bat_update.exe

Queries for the computername (2 events)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameA July 12, 2021, 9:40 a.m.	computer_name: TEST22-PC	1	1	0
GetComputerNameW July 12, 2021, 9:40 a.m.	computer_name: TEST22-PC	1	1	0

Command line console output was observed (3 events)

Time & API	Arguments	Status	Return	Repeated
WriteConsoleW July 12, 2021, 9:40 a.m.	buffer: SUCCESS: The process "bat_update.exe" with PID 1016 has been terminated. console_handle: 0x00000007	1	1	0
WriteConsoleW July 12, 2021, 9:40 a.m.	buffer: Waiting for 6 console_handle: 0x00000007	1	1	0
WriteConsoleW July 12, 2021, 9:40 a.m.	buffer: seconds, press a key to continue ... console_handle: 0x00000007	1	1	0

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

Tries to locate where the browsers are installed (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx July 12, 2021, 9:40 a.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (5 events)

section
section	eda deer
section	.themida
section	.loadcon
section	.boot

One or more processes crashed (3 events)

Time & API	Arguments	Status	Return	Repeated
__exception__ July 12, 2021, 9:40 a.m.	stacktrace: bat_update+0x3d9629 @ 0x7d9629 bat_update+0x3d96c6 @ 0x7d96c6 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008e exception.offset: 46887 exception.address: 0x76a7b727 registers.esp: 1638148 registers.edi: 6492160 registers.eax: 1638148 registers.ebp: 1638228 registers.edx: 2130566132 registers.ebx: 1572907 registers.esi: 2000778283 registers.ecx: 4093181952	1	0	0
__exception__ July 12, 2021, 9:40 a.m.	stacktrace: exception.instruction_r: ed 64 8f 05 00 00 00 00 83 c4 04 e9 be ee ed ff exception.symbol: bat_update+0x409402 exception.instruction: in eax, dx exception.module: bat_update.exe exception.exception_code: 0xc0000096 exception.offset: 4232194 exception.address: 0x809402 registers.esp: 1638268 registers.edi: 16986628 registers.eax: 1750617430 registers.ebp: 6492160 registers.edx: 22614 registers.ebx: 4194304 registers.esi: 7279554 registers.ecx: 20	1	0	0
__exception__ July 12, 2021, 9:40 a.m.	stacktrace: exception.instruction_r: ed 64 8f 05 00 00 00 00 83 c4 04 81 fb 68 58 4d exception.symbol: bat_update+0x409476 exception.instruction: in eax, dx exception.module: bat_update.exe exception.exception_code: 0xc0000096 exception.offset: 4232310 exception.address: 0x809476 registers.esp: 1638268 registers.edi: 16986628 registers.eax: 1447909480 registers.ebp: 6492160 registers.edx: 22104 registers.ebx: 2256917605 registers.esi: 7279554 registers.ecx: 10	1	0	0

HTTP traffic contains suspicious features which may be indicative of malware related traffic (9 events)

suspicious_features	POST method with no referer header, POST method with no useragent header, Connection to IP address				suspicious_request	POST http://162.55.223.232/947
suspicious_features	GET method with no useragent header, Connection to IP address				suspicious_request	GET http://162.55.223.232/freebl3.dll
suspicious_features	GET method with no useragent header, Connection to IP address				suspicious_request	GET http://162.55.223.232/mozglue.dll
suspicious_features	GET method with no useragent header, Connection to IP address				suspicious_request	GET http://162.55.223.232/msvcp140.dll
suspicious_features	GET method with no useragent header, Connection to IP address				suspicious_request	GET http://162.55.223.232/nss3.dll
suspicious_features	GET method with no useragent header, Connection to IP address				suspicious_request	GET http://162.55.223.232/softokn3.dll
suspicious_features	GET method with no useragent header, Connection to IP address				suspicious_request	GET http://162.55.223.232/vcruntime140.dll
suspicious_features	POST method with no referer header, POST method with no useragent header, Connection to IP address				suspicious_request	POST http://162.55.223.232/
suspicious_features	GET method with no useragent header				suspicious_request	GET https://sergeevih43.tumblr.com/

Performs some HTTP requests (9 events)

request	POST http://162.55.223.232/947
request	GET http://162.55.223.232/freebl3.dll
request	GET http://162.55.223.232/mozglue.dll
request	GET http://162.55.223.232/msvcp140.dll
request	GET http://162.55.223.232/nss3.dll
request	GET http://162.55.223.232/softokn3.dll
request	GET http://162.55.223.232/vcruntime140.dll
request	POST http://162.55.223.232/
request	GET https://sergeevih43.tumblr.com/

Sends data using the HTTP POST Method (2 events)

request	POST http://162.55.223.232/947
request	POST http://162.55.223.232/

Allocates read-write-execute memory (usually to unpack itself) (6 events)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory July 12, 2021, 9:40 a.m.	process_identifier: 1016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7743f000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory July 12, 2021, 9:40 a.m.	process_identifier: 1016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x773b0000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory July 12, 2021, 9:40 a.m.	process_identifier: 1016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00499000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory July 12, 2021, 9:40 a.m.	process_identifier: 1016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00483000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory July 12, 2021, 9:40 a.m.	process_identifier: 1016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00483000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory July 12, 2021, 9:40 a.m.	process_identifier: 1016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x726b2000 process_handle: 0xffffffff	1	0	0

Steals private information from local Internet browsers (3 events)

file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local State
file	C:\Users\test22\AppData\Local\Chromium\User Data\Local State
file	C:\Users\test22\AppData\Local\Nichrome\User Data\Local State

Creates executable files on the filesystem (6 events)

file	C:\ProgramData\freebl3.dll
file	C:\ProgramData\msvcp140.dll
file	C:\ProgramData\nss3.dll
file	C:\ProgramData\vcruntime140.dll
file	C:\ProgramData\mozglue.dll
file	C:\ProgramData\softokn3.dll

Creates a suspicious process (2 events)

cmdline	"C:\Windows\System32\cmd.exe" /c taskkill /im bat_update.exe /f & timeout /t 6 & del /f /q "C:\Users\test22\AppData\Local\Temp\bat_update.exe" & del C:\ProgramData\*.dll & exit
cmdline	C:\Windows\System32\cmd.exe /c taskkill /im bat_update.exe /f & timeout /t 6 & del /f /q "C:\Users\test22\AppData\Local\Temp\bat_update.exe" & del C:\ProgramData\*.dll & exit

Drops an executable to the user AppData folder (1 event)

file	C:\Users\test22\AppData\Local\Temp\bat_update.exe

Executes one or more WMI queries (1 event)

wmi	SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "bat_update.exe")

A process created a hidden window (1 event)

Time & API	Arguments	Status	Return	Repeated
ShellExecuteExW July 12, 2021, 9:40 a.m.	show_type: 0 filepath_r: C:\Windows\System32\cmd.exe parameters: /c taskkill /im bat_update.exe /f & timeout /t 6 & del /f /q "C:\Users\test22\AppData\Local\Temp\bat_update.exe" & del C:\ProgramData\*.dll & exit filepath: C:\Windows\System32\cmd.exe	1	1	0

Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (3 events)

Time & API	Arguments	Status	Return	Repeated
Process32NextW July 12, 2021, 9:40 a.m.	snapshot_handle: 0x000002d8 process_name: mobsync.exe process_identifier: 1068	1	1	0
Process32NextW July 12, 2021, 9:40 a.m.	snapshot_handle: 0x000002d8 process_name: taskhost.exe process_identifier: 2576	1	1	0
Process32NextW July 12, 2021, 9:40 a.m.	snapshot_handle: 0x000002d8 process_name: bat_update.exe process_identifier: 1016	1	1	0

An executable file was downloaded by the process bat_update.exe (6 events)

Time & API	Arguments	Status	Return	Repeated
InternetReadFile July 12, 2021, 9:40 a.m.	buffer: MZÿÿ¸@ º´ Í!¸ LÍ!This program cannot be run in DOS mode. $Àð/„‘AV„‘AV„‘AVéÒVˆ‘AV]ó@W†‘AV1†V ‘AV]óBW€‘AV]óDW‘AV]óEW‘AV¦ñ@W€‘AVOò@W‡‘AV„‘@V֑AVOòBW†‘AVOòEWÀ‘AVOòAW ‘AVOò¾V ‘AVOòCW ‘AVRich„‘AVPEL Øbë[à"! Øf )Ýð  p£s@ pæPÀæÈ@xüÐPà0âTˆâ@ð8 .texttÖØ `.rdataüþð Ü@@.data,HðÜ@À.rsrcx@à@@.relocàPä@B request_handle: 0x00cc000c	1	1	0
InternetReadFile July 12, 2021, 9:40 a.m.	buffer: MZÿÿ¸@ º´ Í!¸ LÍ!This program cannot be run in DOS mode. $ÂU±É£;âÉ£;âÉ£;âÀÛ¨âÙ£;âWüâË£;âÁ8ãÇ£;âÁ?ã£;âÁ:ãÍ£;âÁ>ãÛ£;âëÃ:ãÀ£;âÉ£:âw£;âÀ?ãÈ£;âÀ>ãÝ£;âÀ;ãÈ£;âÀÄâÈ£;âÀ9ãÈ£;âRichÉ£;âPEL Ä_ë[à"! z †à‚    @3@A@À t´Þ , xú Ð0h¹ TT¹ h¸ @ ôl¾ €.textÊx z  `.rdata^e f~ @@.data¼ä @À.didat8æ @À.rsrcx è @@.reloch0ì @B request_handle: 0x00cc000c	1	1	0
InternetReadFile July 12, 2021, 9:40 a.m.	buffer: MZÿÿ¸@øº´ Í!¸ LÍ!This program cannot be run in DOS mode. $¦È¼Aâ©Òâ©Òâ©ÒV5=à©ÒëÑAú©Ò;ËÓá©Òâ©Ó"©Ò;ËÑë©Ò;ËÖî©Ò;Ë×ô©Ò;ËÚ•©Ò;ËÒã©Ò;Ë-ã©Ò;ËÐã©ÒRichâ©ÒPEL 8'Yà"! ‚P±  Ðaz@AðC‚Ï ôR, €øx8?4:ðf8È(@Pð˜@@.textr `.data( @À.idata6P @@.didat4p6@À.rsrcø€8@@.reloc4:<<@B request_handle: 0x00cc000c	1	1	0
InternetReadFile July 12, 2021, 9:40 a.m.	buffer: MZÿÿ¸@ º´ Í!¸ LÍ!This program cannot be run in DOS mode. $#ƒ4ŒgâZßgâZßgâZßnšÉßsâZß¾€[ÞeâZßùBßcâZß¾€YÞjâZß¾€_ÞmâZß¾€^ÞlâZßE‚[ÞoâZ߬[ÞdâZßgâ[ߐâZ߬^ÞmãZ߬ZÞfâZ߬¥ßfâZ߬XÞfâZßRichgâZßPEL ­bë[à"! êwð  @·»@ ˆ ˆ=T °pæÐÀ}p—Tȗ@ø.textèê `.rdataRTî@@.datatG`"B@À.rsrcp°d@@.reloc}À~h@B request_handle: 0x00cc000c	1	1	0
InternetReadFile July 12, 2021, 9:40 a.m.	buffer: MZÿÿ¸@ º´ Í!¸ LÍ!This program cannot be run in DOS mode. $¢l$æ JOæ JOæ JOïuÙOê JO?oKNä JO?oINä JO?oONì JO?oNNí JOÄmKNä JO-nKNå JOæ KO~ JO-nNNò JO-nJNç JO-nµOç JO-nHNç JORichæ JOPEL ¿bë[à"! ¶ b—¼ Ð   P ±@ ¨¸È0xÐ@`Ðþ T(ÿ @Ð l.textË´ ¶  `.rdata DÐ Fº @@.data @À.rsrcx0@@.reloc`@@B request_handle: 0x00cc000c	1	1	0
InternetReadFile July 12, 2021, 9:40 a.m.	buffer: MZÿÿ¸@𺴠Í!¸ LÍ!This program cannot be run in DOS mode. $ ù£NE˜ÍE˜ÍE˜Íñ"G˜ÍLà^N˜ÍE˜Ìl˜ÍœúÉU˜ÍœúÎV˜ÍœúÈA˜ÍœúÅ_˜ÍœúÍD˜Íœú2D˜ÍœúÏD˜ÍRichE˜ÍPEL 8'Yà"! ê ®  @ ¼@A°ð À Œ  H?0 ” °8è@ ¼.textÄéê `.dataD î@À.idata¸ ð@@.rsrc ö@@.reloc” 0 ü@B request_handle: 0x00cc000c	1	1	0

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section	{u'size_of_data': u'0x0047bc00', u'virtual_address': u'0x006c3000', u'entropy': 7.938196672998824, u'name': u'eda deer', u'virtual_size': u'0x0047bad0'}				entropy	7.938196673				description	A section with a high entropy has been found
entropy	0.992219580722				description	Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 event)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW July 12, 2021, 9:40 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Queries for potentially installed applications (39 events)

Time & API	Arguments	Status	Return	Repeated
RegOpenKeyExA July 12, 2021, 9:40 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall base_handle: 0x80000002 key_handle: 0x000004c4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall	1	0	0
RegOpenKeyExA July 12, 2021, 9:40 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook base_handle: 0x80000002 key_handle: 0x000004c0 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook	1	0	0
RegOpenKeyExA July 12, 2021, 9:40 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager base_handle: 0x80000002 key_handle: 0x000004c0 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager	1	0	0
RegOpenKeyExA July 12, 2021, 9:40 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx base_handle: 0x80000002 key_handle: 0x000004c0 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx	1	0	0
RegOpenKeyExA July 12, 2021, 9:40 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\EditPlus base_handle: 0x80000002 key_handle: 0x000004c0 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\EditPlus	1	0	0
RegOpenKeyExA July 12, 2021, 9:40 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ENTERPRISE base_handle: 0x80000002 key_handle: 0x000004c0 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ENTERPRISE	1	0	0
RegOpenKeyExA July 12, 2021, 9:40 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore base_handle: 0x80000002 key_handle: 0x000004c0 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore	1	0	0
RegOpenKeyExA July 12, 2021, 9:40 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome base_handle: 0x80000002 key_handle: 0x000004c0 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome	1	0	0
RegOpenKeyExA July 12, 2021, 9:40 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Haansoft HWord 80 Korean base_handle: 0x80000002 key_handle: 0x000004c0 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Haansoft HWord 80 Korean	1	0	0
RegOpenKeyExA July 12, 2021, 9:40 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE40 base_handle: 0x80000002 key_handle: 0x000004c0 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE40	1	0	0
RegOpenKeyExA July 12, 2021, 9:40 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data base_handle: 0x80000002 key_handle: 0x000004c0 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data	1	0	0
RegOpenKeyExA July 12, 2021, 9:40 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX base_handle: 0x80000002 key_handle: 0x000004c0 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX	1	0	0
RegOpenKeyExA July 12, 2021, 9:40 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IEData base_handle: 0x80000002 key_handle: 0x000004c0 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IEData	1	0	0
RegOpenKeyExA July 12, 2021, 9:40 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack base_handle: 0x80000002 key_handle: 0x000004c0 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack	1	0	0
RegOpenKeyExA July 12, 2021, 9:40 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent base_handle: 0x80000002 key_handle: 0x000004c0 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent	1	0	0
RegOpenKeyExA July 12, 2021, 9:40 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WIC base_handle: 0x80000002 key_handle: 0x000004c0 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WIC	1	0	0
RegOpenKeyExA July 12, 2021, 9:40 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{01B845D4-B73E-4CF7-A377-94BC7BB4F77B} base_handle: 0x80000002 key_handle: 0x000004c0 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{01B845D4-B73E-4CF7-A377-94BC7BB4F77B}	1	0	0
RegOpenKeyExA July 12, 2021, 9:40 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1D91F7DA-F517-4727-9E62-B7EA978BE980} base_handle: 0x80000002 key_handle: 0x000004c0 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1D91F7DA-F517-4727-9E62-B7EA978BE980}	1	0	0
RegOpenKeyExA July 12, 2021, 9:40 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA} base_handle: 0x80000002 key_handle: 0x000004c0 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}	1	0	0
RegOpenKeyExA July 12, 2021, 9:40 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0015-0412-0000-0000000FF1CE} base_handle: 0x80000002 key_handle: 0x000004c0 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0015-0412-0000-0000000FF1CE}	1	0	0
RegOpenKeyExA July 12, 2021, 9:40 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0016-0412-0000-0000000FF1CE} base_handle: 0x80000002 key_handle: 0x000004c0 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0016-0412-0000-0000000FF1CE}	1	0	0
RegOpenKeyExA July 12, 2021, 9:40 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0018-0412-0000-0000000FF1CE} base_handle: 0x80000002 key_handle: 0x000004c0 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0018-0412-0000-0000000FF1CE}	1	0	0
RegOpenKeyExA July 12, 2021, 9:40 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0019-0412-0000-0000000FF1CE} base_handle: 0x80000002 key_handle: 0x000004c0 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0019-0412-0000-0000000FF1CE}	1	0	0
RegOpenKeyExA July 12, 2021, 9:40 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001A-0412-0000-0000000FF1CE} base_handle: 0x80000002 key_handle: 0x000004c0 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001A-0412-0000-0000000FF1CE}	1	0	0
RegOpenKeyExA July 12, 2021, 9:40 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001B-0412-0000-0000000FF1CE} base_handle: 0x80000002 key_handle: 0x000004c0 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001B-0412-0000-0000000FF1CE}	1	0	0
RegOpenKeyExA July 12, 2021, 9:40 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001F-0409-0000-0000000FF1CE} base_handle: 0x80000002 key_handle: 0x000004c0 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001F-0409-0000-0000000FF1CE}	1	0	0
RegOpenKeyExA July 12, 2021, 9:40 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001F-0412-0000-0000000FF1CE} base_handle: 0x80000002 key_handle: 0x000004c0 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001F-0412-0000-0000000FF1CE}	1	0	0
RegOpenKeyExA July 12, 2021, 9:40 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0028-0412-0000-0000000FF1CE} base_handle: 0x80000002 key_handle: 0x000004c0 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0028-0412-0000-0000000FF1CE}	1	0	0
RegOpenKeyExA July 12, 2021, 9:40 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-002C-0412-0000-0000000FF1CE} base_handle: 0x80000002 key_handle: 0x000004c0 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-002C-0412-0000-0000000FF1CE}	1	0	0
RegOpenKeyExA July 12, 2021, 9:40 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0030-0000-0000-0000000FF1CE} base_handle: 0x80000002 key_handle: 0x000004c0 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0030-0000-0000-0000000FF1CE}	1	0	0
RegOpenKeyExA July 12, 2021, 9:40 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0044-0412-0000-0000000FF1CE} base_handle: 0x80000002 key_handle: 0x000004c0 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0044-0412-0000-0000000FF1CE}	1	0	0
RegOpenKeyExA July 12, 2021, 9:40 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-006E-0409-0000-0000000FF1CE} base_handle: 0x80000002 key_handle: 0x000004c0 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-006E-0409-0000-0000000FF1CE}	1	0	0
RegOpenKeyExA July 12, 2021, 9:40 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-006E-0412-0000-0000000FF1CE} base_handle: 0x80000002 key_handle: 0x000004c0 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-006E-0412-0000-0000000FF1CE}	1	0	0
RegOpenKeyExA July 12, 2021, 9:40 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-00A1-0412-0000-0000000FF1CE} base_handle: 0x80000002 key_handle: 0x000004c0 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-00A1-0412-0000-0000000FF1CE}	1	0	0
RegOpenKeyExA July 12, 2021, 9:40 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-00BA-0409-0000-0000000FF1CE} base_handle: 0x80000002 key_handle: 0x000004c0 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-00BA-0409-0000-0000000FF1CE}	1	0	0
RegOpenKeyExA July 12, 2021, 9:40 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0114-0412-0000-0000000FF1CE} base_handle: 0x80000002 key_handle: 0x000004c0 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0114-0412-0000-0000000FF1CE}	1	0	0
RegOpenKeyExA July 12, 2021, 9:40 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{939659F3-71D2-461F-B24D-91D05A4389B4} base_handle: 0x80000002 key_handle: 0x000004c0 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{939659F3-71D2-461F-B24D-91D05A4389B4}	1	0	0
RegOpenKeyExA July 12, 2021, 9:40 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{9B84A461-3B4C-40E2-B44F-CE22E215EE40} base_handle: 0x80000002 key_handle: 0x000004c0 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{9B84A461-3B4C-40E2-B44F-CE22E215EE40}	1	0	0
RegOpenKeyExA July 12, 2021, 9:40 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d992c12e-cab2-426f-bde3-fb8c53950b0d} base_handle: 0x80000002 key_handle: 0x000004c0 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d992c12e-cab2-426f-bde3-fb8c53950b0d}	1	0	0

Terminates another process (2 events)

Time & API	Arguments	Status	Return	Repeated
NtTerminateProcess July 12, 2021, 9:40 a.m.	status_code: 0x00000001 process_identifier: 1016 process_handle: 0x00000190		0	0
NtTerminateProcess July 12, 2021, 9:40 a.m.	status_code: 0x00000001 process_identifier: 1016 process_handle: 0x00000190	1	0	0

Uses Windows utilities for basic Windows functionality (3 events)

cmdline	taskkill /im bat_update.exe /f
cmdline	"C:\Windows\System32\cmd.exe" /c taskkill /im bat_update.exe /f & timeout /t 6 & del /f /q "C:\Users\test22\AppData\Local\Temp\bat_update.exe" & del C:\ProgramData\*.dll & exit
cmdline	C:\Windows\System32\cmd.exe /c taskkill /im bat_update.exe /f & timeout /t 6 & del /f /q "C:\Users\test22\AppData\Local\Temp\bat_update.exe" & del C:\ProgramData\*.dll & exit

Communicates with host for which no DNS query was performed (1 event)

host	162.55.223.232

Checks for the presence of known windows from debuggers and forensic tools (21 events)

Time & API	Arguments	Status	Return	Repeated
FindWindowA July 12, 2021, 9:40 a.m.	class_name: RegmonClass window_name:		0	0
FindWindowA July 12, 2021, 9:40 a.m.	class_name: RegmonClass window_name:		0	0
FindWindowA July 12, 2021, 9:40 a.m.	class_name: Registry Monitor - Sysinternals: www.sysinternals.com window_name:		0	0
FindWindowA July 12, 2021, 9:40 a.m.	class_name: 18467-41 window_name:		0	0
FindWindowA July 12, 2021, 9:40 a.m.	class_name: FilemonClass window_name:		0	0
FindWindowA July 12, 2021, 9:40 a.m.	class_name: FilemonClass window_name:		0	0
FindWindowA July 12, 2021, 9:40 a.m.	class_name: File Monitor - Sysinternals: www.sysinternals.com window_name:		0	0
FindWindowA July 12, 2021, 9:40 a.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA July 12, 2021, 9:40 a.m.	class_name: Process Monitor - Sysinternals: www.sysinternals.com window_name:		0	0
FindWindowA July 12, 2021, 9:40 a.m.	class_name: Regmonclass window_name:		0	0
FindWindowA July 12, 2021, 9:40 a.m.	class_name: Regmonclass window_name:		0	0
FindWindowA July 12, 2021, 9:40 a.m.	class_name: 18467-41 window_name:		0	0
FindWindowA July 12, 2021, 9:40 a.m.	class_name: Filemonclass window_name:		0	0
FindWindowA July 12, 2021, 9:40 a.m.	class_name: Filemonclass window_name:		0	0
FindWindowA July 12, 2021, 9:40 a.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA July 12, 2021, 9:40 a.m.	class_name: Regmonclass window_name:		0	0
FindWindowA July 12, 2021, 9:40 a.m.	class_name: Regmonclass window_name:		0	0
FindWindowA July 12, 2021, 9:40 a.m.	class_name: 18467-41 window_name:		0	0
FindWindowA July 12, 2021, 9:40 a.m.	class_name: Filemonclass window_name:		0	0
FindWindowA July 12, 2021, 9:40 a.m.	class_name: Filemonclass window_name:		0	0
FindWindowA July 12, 2021, 9:40 a.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0

Checks the version of Bios, possibly for anti-virtualization (2 events)

registry	HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion
registry	HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion

Checks the CPU name from registry, possibly for anti-virtualization (1 event)

registry

HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString

Attempts to access Bitcoin/ALTCoin wallets (1 event)

file	C:\Users\test22\AppData\Roaming\Electrum\wallets\??????

Harvests credentials from local FTP client softwares (2 events)

file	C:\Users\test22\AppData\Roaming\FileZilla\recentservers.xml
registry	HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration

Collects information about installed applications (27 events)

Time & API	Arguments	Status	Return	Repeated
RegQueryValueExA July 12, 2021, 9:40 a.m.	key_handle: 0x000004c0 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: EditPlus regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\EditPlus\DisplayName	1	0	0
RegQueryValueExA July 12, 2021, 9:40 a.m.	key_handle: 0x000004c0 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Enterprise 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\ENTERPRISE\DisplayName	1	0	0
RegQueryValueExA July 12, 2021, 9:40 a.m.	key_handle: 0x000004c0 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Chrome regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome\DisplayName	1	0	0
RegQueryValueExA July 12, 2021, 9:40 a.m.	key_handle: 0x000004c0 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: ????? ?? 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Haansoft HWord 80 Korean\DisplayName	1	0	0
RegQueryValueExA July 12, 2021, 9:40 a.m.	key_handle: 0x000004c0 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: HttpWatch Professional 9.3.39 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{01B845D4-B73E-4CF7-A377-94BC7BB4F77B}\DisplayName	1	0	0
RegQueryValueExA July 12, 2021, 9:40 a.m.	key_handle: 0x000004c0 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: ????? ?? 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D91F7DA-F517-4727-9E62-B7EA978BE980}\DisplayName	1	0	0
RegQueryValueExA July 12, 2021, 9:40 a.m.	key_handle: 0x000004c0 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Google Update Helper regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}\DisplayName	1	0	0
RegQueryValueExA July 12, 2021, 9:40 a.m.	key_handle: 0x000004c0 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Access MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0015-0412-0000-0000000FF1CE}\DisplayName	1	0	0
RegQueryValueExA July 12, 2021, 9:40 a.m.	key_handle: 0x000004c0 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Excel MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0016-0412-0000-0000000FF1CE}\DisplayName	1	0	0
RegQueryValueExA July 12, 2021, 9:40 a.m.	key_handle: 0x000004c0 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office PowerPoint MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0018-0412-0000-0000000FF1CE}\DisplayName	1	0	0
RegQueryValueExA July 12, 2021, 9:40 a.m.	key_handle: 0x000004c0 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Publisher MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0019-0412-0000-0000000FF1CE}\DisplayName	1	0	0
RegQueryValueExA July 12, 2021, 9:40 a.m.	key_handle: 0x000004c0 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Outlook MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001A-0412-0000-0000000FF1CE}\DisplayName	1	0	0
RegQueryValueExA July 12, 2021, 9:40 a.m.	key_handle: 0x000004c0 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Word MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001B-0412-0000-0000000FF1CE}\DisplayName	1	0	0
RegQueryValueExA July 12, 2021, 9:40 a.m.	key_handle: 0x000004c0 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Proof (English) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001F-0409-0000-0000000FF1CE}\DisplayName	1	0	0
RegQueryValueExA July 12, 2021, 9:40 a.m.	key_handle: 0x000004c0 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Proof (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001F-0412-0000-0000000FF1CE}\DisplayName	1	0	0
RegQueryValueExA July 12, 2021, 9:40 a.m.	key_handle: 0x000004c0 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office IME (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0028-0412-0000-0000000FF1CE}\DisplayName	1	0	0
RegQueryValueExA July 12, 2021, 9:40 a.m.	key_handle: 0x000004c0 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Proofing (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-002C-0412-0000-0000000FF1CE}\DisplayName	1	0	0
RegQueryValueExA July 12, 2021, 9:40 a.m.	key_handle: 0x000004c0 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Enterprise 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0030-0000-0000-0000000FF1CE}\DisplayName	1	0	0
RegQueryValueExA July 12, 2021, 9:40 a.m.	key_handle: 0x000004c0 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office InfoPath MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0044-0412-0000-0000000FF1CE}\DisplayName	1	0	0
RegQueryValueExA July 12, 2021, 9:40 a.m.	key_handle: 0x000004c0 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Shared MUI (English) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-006E-0409-0000-0000000FF1CE}\DisplayName	1	0	0
RegQueryValueExA July 12, 2021, 9:40 a.m.	key_handle: 0x000004c0 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Shared MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-006E-0412-0000-0000000FF1CE}\DisplayName	1	0	0
RegQueryValueExA July 12, 2021, 9:40 a.m.	key_handle: 0x000004c0 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office OneNote MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-00A1-0412-0000-0000000FF1CE}\DisplayName	1	0	0
RegQueryValueExA July 12, 2021, 9:40 a.m.	key_handle: 0x000004c0 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Groove MUI (English) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-00BA-0409-0000-0000000FF1CE}\DisplayName	1	0	0
RegQueryValueExA July 12, 2021, 9:40 a.m.	key_handle: 0x000004c0 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Groove Setup Metadata MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0114-0412-0000-0000000FF1CE}\DisplayName	1	0	0
RegQueryValueExA July 12, 2021, 9:40 a.m.	key_handle: 0x000004c0 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Adobe Flash Player 13 ActiveX regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{939659F3-71D2-461F-B24D-91D05A4389B4}\DisplayName	1	0	0
RegQueryValueExA July 12, 2021, 9:40 a.m.	key_handle: 0x000004c0 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Adobe Flash Player 13 NPAPI regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{9B84A461-3B4C-40E2-B44F-CE22E215EE40}\DisplayName	1	0	0
RegQueryValueExA July 12, 2021, 9:40 a.m.	key_handle: 0x000004c0 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Visual C++ 2015 Redistributable (x64) - 14.0.24215 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{d992c12e-cab2-426f-bde3-fb8c53950b0d}\DisplayName	1	0	0

Harvests credentials from local email clients (1 event)

file	C:\Users\test22\AppData\Roaming\Thunderbird\profiles.ini

Detects VirtualBox through the presence of a registry key (1 event)

registry

HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Detects Virtual Machines through their custom firmware (1 event)

Time & API	Arguments	Status	Return	Repeated
NtQuerySystemInformation July 12, 2021, 9:40 a.m.	information_class: 76 (SystemFirmwareTableInformation)		3221225507	0

Detects VMWare through the in instruction feature (1 event)

Time & API	Arguments	Status	Return	Repeated
__exception__ July 12, 2021, 9:40 a.m.	stacktrace: exception.instruction_r: ed 64 8f 05 00 00 00 00 83 c4 04 81 fb 68 58 4d exception.symbol: bat_update+0x409476 exception.instruction: in eax, dx exception.module: bat_update.exe exception.exception_code: 0xc0000096 exception.offset: 4232310 exception.address: 0x809476 registers.esp: 1638268 registers.edi: 16986628 registers.eax: 1447909480 registers.ebp: 6492160 registers.edx: 22104 registers.ebx: 2256917605 registers.esi: 7279554 registers.ecx: 10	1	0	0

File has been identified by 33 AntiVirus engines on VirusTotal as malicious (33 events)

Bkav	W32.AIDetect.malware1
Elastic	malicious (high confidence)
Malwarebytes	Trojan.MalPack.Themida
Sangfor	Trojan.Win32.Save.a
Alibaba	Trojan:Win32/Chapak.3175900e
Cybereason	malicious.7a7bc2
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/GenCBL.ANM
APEX	Malicious
Paloalto	generic.ml
Kaspersky	Trojan.Win32.Chapak.eztr
Avast	Win32:DangerousSig [Trj]
Sophos	Mal/Generic-S
DrWeb	Trojan.PWS.Stealer.26450
McAfee-GW-Edition	BehavesLike.Win32.Trojan.rc
FireEye	Generic.mg.bbf3c7740a3507b4
SentinelOne	Static AI - Suspicious PE
GData	Win32.Trojan-Stealer.PSWSteal.S3X537
Webroot	W32.Trojan.Gen
Kingsoft	Win32.Troj.Chapak.ez.(kcloud)
Gridinsoft	Trojan.Win32.Gen.dd!n
Microsoft	Trojan:Win32/Tnega!ml
Acronis	suspicious
McAfee	Artemis!BBF3C7740A35
MAX	malware (ai score=99)
Cylance	Unsafe
TrendMicro-HouseCall	TROJ_GEN.R06CH0DG821
Ikarus	Trojan.Win32.Generic
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	W32/Chapak.EZTR!tr
BitDefenderTheta	Gen:NN.ZexaF.34790.@31@aWICEecO
AVG	Win32:DangerousSig [Trj]
CrowdStrike	win/malicious_confidence_60% (W)