Technical Information
Modifies file system
Creates the following files
- %TEMP%\onefile_4008_134064354147487865\loader.dll
- %TEMP%\onefile_4008_134064354147487865\_bz2.pyd
- %TEMP%\onefile_4008_134064354147487865\_ctypes.pyd
- %TEMP%\onefile_4008_134064354147487865\_decimal.pyd
- %TEMP%\onefile_4008_134064354147487865\_hashlib.pyd
- %TEMP%\onefile_4008_134064354147487865\_lzma.pyd
- %TEMP%\onefile_4008_134064354147487865\_socket.pyd
- %TEMP%\onefile_4008_134064354147487865\_ssl.pyd
- %TEMP%\onefile_4008_134064354147487865\_wmi.pyd
- %TEMP%\onefile_4008_134064354147487865\libcrypto-3.dll
- %TEMP%\onefile_4008_134064354147487865\libffi-8.dll
- %TEMP%\onefile_4008_134064354147487865\libssl-3.dll
- %TEMP%\onefile_4008_134064354147487865\python313.dll
- %TEMP%\onefile_4008_134064354147487865\select.pyd
- %TEMP%\onefile_4008_134064354147487865\unicodedata.pyd
- %TEMP%\onefile_4008_134064354147487865\vcruntime140.dll
- %TEMP%\onefile_4008_134064354147487865\vcruntime140_1.dll
Modifies the HOSTS file.
Network activity
TCP
Other
- '15#.#01.129.91':443
Miscellaneous
Restarts the analyzed sample
Executes the following
- '<SYSTEM32>\cmd.exe' /c "certutil -addstore -f Root server.crt"
- '<SYSTEM32>\certutil.exe' -addstore -f Root server.crt
- '<SYSTEM32>\cmd.exe' /c cls
- '<SYSTEM32>\cmd.exe' /c "certutil -addstore -f Root server.crt"' (with hidden window)
