Play interactive tour

Edit tour

Analysis Report module.8144.18ffc90c0.400000.dll

Overview

General Information

Joe Sandbox Version:	26.0.0
Analysis ID:	136638
Start date:	29.05.2019
Start time:	16:49:35
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 12m 37s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	module.8144.18ffc90c0.400000.dll (renamed file extension from dll to exe)
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit (version 1803) with Office 2016, Adobe Reader DC 19, Chrome 70, Firefox 63, Java 8.171, Flash 30.0.0.113
Number of analysed new started processes analysed:	11
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (VBA) GSI enabled (Javascript) GSI enabled (Java)
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal80.rans.evad.winEXE@2/1@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 23 Number of non-executed functions: 93
Cookbook Comments:	Adjust boot time Enable AMSI
Warnings:	Show All Exclude process from analysis (whitelisted): MpCmdRun.exe, sc.exe, dllhost.exe, WMIADAP.exe, conhost.exe, CompatTelRunner.exe, svchost.exe

Detection

Strategy	Score	Range	Reporting	Whitelisted	Detection
Threshold	80	0 - 100		false

Confidence

Strategy	Score	Range	Further Analysis Required?	Confidence
Threshold	5	0 - 5	false

Classification

Analysis Advice

Sample may offer command line options, please run it with the 'Execute binary with arguments' cookbook (it's possible that the command line switches require additional characters like: "-", "/", "--")

Sample monitors Window changes (e.g. starting applications), analyze the sample with the 'Simulates keyboard and window changes' cookbook

Sample tries to load a library which is not present or installed on the analysis machine, adding the library might reveal more behavior

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control
Valid Accounts	Windows Remote Management	Winlogon Helper DLL	Access Token Manipulation1	Disabling Security Tools1	Credential Dumping	System Time Discovery1	Application Deployment Software	Clipboard Data1	Data Encrypted21	Standard Cryptographic Protocol1
Replication Through Removable Media	Service Execution	Port Monitors	Process Injection1	Software Packing1	Network Sniffing	Query Registry1	Remote Services	Data from Removable Media	Exfiltration Over Other Network Medium	Commonly Used Port1
Drive-by Compromise	Windows Management Instrumentation	Accessibility Features	Path Interception	Access Token Manipulation1	Input Capture	Process Discovery2	Windows Remote Management	Data from Network Shared Drive	Automated Exfiltration	Custom Cryptographic Protocol
Exploit Public-Facing Application	Scheduled Task	System Firmware	DLL Search Order Hijacking	Process Injection1	Credentials in Files	Application Window Discovery1	Logon Scripts	Input Capture	Data Encrypted	Multiband Communication
Spearphishing Link	Command-Line Interface	Shortcut Modification	File System Permissions Weakness	Deobfuscate/Decode Files or Information1	Account Manipulation	Account Discovery1	Shared Webroot	Data Staged	Scheduled Transfer	Standard Cryptographic Protocol
Spearphishing Attachment	Graphical User Interface	Modify Existing Service	New Service	File Deletion1	Brute Force	System Owner/User Discovery1	Third-party Software	Screen Capture	Data Transfer Size Limits	Commonly Used Port
Spearphishing via Service	Scripting	Path Interception	Scheduled Task	Obfuscated Files or Information2	Two-Factor Authentication Interception	Security Software Discovery21	Pass the Hash	Email Collection	Exfiltration Over Command and Control Channel	Uncommonly Used Port
Supply Chain Compromise	Third-party Software	Logon Scripts	Process Injection	DLL Side-Loading1	Bash History	File and Directory Discovery1	Remote Desktop Protocol	Clipboard Data	Exfiltration Over Alternative Protocol	Standard Application Layer Protocol
Trusted Relationship	Rundll32	DLL Search Order Hijacking	Service Registry Permissions Weakness	Process Injection	Input Prompt	System Information Discovery13	Windows Admin Shares	Automated Collection	Exfiltration Over Physical Medium	Multilayer Encryption

Signature Overview

Click to jump to signature section

AV Detection:

Antivirus or Machine Learning detection for sample

Show sources

Source: module.8144.18ffc90c0.400000.exe

Joe Sandbox ML: detected

Antivirus or Machine Learning detection for unpacked file

Show sources

Source: 0.0.module.8144.18ffc90c0.400000.exe.400000.0.unpack	Joe Sandbox ML: detected
Source: 0.1.module.8144.18ffc90c0.400000.exe.400000.0.unpack	Joe Sandbox ML: detected
Source: 0.2.module.8144.18ffc90c0.400000.exe.400000.0.unpack	Joe Sandbox ML: detected

Cryptography:

Uses Microsoft's Enhanced Cryptographic Provider

Show sources

Source: C:\Users\user\Desktop\module.8144.18ffc90c0.400000.exe	Code function: 0_2_00401063 CryptImportKey,CryptDecrypt,CryptDestroyKey,CryptReleaseContext,	0_2_00401063
Source: C:\Users\user\Desktop\module.8144.18ffc90c0.400000.exe	Code function: 0_2_00401000 EntryPoint,CryptAcquireContextA,lstrcpyW,lstrlenW,lstrcatW,GetFileAttributesW,CreateFileW,WriteFile,CloseHandle,SetFileAttributesW,GlobalFree,	0_2_00401000
Source: C:\Users\user\Desktop\module.8144.18ffc90c0.400000.exe	Code function: 0_2_004017A2 GetModuleFileNameA,lstrcmpiA,RegOpenKeyExA,lstrlenA,RegSetValueExA,lstrlenA,RegSetValueExA,RegCloseKey,CopyFileA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,CryptAcquireContextA,GetLastError,GetEnvironmentVariableA,ShellExecuteA,Sleep,CryptAcquireContextA,CryptGenKey,CryptExportKey,CryptExportKey,CryptDestroyKey,CryptReleaseContext,CryptAcquireContextA,CryptImportKey,CryptEncrypt,CryptEncrypt,CryptDestroyKey,KiUserExceptionDispatcher,CryptReleaseContext,RegSetValueExA,RegSetValueExA,RegCloseKey,RtlZeroMemory,RegOpenKeyExA,RegSetValueExA,RegSetValueExA,RegSetValueExA,RegCloseKey,CryptAcquireContextA,CryptImportKey,GetSystemTimeAsFileTime,FileTimeToSystemTime,GetDateFormatA,lstrlenA,MultiByteToWideChar,lstrcatA,RegCreateKeyA,lstrcatA,lstrcatA,lstrlenA,RegSetValueExA,RegCloseKey,SHChangeNotify,GetEnvironmentVariableA,ShellExecuteA,GlobalFree,SetErrorMode,Sleep,Sleep,ShellExecuteA,CreateFileA,WriteFile,CloseHandle,ShellExecuteA,	0_2_004017A2
Source: C:\Users\user\Desktop\module.8144.18ffc90c0.400000.exe	Code function: 0_2_0040128D MoveFileW,CreateFileW,MoveFileW,Sleep,CreateFileMappingA,CloseHandle,CryptAcquireContextA,CloseHandle,CryptGenKey,CryptReleaseContext,CryptExportKey,CryptDestroyKey,MapViewOfFile,CryptEncrypt,CryptEncrypt,UnmapViewOfFile,CloseHandle,CryptDestroyKey,CryptReleaseContext,SetFilePointerEx,WriteFile,WriteFile,CloseHandle,SetFileAttributesW,	0_2_0040128D
Source: C:\Users\user\Desktop\module.8144.18ffc90c0.400000.exe	Code function: 0_2_0040191C CryptGenKey,CryptExportKey,CryptExportKey,CryptDestroyKey,CryptReleaseContext,CryptAcquireContextA,CryptImportKey,CryptEncrypt,CryptEncrypt,CryptDestroyKey,KiUserExceptionDispatcher,CryptReleaseContext,RegSetValueExA,RegSetValueExA,RegCloseKey,RtlZeroMemory,RegOpenKeyExA,RegSetValueExA,RegSetValueExA,RegSetValueExA,RegCloseKey,CryptAcquireContextA,CryptImportKey,GetSystemTimeAsFileTime,FileTimeToSystemTime,GetDateFormatA,lstrlenA,MultiByteToWideChar,lstrcatA,RegCreateKeyA,lstrcatA,lstrcatA,lstrlenA,RegSetValueExA,RegCloseKey,SHChangeNotify,GetEnvironmentVariableA,ShellExecuteA,GlobalFree,SetErrorMode,Sleep,Sleep,ShellExecuteA,CreateFileA,WriteFile,CloseHandle,ShellExecuteA,	0_2_0040191C
Source: C:\Users\user\Desktop\module.8144.18ffc90c0.400000.exe	Code function: 0_1_00401063 CryptImportKey,CryptDecrypt,CryptDestroyKey,CryptReleaseContext,	0_1_00401063
Source: C:\Users\user\Desktop\module.8144.18ffc90c0.400000.exe	Code function: 0_1_00401000 EntryPoint,CryptAcquireContextA,lstrcpyW,lstrlenW,lstrcatW,GetFileAttributesW,CreateFileW,WriteFile,CloseHandle,SetFileAttributesW,GlobalFree,	0_1_00401000
Source: C:\Users\user\Desktop\module.8144.18ffc90c0.400000.exe	Code function: 0_1_004017A2 GetModuleFileNameA,lstrcmpiA,RegOpenKeyExA,lstrlenA,RegSetValueExA,lstrlenA,RegSetValueExA,RegCloseKey,CopyFileA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,CryptAcquireContextA,GetLastError,GetEnvironmentVariableA,ShellExecuteA,Sleep,CryptAcquireContextA,CryptGenKey,CryptExportKey,CryptExportKey,CryptDestroyKey,CryptReleaseContext,CryptAcquireContextA,CryptImportKey,CryptEncrypt,CryptEncrypt,CryptDestroyKey,KiUserExceptionDispatcher,CryptReleaseContext,RegSetValueExA,RegSetValueExA,RegCloseKey,RtlZeroMemory,RegOpenKeyExA,RegSetValueExA,RegSetValueExA,RegSetValueExA,RegCloseKey,CryptAcquireContextA,CryptImportKey,GetSystemTimeAsFileTime,FileTimeToSystemTime,GetDateFormatA,lstrlenA,MultiByteToWideChar,lstrcatA,RegCreateKeyA,lstrcatA,lstrcatA,lstrlenA,RegSetValueExA,RegCloseKey,SHChangeNotify,GetEnvironmentVariableA,ShellExecuteA,GlobalFree,SetErrorMode,Sleep,Sleep,ShellExecuteA,CreateFileA,WriteFile,CloseHandle,ShellExecuteA,	0_1_004017A2
Source: C:\Users\user\Desktop\module.8144.18ffc90c0.400000.exe	Code function: 0_1_0040128D MoveFileW,CreateFileW,MoveFileW,Sleep,CreateFileMappingA,CloseHandle,CryptAcquireContextA,CloseHandle,CryptGenKey,CryptReleaseContext,CryptExportKey,CryptDestroyKey,MapViewOfFile,CryptEncrypt,CryptEncrypt,UnmapViewOfFile,CloseHandle,CryptDestroyKey,CryptReleaseContext,SetFilePointerEx,WriteFile,WriteFile,CloseHandle,SetFileAttributesW,	0_1_0040128D
Source: C:\Users\user\Desktop\module.8144.18ffc90c0.400000.exe	Code function: 0_1_0040191C CryptGenKey,CryptExportKey,CryptExportKey,CryptDestroyKey,CryptReleaseContext,CryptAcquireContextA,CryptImportKey,CryptEncrypt,CryptEncrypt,CryptDestroyKey,KiUserExceptionDispatcher,CryptReleaseContext,RegSetValueExA,RegSetValueExA,RegCloseKey,RtlZeroMemory,RegOpenKeyExA,RegSetValueExA,RegSetValueExA,RegSetValueExA,RegCloseKey,CryptAcquireContextA,CryptImportKey,GetSystemTimeAsFileTime,FileTimeToSystemTime,GetDateFormatA,lstrlenA,MultiByteToWideChar,lstrcatA,RegCreateKeyA,lstrcatA,lstrcatA,lstrlenA,RegSetValueExA,RegCloseKey,SHChangeNotify,GetEnvironmentVariableA,ShellExecuteA,GlobalFree,SetErrorMode,Sleep,Sleep,ShellExecuteA,CreateFileA,WriteFile,CloseHandle,ShellExecuteA,	0_1_0040191C

Spreading:

Contains functionality to enumerate / list files inside a directory

Show sources

Source: C:\Users\user\Desktop\module.8144.18ffc90c0.400000.exe	Code function: 0_2_004014CC FindFirstFileW,lstrcmpW,lstrcmpW,lstrcmpiW,lstrcatW,lstrlenW,lstrcatW,lstrcatW,GlobalMemoryStatus,Sleep,CreateThread,CloseHandle,lstrcmpiW,lstrlenW,lstrcmpiW,lstrcatW,lstrlenW,lstrcatW,lstrcatW,lstrcatW,SetFileAttributesW,FindNextFileW,FindClose,GlobalFree,	0_2_004014CC
Source: C:\Users\user\Desktop\module.8144.18ffc90c0.400000.exe	Code function: 0_1_004014CC FindFirstFileW,lstrcmpW,lstrcmpW,lstrcmpiW,lstrcatW,lstrlenW,lstrcatW,lstrcatW,GlobalMemoryStatus,Sleep,CreateThread,CloseHandle,lstrcmpiW,lstrlenW,lstrcmpiW,lstrcatW,lstrlenW,lstrcatW,lstrcatW,lstrcatW,SetFileAttributesW,FindNextFileW,FindClose,GlobalFree,	0_1_004014CC
Source: C:\Users\user\AppData\Local\Microsoft\OneDrive\17.3.6816.0313_2\FileCoAuth.exe	Code function: 9_2_00E9A394 memset,FindFirstFileW,memset,PathRemoveFileSpecW,WerRegisterFile,FindNextFileW,FindClose,	9_2_00E9A394
Source: C:\Users\user\AppData\Local\Microsoft\OneDrive\17.3.6816.0313_2\FileCoAuth.exe	Code function: 9_2_00E95DAE FindFirstFileW,	9_2_00E95DAE
Source: C:\Users\user\AppData\Local\Microsoft\OneDrive\17.3.6816.0313_2\FileCoAuth.exe	Code function: 9_1_00E9A394 memset,FindFirstFileW,memset,PathRemoveFileSpecW,WerRegisterFile,FindNextFileW,FindClose,	9_1_00E9A394
Source: C:\Users\user\AppData\Local\Microsoft\OneDrive\17.3.6816.0313_2\FileCoAuth.exe	Code function: 9_1_00E95DAE FindFirstFileW,	9_1_00E95DAE

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Contains functionality for read data from the clipboard

Show sources

Source: C:\Users\user\AppData\Local\Microsoft\OneDrive\17.3.6816.0313_2\FileCoAuth.exe

Code function: 9_2_00E9765E OpenClipboard,

9_2_00E9765E

Spam, unwanted Advertisements and Ransom Demands:

Detected LockCrypt Ransomware

Show sources

Source: C:\Users\user\Desktop\module.8144.18ffc90c0.400000.exe

Code function: GetModuleFileNameA,lstrcmpiA,RegOpenKeyExA,lstrlenA,RegSetValueExA,lstrlenA,RegSetValueExA,RegCloseKey,CopyFileA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,CryptAcquireContextA,GetLastError,GetEnvironmentVariableA,ShellExecuteA,Sleep,CryptAcquireContextA,CryptGenKey,CryptExportKey,CryptExportKey,CryptDestroyKey,CryptReleaseContext,CryptAcquireContextA,CryptImportKey,CryptEncrypt,CryptEncrypt,CryptDestroyKey,KiUserExceptionDispatcher,CryptReleaseContext,RegSetValueExA,RegSetValueExA,RegCloseKey,RtlZeroMemory,RegOpenKeyExA,RegSetValueExA,RegSetValueExA,RegSetValueExA,RegCloseKey,CryptAcquireContextA,CryptImportKey,GetSystemTimeAsFileTime,FileTimeToSystemTime,GetDateFormatA,lstrlenA,MultiByteToWideChar,lstrcatA,RegCreateKeyA,lstrcatA,lstrcatA,lstrlenA,RegSetValueExA,RegCloseKey,SHChangeNotify,GetEnvironmentVariableA,ShellExecuteA,GlobalFree,SetErrorMode,Sleep,Sleep,ShellExecuteA,CreateFileA,WriteFile,CloseHandle,ShellExecuteA,

0_1_004017A2

Contains functionality to clear event logs

Show sources

Source: C:\Users\user\Desktop\module.8144.18ffc90c0.400000.exe	Code function: @echo offfor /F "tokens=*" %%G in ('wevtutil.exe el') DO (call:r "%%G")goto End:rwevtutil.exe cl %1goto :eof:Endrd /s /q %systemdrive%\$RECYCLE.BINdel %0		0_1_004017A2
Source: C:\Users\user\Desktop\module.8144.18ffc90c0.400000.exe	Code function: @echo offfor /F "tokens=*" %%G in ('wevtutil.exe el') DO (call:r "%%G")goto End:rwevtutil.exe cl %1goto :eof:Endrd /s /q %systemdrive%\$RECYCLE.BINdel %0		0_1_0040191C

Contains functionality to encrypt and move a file in one function

Show sources

Source: C:\Users\user\Desktop\module.8144.18ffc90c0.400000.exe	Code function: 0_2_0040128D MoveFileW,CreateFileW,MoveFileW,Sleep,CreateFileMappingA,CloseHandle,CryptAcquireContextA,CloseHandle,CryptGenKey,CryptReleaseContext,CryptExportKey,CryptDestroyKey,MapViewOfFile,CryptEncrypt,CryptEncrypt,UnmapViewOfFile,CloseHandle,CryptDestroyKey,CryptReleaseContext,SetFilePointerEx,WriteFile,WriteFile,CloseHandle,SetFileAttributesW,		0_2_0040128D
Source: C:\Users\user\Desktop\module.8144.18ffc90c0.400000.exe	Code function: 0_1_0040128D MoveFileW,CreateFileW,MoveFileW,Sleep,CreateFileMappingA,CloseHandle,CryptAcquireContextA,CloseHandle,CryptGenKey,CryptReleaseContext,CryptExportKey,CryptDestroyKey,MapViewOfFile,CryptEncrypt,CryptEncrypt,UnmapViewOfFile,CloseHandle,CryptDestroyKey,CryptReleaseContext,SetFilePointerEx,WriteFile,WriteFile,CloseHandle,SetFileAttributesW,		0_1_0040128D

Deletes shadow drive data (may be related to ransomware)

Show sources

Source: module.8144.18ffc90c0.400000.exe	Binary or memory string: /c vssadmin delete shadows /all
Source: module.8144.18ffc90c0.400000.exe, 00000000.00000000.593186365.0000000000403000.00000008.sdmp	Binary or memory string: del %0/c vssadmin delete shadows /all/c Regsvr32 /s Rsaenh.dllABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+-openSOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\SOFTWARE\Microsoft\Windows\CurrentVersion\DateTime\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\PromptOnSecureDesktopEnableLUAConsentPromptBehaviorAdminSeDebugPrivilegeSeBackupPrivilegeSeRestorePrivilegeunlock"c:\Decoding help.hta"searchfilesC:\windows\searchfiles.exeC:\Windows\System32\mshta.exe
Source: module.8144.18ffc90c0.400000.exe	Binary or memory string: /c vssadmin delete shadows /all
Source: module.8144.18ffc90c0.400000.exe	Binary or memory string: del %0/c vssadmin delete shadows /all/c Regsvr32 /s Rsaenh.dllABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+-openSOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\SOFTWARE\Microsoft\Windows\CurrentVersion\DateTime\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\PromptOnSecureDesktopEnableLUAConsentPromptBehaviorAdminSeDebugPrivilegeSeBackupPrivilegeSeRestorePrivilegeunlock"c:\Decoding help.hta"searchfilesC:\windows\searchfiles.exeC:\Windows\System32\mshta.exe

Detected suspicious e-Mail address in disassembly

Show sources

Source: C:\Users\user\Desktop\module.8144.18ffc90c0.400000.exe	Code function: 04,05,2019);</script></head><body style='text-align:center;background:#000'></br></br></br><h2 style='font-size:40px;color:#b00'>You are unlucky! The terrible virus has captured your files! For decoding please contact by email JonStokton@Protonmail.com or JonS		0_1_004017A2
Source: C:\Users\user\Desktop\module.8144.18ffc90c0.400000.exe	Code function: 04,05,2019);</script></head><body style='text-align:center;background:#000'></br></br></br><h2 style='font-size:40px;color:#b00'>You are unlucky! The terrible virus has captured your files! For decoding please contact by email JonStokton@Protonmail.com or JonS		0_1_0040191C

Contains functionality to import cryptographic keys (often used in ransomware)

Show sources

Source: C:\Users\user\Desktop\module.8144.18ffc90c0.400000.exe	Code function: 0_2_00401063 CryptImportKey,CryptDecrypt,CryptDestroyKey,CryptReleaseContext,	0_2_00401063
Source: C:\Users\user\Desktop\module.8144.18ffc90c0.400000.exe	Code function: 0_2_004017A2 GetModuleFileNameA,lstrcmpiA,RegOpenKeyExA,lstrlenA,RegSetValueExA,lstrlenA,RegSetValueExA,RegCloseKey,CopyFileA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,CryptAcquireContextA,GetLastError,GetEnvironmentVariableA,ShellExecuteA,Sleep,CryptAcquireContextA,CryptGenKey,CryptExportKey,CryptExportKey,CryptDestroyKey,CryptReleaseContext,CryptAcquireContextA,CryptImportKey,CryptEncrypt,CryptEncrypt,CryptDestroyKey,KiUserExceptionDispatcher,CryptReleaseContext,RegSetValueExA,RegSetValueExA,RegCloseKey,RtlZeroMemory,RegOpenKeyExA,RegSetValueExA,RegSetValueExA,RegSetValueExA,RegCloseKey,CryptAcquireContextA,CryptImportKey,GetSystemTimeAsFileTime,FileTimeToSystemTime,GetDateFormatA,lstrlenA,MultiByteToWideChar,lstrcatA,RegCreateKeyA,lstrcatA,lstrcatA,lstrlenA,RegSetValueExA,RegCloseKey,SHChangeNotify,GetEnvironmentVariableA,ShellExecuteA,GlobalFree,SetErrorMode,Sleep,Sleep,ShellExecuteA,CreateFileA,WriteFile,CloseHandle,ShellExecuteA,	0_2_004017A2
Source: C:\Users\user\Desktop\module.8144.18ffc90c0.400000.exe	Code function: 0_2_0040191C CryptGenKey,CryptExportKey,CryptExportKey,CryptDestroyKey,CryptReleaseContext,CryptAcquireContextA,CryptImportKey,CryptEncrypt,CryptEncrypt,CryptDestroyKey,KiUserExceptionDispatcher,CryptReleaseContext,RegSetValueExA,RegSetValueExA,RegCloseKey,RtlZeroMemory,RegOpenKeyExA,RegSetValueExA,RegSetValueExA,RegSetValueExA,RegCloseKey,CryptAcquireContextA,CryptImportKey,GetSystemTimeAsFileTime,FileTimeToSystemTime,GetDateFormatA,lstrlenA,MultiByteToWideChar,lstrcatA,RegCreateKeyA,lstrcatA,lstrcatA,lstrlenA,RegSetValueExA,RegCloseKey,SHChangeNotify,GetEnvironmentVariableA,ShellExecuteA,GlobalFree,SetErrorMode,Sleep,Sleep,ShellExecuteA,CreateFileA,WriteFile,CloseHandle,ShellExecuteA,	0_2_0040191C
Source: C:\Users\user\Desktop\module.8144.18ffc90c0.400000.exe	Code function: 0_1_00401063 CryptImportKey,CryptDecrypt,CryptDestroyKey,CryptReleaseContext,	0_1_00401063
Source: C:\Users\user\Desktop\module.8144.18ffc90c0.400000.exe	Code function: 0_1_004017A2 GetModuleFileNameA,lstrcmpiA,RegOpenKeyExA,lstrlenA,RegSetValueExA,lstrlenA,RegSetValueExA,RegCloseKey,CopyFileA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,CryptAcquireContextA,GetLastError,GetEnvironmentVariableA,ShellExecuteA,Sleep,CryptAcquireContextA,CryptGenKey,CryptExportKey,CryptExportKey,CryptDestroyKey,CryptReleaseContext,CryptAcquireContextA,CryptImportKey,CryptEncrypt,CryptEncrypt,CryptDestroyKey,KiUserExceptionDispatcher,CryptReleaseContext,RegSetValueExA,RegSetValueExA,RegCloseKey,RtlZeroMemory,RegOpenKeyExA,RegSetValueExA,RegSetValueExA,RegSetValueExA,RegCloseKey,CryptAcquireContextA,CryptImportKey,GetSystemTimeAsFileTime,FileTimeToSystemTime,GetDateFormatA,lstrlenA,MultiByteToWideChar,lstrcatA,RegCreateKeyA,lstrcatA,lstrcatA,lstrlenA,RegSetValueExA,RegCloseKey,SHChangeNotify,GetEnvironmentVariableA,ShellExecuteA,GlobalFree,SetErrorMode,Sleep,Sleep,ShellExecuteA,CreateFileA,WriteFile,CloseHandle,ShellExecuteA,	0_1_004017A2
Source: C:\Users\user\Desktop\module.8144.18ffc90c0.400000.exe	Code function: 0_1_0040191C CryptGenKey,CryptExportKey,CryptExportKey,CryptDestroyKey,CryptReleaseContext,CryptAcquireContextA,CryptImportKey,CryptEncrypt,CryptEncrypt,CryptDestroyKey,KiUserExceptionDispatcher,CryptReleaseContext,RegSetValueExA,RegSetValueExA,RegCloseKey,RtlZeroMemory,RegOpenKeyExA,RegSetValueExA,RegSetValueExA,RegSetValueExA,RegCloseKey,CryptAcquireContextA,CryptImportKey,GetSystemTimeAsFileTime,FileTimeToSystemTime,GetDateFormatA,lstrlenA,MultiByteToWideChar,lstrcatA,RegCreateKeyA,lstrcatA,lstrcatA,lstrlenA,RegSetValueExA,RegCloseKey,SHChangeNotify,GetEnvironmentVariableA,ShellExecuteA,GlobalFree,SetErrorMode,Sleep,Sleep,ShellExecuteA,CreateFileA,WriteFile,CloseHandle,ShellExecuteA,	0_1_0040191C

System Summary:

Found potential string decryption / allocating functions

Show sources

Source: C:\Users\user\AppData\Local\Microsoft\OneDrive\17.3.6816.0313_2\FileCoAuth.exe	Code function: String function: 00E94307 appears 246 times
Source: C:\Users\user\AppData\Local\Microsoft\OneDrive\17.3.6816.0313_2\FileCoAuth.exe	Code function: String function: 00EA29EC appears 34 times
Source: C:\Users\user\AppData\Local\Microsoft\OneDrive\17.3.6816.0313_2\FileCoAuth.exe	Code function: String function: 00E94E9D appears 328 times
Source: C:\Users\user\AppData\Local\Microsoft\OneDrive\17.3.6816.0313_2\FileCoAuth.exe	Code function: String function: 00EA31CA appears 74 times
Source: C:\Users\user\AppData\Local\Microsoft\OneDrive\17.3.6816.0313_2\FileCoAuth.exe	Code function: String function: 00EA3194 appears 116 times
Source: C:\Users\user\AppData\Local\Microsoft\OneDrive\17.3.6816.0313_2\FileCoAuth.exe	Code function: String function: 00E91E20 appears 34 times
Source: C:\Users\user\AppData\Local\Microsoft\OneDrive\17.3.6816.0313_2\FileCoAuth.exe	Code function: String function: 00E9851B appears 122 times
Source: C:\Users\user\AppData\Local\Microsoft\OneDrive\17.3.6816.0313_2\FileCoAuth.exe	Code function: String function: 00EA2BBA appears 262 times
Source: C:\Users\user\AppData\Local\Microsoft\OneDrive\17.3.6816.0313_2\FileCoAuth.exe	Code function: String function: 00EA3161 appears 176 times

Sample file is different than original file name gathered from version info

Show sources

Source: module.8144.18ffc90c0.400000.exe, 00000000.00000002.2314748360.00000000004A0000.00000002.sdmp	Binary or memory string: OriginalFilenamempr.dll.muij% vs module.8144.18ffc90c0.400000.exe
Source: module.8144.18ffc90c0.400000.exe, 00000000.00000002.2316354878.0000000002600000.00000002.sdmp	Binary or memory string: OriginalFilenameKernelbase.dll.muij% vs module.8144.18ffc90c0.400000.exe

Tries to load missing DLLs

Show sources

Source: C:\Users\user\Desktop\module.8144.18ffc90c0.400000.exe	Section loaded: wow64log.dll			Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\OneDrive\17.3.6816.0313_2\FileCoAuth.exe	Section loaded: wow64log.dll			Jump to behavior

Classification label

Show sources

Source: classification engine

Classification label: mal80.rans.evad.winEXE@2/1@0/0

Contains functionality to adjust token privileges (e.g. debug / backup)

Show sources

Source: C:\Users\user\Desktop\module.8144.18ffc90c0.400000.exe	Code function: 0_2_00401DE7 OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,CloseHandle,FindCloseChangeNotification,		0_2_00401DE7
Source: C:\Users\user\Desktop\module.8144.18ffc90c0.400000.exe	Code function: 0_1_00401DE7 OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,CloseHandle,FindCloseChangeNotification,		0_1_00401DE7

Contains functionality to check free disk space

Show sources

Source: C:\Users\user\AppData\Local\Microsoft\OneDrive\17.3.6816.0313_2\FileCoAuth.exe

Code function: 9_2_00E97025 GetDiskFreeSpaceExW,

9_2_00E97025

Contains functionality to enum processes or threads

Show sources

Source: C:\Users\user\Desktop\module.8144.18ffc90c0.400000.exe

Code function: 0_2_00401D2D CreateToolhelp32Snapshot,Process32FirstW,lstrcmpiW,lstrlenW,GetCurrentProcessId,OpenProcess,TerminateProcess,CloseHandle,Process32NextW,CloseHandle,Sleep,

0_2_00401D2D

Contains functionality to instantiate COM classes

Show sources

Source: C:\Users\user\AppData\Local\Microsoft\OneDrive\17.3.6816.0313_2\FileCoAuth.exe

Code function: 9_2_00E921A2 CoCreateInstance,

9_2_00E921A2

Creates files inside the user directory

Show sources

Source: C:\Users\user\AppData\Local\Microsoft\OneDrive\17.3.6816.0313_2\FileCoAuth.exe

File created: C:\Users\user\AppData\Local\Microsoft\OneDrive\logs\Common\FileCoAuth-2019-5-29.2357.2916.1.aodl

Jump to behavior

Might use command line arguments

Show sources

Source: C:\Users\user\AppData\Local\Microsoft\OneDrive\17.3.6816.0313_2\FileCoAuth.exe	Command line argument: FileCoAuth	9_2_00E92E4B
Source: C:\Users\user\AppData\Local\Microsoft\OneDrive\17.3.6816.0313_2\FileCoAuth.exe	Command line argument: FileCoAuth	9_2_00E92E4B
Source: C:\Users\user\AppData\Local\Microsoft\OneDrive\17.3.6816.0313_2\FileCoAuth.exe	Command line argument: FileCoAuth	9_2_00E92E4B
Source: C:\Users\user\AppData\Local\Microsoft\OneDrive\17.3.6816.0313_2\FileCoAuth.exe	Command line argument: FileCoAuth	9_1_00E92E4B
Source: C:\Users\user\AppData\Local\Microsoft\OneDrive\17.3.6816.0313_2\FileCoAuth.exe	Command line argument: FileCoAuth	9_1_00E92E4B
Source: C:\Users\user\AppData\Local\Microsoft\OneDrive\17.3.6816.0313_2\FileCoAuth.exe	Command line argument: FileCoAuth	9_1_00E92E4B

PE file has an executable .text section and no other executable section

Show sources

Source: module.8144.18ffc90c0.400000.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Reads software policies

Show sources

Source: C:\Users\user\Desktop\module.8144.18ffc90c0.400000.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Sample might require command line arguments (.Net)

Show sources

Source: FileCoAuth.exe

String found in binary or memory: /installperfcounters

Spawns processes

Show sources

Source: unknown	Process created: C:\Users\user\Desktop\module.8144.18ffc90c0.400000.exe 'C:\Users\user\Desktop\module.8144.18ffc90c0.400000.exe'
Source: unknown	Process created: C:\Users\user\AppData\Local\Microsoft\OneDrive\17.3.6816.0313_2\FileCoAuth.exe C:\Users\user\AppData\Local\Microsoft\OneDrive\17.3.6816.0313_2\FileCoAuth.exe -Embedding

Uses an in-process (OLE) Automation server

Show sources

Source: C:\Users\user\Desktop\module.8144.18ffc90c0.400000.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\InProcServer32

Jump to behavior

Binary contains paths to debug symbols

Show sources

Source:	Binary string: FileCoAuth.pdb source: FileCoAuth.exe, 00000009.00000000.2084517723.0000000000EA6000.00000002.sdmp
Source:	Binary string: FileCoAuth.pdbDD source: FileCoAuth.exe, 00000009.00000000.2084517723.0000000000EA6000.00000002.sdmp

Data Obfuscation:

PE file contains an invalid checksum

Show sources

Source: module.8144.18ffc90c0.400000.exe

Static PE information: real checksum: 0x3f67 should be: 0xa6a9

Uses code obfuscation techniques (call, push, ret)

Show sources

Source: C:\Users\user\AppData\Local\Microsoft\OneDrive\17.3.6816.0313_2\FileCoAuth.exe	Code function: 9_2_00EA313E push ecx; ret	9_2_00EA3151
Source: C:\Users\user\AppData\Local\Microsoft\OneDrive\17.3.6816.0313_2\FileCoAuth.exe	Code function: 9_2_00EA3265 push ecx; ret	9_2_00EA3278
Source: C:\Users\user\AppData\Local\Microsoft\OneDrive\17.3.6816.0313_2\FileCoAuth.exe	Code function: 9_1_00EA313E push ecx; ret	9_1_00EA3151
Source: C:\Users\user\AppData\Local\Microsoft\OneDrive\17.3.6816.0313_2\FileCoAuth.exe	Code function: 9_1_00EA3265 push ecx; ret	9_1_00EA3278

Malware Analysis System Evasion:

Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)

Show sources

Source: C:\Users\user\Desktop\module.8144.18ffc90c0.400000.exe

Code function: 0_2_00401D2D CreateToolhelp32Snapshot,Process32FirstW,lstrcmpiW,lstrlenW,GetCurrentProcessId,OpenProcess,TerminateProcess,CloseHandle,Process32NextW,CloseHandle,Sleep,

0_2_00401D2D

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Show sources

Source: C:\Users\user\Desktop\module.8144.18ffc90c0.400000.exe

Window / User API: threadDelayed 4593

Jump to behavior

Found large amount of non-executed APIs

Show sources

Source: C:\Users\user\AppData\Local\Microsoft\OneDrive\17.3.6816.0313_2\FileCoAuth.exe

API coverage: 5.0 %

May sleep (evasive loops) to hinder dynamic analysis

Show sources

Source: C:\Users\user\Desktop\module.8144.18ffc90c0.400000.exe TID: 4312	Thread sleep count: 4593 > 30	Jump to behavior
Source: C:\Users\user\Desktop\module.8144.18ffc90c0.400000.exe TID: 4312	Thread sleep time: -137790000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\module.8144.18ffc90c0.400000.exe TID: 4312	Thread sleep time: -30000s >= -30000s	Jump to behavior

Sample execution stops while process was sleeping (likely an evasion)

Show sources

Source: C:\Users\user\Desktop\module.8144.18ffc90c0.400000.exe	Last function: Thread delayed
Source: C:\Users\user\Desktop\module.8144.18ffc90c0.400000.exe	Last function: Thread delayed

Contains functionality to enumerate / list files inside a directory

Show sources

Source: C:\Users\user\Desktop\module.8144.18ffc90c0.400000.exe	Code function: 0_2_004014CC FindFirstFileW,lstrcmpW,lstrcmpW,lstrcmpiW,lstrcatW,lstrlenW,lstrcatW,lstrcatW,GlobalMemoryStatus,Sleep,CreateThread,CloseHandle,lstrcmpiW,lstrlenW,lstrcmpiW,lstrcatW,lstrlenW,lstrcatW,lstrcatW,lstrcatW,SetFileAttributesW,FindNextFileW,FindClose,GlobalFree,	0_2_004014CC
Source: C:\Users\user\Desktop\module.8144.18ffc90c0.400000.exe	Code function: 0_1_004014CC FindFirstFileW,lstrcmpW,lstrcmpW,lstrcmpiW,lstrcatW,lstrlenW,lstrcatW,lstrcatW,GlobalMemoryStatus,Sleep,CreateThread,CloseHandle,lstrcmpiW,lstrlenW,lstrcmpiW,lstrcatW,lstrlenW,lstrcatW,lstrcatW,lstrcatW,SetFileAttributesW,FindNextFileW,FindClose,GlobalFree,	0_1_004014CC
Source: C:\Users\user\AppData\Local\Microsoft\OneDrive\17.3.6816.0313_2\FileCoAuth.exe	Code function: 9_2_00E9A394 memset,FindFirstFileW,memset,PathRemoveFileSpecW,WerRegisterFile,FindNextFileW,FindClose,	9_2_00E9A394
Source: C:\Users\user\AppData\Local\Microsoft\OneDrive\17.3.6816.0313_2\FileCoAuth.exe	Code function: 9_2_00E95DAE FindFirstFileW,	9_2_00E95DAE
Source: C:\Users\user\AppData\Local\Microsoft\OneDrive\17.3.6816.0313_2\FileCoAuth.exe	Code function: 9_1_00E9A394 memset,FindFirstFileW,memset,PathRemoveFileSpecW,WerRegisterFile,FindNextFileW,FindClose,	9_1_00E9A394
Source: C:\Users\user\AppData\Local\Microsoft\OneDrive\17.3.6816.0313_2\FileCoAuth.exe	Code function: 9_1_00E95DAE FindFirstFileW,	9_1_00E95DAE

May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)

Show sources

Source: module.8144.18ffc90c0.400000.exe, 00000000.00000002.2316354878.0000000002600000.00000002.sdmp	Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: module.8144.18ffc90c0.400000.exe, 00000000.00000002.2316354878.0000000002600000.00000002.sdmp	Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: module.8144.18ffc90c0.400000.exe, 00000000.00000002.2316354878.0000000002600000.00000002.sdmp	Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: module.8144.18ffc90c0.400000.exe, 00000000.00000002.2316354878.0000000002600000.00000002.sdmp	Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.

Anti Debugging:

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Show sources

Source: C:\Users\user\AppData\Local\Microsoft\OneDrive\17.3.6816.0313_2\FileCoAuth.exe

Code function: 9_2_00E9A7CF IsDebuggerPresent,OutputDebugStringW,

9_2_00E9A7CF

Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)

Show sources

Source: C:\Users\user\Desktop\module.8144.18ffc90c0.400000.exe

Code function: 0_2_00401D2D CreateToolhelp32Snapshot,Process32FirstW,lstrcmpiW,lstrlenW,GetCurrentProcessId,OpenProcess,TerminateProcess,CloseHandle,Process32NextW,CloseHandle,Sleep,

0_2_00401D2D

Contains functionality to register its own exception handler

Show sources

Source: C:\Users\user\AppData\Local\Microsoft\OneDrive\17.3.6816.0313_2\FileCoAuth.exe	Code function: 9_2_00EA32C6 ?terminate@@YAXXZ,__crtSetUnhandledExceptionFilter,		9_2_00EA32C6
Source: C:\Users\user\AppData\Local\Microsoft\OneDrive\17.3.6816.0313_2\FileCoAuth.exe	Code function: 9_1_00EA32C6 ?terminate@@YAXXZ,__crtSetUnhandledExceptionFilter,		9_1_00EA32C6

HIPS / PFW / Operating System Protection Evasion:

May try to detect the Windows Explorer process (often used for injection)

Show sources

Source: module.8144.18ffc90c0.400000.exe, 00000000.00000002.2315187273.0000000000EB0000.00000002.sdmp, FileCoAuth.exe, 00000009.00000002.2317512776.0000000001CA0000.00000002.sdmp	Binary or memory string: Program Manager
Source: module.8144.18ffc90c0.400000.exe, 00000000.00000002.2315187273.0000000000EB0000.00000002.sdmp, FileCoAuth.exe, 00000009.00000002.2317512776.0000000001CA0000.00000002.sdmp	Binary or memory string: Shell_TrayWnd
Source: module.8144.18ffc90c0.400000.exe, 00000000.00000002.2315187273.0000000000EB0000.00000002.sdmp, FileCoAuth.exe, 00000009.00000002.2317512776.0000000001CA0000.00000002.sdmp	Binary or memory string: Progman
Source: module.8144.18ffc90c0.400000.exe, 00000000.00000002.2315187273.0000000000EB0000.00000002.sdmp, FileCoAuth.exe, 00000009.00000002.2317512776.0000000001CA0000.00000002.sdmp	Binary or memory string: Progmanlock

Language, Device and Operating System Detection:

Contains functionality locales information (e.g. system language)

Show sources

Source: C:\Users\user\AppData\Local\Microsoft\OneDrive\17.3.6816.0313_2\FileCoAuth.exe	Code function: GetLocaleInfoW,		9_2_00E97325
Source: C:\Users\user\AppData\Local\Microsoft\OneDrive\17.3.6816.0313_2\FileCoAuth.exe	Code function: GetLocaleInfoW,		9_1_00E97325

Contains functionality to query local / system time

Show sources

Source: C:\Users\user\Desktop\module.8144.18ffc90c0.400000.exe

Code function: 0_2_004017A2 GetModuleFileNameA,lstrcmpiA,RegOpenKeyExA,lstrlenA,RegSetValueExA,lstrlenA,RegSetValueExA,RegCloseKey,CopyFileA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,CryptAcquireContextA,GetLastError,GetEnvironmentVariableA,ShellExecuteA,Sleep,CryptAcquireContextA,CryptGenKey,CryptExportKey,CryptExportKey,CryptDestroyKey,CryptReleaseContext,CryptAcquireContextA,CryptImportKey,CryptEncrypt,CryptEncrypt,CryptDestroyKey,KiUserExceptionDispatcher,CryptReleaseContext,RegSetValueExA,RegSetValueExA,RegCloseKey,RtlZeroMemory,RegOpenKeyExA,RegSetValueExA,RegSetValueExA,RegSetValueExA,RegCloseKey,CryptAcquireContextA,CryptImportKey,GetSystemTimeAsFileTime,FileTimeToSystemTime,GetDateFormatA,lstrlenA,MultiByteToWideChar,lstrcatA,RegCreateKeyA,lstrcatA,lstrcatA,lstrlenA,RegSetValueExA,RegCloseKey,SHChangeNotify,GetEnvironmentVariableA,ShellExecuteA,GlobalFree,SetErrorMode,Sleep,Sleep,ShellExecuteA,CreateFileA,WriteFile,CloseHandle,ShellExecuteA,

0_2_004017A2

Contains functionality to query the account / user name

Show sources

Source: C:\Users\user\AppData\Local\Microsoft\OneDrive\17.3.6816.0313_2\FileCoAuth.exe

Code function: 9_2_00E969DE memset,GetUserNameW,

9_2_00E969DE

Contains functionality to query windows version

Show sources

Source: C:\Users\user\AppData\Local\Microsoft\OneDrive\17.3.6816.0313_2\FileCoAuth.exe

Code function: 9_2_00EA1383 GetVersionExW,

9_2_00EA1383

Queries the cryptographic machine GUID

Show sources

Source: C:\Users\user\Desktop\module.8144.18ffc90c0.400000.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings:

Contains functionality to modify Windows User Account Control (UAC) settings

Show sources

Source: C:\Users\user\Desktop\module.8144.18ffc90c0.400000.exe	Code function: RegSetValue: SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktopEnableLUAConsentPromptBehaviorAdmin		0_1_004017A2
Source: C:\Users\user\Desktop\module.8144.18ffc90c0.400000.exe	Code function: RegSetValue: SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktopEnableLUAConsentPromptBehaviorAdmin		0_1_0040191C

Remote Access Functionality:

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Show sources

Source: C:\Users\user\AppData\Local\Microsoft\OneDrive\17.3.6816.0313_2\FileCoAuth.exe	Code function: 9_2_00E9ECC0 __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z,__EH_prolog3,CreateBindCtx,		9_2_00E9ECC0
Source: C:\Users\user\AppData\Local\Microsoft\OneDrive\17.3.6816.0313_2\FileCoAuth.exe	Code function: 9_1_00E9ECC0 __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z,__EH_prolog3,CreateBindCtx,		9_1_00E9ECC0

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Simulations

Behavior and APIs

Time	Type	Description
16:50:40	API Interceptor	4607x Sleep call for process: module.8144.18ffc90c0.400000.exe modified

Antivirus and Machine Learning Detection

Initial Sample

Source	Detection	Scanner	Label	Link
module.8144.18ffc90c0.400000.exe	100%	Joe Sandbox ML

Dropped Files

No Antivirus matches

Unpacked PE Files

Source	Detection	Scanner	Download
0.0.module.8144.18ffc90c0.400000.exe.400000.0.unpack	100%	Joe Sandbox ML	Download File
0.1.module.8144.18ffc90c0.400000.exe.400000.0.unpack	100%	Joe Sandbox ML	Download File
0.2.module.8144.18ffc90c0.400000.exe.400000.0.unpack	100%	Joe Sandbox ML	Download File

Domains

No Antivirus matches

URLs

No Antivirus matches

Yara Overview

Initial Sample

No yara matches

PCAP (Network Traffic)

No yara matches

Dropped Files

No yara matches

Memory Dumps

No yara matches

Unpacked PEs

No yara matches

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report module.8144.18ffc90c0.400000.dll

Overview

General Information

Detection

Confidence

Classification

Analysis Advice

Mitre Att&ck Matrix

Signature Overview

AV Detection:

Cryptography:

Spreading:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Spam, unwanted Advertisements and Ransom Demands:

System Summary:

Data Obfuscation:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Lowering of HIPS / PFW / Operating System Security Settings:

Remote Access Functionality:

Behavior Graph

Simulations

Behavior and APIs

Antivirus and Machine Learning Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Yara Overview

Initial Sample

PCAP (Network Traffic)

Dropped Files

Memory Dumps

Unpacked PEs

Screenshots

Thumbnails