\Windows\Temp\{7E66493E-A433-47D4-9045-EEADE201F171}\.ba\1036\mbapreq.wxl
|
XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Windows\Temp\{7E66493E-A433-47D4-9045-EEADE201F171}\.ba\1036\mbapreq.wxl
|
| Category: |
dropped
|
| Dump: |
mbapreq.wxl9.6.dr
|
| ID: |
dr_41
|
| Target ID: |
6
|
| Process: |
C:\Windows\Temp\{CB5AD3D6-270A-4AB0-A898-D5E0F7C2252B}\.cr\camtasia.exe
|
| Type: |
XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
|
| Entropy: |
5.076293283609686
|
| Encrypted: |
false
|
| Ssdeep: |
48:cxX7DyBT81BbKBswAL1xV1wjRcDSNwDXoN3mSZfNhkLPkQpznsdMEodAY:8LwTK5KHsijmEXY
|
| Size: |
2306
|
| Whitelisted: |
true
|
| Reputation: |
low
|
|
|
C:\Windows\Temp\{7E66493E-A433-47D4-9045-EEADE201F171}\.ba\1038\mbapreq.wxl
|
XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Windows\Temp\{7E66493E-A433-47D4-9045-EEADE201F171}\.ba\1038\mbapreq.wxl
|
| Category: |
dropped
|
| Dump: |
mbapreq.wxl10.6.dr
|
| ID: |
dr_42
|
| Target ID: |
6
|
| Process: |
C:\Windows\Temp\{CB5AD3D6-270A-4AB0-A898-D5E0F7C2252B}\.cr\camtasia.exe
|
| Type: |
XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
|
| Entropy: |
5.293225307744296
|
| Encrypted: |
false
|
| Ssdeep: |
48:cxX7DwzT8cSwvs48mF7GD/g1v0wH7N3wwJxL99oN3m/ZNRUYPBZRT1XESW3o/ULG:8LQT2wpFGbgT3wMN2QRj/y/LKr
|
| Size: |
2392
|
| Whitelisted: |
true
|
| Reputation: |
low
|
|
|
C:\Windows\Temp\{7E66493E-A433-47D4-9045-EEADE201F171}\.ba\1040\mbapreq.wxl
|
XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Windows\Temp\{7E66493E-A433-47D4-9045-EEADE201F171}\.ba\1040\mbapreq.wxl
|
| Category: |
dropped
|
| Dump: |
mbapreq.wxl11.6.dr
|
| ID: |
dr_43
|
| Target ID: |
6
|
| Process: |
C:\Windows\Temp\{CB5AD3D6-270A-4AB0-A898-D5E0F7C2252B}\.cr\camtasia.exe
|
| Type: |
XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
|
| Entropy: |
4.985260685429469
|
| Encrypted: |
false
|
| Ssdeep: |
48:cxX7DQyT81ebRcesyB+lY25ukVpkXJM2DJNXhpXZoN3mMhNTM+POYO/n1YxXlcI5:8LFTzLtkfwWKXHZi37MIDp
|
| Size: |
2304
|
| Whitelisted: |
true
|
| Reputation: |
low
|
|
|
C:\Windows\Temp\{7E66493E-A433-47D4-9045-EEADE201F171}\.ba\1041\mbapreq.wxl
|
XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Windows\Temp\{7E66493E-A433-47D4-9045-EEADE201F171}\.ba\1041\mbapreq.wxl
|
| Category: |
dropped
|
| Dump: |
mbapreq.wxl12.6.dr
|
| ID: |
dr_44
|
| Target ID: |
6
|
| Process: |
C:\Windows\Temp\{CB5AD3D6-270A-4AB0-A898-D5E0F7C2252B}\.cr\camtasia.exe
|
| Type: |
XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
|
| Entropy: |
5.923292576429967
|
| Encrypted: |
false
|
| Ssdeep: |
48:cxX7DpcYT86WyscLpTIFw6tnOUjsj/D3NIgHcQN3mKN/WPOhT0SXsDay+z8QZEcE:8L1TccOFw6tnOUjsjpICnlOO934apWz
|
| Size: |
2545
|
| Whitelisted: |
true
|
| Reputation: |
low
|
|
|
C:\Windows\Temp\{7E66493E-A433-47D4-9045-EEADE201F171}\.ba\1042\mbapreq.wxl
|
XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Windows\Temp\{7E66493E-A433-47D4-9045-EEADE201F171}\.ba\1042\mbapreq.wxl
|
| Category: |
dropped
|
| Dump: |
mbapreq.wxl13.6.dr
|
| ID: |
dr_45
|
| Target ID: |
6
|
| Process: |
C:\Windows\Temp\{CB5AD3D6-270A-4AB0-A898-D5E0F7C2252B}\.cr\camtasia.exe
|
| Type: |
XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
|
| Entropy: |
5.97627825234954
|
| Encrypted: |
false
|
| Ssdeep: |
48:cxX7D3sT8ZeusKOwOWGyKCstFmhENI2Y+kN3mp4iNmi6IPa0dDaoIunvZqIHU5UH:8LQTXvRFhIzl44wmgko04U5TY
|
| Size: |
2236
|
| Whitelisted: |
true
|
| Reputation: |
low
|
|
|
C:\Windows\Temp\{7E66493E-A433-47D4-9045-EEADE201F171}\.ba\1043\mbapreq.wxl
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Windows\Temp\{7E66493E-A433-47D4-9045-EEADE201F171}\.ba\1043\mbapreq.wxl
|
| Category: |
dropped
|
| Dump: |
mbapreq.wxl14.6.dr
|
| ID: |
dr_46
|
| Target ID: |
6
|
| Process: |
C:\Windows\Temp\{CB5AD3D6-270A-4AB0-A898-D5E0F7C2252B}\.cr\camtasia.exe
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.965432037520827
|
| Encrypted: |
false
|
| Ssdeep: |
48:cxX7DK1T8u7hbU7Asd7MqpSwzCcHGFN9OsNN3mvoNBC7hPFtO7+xw7t0Yza2Al:8LcTtpGLFSwJHmPnnKhEBtsl
|
| Size: |
2312
|
| Whitelisted: |
true
|
| Reputation: |
low
|
|
|
C:\Windows\Temp\{7E66493E-A433-47D4-9045-EEADE201F171}\.ba\1044\mbapreq.wxl
|
XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Windows\Temp\{7E66493E-A433-47D4-9045-EEADE201F171}\.ba\1044\mbapreq.wxl
|
| Category: |
dropped
|
| Dump: |
mbapreq.wxl15.6.dr
|
| ID: |
dr_47
|
| Target ID: |
6
|
| Process: |
C:\Windows\Temp\{CB5AD3D6-270A-4AB0-A898-D5E0F7C2252B}\.cr\camtasia.exe
|
| Type: |
XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
|
| Entropy: |
5.089922193759582
|
| Encrypted: |
false
|
| Ssdeep: |
48:cxX7DTeT8uUbnFdsLnFHv+Gpm1qL5DQNDDaoN3mpZfN15dPnfuOOg5wZ5uAq8fAS:8L+Tec1x8Siule4S
|
| Size: |
2171
|
| Whitelisted: |
true
|
| Reputation: |
low
|
|
|
C:\Windows\Temp\{7E66493E-A433-47D4-9045-EEADE201F171}\.ba\1045\mbapreq.wxl
|
XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Windows\Temp\{7E66493E-A433-47D4-9045-EEADE201F171}\.ba\1045\mbapreq.wxl
|
| Category: |
dropped
|
| Dump: |
mbapreq.wxl16.6.dr
|
| ID: |
dr_48
|
| Target ID: |
6
|
| Process: |
C:\Windows\Temp\{CB5AD3D6-270A-4AB0-A898-D5E0F7C2252B}\.cr\camtasia.exe
|
| Type: |
XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
|
| Entropy: |
5.270514043715206
|
| Encrypted: |
false
|
| Ssdeep: |
48:cxX7Du4OT82gXusarwkfpYrKD8DTNkbNuoN3mjbsNniIPh8ynN1NYd4iYuffAL:8LKTsXgpYr2IyoiiOffpT3L
|
| Size: |
2368
|
| Whitelisted: |
true
|
| Reputation: |
low
|
|
|
C:\Windows\Temp\{7E66493E-A433-47D4-9045-EEADE201F171}\.ba\1046\mbapreq.wxl
|
XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Windows\Temp\{7E66493E-A433-47D4-9045-EEADE201F171}\.ba\1046\mbapreq.wxl
|
| Category: |
dropped
|
| Dump: |
mbapreq.wxl17.6.dr
|
| ID: |
dr_49
|
| Target ID: |
6
|
| Process: |
C:\Windows\Temp\{CB5AD3D6-270A-4AB0-A898-D5E0F7C2252B}\.cr\camtasia.exe
|
| Type: |
XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
|
| Entropy: |
5.130635342194656
|
| Encrypted: |
false
|
| Ssdeep: |
48:cxX7DuoT85b0s/4TDoYDj4NF5j2hN3mMNYskPDXKIMaKcP9A5g:8L1TmBHjs59M8r6
|
| Size: |
2147
|
| Whitelisted: |
true
|
| Reputation: |
low
|
|
|
C:\Windows\Temp\{7E66493E-A433-47D4-9045-EEADE201F171}\.ba\1049\mbapreq.wxl
|
XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Windows\Temp\{7E66493E-A433-47D4-9045-EEADE201F171}\.ba\1049\mbapreq.wxl
|
| Category: |
dropped
|
| Dump: |
mbapreq.wxl18.6.dr
|
| ID: |
dr_50
|
| Target ID: |
6
|
| Process: |
C:\Windows\Temp\{CB5AD3D6-270A-4AB0-A898-D5E0F7C2252B}\.cr\camtasia.exe
|
| Type: |
XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
|
| Entropy: |
5.408094213063887
|
| Encrypted: |
false
|
| Ssdeep: |
48:cxX7DkTT8fjtEeusogrohY2Ar7DHNnjTh53oN3miRMNKrdPin+/uYcbSkuEIcOvG:8LYT8EeHMMJRNi1Ruwi3OwL
|
| Size: |
2880
|
| Whitelisted: |
true
|
| Reputation: |
low
|
|
|
C:\Windows\Temp\{7E66493E-A433-47D4-9045-EEADE201F171}\.ba\1051\mbapreq.wxl
|
XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Windows\Temp\{7E66493E-A433-47D4-9045-EEADE201F171}\.ba\1051\mbapreq.wxl
|
| Category: |
dropped
|
| Dump: |
mbapreq.wxl19.6.dr
|
| ID: |
dr_51
|
| Target ID: |
6
|
| Process: |
C:\Windows\Temp\{CB5AD3D6-270A-4AB0-A898-D5E0F7C2252B}\.cr\camtasia.exe
|
| Type: |
XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
|
| Entropy: |
5.397882326481071
|
| Encrypted: |
false
|
| Ssdeep: |
48:cxX7D+cT8muPusz2qs1u+Vh1TqDINHZJoN3m8fN0vPp3OAwa2ywSODAm:8L1TuPdKNzfifFmcatm
|
| Size: |
2334
|
| Whitelisted: |
true
|
| Reputation: |
low
|
|
|
C:\Windows\Temp\{7E66493E-A433-47D4-9045-EEADE201F171}\.ba\1053\mbapreq.wxl
|
XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Windows\Temp\{7E66493E-A433-47D4-9045-EEADE201F171}\.ba\1053\mbapreq.wxl
|
| Category: |
dropped
|
| Dump: |
mbapreq.wxl20.6.dr
|
| ID: |
dr_52
|
| Target ID: |
6
|
| Process: |
C:\Windows\Temp\{CB5AD3D6-270A-4AB0-A898-D5E0F7C2252B}\.cr\camtasia.exe
|
| Type: |
XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
|
| Entropy: |
5.1255014007111495
|
| Encrypted: |
false
|
| Ssdeep: |
48:cxX7DviT8NFLbu9sM2vECjf26axBZYXcqADCNKTbkoN3maT6NWOjEXPauOOKYnhf:8LmTAcRnQXFPK0iHMsfb2Ws3M
|
| Size: |
2132
|
| Whitelisted: |
true
|
| Reputation: |
low
|
|
|
C:\Windows\Temp\{7E66493E-A433-47D4-9045-EEADE201F171}\.ba\1055\mbapreq.wxl
|
XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Windows\Temp\{7E66493E-A433-47D4-9045-EEADE201F171}\.ba\1055\mbapreq.wxl
|
| Category: |
dropped
|
| Dump: |
mbapreq.wxl21.6.dr
|
| ID: |
dr_53
|
| Target ID: |
6
|
| Process: |
C:\Windows\Temp\{CB5AD3D6-270A-4AB0-A898-D5E0F7C2252B}\.cr\camtasia.exe
|
| Type: |
XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
|
| Entropy: |
5.2754753523795275
|
| Encrypted: |
false
|
| Ssdeep: |
48:cxX7DNcYT8anOSMsHEqGpcBztpvrJlrs2ZmNI2+Yo6irN3m22NFcPc+4Trzrdgc7:8LZHTE7APaTI9sq6yEbgg
|
| Size: |
2303
|
| Whitelisted: |
true
|
| Reputation: |
low
|
|
|
C:\Windows\Temp\{7E66493E-A433-47D4-9045-EEADE201F171}\.ba\1060\mbapreq.wxl
|
XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Windows\Temp\{7E66493E-A433-47D4-9045-EEADE201F171}\.ba\1060\mbapreq.wxl
|
| Category: |
dropped
|
| Dump: |
mbapreq.wxl22.6.dr
|
| ID: |
dr_54
|
| Target ID: |
6
|
| Process: |
C:\Windows\Temp\{CB5AD3D6-270A-4AB0-A898-D5E0F7C2252B}\.cr\camtasia.exe
|
| Type: |
XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
|
| Entropy: |
5.1485120966265
|
| Encrypted: |
false
|
| Ssdeep: |
48:cxX7DZ0T8obZsw9g5gS56K97D7NCt2VoN3mQXNJPOhP58vqc1qwueo3RAL:8LyTLlS9h9hCtsihdxOh+NL
|
| Size: |
2200
|
| Whitelisted: |
true
|
| Reputation: |
low
|
|
|
C:\Windows\Temp\{7E66493E-A433-47D4-9045-EEADE201F171}\.ba\2052\mbapreq.wxl
|
XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Windows\Temp\{7E66493E-A433-47D4-9045-EEADE201F171}\.ba\2052\mbapreq.wxl
|
| Category: |
dropped
|
| Dump: |
mbapreq.wxl.6.dr
|
| ID: |
dr_3
|
| Target ID: |
6
|
| Process: |
C:\Windows\Temp\{CB5AD3D6-270A-4AB0-A898-D5E0F7C2252B}\.cr\camtasia.exe
|
| Type: |
XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
|
| Entropy: |
6.189594519053644
|
| Encrypted: |
false
|
| Ssdeep: |
48:cxX7DjQT8tOBousi+zq+frUR2ropNV2rfN3msNUqPPT9T+DwZ9f5wDTAV:8L4TGUGw3V8N3RykV
|
| Size: |
1980
|
| Whitelisted: |
true
|
| Reputation: |
low
|
|
|
C:\Windows\Temp\{7E66493E-A433-47D4-9045-EEADE201F171}\.ba\2070\mbapreq.wxl
|
XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Windows\Temp\{7E66493E-A433-47D4-9045-EEADE201F171}\.ba\2070\mbapreq.wxl
|
| Category: |
dropped
|
| Dump: |
mbapreq.wxl0.6.dr
|
| ID: |
dr_4
|
| Target ID: |
6
|
| Process: |
C:\Windows\Temp\{CB5AD3D6-270A-4AB0-A898-D5E0F7C2252B}\.cr\camtasia.exe
|
| Type: |
XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
|
| Entropy: |
5.1155097909395035
|
| Encrypted: |
false
|
| Ssdeep: |
48:cxX7DbT8QGls54nK3znI5zKDj4NLkdoN3mMNYsEPbpK2Aegeu9A5g:8LXTUasJnYdi59som6
|
| Size: |
2211
|
| Whitelisted: |
true
|
| Reputation: |
low
|
|
|
C:\Windows\Temp\{7E66493E-A433-47D4-9045-EEADE201F171}\.ba\3082\mbapreq.wxl
|
XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Windows\Temp\{7E66493E-A433-47D4-9045-EEADE201F171}\.ba\3082\mbapreq.wxl
|
| Category: |
dropped
|
| Dump: |
mbapreq.wxl1.6.dr
|
| ID: |
dr_5
|
| Target ID: |
6
|
| Process: |
C:\Windows\Temp\{CB5AD3D6-270A-4AB0-A898-D5E0F7C2252B}\.cr\camtasia.exe
|
| Type: |
XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
|
| Entropy: |
4.992567587099768
|
| Encrypted: |
false
|
| Ssdeep: |
48:cxX7DLT8/OusS2V8j4Lq+7dKzCLdqaaD6NJaXFoN3mRNLo3PWKWnRcsB9A8:8LfTz+8EPqKqTJiFikUgk8
|
| Size: |
2400
|
| Whitelisted: |
true
|
| Reputation: |
low
|
|
|
C:\Windows\Temp\{7E66493E-A433-47D4-9045-EEADE201F171}\.ba\Bootstrapper.de-DE.wxl
|
XML 1.0 document, Unicode text, UTF-8 text, with very long lines (336), with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Windows\Temp\{7E66493E-A433-47D4-9045-EEADE201F171}\.ba\Bootstrapper.de-DE.wxl
|
| Category: |
dropped
|
| Dump: |
Bootstrapper.de-DE.wxl.6.dr
|
| ID: |
dr_10
|
| Target ID: |
6
|
| Process: |
C:\Windows\Temp\{CB5AD3D6-270A-4AB0-A898-D5E0F7C2252B}\.cr\camtasia.exe
|
| Type: |
XML 1.0 document, Unicode text, UTF-8 text, with very long lines (336), with CRLF line terminators
|
| Entropy: |
5.233721305179343
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d54+QGRLjoEDo+xRvn1IQoPoecam+6N0bYoxZaVwWJs2ix8d5:c9TSET71CQLt0bzIJ
|
| Size: |
1020
|
| Whitelisted: |
false
|
| Reputation: |
low
|
|
|
C:\Windows\Temp\{7E66493E-A433-47D4-9045-EEADE201F171}\.ba\Bootstrapper.en-US.wxl
|
XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (302), with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Windows\Temp\{7E66493E-A433-47D4-9045-EEADE201F171}\.ba\Bootstrapper.en-US.wxl
|
| Category: |
dropped
|
| Dump: |
Bootstrapper.en-US.wxl.6.dr
|
| ID: |
dr_22
|
| Target ID: |
6
|
| Process: |
C:\Windows\Temp\{CB5AD3D6-270A-4AB0-A898-D5E0F7C2252B}\.cr\camtasia.exe
|
| Type: |
XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (302), with CRLF line terminators
|
| Entropy: |
5.201493348802633
|
| Encrypted: |
false
|
| Ssdeep: |
24:JdO4+QGRLjorp+xHyOgJSoecC1QsoQc3640EwbIaqs:30TS0TgJ9+GPhcI0
|
| Size: |
920
|
| Whitelisted: |
false
|
| Reputation: |
low
|
|
|
C:\Windows\Temp\{7E66493E-A433-47D4-9045-EEADE201F171}\.ba\Bootstrapper.es-ES.wxl
|
XML 1.0 document, Unicode text, UTF-8 text, with very long lines (312), with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Windows\Temp\{7E66493E-A433-47D4-9045-EEADE201F171}\.ba\Bootstrapper.es-ES.wxl
|
| Category: |
dropped
|
| Dump: |
Bootstrapper.es-ES.wxl.6.dr
|
| ID: |
dr_11
|
| Target ID: |
6
|
| Process: |
C:\Windows\Temp\{CB5AD3D6-270A-4AB0-A898-D5E0F7C2252B}\.cr\camtasia.exe
|
| Type: |
XML 1.0 document, Unicode text, UTF-8 text, with very long lines (312), with CRLF line terminators
|
| Entropy: |
5.168443890300373
|
| Encrypted: |
false
|
| Ssdeep: |
24:2dgo4+QGRLjor8xHrCD5t/3oecwEkwtioQcbZU8HXZntqe:cPTSo8le8E//3Tntj
|
| Size: |
964
|
| Whitelisted: |
false
|
| Reputation: |
low
|
|
|
C:\Windows\Temp\{7E66493E-A433-47D4-9045-EEADE201F171}\.ba\Bootstrapper.fr-FR.wxl
|
XML 1.0 document, Unicode text, UTF-8 text, with very long lines (348), with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Windows\Temp\{7E66493E-A433-47D4-9045-EEADE201F171}\.ba\Bootstrapper.fr-FR.wxl
|
| Category: |
dropped
|
| Dump: |
Bootstrapper.fr-FR.wxl.6.dr
|
| ID: |
dr_12
|
| Target ID: |
6
|
| Process: |
C:\Windows\Temp\{CB5AD3D6-270A-4AB0-A898-D5E0F7C2252B}\.cr\camtasia.exe
|
| Type: |
XML 1.0 document, Unicode text, UTF-8 text, with very long lines (348), with CRLF line terminators
|
| Entropy: |
5.2506564347881985
|
| Encrypted: |
false
|
| Ssdeep: |
24:2dj4+QGRLjoKCIxHs8N9dTQe2Rnco68gnYOb5toQc1znqPiUGznU/Y9J:cPTSKTOk9+Rn/NBObcz2fG1J
|
| Size: |
1080
|
| Whitelisted: |
false
|
| Reputation: |
low
|
|
|
C:\Windows\Temp\{7E66493E-A433-47D4-9045-EEADE201F171}\.ba\Bootstrapper.ja-JP.wxl
|
XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Windows\Temp\{7E66493E-A433-47D4-9045-EEADE201F171}\.ba\Bootstrapper.ja-JP.wxl
|
| Category: |
dropped
|
| Dump: |
Bootstrapper.ja-JP.wxl.6.dr
|
| ID: |
dr_23
|
| Target ID: |
6
|
| Process: |
C:\Windows\Temp\{CB5AD3D6-270A-4AB0-A898-D5E0F7C2252B}\.cr\camtasia.exe
|
| Type: |
XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
|
| Entropy: |
5.8659845373957005
|
| Encrypted: |
false
|
| Ssdeep: |
24:2dy4+QGRLjorcKxG6OoNXGu2fnRfZoecxxXGrb/oQcwQj49WbN6yY4Mc:cwTS4KkjcsfKuASQ0aLMc
|
| Size: |
1201
|
| Whitelisted: |
false
|
| Reputation: |
low
|
|
|
C:\Windows\Temp\{7E66493E-A433-47D4-9045-EEADE201F171}\.ba\Bootstrapper.pt-BR.wxl
|
XML 1.0 document, Unicode text, UTF-8 text, with very long lines (318), with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Windows\Temp\{7E66493E-A433-47D4-9045-EEADE201F171}\.ba\Bootstrapper.pt-BR.wxl
|
| Category: |
dropped
|
| Dump: |
Bootstrapper.pt-BR.wxl.6.dr
|
| ID: |
dr_24
|
| Target ID: |
6
|
| Process: |
C:\Windows\Temp\{CB5AD3D6-270A-4AB0-A898-D5E0F7C2252B}\.cr\camtasia.exe
|
| Type: |
XML 1.0 document, Unicode text, UTF-8 text, with very long lines (318), with CRLF line terminators
|
| Entropy: |
5.186546315874703
|
| Encrypted: |
false
|
| Ssdeep: |
24:2dD4+QGRLjoeZxH6Is7K6KFkAoeSkLTHo0F2ZINUZhql:cvTSi5s3OYNINK4
|
| Size: |
981
|
| Whitelisted: |
false
|
| Reputation: |
low
|
|
|
C:\Windows\Temp\{7E66493E-A433-47D4-9045-EEADE201F171}\.ba\Bootstrapper.zh-CN.wxl
|
XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Windows\Temp\{7E66493E-A433-47D4-9045-EEADE201F171}\.ba\Bootstrapper.zh-CN.wxl
|
| Category: |
dropped
|
| Dump: |
Bootstrapper.zh-CN.wxl.6.dr
|
| ID: |
dr_14
|
| Target ID: |
6
|
| Process: |
C:\Windows\Temp\{CB5AD3D6-270A-4AB0-A898-D5E0F7C2252B}\.cr\camtasia.exe
|
| Type: |
XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
|
| Entropy: |
6.170692116826478
|
| Encrypted: |
false
|
| Ssdeep: |
24:2dE4+QGRLjorXWxatpiSSyoecn9HoQcFT2UY+8O45:ciTS7WccdLO3TaD
|
| Size: |
868
|
| Whitelisted: |
false
|
| Reputation: |
low
|
|
|
C:\Windows\Temp\{7E66493E-A433-47D4-9045-EEADE201F171}\.ba\BootstrapperApplicationData.xml
|
XML 1.0 document, Unicode text, UTF-16, little-endian text, with very long lines (573), with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Windows\Temp\{7E66493E-A433-47D4-9045-EEADE201F171}\.ba\BootstrapperApplicationData.xml
|
| Category: |
dropped
|
| Dump: |
BootstrapperApplicationData.xml.6.dr
|
| ID: |
dr_16
|
| Target ID: |
6
|
| Process: |
C:\Windows\Temp\{CB5AD3D6-270A-4AB0-A898-D5E0F7C2252B}\.cr\camtasia.exe
|
| Type: |
XML 1.0 document, Unicode text, UTF-16, little-endian text, with very long lines (573), with CRLF line terminators
|
| Entropy: |
3.704158393359043
|
| Encrypted: |
false
|
| Ssdeep: |
192:X0sGsNs4gjTGSRFxF0F1xErF/FUFyF0FgF+FVFhFwucFjFNF6FJFhFwWFhFpFGfi:X0sGsNs4gjTCEN12reCCmT
|
| Size: |
22588
|
| Whitelisted: |
false
|
| Reputation: |
low
|
|
|
C:\Windows\Temp\{7E66493E-A433-47D4-9045-EEADE201F171}\.ba\BootstrapperCore.config
|
XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Windows\Temp\{7E66493E-A433-47D4-9045-EEADE201F171}\.ba\BootstrapperCore.config
|
| Category: |
dropped
|
| Dump: |
BootstrapperCore.config.6.dr
|
| ID: |
dr_20
|
| Target ID: |
6
|
| Process: |
C:\Windows\Temp\{CB5AD3D6-270A-4AB0-A898-D5E0F7C2252B}\.cr\camtasia.exe
|
| Type: |
XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
|
| Entropy: |
4.928176017224312
|
| Encrypted: |
false
|
| Ssdeep: |
12:MMHd41id7lzc+TXYr+XFy9bWzc+TXYcXIIfMVymhsSY9g3XmG/nQ3bxT:Jd17RtYrx9itYsmhV3WenQ3l
|
| Size: |
621
|
| Whitelisted: |
false
|
| Reputation: |
low
|
|
|
C:\Windows\Temp\{7E66493E-A433-47D4-9045-EEADE201F171}\.ba\BootstrapperCore.dll
|
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
|
dropped
|
|
|
|
| File: |
C:\Windows\Temp\{7E66493E-A433-47D4-9045-EEADE201F171}\.ba\BootstrapperCore.dll
|
| Category: |
dropped
|
| Dump: |
BootstrapperCore.dll.6.dr
|
| ID: |
dr_26
|
| Target ID: |
6
|
| Process: |
C:\Windows\Temp\{CB5AD3D6-270A-4AB0-A898-D5E0F7C2252B}\.cr\camtasia.exe
|
| Type: |
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
|
| Entropy: |
5.688550211341784
|
| Encrypted: |
false
|
| Ssdeep: |
768:9BgPxZlx0MBps+j7ejaab0Y6OwE7v10WHSp5fh06iG27N9k+6ybJ1ErEgtCmYjhm:HHMBp/GRbgi5ofpiG2pq+51EogsmYI
|
| Size: |
90032
|
| Whitelisted: |
true
|
| Reputation: |
low
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Drops PE files |
Persistence and Installation Behavior |
|
| Drops PE files to the windows directory (C:\Windows) |
Persistence and Installation Behavior |
|
| Found dropped PE file which has not been started or loaded |
Malware Analysis System Evasion |
|
| Queries the volume information (name, serial number etc) of a device |
Language, Device and Operating System Detection |
System Information Discovery
|
|
|
C:\Windows\Temp\{7E66493E-A433-47D4-9045-EEADE201F171}\.ba\CamtasiaBootstrapperApplication.dll
|
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
|
dropped
|
|
|
|
| File: |
C:\Windows\Temp\{7E66493E-A433-47D4-9045-EEADE201F171}\.ba\CamtasiaBootstrapperApplication.dll
|
| Category: |
dropped
|
| Dump: |
CamtasiaBootstrapperApplication.dll.6.dr
|
| ID: |
dr_27
|
| Target ID: |
6
|
| Process: |
C:\Windows\Temp\{CB5AD3D6-270A-4AB0-A898-D5E0F7C2252B}\.cr\camtasia.exe
|
| Type: |
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
|
| Entropy: |
7.098862290420886
|
| Encrypted: |
false
|
| Ssdeep: |
12288:yWOP5P6Mfv32KwxUc1iLiGD9SSMRoHQkupgv:ypPhvGV1iN0SMRy
|
| Size: |
741376
|
| Whitelisted: |
false
|
| Reputation: |
low
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Drops PE files |
Persistence and Installation Behavior |
|
| Drops PE files to the windows directory (C:\Windows) |
Persistence and Installation Behavior |
|
| Found dropped PE file which has not been started or loaded |
Malware Analysis System Evasion |
|
| Queries the volume information (name, serial number etc) of a device |
Language, Device and Operating System Detection |
System Information Discovery
|
|
|
C:\Windows\Temp\{7E66493E-A433-47D4-9045-EEADE201F171}\.ba\EditionConstants.dll
|
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
|
dropped
|
|
|
|
| File: |
C:\Windows\Temp\{7E66493E-A433-47D4-9045-EEADE201F171}\.ba\EditionConstants.dll
|
| Category: |
dropped
|
| Dump: |
EditionConstants.dll.6.dr
|
| ID: |
dr_30
|
| Target ID: |
6
|
| Process: |
C:\Windows\Temp\{CB5AD3D6-270A-4AB0-A898-D5E0F7C2252B}\.cr\camtasia.exe
|
| Type: |
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
|
| Entropy: |
5.052927687512696
|
| Encrypted: |
false
|
| Ssdeep: |
192:3tjaOqSpC00lyozQW6ZKiNOcmJW2Fl8p4wRSrBlOg+YbQ+4GkdL93T2:FaOhpilVQW6rVmJW2MewRUnLk3T2
|
| Size: |
12288
|
| Whitelisted: |
false
|
| Reputation: |
low
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Drops PE files |
Persistence and Installation Behavior |
|
| Drops PE files to the windows directory (C:\Windows) |
Persistence and Installation Behavior |
|
| Found dropped PE file which has not been started or loaded |
Malware Analysis System Evasion |
|
| Queries the volume information (name, serial number etc) of a device |
Language, Device and Operating System Detection |
System Information Discovery
|
|
|
C:\Windows\Temp\{7E66493E-A433-47D4-9045-EEADE201F171}\.ba\Microsoft.Deployment.WindowsInstaller.dll
|
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
|
dropped
|
|
|
|
| File: |
C:\Windows\Temp\{7E66493E-A433-47D4-9045-EEADE201F171}\.ba\Microsoft.Deployment.WindowsInstaller.dll
|
| Category: |
dropped
|
| Dump: |
Microsoft.Deployment.WindowsInstaller.dll.6.dr
|
| ID: |
dr_21
|
| Target ID: |
6
|
| Process: |
C:\Windows\Temp\{CB5AD3D6-270A-4AB0-A898-D5E0F7C2252B}\.cr\camtasia.exe
|
| Type: |
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
|
| Entropy: |
5.876033362692288
|
| Encrypted: |
false
|
| Ssdeep: |
3072:BGfZS7hUuK3PcbFeRRLxyR69UgoCaf8+aCnfKlRUjW01KymkO:9zMRLkR6joxfRPW
|
| Size: |
184240
|
| Whitelisted: |
true
|
| Reputation: |
low
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Drops PE files |
Persistence and Installation Behavior |
|
| Drops PE files to the windows directory (C:\Windows) |
Persistence and Installation Behavior |
|
| Found dropped PE file which has not been started or loaded |
Malware Analysis System Evasion |
|
|
|
C:\Windows\Temp\{7E66493E-A433-47D4-9045-EEADE201F171}\.ba\Microsoft.Expression.Interactions.dll
|
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
|
dropped
|
|
|
|
| File: |
C:\Windows\Temp\{7E66493E-A433-47D4-9045-EEADE201F171}\.ba\Microsoft.Expression.Interactions.dll
|
| Category: |
dropped
|
| Dump: |
Microsoft.Expression.Interactions.dll.6.dr
|
| ID: |
dr_8
|
| Target ID: |
6
|
| Process: |
C:\Windows\Temp\{CB5AD3D6-270A-4AB0-A898-D5E0F7C2252B}\.cr\camtasia.exe
|
| Type: |
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
|
| Entropy: |
5.836675531273972
|
| Encrypted: |
false
|
| Ssdeep: |
1536:Srf5GttgxHXEuRmG5rtkGY4CEmWAxXSSYhhS98ca2Wvsd65FJDlGWwkEy:a5GttWHXEUx5r65LxXshk8JDIWP
|
| Size: |
91648
|
| Whitelisted: |
true
|
| Reputation: |
low
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Drops PE files |
Persistence and Installation Behavior |
|
| Drops PE files to the windows directory (C:\Windows) |
Persistence and Installation Behavior |
|
| Found dropped PE file which has not been started or loaded |
Malware Analysis System Evasion |
|
|
|
C:\Windows\Temp\{7E66493E-A433-47D4-9045-EEADE201F171}\.ba\System.Windows.Interactivity.dll
|
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
|
dropped
|
|
|
|
| File: |
C:\Windows\Temp\{7E66493E-A433-47D4-9045-EEADE201F171}\.ba\System.Windows.Interactivity.dll
|
| Category: |
dropped
|
| Dump: |
System.Windows.Interactivity.dll.6.dr
|
| ID: |
dr_28
|
| Target ID: |
6
|
| Process: |
C:\Windows\Temp\{CB5AD3D6-270A-4AB0-A898-D5E0F7C2252B}\.cr\camtasia.exe
|
| Type: |
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
|
| Entropy: |
5.593512133791687
|
| Encrypted: |
false
|
| Ssdeep: |
768:6MazwAgR8/XJ665bKZdxuB8DCuL5enM7JxKjuMlZCZN+R0E7E:63wBccZdxuB8mQen6JxKjrlMZgR0Eo
|
| Size: |
39936
|
| Whitelisted: |
true
|
| Reputation: |
low
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Drops PE files |
Persistence and Installation Behavior |
|
| Drops PE files to the windows directory (C:\Windows) |
Persistence and Installation Behavior |
|
| Found dropped PE file which has not been started or loaded |
Malware Analysis System Evasion |
|
| Queries the volume information (name, serial number etc) of a device |
Language, Device and Operating System Detection |
System Information Discovery
|
|
|
C:\Windows\Temp\{7E66493E-A433-47D4-9045-EEADE201F171}\.ba\TechSmith.Win32.dll
|
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
|
dropped
|
|
|
|
| File: |
C:\Windows\Temp\{7E66493E-A433-47D4-9045-EEADE201F171}\.ba\TechSmith.Win32.dll
|
| Category: |
dropped
|
| Dump: |
TechSmith.Win32.dll.6.dr
|
| ID: |
dr_29
|
| Target ID: |
6
|
| Process: |
C:\Windows\Temp\{CB5AD3D6-270A-4AB0-A898-D5E0F7C2252B}\.cr\camtasia.exe
|
| Type: |
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
|
| Entropy: |
5.895235960595344
|
| Encrypted: |
false
|
| Ssdeep: |
768:RB9QbO/taV0arVikz3qVj6nlHCfPsNhYTmeBUOkWZ+EAQz:Z0JxPqVj6lHC3uhYTLyWUED
|
| Size: |
35328
|
| Whitelisted: |
false
|
| Reputation: |
low
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Drops PE files |
Persistence and Installation Behavior |
|
| Drops PE files to the windows directory (C:\Windows) |
Persistence and Installation Behavior |
|
| Found dropped PE file which has not been started or loaded |
Malware Analysis System Evasion |
|
|
|
C:\Windows\Temp\{7E66493E-A433-47D4-9045-EEADE201F171}\.ba\WPFCommonControls.dll
|
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
|
dropped
|
|
|
|
| File: |
C:\Windows\Temp\{7E66493E-A433-47D4-9045-EEADE201F171}\.ba\WPFCommonControls.dll
|
| Category: |
dropped
|
| Dump: |
WPFCommonControls.dll.6.dr
|
| ID: |
dr_7
|
| Target ID: |
6
|
| Process: |
C:\Windows\Temp\{CB5AD3D6-270A-4AB0-A898-D5E0F7C2252B}\.cr\camtasia.exe
|
| Type: |
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
|
| Entropy: |
6.600314060415237
|
| Encrypted: |
false
|
| Ssdeep: |
6144:duW1g+cmqDkdA4FdVEcRm7ccI0w11Sxs79L95HtFtISqTNGV8CvOEp91f36bGRw+:duW1VA4FHdD6Mfv32KwobzI4
|
| Size: |
562688
|
| Whitelisted: |
false
|
| Reputation: |
low
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Drops PE files |
Persistence and Installation Behavior |
|
| Drops PE files to the windows directory (C:\Windows) |
Persistence and Installation Behavior |
|
| Found dropped PE file which has not been started or loaded |
Malware Analysis System Evasion |
|
| Queries the volume information (name, serial number etc) of a device |
Language, Device and Operating System Detection |
System Information Discovery
|
|
|
C:\Windows\Temp\{7E66493E-A433-47D4-9045-EEADE201F171}\.ba\WPFCommonViewModel.dll
|
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
|
dropped
|
|
|
|
| File: |
C:\Windows\Temp\{7E66493E-A433-47D4-9045-EEADE201F171}\.ba\WPFCommonViewModel.dll
|
| Category: |
dropped
|
| Dump: |
WPFCommonViewModel.dll.6.dr
|
| ID: |
dr_6
|
| Target ID: |
6
|
| Process: |
C:\Windows\Temp\{CB5AD3D6-270A-4AB0-A898-D5E0F7C2252B}\.cr\camtasia.exe
|
| Type: |
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
|
| Entropy: |
4.765172486061349
|
| Encrypted: |
false
|
| Ssdeep: |
96:BH46qr6ooN6E8mYj/+Dj7gq01Jb+rmJy633BM19wLJzr/N:BHVqr6DNfqj/+DjYb+ru3BMELNr/N
|
| Size: |
7680
|
| Whitelisted: |
false
|
| Reputation: |
low
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Drops PE files |
Persistence and Installation Behavior |
|
| Drops PE files to the windows directory (C:\Windows) |
Persistence and Installation Behavior |
|
| Found dropped PE file which has not been started or loaded |
Malware Analysis System Evasion |
|
| Queries the volume information (name, serial number etc) of a device |
Language, Device and Operating System Detection |
System Information Discovery
|
|
|
C:\Windows\Temp\{7E66493E-A433-47D4-9045-EEADE201F171}\.ba\de-DE\CamtasiaBootstrapperApplication.resources.dll
|
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
|
dropped
|
|
|
|
| File: |
C:\Windows\Temp\{7E66493E-A433-47D4-9045-EEADE201F171}\.ba\de-DE\CamtasiaBootstrapperApplication.resources.dll
|
| Category: |
dropped
|
| Dump: |
CamtasiaBootstrapperApplication.resources.dll0.6.dr
|
| ID: |
dr_13
|
| Target ID: |
6
|
| Process: |
C:\Windows\Temp\{CB5AD3D6-270A-4AB0-A898-D5E0F7C2252B}\.cr\camtasia.exe
|
| Type: |
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
|
| Entropy: |
5.20949991216615
|
| Encrypted: |
false
|
| Ssdeep: |
1536:J2xR3fwTRWhyOCCQJ6vDA+boDy+Ujw15PrCc8QiIOXwzdlgM+HfdV:J2r3fwNWhyO7Q4foDy7kpiIOy8dV
|
| Size: |
96256
|
| Whitelisted: |
false
|
| Reputation: |
low
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Drops PE files |
Persistence and Installation Behavior |
|
| Drops PE files to the windows directory (C:\Windows) |
Persistence and Installation Behavior |
|
| Found dropped PE file which has not been started or loaded |
Malware Analysis System Evasion |
|
|
|
C:\Windows\Temp\{7E66493E-A433-47D4-9045-EEADE201F171}\.ba\es-ES\CamtasiaBootstrapperApplication.resources.dll
|
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
|
dropped
|
|
|
|
| File: |
C:\Windows\Temp\{7E66493E-A433-47D4-9045-EEADE201F171}\.ba\es-ES\CamtasiaBootstrapperApplication.resources.dll
|
| Category: |
dropped
|
| Dump: |
CamtasiaBootstrapperApplication.resources.dll3.6.dr
|
| ID: |
dr_18
|
| Target ID: |
6
|
| Process: |
C:\Windows\Temp\{CB5AD3D6-270A-4AB0-A898-D5E0F7C2252B}\.cr\camtasia.exe
|
| Type: |
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
|
| Entropy: |
5.073136095594621
|
| Encrypted: |
false
|
| Ssdeep: |
1536:d2xR3fTYv0FQK+rgWxn8nhPNkJgQ8KM7oXdhW7XHm8nebXym2OE0kOJUi6Ua7Vei:d2r3fTYv0FQKE98G2oNqW/XyAK7VABd8
|
| Size: |
91136
|
| Whitelisted: |
false
|
| Reputation: |
low
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Drops PE files |
Persistence and Installation Behavior |
|
| Drops PE files to the windows directory (C:\Windows) |
Persistence and Installation Behavior |
|
| Found dropped PE file which has not been started or loaded |
Malware Analysis System Evasion |
|
|
|
C:\Windows\Temp\{7E66493E-A433-47D4-9045-EEADE201F171}\.ba\fr-FR\CamtasiaBootstrapperApplication.resources.dll
|
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
|
dropped
|
|
|
|
| File: |
C:\Windows\Temp\{7E66493E-A433-47D4-9045-EEADE201F171}\.ba\fr-FR\CamtasiaBootstrapperApplication.resources.dll
|
| Category: |
dropped
|
| Dump: |
CamtasiaBootstrapperApplication.resources.dll1.6.dr
|
| ID: |
dr_15
|
| Target ID: |
6
|
| Process: |
C:\Windows\Temp\{CB5AD3D6-270A-4AB0-A898-D5E0F7C2252B}\.cr\camtasia.exe
|
| Type: |
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
|
| Entropy: |
5.137513025025834
|
| Encrypted: |
false
|
| Ssdeep: |
3072:72r3evq/2AZMhoXtGJQEcfSR6i+khLF68id8:loXQJQEcfShLF6fd
|
| Size: |
99328
|
| Whitelisted: |
false
|
| Reputation: |
low
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Drops PE files |
Persistence and Installation Behavior |
|
| Drops PE files to the windows directory (C:\Windows) |
Persistence and Installation Behavior |
|
| Found dropped PE file which has not been started or loaded |
Malware Analysis System Evasion |
|
|
|
C:\Windows\Temp\{7E66493E-A433-47D4-9045-EEADE201F171}\.ba\ja-JP\CamtasiaBootstrapperApplication.resources.dll
|
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
|
dropped
|
|
|
|
| File: |
C:\Windows\Temp\{7E66493E-A433-47D4-9045-EEADE201F171}\.ba\ja-JP\CamtasiaBootstrapperApplication.resources.dll
|
| Category: |
dropped
|
| Dump: |
CamtasiaBootstrapperApplication.resources.dll.6.dr
|
| ID: |
dr_9
|
| Target ID: |
6
|
| Process: |
C:\Windows\Temp\{CB5AD3D6-270A-4AB0-A898-D5E0F7C2252B}\.cr\camtasia.exe
|
| Type: |
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
|
| Entropy: |
4.590826361002773
|
| Encrypted: |
false
|
| Ssdeep: |
1536:02xR3gpCifGHg6ed53BgXoozCh6wBPkQHtSD4MQl+hm4qkA86phOyOhmdu:02r3gpC4GHg6K3BVwCh6cPF04bpFdu
|
| Size: |
207360
|
| Whitelisted: |
false
|
| Reputation: |
low
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Drops PE files |
Persistence and Installation Behavior |
|
| Drops PE files to the windows directory (C:\Windows) |
Persistence and Installation Behavior |
|
| Found dropped PE file which has not been started or loaded |
Malware Analysis System Evasion |
|
|
|
C:\Windows\Temp\{7E66493E-A433-47D4-9045-EEADE201F171}\.ba\mbahost.dll
|
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
|
dropped
|
|
|
|
| File: |
C:\Windows\Temp\{7E66493E-A433-47D4-9045-EEADE201F171}\.ba\mbahost.dll
|
| Category: |
dropped
|
| Dump: |
mbahost.dll.6.dr
|
| ID: |
dr_25
|
| Target ID: |
6
|
| Process: |
C:\Windows\Temp\{CB5AD3D6-270A-4AB0-A898-D5E0F7C2252B}\.cr\camtasia.exe
|
| Type: |
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
|
| Entropy: |
6.643662045821993
|
| Encrypted: |
false
|
| Ssdeep: |
3072:iyjfrCvv4JR5zsemsABCF0TPSLNegl/+b:xrrCYRsehsIX/E
|
| Size: |
122288
|
| Whitelisted: |
true
|
| Reputation: |
low
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Drops PE files |
Persistence and Installation Behavior |
|
| Drops PE files to the windows directory (C:\Windows) |
Persistence and Installation Behavior |
|
|
|
C:\Windows\Temp\{7E66493E-A433-47D4-9045-EEADE201F171}\.ba\mbapreq.dll
|
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
|
dropped
|
|
|
|
| File: |
C:\Windows\Temp\{7E66493E-A433-47D4-9045-EEADE201F171}\.ba\mbapreq.dll
|
| Category: |
dropped
|
| Dump: |
mbapreq.dll.6.dr
|
| ID: |
dr_31
|
| Target ID: |
6
|
| Process: |
C:\Windows\Temp\{CB5AD3D6-270A-4AB0-A898-D5E0F7C2252B}\.cr\camtasia.exe
|
| Type: |
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
|
| Entropy: |
6.598346436496911
|
| Encrypted: |
false
|
| Ssdeep: |
3072:iaVVzf0r2vM357+pwnohBIiv8+2kt2GOTALPN2obXbE7PKPU9+Wxhsz7CMD:iaLzfpIsHhBIqgGOTALFdbz7f
|
| Size: |
188848
|
| Whitelisted: |
true
|
| Reputation: |
low
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Drops PE files |
Persistence and Installation Behavior |
|
| Drops PE files to the windows directory (C:\Windows) |
Persistence and Installation Behavior |
|
| Found dropped PE file which has not been started or loaded |
Malware Analysis System Evasion |
|
|
|
C:\Windows\Temp\{7E66493E-A433-47D4-9045-EEADE201F171}\.ba\mbapreq.png
|
PNG image data, 63 x 63, 8-bit/color RGBA, non-interlaced
|
dropped
|
|
|
|
| File: |
C:\Windows\Temp\{7E66493E-A433-47D4-9045-EEADE201F171}\.ba\mbapreq.png
|
| Category: |
dropped
|
| Dump: |
mbapreq.png.6.dr
|
| ID: |
dr_33
|
| Target ID: |
6
|
| Process: |
C:\Windows\Temp\{CB5AD3D6-270A-4AB0-A898-D5E0F7C2252B}\.cr\camtasia.exe
|
| Type: |
PNG image data, 63 x 63, 8-bit/color RGBA, non-interlaced
|
| Entropy: |
7.648767094164769
|
| Encrypted: |
false
|
| Ssdeep: |
12:6v/7rW3M/jDYAlFTzdvhKZ7e/cbp4/82UNb6MjmlKPNXheD1H0oJodqSXaTbutak:lQD1lldv8Z7g04/82Y6+Pxi19mDoqt5
|
| Size: |
797
|
| Whitelisted: |
true
|
| Reputation: |
low
|
|
|
C:\Windows\Temp\{7E66493E-A433-47D4-9045-EEADE201F171}\.ba\mbapreq.thm
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Windows\Temp\{7E66493E-A433-47D4-9045-EEADE201F171}\.ba\mbapreq.thm
|
| Category: |
dropped
|
| Dump: |
mbapreq.thm.6.dr
|
| ID: |
dr_32
|
| Target ID: |
6
|
| Process: |
C:\Windows\Temp\{CB5AD3D6-270A-4AB0-A898-D5E0F7C2252B}\.cr\camtasia.exe
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.15881451198739
|
| Encrypted: |
false
|
| Ssdeep: |
48:cecHddpXBT2E/zPHWgtpmAPH8TSJmBP+NPHrM/O8YpQbFUuhJ3PK7usPH4Lr:wHdHxS4Z9UG4BmNjCOhpsB3PswP
|
| Size: |
3915
|
| Whitelisted: |
true
|
| Reputation: |
low
|
|
|
C:\Windows\Temp\{7E66493E-A433-47D4-9045-EEADE201F171}\.ba\mbapreq.wxl
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Windows\Temp\{7E66493E-A433-47D4-9045-EEADE201F171}\.ba\mbapreq.wxl
|
| Category: |
dropped
|
| Dump: |
mbapreq.wxl2.6.dr
|
| ID: |
dr_34
|
| Target ID: |
6
|
| Process: |
C:\Windows\Temp\{CB5AD3D6-270A-4AB0-A898-D5E0F7C2252B}\.cr\camtasia.exe
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.076345322304751
|
| Encrypted: |
false
|
| Ssdeep: |
48:cxX7DxMT8dbCsK19Wqq8+JIDxN3Wm2WcN3miNlLPDHXsmkaYXfXQ2BmGA7b1fABP:8LuTY1xmmmTerNR0AT1O
|
| Size: |
2464
|
| Whitelisted: |
true
|
| Reputation: |
low
|
|
|
C:\Windows\Temp\{7E66493E-A433-47D4-9045-EEADE201F171}\.ba\pt-BR\CamtasiaBootstrapperApplication.resources.dll
|
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
|
dropped
|
|
|
|
| File: |
C:\Windows\Temp\{7E66493E-A433-47D4-9045-EEADE201F171}\.ba\pt-BR\CamtasiaBootstrapperApplication.resources.dll
|
| Category: |
dropped
|
| Dump: |
CamtasiaBootstrapperApplication.resources.dll4.6.dr
|
| ID: |
dr_19
|
| Target ID: |
6
|
| Process: |
C:\Windows\Temp\{CB5AD3D6-270A-4AB0-A898-D5E0F7C2252B}\.cr\camtasia.exe
|
| Type: |
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
|
| Entropy: |
5.134240795112116
|
| Encrypted: |
false
|
| Ssdeep: |
1536:i2xR3nVSXEtap6wpOwgpcJIxXsAeY57VphIXIL99Cl4gS2h+tedT:i2r3nVSX4ap6WexXsnY5j+TdT
|
| Size: |
91648
|
| Whitelisted: |
false
|
| Reputation: |
low
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Drops PE files |
Persistence and Installation Behavior |
|
| Drops PE files to the windows directory (C:\Windows) |
Persistence and Installation Behavior |
|
| Found dropped PE file which has not been started or loaded |
Malware Analysis System Evasion |
|
|
|
C:\Windows\Temp\{7E66493E-A433-47D4-9045-EEADE201F171}\.ba\zh-CN\CamtasiaBootstrapperApplication.resources.dll
|
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
|
dropped
|
|
|
|
| File: |
C:\Windows\Temp\{7E66493E-A433-47D4-9045-EEADE201F171}\.ba\zh-CN\CamtasiaBootstrapperApplication.resources.dll
|
| Category: |
dropped
|
| Dump: |
CamtasiaBootstrapperApplication.resources.dll2.6.dr
|
| ID: |
dr_17
|
| Target ID: |
6
|
| Process: |
C:\Windows\Temp\{CB5AD3D6-270A-4AB0-A898-D5E0F7C2252B}\.cr\camtasia.exe
|
| Type: |
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
|
| Entropy: |
4.838800823163518
|
| Encrypted: |
false
|
| Ssdeep: |
768:7DyxR3Aup5VdsVfZi6gEqcyvCxcamR2nbBwrwYUNskIPb0o+WMEGIxYT/6F0Ow0B:72xR3Au5dsfZihQSesH0uWadR
|
| Size: |
128000
|
| Whitelisted: |
false
|
| Reputation: |
low
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Drops PE files |
Persistence and Installation Behavior |
|
| Drops PE files to the windows directory (C:\Windows) |
Persistence and Installation Behavior |
|
| Found dropped PE file which has not been started or loaded |
Malware Analysis System Evasion |
|
|
|
C:\Windows\Temp\{CB5AD3D6-270A-4AB0-A898-D5E0F7C2252B}\.cr\camtasia.exe
|
PE32 executable (GUI) Intel 80386, for MS Windows
|
dropped
|
|
|
|
| File: |
C:\Windows\Temp\{CB5AD3D6-270A-4AB0-A898-D5E0F7C2252B}\.cr\camtasia.exe
|
| Category: |
dropped
|
| Dump: |
camtasia.exe.5.dr
|
| ID: |
dr_2
|
| Target ID: |
5
|
| Process: |
C:\Users\user\Desktop\download\camtasia.exe
|
| Type: |
PE32 executable (GUI) Intel 80386, for MS Windows
|
| Entropy: |
7.817645109909811
|
| Encrypted: |
false
|
| Ssdeep: |
49152:2T2pZ1Xrp9c4H5p9i6lmPli4sVwP8jLI4DtEm9+:2T0zp9c4H5VlfMUHHDtEF
|
| Size: |
1707656
|
| Whitelisted: |
false
|
| Reputation: |
low
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Creates a process in suspended mode (likely to inject code) |
HIPS / PFW / Operating System Protection Evasion |
|
| Drops PE files |
Persistence and Installation Behavior |
|
| Drops PE files to the windows directory (C:\Windows) |
Persistence and Installation Behavior |
|
| Found dropped PE file which has not been started or loaded |
Malware Analysis System Evasion |
|
| Found evasive API chain (date check) |
Malware Analysis System Evasion |
|
| Found evasive API chain checking for process token information |
Malware Analysis System Evasion |
|
| Is looking for software installed on the system |
Malware Analysis System Evasion |
System Information Discovery
|
| Queries the volume information (name, serial number etc) of a device |
Language, Device and Operating System Detection |
System Information Discovery
|
| Creates guard pages, often used to prevent reverse engineering and debugging |
Anti Debugging |
|
| Creates mutexes |
System Summary |
|
| Disables application error messsages (SetErrorMode) |
Hooking and other Techniques for Hiding and Protection |
|
| Parts of this applications are using the .NET runtime (Probably coded in C#) |
System Summary |
|
| Program exit points |
Malware Analysis System Evasion |
|
| Spawns processes |
System Summary |
|
| URLs found in memory or binary data |
Networking |
|
| Uses Microsoft Silverlight |
System Summary |
|
|
