5uwl_cqfirm2code090407.rar

Checks if process is being debugged by a debugger (1 event)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent April 13, 2021, 9:03 a.m.			0	0

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx April 13, 2021, 9:03 a.m.		1	1	0

Allocates read-write-execute memory (usually to unpack itself) (1 event)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory April 13, 2021, 9:03 a.m.	process_identifier: 5540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73772000 process_handle: 0xffffffff	1	0	0

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 event)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW April 13, 2021, 9:03 a.m.	system_name: privilege_name: SeRestorePrivilege	1	1	0

Yara rule detected in process memory (13 events)

description	Escalade priviledges				rule	escalate_priv
description	Run a keylogger				rule	keylogger
description	Affect system registries				rule	win_registry
description	Affect system token				rule	win_token
description	Affect private profile				rule	win_files_operation
description	(no description)				rule	DebuggerCheck__GlobalFlags
description	(no description)				rule	DebuggerCheck__QueryInfo
description	(no description)				rule	DebuggerHiding__Thread
description	(no description)				rule	DebuggerHiding__Active
description	(no description)				rule	ThreadControl__Context
description	(no description)				rule	SEH__vectored
description	Checks if being debugged				rule	anti_dbg
description	Bypass DEP				rule	disable_dep

Communicates with host for which no DNS query was performed (1 event)

host	172.217.25.14

File has been identified by 14 AntiVirus engines on VirusTotal as malicious (14 events)

NANO-Antivirus	Trojan.Reg.StartPage.dcnage
Cyren	W32/GenBl.F0857D74!Olympus
TrendMicro-HouseCall	Suspici.CF2FA188
Kaspersky	Trojan.WinREG.StartPage.dj
AegisLab	Troj.Winreg.Startpage!c
Ikarus	Trojan.WinREG.StartPage
Jiangmin	Trojan/Reg.j
ZoneAlarm	Trojan.WinREG.StartPage.dj
GData	Script.Application.StartPage.V (2x)
VBA32	Trojan.WinREG.StartPage.dj
Tencent	Unk.Win32.Script.400195
MAX	malware (ai score=87)
Fortinet	Riskware/StartPage.DJ
Qihoo-360	Win32/Trojan.f4a