Windows Analysis Report
DHL_Shipping_Document2.exe

Overview

General Information

Sample Name: DHL_Shipping_Document2.exe
Analysis ID: 830438
MD5: e2f0b0afe1d1cabe6d0fc082fadde43f
SHA1: 8ab34b84b1475d03beda51c79f841ec98e97e350
SHA256: 9080fc157a688b3946bb805b004da99ebf4415ba1d9b46e3dac43a6f02dd11c3
Tags: AgentTeslaDHLexe
Infos:

Detection

AgentTesla, zgRAT
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Multi AV Scanner detection for submitted file
Yara detected zgRAT
Malicious sample detected (through community Yara rule)
Yara detected AgentTesla
Antivirus detection for dropped file
Multi AV Scanner detection for dropped file
Snort IDS alert for network traffic
Tries to steal Mail credentials (via file / registry access)
Creates multiple autostart registry keys
Initial sample is a PE file and has a suspicious name
Writes to foreign memory regions
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Encrypted powershell cmdline option found
Machine Learning detection for sample
May check the online IP address of the machine
Injects a PE file into a foreign processes
Yara detected Generic Downloader
Machine Learning detection for dropped file
Modifies the context of a thread in another process (thread injection)
Hides that the sample has been downloaded from the Internet (zone.identifier)
Found many strings related to Crypto-Wallets (likely being stolen)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to harvest and steal browser information (history, passwords, etc)
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Yara signature match
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
Internet Provider seen in connection with other malware
Detected potential crypto function
Sample execution stops while process was sleeping (likely an evasion)
Yara detected Credential Stealer
JA3 SSL client fingerprint seen in connection with other malware
IP address seen in connection with other malware
Contains long sleeps (>= 3 min)
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Sample file is different than original file name gathered from version info
Drops PE files
Uses a known web browser user agent for HTTP communication
Detected TCP or UDP traffic on non-standard ports
Uses SMTP (mail sending)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Creates a process in suspended mode (likely to inject code)

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: DHL_Shipping_Document2.exe ReversingLabs: Detection: 38%
Source: DHL_Shipping_Document2.exe Virustotal: Detection: 33% Perma Link
Antivirus detection for dropped file
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe Avira: detection malicious, Label: TR/Spy.Gen8
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe Avira: detection malicious, Label: TR/Spy.Gen8
Multi AV Scanner detection for dropped file
Source: C:\Users\user\AppData\Local\explorers.exe ReversingLabs: Detection: 38%
Machine Learning detection for sample
Source: DHL_Shipping_Document2.exe Joe Sandbox ML: detected
Machine Learning detection for dropped file
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\explorers.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe Joe Sandbox ML: detected
Source: 0.2.DHL_Shipping_Document2.exe.1991d39abb0.11.raw.unpack Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Host": "smtp.thanhphoung-vn.com", "Username": "log@thanhphoung-vn.com", "Password": "smartyok4"}
Source: unknown HTTPS traffic detected: 173.231.16.76:443 -> 192.168.2.3:49697 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.237.62.211:443 -> 192.168.2.3:49700 version: TLS 1.2
Source: unknown HTTPS traffic detected: 173.231.16.76:443 -> 192.168.2.3:49701 version: TLS 1.2
Source: DHL_Shipping_Document2.exe Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: /_/Src/Newtonsoft.Json/obj/Release/net40/Newtonsoft.Json.pdb source: DHL_Shipping_Document2.exe, 00000000.00000002.540113252.00000199245B0000.00000004.08000000.00040000.00000000.sdmp, DHL_Shipping_Document2.exe, 00000000.00000002.406089795.000001991C83F000.00000004.00000800.00020000.00000000.sdmp, DHL_Shipping_Document2.exe, 00000000.00000002.392885416.000001990BC53000.00000004.00000800.00020000.00000000.sdmp, DHL_Shipping_Document2.exe, 00000000.00000002.406089795.000001991C727000.00000004.00000800.00020000.00000000.sdmp, explorers.exe, 00000016.00000002.554544853.0000029794097000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: protobuf-net.pdbSHA256 source: InstallUtil.exe, 00000011.00000002.556097458.0000029420550000.00000004.08000000.00040000.00000000.sdmp
Source: Binary string: Doxfkywupn.pdb source: InstallUtil.exe, 00000011.00000002.556335374.00000294205D0000.00000004.08000000.00040000.00000000.sdmp
Source: Binary string: C:\projects\dotnetzip-semverd\src\Zip\obj\Release\DotNetZip.pdb source: InstallUtil.exe, 00000011.00000002.552825754.0000029417F5C000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000011.00000002.552825754.000002941804D000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000011.00000002.557517142.0000029420820000.00000004.08000000.00040000.00000000.sdmp
Source: Binary string: protobuf-net.pdb source: InstallUtil.exe, 00000011.00000002.556097458.0000029420550000.00000004.08000000.00040000.00000000.sdmp
Source: Binary string: /_/Src/Newtonsoft.Json/obj/Release/net40/Newtonsoft.Json.pdbSHA256 source: DHL_Shipping_Document2.exe, 00000000.00000002.540113252.00000199245B0000.00000004.08000000.00040000.00000000.sdmp, DHL_Shipping_Document2.exe, 00000000.00000002.406089795.000001991C83F000.00000004.00000800.00020000.00000000.sdmp, DHL_Shipping_Document2.exe, 00000000.00000002.392885416.000001990BC53000.00000004.00000800.00020000.00000000.sdmp, DHL_Shipping_Document2.exe, 00000000.00000002.406089795.000001991C727000.00000004.00000800.00020000.00000000.sdmp, explorers.exe, 00000016.00000002.554544853.0000029794097000.00000004.00000800.00020000.00000000.sdmp

Networking
barindex
Snort IDS alert for network traffic
Source: Traffic Snort IDS: 2851779 ETPRO TROJAN Agent Tesla Telegram Exfil 192.168.2.3:49698 -> 208.91.199.223:587
Source: Traffic Snort IDS: 2840032 ETPRO TROJAN Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 192.168.2.3:49698 -> 208.91.199.223:587
Source: Traffic Snort IDS: 2030171 ET TROJAN AgentTesla Exfil Via SMTP 192.168.2.3:49698 -> 208.91.199.223:587
Source: Traffic Snort IDS: 2851779 ETPRO TROJAN Agent Tesla Telegram Exfil 192.168.2.3:49699 -> 208.91.199.225:587
Source: Traffic Snort IDS: 2840032 ETPRO TROJAN Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 192.168.2.3:49699 -> 208.91.199.225:587
Source: Traffic Snort IDS: 2030171 ET TROJAN AgentTesla Exfil Via SMTP 192.168.2.3:49699 -> 208.91.199.225:587
Source: Traffic Snort IDS: 2851779 ETPRO TROJAN Agent Tesla Telegram Exfil 192.168.2.3:49702 -> 208.91.198.143:587
Source: Traffic Snort IDS: 2840032 ETPRO TROJAN Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 192.168.2.3:49702 -> 208.91.198.143:587
Source: Traffic Snort IDS: 2030171 ET TROJAN AgentTesla Exfil Via SMTP 192.168.2.3:49702 -> 208.91.198.143:587
Source: Traffic Snort IDS: 2851779 ETPRO TROJAN Agent Tesla Telegram Exfil 192.168.2.3:49703 -> 208.91.199.225:587
Source: Traffic Snort IDS: 2840032 ETPRO TROJAN Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 192.168.2.3:49703 -> 208.91.199.225:587
Source: Traffic Snort IDS: 2030171 ET TROJAN AgentTesla Exfil Via SMTP 192.168.2.3:49703 -> 208.91.199.225:587
Source: Traffic Snort IDS: 2851779 ETPRO TROJAN Agent Tesla Telegram Exfil 192.168.2.3:49704 -> 208.91.198.143:587
Source: Traffic Snort IDS: 2840032 ETPRO TROJAN Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 192.168.2.3:49704 -> 208.91.198.143:587
Source: Traffic Snort IDS: 2030171 ET TROJAN AgentTesla Exfil Via SMTP 192.168.2.3:49704 -> 208.91.198.143:587
Source: Traffic Snort IDS: 2851779 ETPRO TROJAN Agent Tesla Telegram Exfil 192.168.2.3:49705 -> 208.91.199.223:587
Source: Traffic Snort IDS: 2840032 ETPRO TROJAN Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 192.168.2.3:49705 -> 208.91.199.223:587
Source: Traffic Snort IDS: 2030171 ET TROJAN AgentTesla Exfil Via SMTP 192.168.2.3:49705 -> 208.91.199.223:587
May check the online IP address of the machine
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe DNS query: name: api.ipify.org
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe DNS query: name: api.ipify.org
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe DNS query: name: api.ipify.org
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe DNS query: name: api.ipify.org
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe DNS query: name: api.ipify.org
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe DNS query: name: api.ipify.org
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe DNS query: name: api.ipify.org
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe DNS query: name: api.ipify.org
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe DNS query: name: api.ipify.org
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe DNS query: name: api.ipify.org
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe DNS query: name: api.ipify.org
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe DNS query: name: api.ipify.org
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe DNS query: name: api.ipify.org
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe DNS query: name: api.ipify.org
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe DNS query: name: api.ipify.org
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe DNS query: name: api.ipify.org
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe DNS query: name: api.ipify.org
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe DNS query: name: api.ipify.org
Yara detected Generic Downloader
Source: Yara match File source: 0.2.DHL_Shipping_Document2.exe.199242b0000.12.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.DHL_Shipping_Document2.exe.1991c263270.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000002.532957763.00000199242B0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: PUBLIC-DOMAIN-REGISTRYUS PUBLIC-DOMAIN-REGISTRYUS
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 208.91.198.143 208.91.198.143
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.3:49698 -> 208.91.199.223:587
Source: global traffic TCP traffic: 192.168.2.3:49699 -> 208.91.199.225:587
Source: global traffic TCP traffic: 192.168.2.3:49702 -> 208.91.198.143:587
Uses SMTP (mail sending)
Source: global traffic TCP traffic: 192.168.2.3:49698 -> 208.91.199.223:587
Source: global traffic TCP traffic: 192.168.2.3:49699 -> 208.91.199.225:587
Source: global traffic TCP traffic: 192.168.2.3:49702 -> 208.91.198.143:587
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49697
Source: unknown Network traffic detected: HTTP traffic on port 49697 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49701
Source: DHL_Shipping_Document2.exe, 00000000.00000002.392885416.000001990BC53000.00000004.00000800.00020000.00000000.sdmp, explorers.exe, 00000012.00000002.554655774.000001D80A047000.00000004.00000800.00020000.00000000.sdmp, explorers.exe, 00000016.00000002.554544853.0000029794366000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/
Source: DHL_Shipping_Document2.exe, 00000000.00000002.392885416.000001990BC53000.00000004.00000800.00020000.00000000.sdmp, explorers.exe, 00000012.00000002.554655774.000001D80A047000.00000004.00000800.00020000.00000000.sdmp, explorers.exe, 00000016.00000002.554544853.0000029794368000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCert
Source: DHL_Shipping_Document2.exe, 00000000.00000002.540113252.00000199245B0000.00000004.08000000.00040000.00000000.sdmp, DHL_Shipping_Document2.exe, 00000000.00000002.406089795.000001991C83F000.00000004.00000800.00020000.00000000.sdmp, DHL_Shipping_Document2.exe, 00000000.00000002.392885416.000001990BC53000.00000004.00000800.00020000.00000000.sdmp, DHL_Shipping_Document2.exe, 00000000.00000002.406089795.000001991C727000.00000004.00000800.00020000.00000000.sdmp, explorers.exe, 00000016.00000002.554544853.000002979409E000.00000004.00000800.00020000.00000000.sdmp, explorers.exe, 00000016.00000002.554544853.0000029794083000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: DHL_Shipping_Document2.exe, 00000000.00000002.540113252.00000199245B0000.00000004.08000000.00040000.00000000.sdmp, DHL_Shipping_Document2.exe, 00000000.00000002.406089795.000001991C83F000.00000004.00000800.00020000.00000000.sdmp, DHL_Shipping_Document2.exe, 00000000.00000002.392885416.000001990BC53000.00000004.00000800.00020000.00000000.sdmp, DHL_Shipping_Document2.exe, 00000000.00000002.406089795.000001991C727000.00000004.00000800.00020000.00000000.sdmp, explorers.exe, 00000012.00000002.554655774.000001D809D7D000.00000004.00000800.00020000.00000000.sdmp, explorers.exe, 00000016.00000002.554544853.0000029794083000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertCSRSA4096RootG5.crt0E
Source: explorers.exe, 00000016.00000002.554544853.0000029794368000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertTrusted
Source: DHL_Shipping_Document2.exe, 00000000.00000002.540113252.00000199245B0000.00000004.08000000.00040000.00000000.sdmp, DHL_Shipping_Document2.exe, 00000000.00000002.406089795.000001991C83F000.00000004.00000800.00020000.00000000.sdmp, DHL_Shipping_Document2.exe, 00000000.00000002.392885416.000001990BC53000.00000004.00000800.00020000.00000000.sdmp, DHL_Shipping_Document2.exe, 00000000.00000002.406089795.000001991C727000.00000004.00000800.00020000.00000000.sdmp, explorers.exe, 00000016.00000002.554544853.000002979409E000.00000004.00000800.00020000.00000000.sdmp, explorers.exe, 00000016.00000002.554544853.0000029794083000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: DHL_Shipping_Document2.exe, 00000000.00000002.540113252.00000199245B0000.00000004.08000000.00040000.00000000.sdmp, DHL_Shipping_Document2.exe, 00000000.00000002.406089795.000001991C83F000.00000004.00000800.00020000.00000000.sdmp, DHL_Shipping_Document2.exe, 00000000.00000002.392885416.000001990BC53000.00000004.00000800.00020000.00000000.sdmp, DHL_Shipping_Document2.exe, 00000000.00000002.406089795.000001991C727000.00000004.00000800.00020000.00000000.sdmp, explorers.exe, 00000016.00000002.554544853.000002979409E000.00000004.00000800.00020000.00000000.sdmp, explorers.exe, 00000016.00000002.554544853.0000029794083000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: DHL_Shipping_Document2.exe, 00000000.00000002.540113252.00000199245B0000.00000004.08000000.00040000.00000000.sdmp, DHL_Shipping_Document2.exe, 00000000.00000002.406089795.000001991C83F000.00000004.00000800.00020000.00000000.sdmp, DHL_Shipping_Document2.exe, 00000000.00000002.392885416.000001990BC53000.00000004.00000800.00020000.00000000.sdmp, DHL_Shipping_Document2.exe, 00000000.00000002.406089795.000001991C727000.00000004.00000800.00020000.00000000.sdmp, explorers.exe, 00000012.00000002.554655774.000001D809D7D000.00000004.00000800.00020000.00000000.sdmp, explorers.exe, 00000016.00000002.554544853.0000029794083000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/NETFoundationProjectsCodeSigningCA2.crt0
Source: Lutyzivrgpnlssvvvftlfile.exe, 0000000F.00000002.545974916.00000000006B1000.00000004.00000020.00020000.00000000.sdmp, Lutyzivrgpnlssvvvftlfile.exe, 0000000F.00000003.396387284.00000000006A6000.00000004.00000020.00020000.00000000.sdmp, KbWSe.exe, 00000013.00000002.548180478.0000000000899000.00000004.00000020.00020000.00000000.sdmp, KbWSe.exe, 00000013.00000003.479323373.0000000000891000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: DHL_Shipping_Document2.exe, 00000000.00000002.392885416.000001990BC53000.00000004.00000800.00020000.00000000.sdmp, explorers.exe, 00000012.00000002.554655774.000001D80A047000.00000004.00000800.00020000.00000000.sdmp, explorers.exe, 00000016.00000002.554544853.0000029794366000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/
Source: DHL_Shipping_Document2.exe, 00000000.00000002.392885416.000001990BC53000.00000004.00000800.00020000.00000000.sdmp, explorers.exe, 00000012.00000002.554655774.000001D80A047000.00000004.00000800.00020000.00000000.sdmp, explorers.exe, 00000016.00000002.554544853.0000029794368000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCert
Source: DHL_Shipping_Document2.exe, 00000000.00000002.540113252.00000199245B0000.00000004.08000000.00040000.00000000.sdmp, DHL_Shipping_Document2.exe, 00000000.00000002.406089795.000001991C83F000.00000004.00000800.00020000.00000000.sdmp, DHL_Shipping_Document2.exe, 00000000.00000002.392885416.000001990BC53000.00000004.00000800.00020000.00000000.sdmp, DHL_Shipping_Document2.exe, 00000000.00000002.406089795.000001991C727000.00000004.00000800.00020000.00000000.sdmp, explorers.exe, 00000016.00000002.554544853.000002979409E000.00000004.00000800.00020000.00000000.sdmp, explorers.exe, 00000016.00000002.554544853.0000029794083000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: DHL_Shipping_Document2.exe, 00000000.00000002.540113252.00000199245B0000.00000004.08000000.00040000.00000000.sdmp, DHL_Shipping_Document2.exe, 00000000.00000002.406089795.000001991C83F000.00000004.00000800.00020000.00000000.sdmp, DHL_Shipping_Document2.exe, 00000000.00000002.392885416.000001990BC53000.00000004.00000800.00020000.00000000.sdmp, DHL_Shipping_Document2.exe, 00000000.00000002.406089795.000001991C727000.00000004.00000800.00020000.00000000.sdmp, explorers.exe, 00000012.00000002.554655774.000001D809D7D000.00000004.00000800.00020000.00000000.sdmp, explorers.exe, 00000016.00000002.554544853.0000029794083000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertCSRSA4096RootG5.crl0
Source: explorers.exe, 00000016.00000002.554544853.0000029794368000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertTrusted
Source: DHL_Shipping_Document2.exe, 00000000.00000002.540113252.00000199245B0000.00000004.08000000.00040000.00000000.sdmp, DHL_Shipping_Document2.exe, 00000000.00000002.406089795.000001991C83F000.00000004.00000800.00020000.00000000.sdmp, DHL_Shipping_Document2.exe, 00000000.00000002.392885416.000001990BC53000.00000004.00000800.00020000.00000000.sdmp, DHL_Shipping_Document2.exe, 00000000.00000002.406089795.000001991C727000.00000004.00000800.00020000.00000000.sdmp, explorers.exe, 00000016.00000002.554544853.000002979409E000.00000004.00000800.00020000.00000000.sdmp, explorers.exe, 00000016.00000002.554544853.0000029794083000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: DHL_Shipping_Document2.exe, 00000000.00000002.540113252.00000199245B0000.00000004.08000000.00040000.00000000.sdmp, DHL_Shipping_Document2.exe, 00000000.00000002.406089795.000001991C83F000.00000004.00000800.00020000.00000000.sdmp, DHL_Shipping_Document2.exe, 00000000.00000002.392885416.000001990BC53000.00000004.00000800.00020000.00000000.sdmp, DHL_Shipping_Document2.exe, 00000000.00000002.406089795.000001991C727000.00000004.00000800.00020000.00000000.sdmp, explorers.exe, 00000016.00000002.554544853.000002979409E000.00000004.00000800.00020000.00000000.sdmp, explorers.exe, 00000016.00000002.554544853.0000029794083000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: DHL_Shipping_Document2.exe, 00000000.00000002.540113252.00000199245B0000.00000004.08000000.00040000.00000000.sdmp, DHL_Shipping_Document2.exe, 00000000.00000002.406089795.000001991C83F000.00000004.00000800.00020000.00000000.sdmp, DHL_Shipping_Document2.exe, 00000000.00000002.392885416.000001990BC53000.00000004.00000800.00020000.00000000.sdmp, DHL_Shipping_Document2.exe, 00000000.00000002.406089795.000001991C727000.00000004.00000800.00020000.00000000.sdmp, explorers.exe, 00000012.00000002.554655774.000001D809D7D000.00000004.00000800.00020000.00000000.sdmp, explorers.exe, 00000016.00000002.554544853.0000029794083000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/NETFoundationProjectsCodeSigningCA2.crl0F
Source: DHL_Shipping_Document2.exe, 00000000.00000002.540113252.00000199245B0000.00000004.08000000.00040000.00000000.sdmp, DHL_Shipping_Document2.exe, 00000000.00000002.406089795.000001991C83F000.00000004.00000800.00020000.00000000.sdmp, DHL_Shipping_Document2.exe, 00000000.00000002.392885416.000001990BC53000.00000004.00000800.00020000.00000000.sdmp, DHL_Shipping_Document2.exe, 00000000.00000002.406089795.000001991C727000.00000004.00000800.00020000.00000000.sdmp, explorers.exe, 00000012.00000002.554655774.000001D809D7D000.00000004.00000800.00020000.00000000.sdmp, explorers.exe, 00000016.00000002.554544853.0000029794083000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl4.digicert.com/NETFoundationProjectsCodeSigningCA2.crl0=
Source: DHL_Shipping_Document2.exe, 00000000.00000002.406089795.000001991C727000.00000004.00000800.00020000.00000000.sdmp, explorers.exe, 00000012.00000002.554655774.000001D809D72000.00000004.00000800.00020000.00000000.sdmp, explorers.exe, 00000012.00000002.554655774.000001D80A029000.00000004.00000800.00020000.00000000.sdmp, explorers.exe, 00000012.00000002.554655774.000001D809D6B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://james.newtonking.com/projects/json
Source: DHL_Shipping_Document2.exe, 00000000.00000002.392885416.000001990BC53000.00000004.00000800.00020000.00000000.sdmp, explorers.exe, 00000012.00000002.554655774.000001D80A047000.00000004.00000800.00020000.00000000.sdmp, explorers.exe, 00000016.00000002.554544853.0000029794366000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com0
Source: DHL_Shipping_Document2.exe, 00000000.00000002.540113252.00000199245B0000.00000004.08000000.00040000.00000000.sdmp, DHL_Shipping_Document2.exe, 00000000.00000002.406089795.000001991C83F000.00000004.00000800.00020000.00000000.sdmp, DHL_Shipping_Document2.exe, 00000000.00000002.392885416.000001990BC53000.00000004.00000800.00020000.00000000.sdmp, DHL_Shipping_Document2.exe, 00000000.00000002.406089795.000001991C727000.00000004.00000800.00020000.00000000.sdmp, explorers.exe, 00000016.00000002.554544853.000002979409E000.00000004.00000800.00020000.00000000.sdmp, explorers.exe, 00000016.00000002.554544853.0000029794083000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com0A
Source: DHL_Shipping_Document2.exe, 00000000.00000002.540113252.00000199245B0000.00000004.08000000.00040000.00000000.sdmp, DHL_Shipping_Document2.exe, 00000000.00000002.406089795.000001991C83F000.00000004.00000800.00020000.00000000.sdmp, DHL_Shipping_Document2.exe, 00000000.00000002.392885416.000001990BC53000.00000004.00000800.00020000.00000000.sdmp, DHL_Shipping_Document2.exe, 00000000.00000002.406089795.000001991C727000.00000004.00000800.00020000.00000000.sdmp, explorers.exe, 00000012.00000002.554655774.000001D80A047000.00000004.00000800.00020000.00000000.sdmp, explorers.exe, 00000012.00000002.554655774.000001D809D7D000.00000004.00000800.00020000.00000000.sdmp, explorers.exe, 00000016.00000002.554544853.000002979409E000.00000004.00000800.00020000.00000000.sdmp, explorers.exe, 00000016.00000002.554544853.0000029794368000.00000004.00000800.00020000.00000000.sdmp, explorers.exe, 00000016.00000002.554544853.0000029794083000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com0C
Source: DHL_Shipping_Document2.exe, 00000000.00000002.540113252.00000199245B0000.00000004.08000000.00040000.00000000.sdmp, DHL_Shipping_Document2.exe, 00000000.00000002.406089795.000001991C83F000.00000004.00000800.00020000.00000000.sdmp, DHL_Shipping_Document2.exe, 00000000.00000002.392885416.000001990BC53000.00000004.00000800.00020000.00000000.sdmp, DHL_Shipping_Document2.exe, 00000000.00000002.406089795.000001991C727000.00000004.00000800.00020000.00000000.sdmp, explorers.exe, 00000012.00000002.554655774.000001D809D7D000.00000004.00000800.00020000.00000000.sdmp, explorers.exe, 00000016.00000002.554544853.0000029794083000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com0O
Source: DHL_Shipping_Document2.exe, 00000000.00000002.540113252.00000199245B0000.00000004.08000000.00040000.00000000.sdmp, DHL_Shipping_Document2.exe, 00000000.00000002.406089795.000001991C83F000.00000004.00000800.00020000.00000000.sdmp, DHL_Shipping_Document2.exe, 00000000.00000002.392885416.000001990BC53000.00000004.00000800.00020000.00000000.sdmp, DHL_Shipping_Document2.exe, 00000000.00000002.406089795.000001991C727000.00000004.00000800.00020000.00000000.sdmp, explorers.exe, 00000016.00000002.554544853.000002979409E000.00000004.00000800.00020000.00000000.sdmp, explorers.exe, 00000016.00000002.554544853.0000029794083000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com0X
Source: DHL_Shipping_Document2.exe, 00000000.00000002.392885416.000001990BABE000.00000004.00000800.00020000.00000000.sdmp, DHL_Shipping_Document2.exe, 00000000.00000002.392885416.000001990BF6E000.00000004.00000800.00020000.00000000.sdmp, Lutyzivrgpnlssvvvftlfile.exe, 0000000F.00000002.555838851.0000000002401000.00000004.00000800.00020000.00000000.sdmp, KbWSe.exe, 00000013.00000002.556924562.0000000002361000.00000004.00000800.00020000.00000000.sdmp, KbWSe.exe, 00000017.00000002.558518953.000000000287C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Lutyzivrgpnlssvvvftlfile.exe, 0000000F.00000002.555838851.000000000244C000.00000004.00000800.00020000.00000000.sdmp, Lutyzivrgpnlssvvvftlfile.exe, 0000000F.00000002.555838851.0000000002493000.00000004.00000800.00020000.00000000.sdmp, Lutyzivrgpnlssvvvftlfile.exe, 0000000F.00000002.555838851.000000000247E000.00000004.00000800.00020000.00000000.sdmp, KbWSe.exe, 00000013.00000002.556924562.00000000023E2000.00000004.00000800.00020000.00000000.sdmp, KbWSe.exe, 00000013.00000002.556924562.00000000023F7000.00000004.00000800.00020000.00000000.sdmp, KbWSe.exe, 00000013.00000002.556924562.00000000023CC000.00000004.00000800.00020000.00000000.sdmp, KbWSe.exe, 00000017.00000002.558518953.00000000028EE000.00000004.00000800.00020000.00000000.sdmp, KbWSe.exe, 00000017.00000002.558518953.00000000028BC000.00000004.00000800.00020000.00000000.sdmp, KbWSe.exe, 00000017.00000002.558518953.0000000002903000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://smtp.thanhphoung-vn.com
Source: Lutyzivrgpnlssvvvftlfile.exe, 0000000F.00000002.555838851.0000000002493000.00000004.00000800.00020000.00000000.sdmp, Lutyzivrgpnlssvvvftlfile.exe, 0000000F.00000002.555838851.000000000247E000.00000004.00000800.00020000.00000000.sdmp, KbWSe.exe, 00000013.00000002.556924562.00000000023E2000.00000004.00000800.00020000.00000000.sdmp, KbWSe.exe, 00000013.00000002.556924562.00000000023F7000.00000004.00000800.00020000.00000000.sdmp, KbWSe.exe, 00000017.00000002.558518953.00000000028EE000.00000004.00000800.00020000.00000000.sdmp, KbWSe.exe, 00000017.00000002.558518953.0000000002903000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://us2.smtp.mailhostbox.com
Source: InstallUtil.exe, 00000011.00000002.557517142.0000029420820000.00000004.08000000.00040000.00000000.sdmp String found in binary or memory: http://www.codeplex.com/DotNetZip
Source: DHL_Shipping_Document2.exe, 00000000.00000002.540113252.00000199245B0000.00000004.08000000.00040000.00000000.sdmp, DHL_Shipping_Document2.exe, 00000000.00000002.406089795.000001991C83F000.00000004.00000800.00020000.00000000.sdmp, DHL_Shipping_Document2.exe, 00000000.00000002.392885416.000001990BC53000.00000004.00000800.00020000.00000000.sdmp, DHL_Shipping_Document2.exe, 00000000.00000002.406089795.000001991C727000.00000004.00000800.00020000.00000000.sdmp, explorers.exe, 00000012.00000002.554655774.000001D809D7D000.00000004.00000800.00020000.00000000.sdmp, explorers.exe, 00000016.00000002.554544853.0000029794083000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.digicert.com/CPS0
Source: Xubyeworypu.tmpdb.17.dr String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: Lutyzivrgpnlssvvvftlfile.exe, 0000000F.00000002.555838851.0000000002401000.00000004.00000800.00020000.00000000.sdmp, KbWSe.exe, 00000013.00000002.556924562.0000000002361000.00000004.00000800.00020000.00000000.sdmp, KbWSe.exe, 00000017.00000002.558518953.000000000287C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://api.ipify.org
Source: Lutyzivrgpnlssvvvftlfile.exe, 0000000F.00000002.555838851.0000000002401000.00000004.00000800.00020000.00000000.sdmp, KbWSe.exe, 00000013.00000002.556924562.0000000002361000.00000004.00000800.00020000.00000000.sdmp, KbWSe.exe, 00000017.00000002.558518953.000000000287C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://api.ipify.org/
Source: Xubyeworypu.tmpdb.17.dr String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: InstallUtil.exe, 00000011.00000002.552825754.0000029417ECC000.00000004.00000800.00020000.00000000.sdmp, Spsfpf.tmpdb.17.dr, Lfzmsuaggmw.tmpdb.17.dr String found in binary or memory: https://dl.google.com/tag/s/appguid%3D%7B8A69D345-D564-463C-AFF1-A69D9E530F96%7D%26iid%3D%7BBD4EA3DA
Source: Xubyeworypu.tmpdb.17.dr String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: InstallUtil.exe, 00000011.00000002.552825754.0000029417E66000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000011.00000002.552825754.0000029417EF3000.00000004.00000800.00020000.00000000.sdmp, Unjsdaqackg.tmpdb.17.dr, Xubyeworypu.tmpdb.17.dr String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: Xubyeworypu.tmpdb.17.dr String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: InstallUtil.exe, 00000011.00000002.556097458.0000029420550000.00000004.08000000.00040000.00000000.sdmp String found in binary or memory: https://github.com/mgravell/protobuf-net
Source: InstallUtil.exe, 00000011.00000002.556097458.0000029420550000.00000004.08000000.00040000.00000000.sdmp String found in binary or memory: https://github.com/mgravell/protobuf-netJ
Source: InstallUtil.exe, 00000011.00000002.556097458.0000029420550000.00000004.08000000.00040000.00000000.sdmp String found in binary or memory: https://github.com/mgravell/protobuf-neti
Source: InstallUtil.exe, 00000011.00000002.552825754.0000029417E66000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000011.00000002.552825754.0000029417EF3000.00000004.00000800.00020000.00000000.sdmp, Unjsdaqackg.tmpdb.17.dr, Xubyeworypu.tmpdb.17.dr String found in binary or memory: https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search
Source: InstallUtil.exe, 00000011.00000002.552825754.0000029417E66000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000011.00000002.552825754.0000029417EF3000.00000004.00000800.00020000.00000000.sdmp, Unjsdaqackg.tmpdb.17.dr, Xubyeworypu.tmpdb.17.dr String found in binary or memory: https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas_sfp&command=
Source: InstallUtil.exe, 00000011.00000002.552825754.0000029417E66000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000011.00000002.552825754.0000029417EF3000.00000004.00000800.00020000.00000000.sdmp, Unjsdaqackg.tmpdb.17.dr, Xubyeworypu.tmpdb.17.dr String found in binary or memory: https://search.yahoo.com?fr=crmas_sfp
Source: InstallUtil.exe, 00000011.00000002.552825754.0000029417E66000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000011.00000002.552825754.0000029417EF3000.00000004.00000800.00020000.00000000.sdmp, Unjsdaqackg.tmpdb.17.dr, Xubyeworypu.tmpdb.17.dr String found in binary or memory: https://search.yahoo.com?fr=crmas_sfpf
Source: InstallUtil.exe, 00000011.00000002.556097458.0000029420550000.00000004.08000000.00040000.00000000.sdmp String found in binary or memory: https://stackoverflow.com/q/11564914/23354;
Source: InstallUtil.exe, 00000011.00000002.556097458.0000029420550000.00000004.08000000.00040000.00000000.sdmp, InstallUtil.exe, 00000011.00000002.550292879.0000029407DCA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://stackoverflow.com/q/14436606/23354
Source: InstallUtil.exe, 00000011.00000002.556097458.0000029420550000.00000004.08000000.00040000.00000000.sdmp String found in binary or memory: https://stackoverflow.com/q/2152978/23354
Source: Lfzmsuaggmw.tmpdb.17.dr String found in binary or memory: https://support.google.com/chrome/answer/111996?visit_id=637962485686793996-3320600880&p=update_erro
Source: Lfzmsuaggmw.tmpdb.17.dr String found in binary or memory: https://support.google.com/chrome/answer/6315198?product=
Source: InstallUtil.exe, 00000011.00000002.552825754.0000029417E9C000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000011.00000002.552825754.0000029417ED8000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000011.00000002.550292879.0000029407DCA000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000011.00000002.552825754.0000029417DA1000.00000004.00000800.00020000.00000000.sdmp, Spsfpf.tmpdb.17.dr, Lfzmsuaggmw.tmpdb.17.dr String found in binary or memory: https://support.google.com/chrome?p=update_error
Source: InstallUtil.exe, 00000011.00000002.550292879.0000029407DCA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.google.com/chrome?p=update_error8
Source: Lfzmsuaggmw.tmpdb.17.dr String found in binary or memory: https://support.google.com/chrome?p=update_errorFix
Source: Lfzmsuaggmw.tmpdb.17.dr String found in binary or memory: https://support.google.com/installer/?product=
Source: DHL_Shipping_Document2.exe, 00000000.00000002.406089795.000001991C12E000.00000004.00000800.00020000.00000000.sdmp, DHL_Shipping_Document2.exe, 00000000.00000002.532957763.00000199242B0000.00000004.08000000.00040000.00000000.sdmp String found in binary or memory: https://urn.to/r/sds_see
Source: InstallUtil.exe, 00000011.00000002.552825754.0000029417E66000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000011.00000002.552825754.0000029417EF3000.00000004.00000800.00020000.00000000.sdmp, Unjsdaqackg.tmpdb.17.dr, Xubyeworypu.tmpdb.17.dr String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: Lfzmsuaggmw.tmpdb.17.dr String found in binary or memory: https://www.google.com/intl/en_uk/chrome/
Source: InstallUtil.exe, 00000011.00000002.550292879.0000029407DCA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/intl/en_uk/chrome/8
Source: InstallUtil.exe, 00000011.00000002.552825754.0000029417EBF000.00000004.00000800.00020000.00000000.sdmp, Spsfpf.tmpdb.17.dr, Lfzmsuaggmw.tmpdb.17.dr String found in binary or memory: https://www.google.com/intl/en_uk/chrome/Google
Source: InstallUtil.exe, 00000011.00000002.552825754.0000029417ECC000.00000004.00000800.00020000.00000000.sdmp, Spsfpf.tmpdb.17.dr, Lfzmsuaggmw.tmpdb.17.dr String found in binary or memory: https://www.google.com/intl/en_uk/chrome/https://www.google.com/intl/en_uk/chrome/https://www.google
Source: Lfzmsuaggmw.tmpdb.17.dr String found in binary or memory: https://www.google.com/intl/en_uk/chrome/thank-you.html?statcb=0&installdataindex=empty&defaultbrows
Source: Lfzmsuaggmw.tmpdb.17.dr String found in binary or memory: https://www.google.com/search?q=chrome&oq=chrome&aqs=chrome..69i57j0j5l3j69i60l3.2663j0j4&sourceid=c
Source: explorers.exe, 00000012.00000002.554655774.000001D80A047000.00000004.00000800.00020000.00000000.sdmp, explorers.exe, 00000012.00000002.554655774.000001D809D7D000.00000004.00000800.00020000.00000000.sdmp, explorers.exe, 00000016.00000002.554544853.0000029794083000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.newtonsoft.com/json
Source: explorers.exe, 00000016.00000002.554544853.0000029794097000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.newtonsoft.com/jsonschema
Source: DHL_Shipping_Document2.exe, 00000000.00000002.540113252.00000199245B0000.00000004.08000000.00040000.00000000.sdmp, DHL_Shipping_Document2.exe, 00000000.00000002.406089795.000001991C83F000.00000004.00000800.00020000.00000000.sdmp, DHL_Shipping_Document2.exe, 00000000.00000002.392885416.000001990BC53000.00000004.00000800.00020000.00000000.sdmp, DHL_Shipping_Document2.exe, 00000000.00000002.406089795.000001991C727000.00000004.00000800.00020000.00000000.sdmp, explorers.exe, 00000016.00000002.554544853.0000029794097000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.nuget.org/packages/Newtonsoft.Json.Bson
Source: unknown DNS traffic detected: queries for: api.ipify.org
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: unknown HTTPS traffic detected: 173.231.16.76:443 -> 192.168.2.3:49697 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.237.62.211:443 -> 192.168.2.3:49700 version: TLS 1.2
Source: unknown HTTPS traffic detected: 173.231.16.76:443 -> 192.168.2.3:49701 version: TLS 1.2

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 0.2.DHL_Shipping_Document2.exe.1990bb43928.2.raw.unpack, type: UNPACKEDPE Matched rule: Detects zgRAT Author: ditekSHen
Source: 0.2.DHL_Shipping_Document2.exe.1991bf4df80.4.unpack, type: UNPACKEDPE Matched rule: Detects zgRAT Author: ditekSHen
Source: 0.2.DHL_Shipping_Document2.exe.1991bed5f10.5.unpack, type: UNPACKEDPE Matched rule: Detects zgRAT Author: ditekSHen
Source: 0.2.DHL_Shipping_Document2.exe.1991befdf48.9.raw.unpack, type: UNPACKEDPE Matched rule: Detects zgRAT Author: ditekSHen
Source: 0.2.DHL_Shipping_Document2.exe.1990bb43928.2.unpack, type: UNPACKEDPE Matched rule: Detects zgRAT Author: ditekSHen
Source: 17.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Detects zgRAT Author: ditekSHen
Source: 0.2.DHL_Shipping_Document2.exe.1991bf4df80.4.raw.unpack, type: UNPACKEDPE Matched rule: Detects zgRAT Author: ditekSHen
Source: 0.2.DHL_Shipping_Document2.exe.1991befdf48.9.unpack, type: UNPACKEDPE Matched rule: Detects zgRAT Author: ditekSHen
Source: 0.2.DHL_Shipping_Document2.exe.1991bed5f10.5.raw.unpack, type: UNPACKEDPE Matched rule: Detects zgRAT Author: ditekSHen
Initial sample is a PE file and has a suspicious name
Source: initial sample Static PE information: Filename: DHL_Shipping_Document2.exe
Yara signature match
Source: 0.2.DHL_Shipping_Document2.exe.1990bb43928.2.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 0.2.DHL_Shipping_Document2.exe.1991bf4df80.4.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 0.2.DHL_Shipping_Document2.exe.1991bed5f10.5.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 0.2.DHL_Shipping_Document2.exe.1991befdf48.9.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 0.2.DHL_Shipping_Document2.exe.1990bb43928.2.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 17.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 0.2.DHL_Shipping_Document2.exe.1991bf4df80.4.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 0.2.DHL_Shipping_Document2.exe.1991befdf48.9.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 0.2.DHL_Shipping_Document2.exe.1991bed5f10.5.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Detected potential crypto function
Source: C:\Users\user\Desktop\DHL_Shipping_Document2.exe Code function: 0_2_00007FFBAD3C29A3 0_2_00007FFBAD3C29A3
Source: C:\Users\user\Desktop\DHL_Shipping_Document2.exe Code function: 0_2_00007FFBAD3C0C00 0_2_00007FFBAD3C0C00
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe Code function: 15_2_022DC978 15_2_022DC978
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe Code function: 15_2_022DA9B8 15_2_022DA9B8
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe Code function: 15_2_022D9DA0 15_2_022D9DA0
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe Code function: 15_2_022D02BF 15_2_022D02BF
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe Code function: 15_2_022DA0E8 15_2_022DA0E8
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe Code function: 17_2_00007FFBAD400CAA 17_2_00007FFBAD400CAA
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe Code function: 17_2_00007FFBAD403EDF 17_2_00007FFBAD403EDF
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe Code function: 17_2_00007FFBAD40BDE8 17_2_00007FFBAD40BDE8
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe Code function: 19_2_021AA0E8 19_2_021AA0E8
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe Code function: 19_2_021AC978 19_2_021AC978
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe Code function: 19_2_021AA9B8 19_2_021AA9B8
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe Code function: 19_2_021A9DA0 19_2_021A9DA0
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe Code function: 19_2_021A07A2 19_2_021A07A2
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe Code function: 23_2_00DFA9B8 23_2_00DFA9B8
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe Code function: 23_2_00DFC978 23_2_00DFC978
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe Code function: 23_2_00DF5AD0 23_2_00DF5AD0
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe Code function: 23_2_00DF9DA0 23_2_00DF9DA0
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe Code function: 23_2_00DFA0DC 23_2_00DFA0DC
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe Code function: 23_2_00DFA0E8 23_2_00DFA0E8
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe Code function: 23_2_00DF5A80 23_2_00DF5A80
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe Code function: 23_2_00DF7A44 23_2_00DF7A44
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe Code function: 23_2_00DF3B48 23_2_00DF3B48
Sample file is different than original file name gathered from version info
Source: DHL_Shipping_Document2.exe, 00000000.00000000.255501089.0000019909E32000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenameDHL Shipping Document2.exe" vs DHL_Shipping_Document2.exe
Source: DHL_Shipping_Document2.exe, 00000000.00000002.406089795.000001991C12E000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameCLIENTS.exe" vs DHL_Shipping_Document2.exe
Source: DHL_Shipping_Document2.exe, 00000000.00000002.406089795.000001991C12E000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameFmdxqenedkdyqyti.dll" vs DHL_Shipping_Document2.exe
Source: DHL_Shipping_Document2.exe, 00000000.00000002.392885416.000001990BB02000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameCLIENTS.exe" vs DHL_Shipping_Document2.exe
Source: DHL_Shipping_Document2.exe, 00000000.00000002.390559945.0000019909F19000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameclr.dllT vs DHL_Shipping_Document2.exe
Source: DHL_Shipping_Document2.exe, 00000000.00000002.540113252.00000199245B0000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameNewtonsoft.Json.dll2 vs DHL_Shipping_Document2.exe
Source: DHL_Shipping_Document2.exe, 00000000.00000002.392885416.000001990BABE000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameCLIENTS.exe" vs DHL_Shipping_Document2.exe
Source: DHL_Shipping_Document2.exe, 00000000.00000002.406089795.000001991C83F000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameNewtonsoft.Json.dll2 vs DHL_Shipping_Document2.exe
Source: DHL_Shipping_Document2.exe, 00000000.00000003.378760182.000001991D412000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamea8eb5b4e-e105-4f1d-aa30-476080d81880.exe4 vs DHL_Shipping_Document2.exe
Source: DHL_Shipping_Document2.exe, 00000000.00000002.392885416.000001990BF6E000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamea8eb5b4e-e105-4f1d-aa30-476080d81880.exe4 vs DHL_Shipping_Document2.exe
Source: DHL_Shipping_Document2.exe, 00000000.00000003.378760182.000001991D3BB000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamea8eb5b4e-e105-4f1d-aa30-476080d81880.exe4 vs DHL_Shipping_Document2.exe
Source: DHL_Shipping_Document2.exe, 00000000.00000002.392885416.000001990BC53000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameNewtonsoft.Json.dll2 vs DHL_Shipping_Document2.exe
Source: DHL_Shipping_Document2.exe, 00000000.00000002.532957763.00000199242B0000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameFmdxqenedkdyqyti.dll" vs DHL_Shipping_Document2.exe
Source: DHL_Shipping_Document2.exe, 00000000.00000002.406089795.000001991C727000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameNewtonsoft.Json.dll2 vs DHL_Shipping_Document2.exe
Source: DHL_Shipping_Document2.exe Binary or memory string: OriginalFilenameDHL Shipping Document2.exe" vs DHL_Shipping_Document2.exe
Source: DHL_Shipping_Document2.exe ReversingLabs: Detection: 38%
Source: DHL_Shipping_Document2.exe Virustotal: Detection: 33%
Source: C:\Users\user\Desktop\DHL_Shipping_Document2.exe File read: C:\Users\user\Desktop\DHL_Shipping_Document2.exe Jump to behavior
Source: DHL_Shipping_Document2.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\DHL_Shipping_Document2.exe Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\DHL_Shipping_Document2.exe C:\Users\user\Desktop\DHL_Shipping_Document2.exe
Source: C:\Users\user\Desktop\DHL_Shipping_Document2.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMQAwAA==
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\DHL_Shipping_Document2.exe Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell -ENC cwBlAHQALQBtAHAAcAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AZQB4AGMAbAB1AHMAaQBvAG4AcABhAHQAaAAgAEMAOgBcAA==
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -ENC cwBlAHQALQBtAHAAcAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AZQB4AGMAbAB1AHMAaQBvAG4AcABhAHQAaAAgAEMAOgBcAA==
Source: C:\Users\user\Desktop\DHL_Shipping_Document2.exe Process created: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe "C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe"
Source: C:\Users\user\Desktop\DHL_Shipping_Document2.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
Source: unknown Process created: C:\Users\user\AppData\Local\explorers.exe "C:\Users\user\AppData\Local\explorers.exe"
Source: unknown Process created: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe "C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe"
Source: unknown Process created: C:\Users\user\AppData\Local\explorers.exe "C:\Users\user\AppData\Local\explorers.exe"
Source: unknown Process created: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe "C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe"
Source: C:\Users\user\Desktop\DHL_Shipping_Document2.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMQAwAA== Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shipping_Document2.exe Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell -ENC cwBlAHQALQBtAHAAcAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AZQB4AGMAbAB1AHMAaQBvAG4AcABhAHQAaAAgAEMAOgBcAA== Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shipping_Document2.exe Process created: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe "C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe" Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shipping_Document2.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -ENC cwBlAHQALQBtAHAAcAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AZQB4AGMAbAB1AHMAaQBvAG4AcABhAHQAaAAgAEMAOgBcAA== Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shipping_Document2.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\InProcServer32 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\DHL_Shipping_Document2.exe File created: C:\Users\user\AppData\Local\explorers.exe Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shipping_Document2.exe File created: C:\Users\user\AppData\Local\Temp\CdFileMgr Jump to behavior
Source: classification engine Classification label: mal100.troj.spyw.evad.winEXE@17/19@19/6
Source: C:\Users\user\Desktop\DHL_Shipping_Document2.exe File read: C:\Users\user\Desktop\desktop.ini Jump to behavior
Source: Nuaaqwldle.tmpdb.17.dr Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: DHL_Shipping_Document2.exe Static file information: TRID: Win64 Executable GUI Net Framework (217006/5) 47.53%
Source: C:\Users\user\Desktop\DHL_Shipping_Document2.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dll Jump to behavior
Source: C:\Users\user\AppData\Local\explorers.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Users\user\AppData\Local\explorers.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dll
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2072:120:WilError_01
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3624:120:WilError_01
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\Desktop\DHL_Shipping_Document2.exe File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll Jump to behavior
Source: DHL_Shipping_Document2.exe Static PE information: Virtual size of .text is bigger than: 0x100000
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Jump to behavior
Source: DHL_Shipping_Document2.exe Static file information: File size 2802176 > 1048576
Source: DHL_Shipping_Document2.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: DHL_Shipping_Document2.exe Static PE information: Raw size of .text is bigger than: 0x100000 < 0x29e400
Source: DHL_Shipping_Document2.exe Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: /_/Src/Newtonsoft.Json/obj/Release/net40/Newtonsoft.Json.pdb source: DHL_Shipping_Document2.exe, 00000000.00000002.540113252.00000199245B0000.00000004.08000000.00040000.00000000.sdmp, DHL_Shipping_Document2.exe, 00000000.00000002.406089795.000001991C83F000.00000004.00000800.00020000.00000000.sdmp, DHL_Shipping_Document2.exe, 00000000.00000002.392885416.000001990BC53000.00000004.00000800.00020000.00000000.sdmp, DHL_Shipping_Document2.exe, 00000000.00000002.406089795.000001991C727000.00000004.00000800.00020000.00000000.sdmp, explorers.exe, 00000016.00000002.554544853.0000029794097000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: protobuf-net.pdbSHA256 source: InstallUtil.exe, 00000011.00000002.556097458.0000029420550000.00000004.08000000.00040000.00000000.sdmp
Source: Binary string: Doxfkywupn.pdb source: InstallUtil.exe, 00000011.00000002.556335374.00000294205D0000.00000004.08000000.00040000.00000000.sdmp
Source: Binary string: C:\projects\dotnetzip-semverd\src\Zip\obj\Release\DotNetZip.pdb source: InstallUtil.exe, 00000011.00000002.552825754.0000029417F5C000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000011.00000002.552825754.000002941804D000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000011.00000002.557517142.0000029420820000.00000004.08000000.00040000.00000000.sdmp
Source: Binary string: protobuf-net.pdb source: InstallUtil.exe, 00000011.00000002.556097458.0000029420550000.00000004.08000000.00040000.00000000.sdmp
Source: Binary string: /_/Src/Newtonsoft.Json/obj/Release/net40/Newtonsoft.Json.pdbSHA256 source: DHL_Shipping_Document2.exe, 00000000.00000002.540113252.00000199245B0000.00000004.08000000.00040000.00000000.sdmp, DHL_Shipping_Document2.exe, 00000000.00000002.406089795.000001991C83F000.00000004.00000800.00020000.00000000.sdmp, DHL_Shipping_Document2.exe, 00000000.00000002.392885416.000001990BC53000.00000004.00000800.00020000.00000000.sdmp, DHL_Shipping_Document2.exe, 00000000.00000002.406089795.000001991C727000.00000004.00000800.00020000.00000000.sdmp, explorers.exe, 00000016.00000002.554544853.0000029794097000.00000004.00000800.00020000.00000000.sdmp
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\DHL_Shipping_Document2.exe Code function: 0_2_00007FFBAD3C7216 pushad ; iretd 0_2_00007FFBAD3C724D
Source: C:\Users\user\Desktop\DHL_Shipping_Document2.exe Code function: 0_2_00007FFBAD3C724E push eax; iretd 0_2_00007FFBAD3C725D
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe Code function: 23_2_00DFDACA push ebp; iretd 23_2_00DFDACC
Drops PE files
Source: C:\Users\user\Desktop\DHL_Shipping_Document2.exe File created: C:\Users\user\AppData\Local\explorers.exe Jump to dropped file
Source: C:\Users\user\Desktop\DHL_Shipping_Document2.exe File created: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe File created: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe Jump to dropped file

Boot Survival
barindex
Creates multiple autostart registry keys
Source: C:\Users\user\Desktop\DHL_Shipping_Document2.exe Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run explorers Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run KbWSe Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shipping_Document2.exe Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run explorers Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shipping_Document2.exe Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run explorers Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run KbWSe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run KbWSe Jump to behavior

Hooking and other Techniques for Hiding and Protection
barindex
Hides that the sample has been downloaded from the Internet (zone.identifier)
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe File opened: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe:Zone.Identifier read attributes | delete Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shipping_Document2.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shipping_Document2.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shipping_Document2.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shipping_Document2.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shipping_Document2.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shipping_Document2.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shipping_Document2.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shipping_Document2.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shipping_Document2.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shipping_Document2.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shipping_Document2.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shipping_Document2.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shipping_Document2.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shipping_Document2.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shipping_Document2.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shipping_Document2.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shipping_Document2.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shipping_Document2.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shipping_Document2.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shipping_Document2.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shipping_Document2.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shipping_Document2.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shipping_Document2.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shipping_Document2.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shipping_Document2.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shipping_Document2.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shipping_Document2.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shipping_Document2.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shipping_Document2.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shipping_Document2.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shipping_Document2.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shipping_Document2.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shipping_Document2.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shipping_Document2.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shipping_Document2.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shipping_Document2.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shipping_Document2.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shipping_Document2.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shipping_Document2.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shipping_Document2.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shipping_Document2.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shipping_Document2.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shipping_Document2.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shipping_Document2.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shipping_Document2.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shipping_Document2.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shipping_Document2.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shipping_Document2.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\explorers.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\explorers.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\explorers.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\explorers.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\explorers.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\explorers.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\explorers.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\explorers.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\explorers.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\explorers.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\explorers.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\explorers.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\explorers.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\explorers.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\explorers.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\explorers.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\explorers.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\explorers.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\explorers.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\explorers.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\explorers.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\explorers.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\explorers.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\explorers.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\explorers.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\explorers.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\explorers.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\explorers.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\explorers.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\explorers.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\explorers.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\explorers.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\explorers.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\explorers.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\explorers.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\explorers.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\explorers.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\explorers.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\explorers.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\explorers.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\explorers.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\explorers.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\explorers.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\explorers.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\explorers.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\explorers.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\explorers.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\explorers.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\explorers.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\explorers.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\explorers.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\explorers.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\explorers.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\explorers.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\explorers.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\explorers.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\explorers.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\explorers.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\explorers.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\explorers.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\explorers.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\explorers.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\explorers.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\explorers.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\explorers.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\explorers.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\explorers.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\explorers.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\explorers.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\explorers.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\explorers.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\explorers.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\explorers.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\explorers.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\explorers.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion
barindex
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\DHL_Shipping_Document2.exe TID: 5268 Thread sleep time: -2767011611056431s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shipping_Document2.exe TID: 5268 Thread sleep count: 48 > 30 Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shipping_Document2.exe TID: 5248 Thread sleep count: 9575 > 30 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4672 Thread sleep time: -10145709240540247s >= -30000s Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4604 Thread sleep count: 9332 > 30 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1244 Thread sleep time: -2767011611056431s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe TID: 1844 Thread sleep count: 9713 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe TID: 5884 Thread sleep time: -23980767295822402s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe TID: 5884 Thread sleep time: -100000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe TID: 5884 Thread sleep time: -99839s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe TID: 5884 Thread sleep time: -99733s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe TID: 5884 Thread sleep time: -99621s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe TID: 5884 Thread sleep time: -99486s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe TID: 5884 Thread sleep time: -99344s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe TID: 5884 Thread sleep time: -99230s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe TID: 5884 Thread sleep time: -99119s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe TID: 5884 Thread sleep time: -99014s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe TID: 5884 Thread sleep time: -98894s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe TID: 5884 Thread sleep time: -98750s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe TID: 5884 Thread sleep time: -98631s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe TID: 5884 Thread sleep time: -98511s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe TID: 5884 Thread sleep time: -98402s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe TID: 5884 Thread sleep time: -98292s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe TID: 5884 Thread sleep time: -98171s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe TID: 5884 Thread sleep time: -98059s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe TID: 5884 Thread sleep time: -97950s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe TID: 5884 Thread sleep time: -97835s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe TID: 5884 Thread sleep time: -97714s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe TID: 5884 Thread sleep time: -97591s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe TID: 5884 Thread sleep time: -97482s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe TID: 5884 Thread sleep time: -97359s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe TID: 5884 Thread sleep time: -97244s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe TID: 5884 Thread sleep time: -97140s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe TID: 5884 Thread sleep time: -97031s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe TID: 5884 Thread sleep time: -99825s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe TID: 5884 Thread sleep time: -99711s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe TID: 5884 Thread sleep time: -99559s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe TID: 5884 Thread sleep time: -99424s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe TID: 5884 Thread sleep time: -99297s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe TID: 5884 Thread sleep time: -99186s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe TID: 5884 Thread sleep time: -99078s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe TID: 5884 Thread sleep time: -98968s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe TID: 5884 Thread sleep time: -98851s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe TID: 5884 Thread sleep time: -98720s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe TID: 5884 Thread sleep time: -98527s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe TID: 5884 Thread sleep time: -98414s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe TID: 5884 Thread sleep time: -98311s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe TID: 5884 Thread sleep time: -98200s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe TID: 5884 Thread sleep time: -98089s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe TID: 5884 Thread sleep time: -97964s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe TID: 5884 Thread sleep time: -97851s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe TID: 5884 Thread sleep time: -97734s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe TID: 5884 Thread sleep time: -97593s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe TID: 5884 Thread sleep time: -97462s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\explorers.exe TID: 5840 Thread sleep time: -3689348814741908s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\explorers.exe TID: 5840 Thread sleep count: 37 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\explorers.exe TID: 5912 Thread sleep count: 9667 > 30 Jump to behavior
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe TID: 5492 Thread sleep count: 4987 > 30
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe TID: 760 Thread sleep time: -11068046444225724s >= -30000s
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe TID: 760 Thread sleep time: -100000s >= -30000s
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe TID: 760 Thread sleep time: -99868s >= -30000s
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe TID: 760 Thread sleep time: -99734s >= -30000s
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe TID: 760 Thread sleep time: -99621s >= -30000s
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe TID: 760 Thread sleep time: -99514s >= -30000s
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe TID: 760 Thread sleep time: -99398s >= -30000s
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe TID: 760 Thread sleep time: -99282s >= -30000s
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe TID: 760 Thread sleep time: -99167s >= -30000s
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe TID: 760 Thread sleep time: -99036s >= -30000s
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe TID: 760 Thread sleep time: -98922s >= -30000s
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe TID: 760 Thread sleep time: -98792s >= -30000s
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe TID: 760 Thread sleep time: -98687s >= -30000s
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe TID: 760 Thread sleep time: -98538s >= -30000s
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe TID: 760 Thread sleep time: -98420s >= -30000s
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe TID: 760 Thread sleep time: -98310s >= -30000s
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe TID: 760 Thread sleep time: -98203s >= -30000s
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe TID: 760 Thread sleep time: -98094s >= -30000s
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe TID: 760 Thread sleep time: -97976s >= -30000s
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe TID: 760 Thread sleep time: -97853s >= -30000s
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe TID: 760 Thread sleep time: -97732s >= -30000s
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe TID: 760 Thread sleep time: -97625s >= -30000s
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe TID: 760 Thread sleep time: -97508s >= -30000s
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe TID: 760 Thread sleep time: -97390s >= -30000s
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe TID: 760 Thread sleep time: -97264s >= -30000s
Source: C:\Users\user\AppData\Local\explorers.exe TID: 5104 Thread sleep time: -2767011611056431s >= -30000s
Source: C:\Users\user\AppData\Local\explorers.exe TID: 2220 Thread sleep count: 6320 > 30
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe TID: 1176 Thread sleep count: 499 > 30
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe Last function: Thread delayed
Contains long sleeps (>= 3 min)
Source: C:\Users\user\Desktop\DHL_Shipping_Document2.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Local\explorers.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\explorers.exe Thread delayed: delay time: 922337203685477
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Users\user\Desktop\DHL_Shipping_Document2.exe Window / User API: threadDelayed 9575 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 9389 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 9332 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe Window / User API: threadDelayed 9713 Jump to behavior
Source: C:\Users\user\AppData\Local\explorers.exe Window / User API: threadDelayed 9667 Jump to behavior
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe Window / User API: threadDelayed 4987
Source: C:\Users\user\AppData\Local\explorers.exe Window / User API: threadDelayed 6320
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe Window / User API: threadDelayed 499
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information queried: ProcessInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shipping_Document2.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe Thread delayed: delay time: 100000 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe Thread delayed: delay time: 99839 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe Thread delayed: delay time: 99733 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe Thread delayed: delay time: 99621 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe Thread delayed: delay time: 99486 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe Thread delayed: delay time: 99344 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe Thread delayed: delay time: 99230 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe Thread delayed: delay time: 99119 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe Thread delayed: delay time: 99014 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe Thread delayed: delay time: 98894 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe Thread delayed: delay time: 98750 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe Thread delayed: delay time: 98631 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe Thread delayed: delay time: 98511 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe Thread delayed: delay time: 98402 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe Thread delayed: delay time: 98292 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe Thread delayed: delay time: 98171 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe Thread delayed: delay time: 98059 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe Thread delayed: delay time: 97950 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe Thread delayed: delay time: 97835 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe Thread delayed: delay time: 97714 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe Thread delayed: delay time: 97591 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe Thread delayed: delay time: 97482 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe Thread delayed: delay time: 97359 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe Thread delayed: delay time: 97244 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe Thread delayed: delay time: 97140 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe Thread delayed: delay time: 97031 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe Thread delayed: delay time: 99825 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe Thread delayed: delay time: 99711 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe Thread delayed: delay time: 99559 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe Thread delayed: delay time: 99424 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe Thread delayed: delay time: 99297 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe Thread delayed: delay time: 99186 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe Thread delayed: delay time: 99078 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe Thread delayed: delay time: 98968 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe Thread delayed: delay time: 98851 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe Thread delayed: delay time: 98720 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe Thread delayed: delay time: 98527 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe Thread delayed: delay time: 98414 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe Thread delayed: delay time: 98311 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe Thread delayed: delay time: 98200 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe Thread delayed: delay time: 98089 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe Thread delayed: delay time: 97964 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe Thread delayed: delay time: 97851 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe Thread delayed: delay time: 97734 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe Thread delayed: delay time: 97593 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe Thread delayed: delay time: 97462 Jump to behavior
Source: C:\Users\user\AppData\Local\explorers.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe Thread delayed: delay time: 100000
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe Thread delayed: delay time: 99868
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe Thread delayed: delay time: 99734
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe Thread delayed: delay time: 99621
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe Thread delayed: delay time: 99514
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe Thread delayed: delay time: 99398
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe Thread delayed: delay time: 99282
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe Thread delayed: delay time: 99167
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe Thread delayed: delay time: 99036
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe Thread delayed: delay time: 98922
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe Thread delayed: delay time: 98792
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe Thread delayed: delay time: 98687
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe Thread delayed: delay time: 98538
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe Thread delayed: delay time: 98420
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe Thread delayed: delay time: 98310
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe Thread delayed: delay time: 98203
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe Thread delayed: delay time: 98094
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe Thread delayed: delay time: 97976
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe Thread delayed: delay time: 97853
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe Thread delayed: delay time: 97732
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe Thread delayed: delay time: 97625
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe Thread delayed: delay time: 97508
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe Thread delayed: delay time: 97390
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe Thread delayed: delay time: 97264
Source: C:\Users\user\AppData\Local\explorers.exe Thread delayed: delay time: 922337203685477
Source: InstallUtil.exe, 00000011.00000002.556971719.00000294206D0000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: VMware
Source: KbWSe.exe, 00000013.00000003.479323373.0000000000891000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll;
Source: InstallUtil.exe, 00000011.00000002.556971719.00000294206D0000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Win32_VideoController(Standard display types)VMware4X7R9VV9Win32_VideoController66XGVD9WVideoController120060621000000.000000-00014.85187display.infMSBDA328S4PUGPCI\VEN_15AD&DEV_0405&SUBSYS_040515AD&REV_00\3&61AAA01&0&78OKWin32_ComputerSystemcomputer1280 x 1024 x 4294967296 colorsVV92AOMP
Source: Lutyzivrgpnlssvvvftlfile.exe, 0000000F.00000002.545974916.0000000000694000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000011.00000002.556971719.00000294206D0000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Enables debug privileges
Source: C:\Users\user\Desktop\DHL_Shipping_Document2.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shipping_Document2.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
Writes to foreign memory regions
Source: C:\Users\user\Desktop\DHL_Shipping_Document2.exe Memory written: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe base: 400000 Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shipping_Document2.exe Memory written: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe base: 402000 Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shipping_Document2.exe Memory written: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe base: 4C4000 Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shipping_Document2.exe Memory written: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe base: E7A101B010 Jump to behavior
Encrypted powershell cmdline option found
Source: C:\Users\user\Desktop\DHL_Shipping_Document2.exe Process created: Base64 decoded start-sleep -seconds 10
Source: C:\Windows\System32\cmd.exe Process created: Base64 decoded set-mppreference -exclusionpath C:\
Source: C:\Users\user\Desktop\DHL_Shipping_Document2.exe Process created: Base64 decoded start-sleep -seconds 10 Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: Base64 decoded set-mppreference -exclusionpath C:\ Jump to behavior
Injects a PE file into a foreign processes
Source: C:\Users\user\Desktop\DHL_Shipping_Document2.exe Memory written: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe base: 400000 value starts with: 4D5A Jump to behavior
Modifies the context of a thread in another process (thread injection)
Source: C:\Users\user\Desktop\DHL_Shipping_Document2.exe Thread register set: target process: 1764 Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\DHL_Shipping_Document2.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMQAwAA== Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shipping_Document2.exe Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell -ENC cwBlAHQALQBtAHAAcAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AZQB4AGMAbAB1AHMAaQBvAG4AcABhAHQAaAAgAEMAOgBcAA== Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shipping_Document2.exe Process created: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe "C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe" Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shipping_Document2.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -ENC cwBlAHQALQBtAHAAcAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AZQB4AGMAbAB1AHMAaQBvAG4AcABhAHQAaAAgAEMAOgBcAA== Jump to behavior
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\DHL_Shipping_Document2.exe Queries volume information: C:\Users\user\Desktop\DHL_Shipping_Document2.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shipping_Document2.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shipping_Document2.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shipping_Document2.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shipping_Document2.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shipping_Document2.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shipping_Document2.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-ds-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-base-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-base-Package~31bf3856ad364e35~amd64~en-US~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe Queries volume information: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\explorers.exe Queries volume information: C:\Users\user\AppData\Local\explorers.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\explorers.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\explorers.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\explorers.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\explorers.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\explorers.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\explorers.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe Queries volume information: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Local\explorers.exe Queries volume information: C:\Users\user\AppData\Local\explorers.exe VolumeInformation
Source: C:\Users\user\AppData\Local\explorers.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Users\user\AppData\Local\explorers.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.dll VolumeInformation
Source: C:\Users\user\AppData\Local\explorers.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll VolumeInformation
Source: C:\Users\user\AppData\Local\explorers.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll VolumeInformation
Source: C:\Users\user\AppData\Local\explorers.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll VolumeInformation
Source: C:\Users\user\AppData\Local\explorers.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe Queries volume information: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Users\user\Desktop\DHL_Shipping_Document2.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe Code function: 15_2_022DF6E0 GetUserNameW, 15_2_022DF6E0

Stealing of Sensitive Information
barindex
Yara detected zgRAT
Source: Yara match File source: 0.2.DHL_Shipping_Document2.exe.1990bb43928.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.DHL_Shipping_Document2.exe.1991bf4df80.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.DHL_Shipping_Document2.exe.1991bed5f10.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.DHL_Shipping_Document2.exe.1991befdf48.9.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.DHL_Shipping_Document2.exe.1990bb43928.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.DHL_Shipping_Document2.exe.1991bf4df80.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.DHL_Shipping_Document2.exe.1991befdf48.9.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.DHL_Shipping_Document2.exe.1991bed5f10.5.raw.unpack, type: UNPACKEDPE
Yara detected AgentTesla
Source: Yara match File source: 00000013.00000002.556924562.00000000023AC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.555838851.000000000244C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000017.00000002.558518953.00000000028BC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: Lutyzivrgpnlssvvvftlfile.exe PID: 5084, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: KbWSe.exe PID: 5916, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: KbWSe.exe PID: 2948, type: MEMORYSTR
Tries to steal Mail credentials (via file / registry access)
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities Jump to behavior
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions Jump to behavior
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions
Found many strings related to Crypto-Wallets (likely being stolen)
Source: InstallUtil.exe, 00000011.00000002.550292879.0000029407DCA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: Electrum
Source: InstallUtil.exe, 00000011.00000002.550292879.00000294081A3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: Jaxx Liberty
Source: InstallUtil.exe, 00000011.00000002.550292879.00000294081A3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: Exodus Web3
Source: InstallUtil.exe, 00000011.00000002.550292879.0000029407DCA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: Ethereum
Source: DHL_Shipping_Document2.exe, 00000000.00000002.406089795.000001991C12E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: set_UseMachineKeyStore
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini
Source: C:\Users\user\AppData\Roaming\KbWSe\KbWSe.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\Lutyzivrgpnlssvvvftlfile.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies Jump to behavior
Yara detected Credential Stealer
Source: Yara match File source: 00000013.00000002.556924562.00000000023AC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.555838851.000000000244C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000017.00000002.558518953.00000000028BC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000002.550292879.0000029407DCA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: Lutyzivrgpnlssvvvftlfile.exe PID: 5084, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: InstallUtil.exe PID: 1764, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: KbWSe.exe PID: 5916, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: KbWSe.exe PID: 2948, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected zgRAT
Source: Yara match File source: 0.2.DHL_Shipping_Document2.exe.1990bb43928.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.DHL_Shipping_Document2.exe.1991bf4df80.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.DHL_Shipping_Document2.exe.1991bed5f10.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.DHL_Shipping_Document2.exe.1991befdf48.9.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.DHL_Shipping_Document2.exe.1990bb43928.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.DHL_Shipping_Document2.exe.1991bf4df80.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.DHL_Shipping_Document2.exe.1991befdf48.9.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.DHL_Shipping_Document2.exe.1991bed5f10.5.raw.unpack, type: UNPACKEDPE
Yara detected AgentTesla
Source: Yara match File source: 00000013.00000002.556924562.00000000023AC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.555838851.000000000244C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000017.00000002.558518953.00000000028BC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: Lutyzivrgpnlssvvvftlfile.exe PID: 5084, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: KbWSe.exe PID: 5916, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: KbWSe.exe PID: 2948, type: MEMORYSTR
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 830438 Sample: DHL_Shipping_Document2.exe Startdate: 20/03/2023 Architecture: WINDOWS Score: 100 46 us2.smtp.mailhostbox.com 2->46 48 smtp.thanhphoung-vn.com 2->48 50 203.215.12.0.in-addr.arpa 2->50 68 Snort IDS alert for network traffic 2->68 70 Malicious sample detected (through community Yara rule) 2->70 72 Multi AV Scanner detection for submitted file 2->72 74 6 other signatures 2->74 8 DHL_Shipping_Document2.exe 1 8 2->8         started        12 KbWSe.exe 2->12         started        15 explorers.exe 2 2->15         started        17 2 other processes 2->17 signatures3 process4 dnsIp5 38 C:\Users\user\AppData\Local\explorers.exe, PE32+ 8->38 dropped 40 C:\Users\...\Lutyzivrgpnlssvvvftlfile.exe, PE32 8->40 dropped 42 C:\Users\...\explorers.exe:Zone.Identifier, ASCII 8->42 dropped 44 C:\Users\...\DHL_Shipping_Document2.exe.log, ASCII 8->44 dropped 86 Encrypted powershell cmdline option found 8->86 88 Creates multiple autostart registry keys 8->88 90 Writes to foreign memory regions 8->90 104 2 other signatures 8->104 19 Lutyzivrgpnlssvvvftlfile.exe 17 9 8->19         started        24 cmd.exe 1 8->24         started        26 powershell.exe 13 8->26         started        28 InstallUtil.exe 8->28         started        58 208.91.198.143, 49702, 49704, 587 PUBLIC-DOMAIN-REGISTRYUS United States 12->58 60 104.237.62.211, 443, 49700 WEBNXUS United States 12->60 66 4 other IPs or domains 12->66 92 Antivirus detection for dropped file 12->92 94 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 12->94 96 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 12->96 106 3 other signatures 12->106 98 Multi AV Scanner detection for dropped file 15->98 100 Machine Learning detection for dropped file 15->100 62 api4.ipify.org 17->62 64 api.ipify.org 17->64 102 Tries to harvest and steal browser information (history, passwords, etc) 17->102 file6 signatures7 process8 dnsIp9 52 208.91.199.225, 49699, 49703, 587 PUBLIC-DOMAIN-REGISTRYUS United States 19->52 54 api4.ipify.org 173.231.16.76, 443, 49697, 49701 WEBNXUS United States 19->54 56 4 other IPs or domains 19->56 36 C:\Users\user\AppData\Roaming\...\KbWSe.exe, PE32 19->36 dropped 76 Antivirus detection for dropped file 19->76 78 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 19->78 80 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 19->80 84 7 other signatures 19->84 82 Encrypted powershell cmdline option found 24->82 30 powershell.exe 15 24->30         started        32 conhost.exe 24->32         started        34 conhost.exe 26->34         started        file10 signatures11 process12
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
208.91.198.143
 unknown United States
394695 PUBLIC-DOMAIN-REGISTRYUS true
104.237.62.211
 unknown United States
18450 WEBNXUS false
208.91.199.225
 unknown United States
394695 PUBLIC-DOMAIN-REGISTRYUS true
208.91.199.223
 us2.smtp.mailhostbox.com United States
394695 PUBLIC-DOMAIN-REGISTRYUS false
173.231.16.76
 api4.ipify.org United States
18450 WEBNXUS false

Private

IP
192.168.2.1

Contacted Domains

Name IP Active
us2.smtp.mailhostbox.com 208.91.199.223 true
api4.ipify.org 173.231.16.76 true
smtp.thanhphoung-vn.com unknown unknown
203.215.12.0.in-addr.arpa unknown unknown
api.ipify.org unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
https://api.ipify.org/ false
    		high