Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	May 30, 2023, 3:12 p.m.	May 30, 2023, 3:14 p.m.

Size	2.0MB
Type	PE32 executable (console) Intel 80386, for MS Windows
MD5	`433dbed8a7afbf15bfee967c63a50769`
SHA256	`6c5cff00451680070af8daca0a59ee6a6f467f6b3152f60de6cec6cdcb9cf601`
CRC32	`72014A56`
ssdeep	`12288:8+GMPjZBXBlm7PRfbjn9pmhpeXN9wqdOlt:VP7QPRz/mhpK4`
Yara	UPX_Zero - UPX packed file OS_Processor_Check_Zero - OS Processor Check Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature IsPE32 - (no description)

kds7uq5kknv.exe "C:\Users\test22\AppData\Local\Temp\kds7uq5kknv.exe"
2544
- RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2656

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
185.99.133.246	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.101:49163 -> 185.99.133.246:80	2043206	ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2	A Network Trojan was detected
TCP 192.168.56.101:49163 -> 185.99.133.246:80	2043206	ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2	A Network Trojan was detected
TCP 192.168.56.101:49163 -> 185.99.133.246:80	2043206	ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2	A Network Trojan was detected
TCP 192.168.56.101:49163 -> 185.99.133.246:80	2043206	ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2	A Network Trojan was detected
TCP 192.168.56.101:49163 -> 185.99.133.246:80	2043206	ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2	A Network Trojan was detected
TCP 192.168.56.101:49163 -> 185.99.133.246:80	2043206	ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2	A Network Trojan was detected
TCP 192.168.56.101:49163 -> 185.99.133.246:80	2043206	ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2	A Network Trojan was detected
TCP 185.99.133.246:80 -> 192.168.56.101:49163	2221010	SURICATA HTTP unable to match response to request	Generic Protocol Command Decode
TCP 185.99.133.246:80 -> 192.168.56.101:49163	2221010	SURICATA HTTP unable to match response to request	Generic Protocol Command Decode
TCP 185.99.133.246:80 -> 192.168.56.101:49163	2221010	SURICATA HTTP unable to match response to request	Generic Protocol Command Decode
TCP 185.99.133.246:80 -> 192.168.56.101:49163	2221010	SURICATA HTTP unable to match response to request	Generic Protocol Command Decode
TCP 185.99.133.246:80 -> 192.168.56.101:49163	2221010	SURICATA HTTP unable to match response to request	Generic Protocol Command Decode
TCP 185.99.133.246:80 -> 192.168.56.101:49163	2221010	SURICATA HTTP unable to match response to request	Generic Protocol Command Decode

Suricata TLS

No Suricata TLS

Queries for the computername (50 out of 80 events)

Time & API	Arguments	Status	Return
GetComputerNameA May 30, 2023, 3:12 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 30, 2023, 3:12 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 30, 2023, 3:12 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 30, 2023, 3:12 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 30, 2023, 3:12 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 30, 2023, 3:12 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 30, 2023, 3:12 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 30, 2023, 3:12 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 30, 2023, 3:12 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 30, 2023, 3:12 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 30, 2023, 3:12 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 30, 2023, 3:12 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 30, 2023, 3:12 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 30, 2023, 3:12 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 30, 2023, 3:12 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 30, 2023, 3:12 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 30, 2023, 3:12 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 30, 2023, 3:12 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 30, 2023, 3:12 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 30, 2023, 3:12 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 30, 2023, 3:12 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 30, 2023, 3:12 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 30, 2023, 3:12 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 30, 2023, 3:12 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 30, 2023, 3:12 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 30, 2023, 3:12 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 30, 2023, 3:12 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 30, 2023, 3:12 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 30, 2023, 3:12 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 30, 2023, 3:12 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 30, 2023, 3:12 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 30, 2023, 3:12 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 30, 2023, 3:12 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 30, 2023, 3:12 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 30, 2023, 3:12 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 30, 2023, 3:12 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 30, 2023, 3:12 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 30, 2023, 3:12 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 30, 2023, 3:12 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 30, 2023, 3:12 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 30, 2023, 3:12 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 30, 2023, 3:12 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 30, 2023, 3:12 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 30, 2023, 3:12 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 30, 2023, 3:12 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 30, 2023, 3:12 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 30, 2023, 3:12 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 30, 2023, 3:12 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 30, 2023, 3:12 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 30, 2023, 3:12 p.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (50 out of 51 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent May 30, 2023, 3:12 p.m.			0	0
IsDebuggerPresent May 30, 2023, 3:12 p.m.			0	0
IsDebuggerPresent May 30, 2023, 3:12 p.m.			0	0
IsDebuggerPresent May 30, 2023, 3:12 p.m.			0	0
IsDebuggerPresent May 30, 2023, 3:12 p.m.			0	0
IsDebuggerPresent May 30, 2023, 3:12 p.m.			0	0
IsDebuggerPresent May 30, 2023, 3:12 p.m.			0	0
IsDebuggerPresent May 30, 2023, 3:12 p.m.			0	0
IsDebuggerPresent May 30, 2023, 3:12 p.m.			0	0
IsDebuggerPresent May 30, 2023, 3:12 p.m.			0	0
IsDebuggerPresent May 30, 2023, 3:12 p.m.			0	0
IsDebuggerPresent May 30, 2023, 3:12 p.m.			0	0
IsDebuggerPresent May 30, 2023, 3:12 p.m.			0	0
IsDebuggerPresent May 30, 2023, 3:12 p.m.			0	0
IsDebuggerPresent May 30, 2023, 3:12 p.m.			0	0
IsDebuggerPresent May 30, 2023, 3:12 p.m.			0	0
IsDebuggerPresent May 30, 2023, 3:12 p.m.			0	0
IsDebuggerPresent May 30, 2023, 3:12 p.m.			0	0
IsDebuggerPresent May 30, 2023, 3:12 p.m.			0	0
IsDebuggerPresent May 30, 2023, 3:12 p.m.			0	0
IsDebuggerPresent May 30, 2023, 3:12 p.m.			0	0
IsDebuggerPresent May 30, 2023, 3:12 p.m.			0	0
IsDebuggerPresent May 30, 2023, 3:12 p.m.			0	0
IsDebuggerPresent May 30, 2023, 3:12 p.m.			0	0
IsDebuggerPresent May 30, 2023, 3:12 p.m.			0	0
IsDebuggerPresent May 30, 2023, 3:12 p.m.			0	0
IsDebuggerPresent May 30, 2023, 3:12 p.m.			0	0
IsDebuggerPresent May 30, 2023, 3:12 p.m.			0	0
IsDebuggerPresent May 30, 2023, 3:12 p.m.			0	0
IsDebuggerPresent May 30, 2023, 3:12 p.m.			0	0
IsDebuggerPresent May 30, 2023, 3:12 p.m.			0	0
IsDebuggerPresent May 30, 2023, 3:12 p.m.			0	0
IsDebuggerPresent May 30, 2023, 3:12 p.m.			0	0
IsDebuggerPresent May 30, 2023, 3:12 p.m.			0	0
IsDebuggerPresent May 30, 2023, 3:12 p.m.			0	0
IsDebuggerPresent May 30, 2023, 3:12 p.m.			0	0
IsDebuggerPresent May 30, 2023, 3:12 p.m.			0	0
IsDebuggerPresent May 30, 2023, 3:12 p.m.			0	0
IsDebuggerPresent May 30, 2023, 3:12 p.m.			0	0
IsDebuggerPresent May 30, 2023, 3:12 p.m.			0	0
IsDebuggerPresent May 30, 2023, 3:12 p.m.			0	0
IsDebuggerPresent May 30, 2023, 3:12 p.m.			0	0
IsDebuggerPresent May 30, 2023, 3:12 p.m.			0	0
IsDebuggerPresent May 30, 2023, 3:12 p.m.			0	0
IsDebuggerPresent May 30, 2023, 3:12 p.m.			0	0
IsDebuggerPresent May 30, 2023, 3:12 p.m.			0	0
IsDebuggerPresent May 30, 2023, 3:12 p.m.			0	0
IsDebuggerPresent May 30, 2023, 3:12 p.m.			0	0
IsDebuggerPresent May 30, 2023, 3:12 p.m.			0	0
IsDebuggerPresent May 30, 2023, 3:12 p.m.			0	0

Command line console output was observed (9 events)

Time & API	Arguments	Status	Return
WriteConsoleA May 30, 2023, 3:12 p.m.	buffer: m console_handle: 0x00000007	1	1
WriteConsoleA May 30, 2023, 3:12 p.m.	buffer: o console_handle: 0x00000007	1	1
WriteConsoleA May 30, 2023, 3:12 p.m.	buffer: A console_handle: 0x00000007	1	1
WriteConsoleA May 30, 2023, 3:12 p.m.	buffer: o console_handle: 0x00000007	1	1
WriteConsoleA May 30, 2023, 3:12 p.m.	buffer: A console_handle: 0x00000007	1	1
WriteConsoleA May 30, 2023, 3:12 p.m.	buffer: m console_handle: 0x00000007	1	1
WriteConsoleA May 30, 2023, 3:12 p.m.	buffer: e console_handle: 0x00000007	1	1
WriteConsoleA May 30, 2023, 3:12 p.m.	buffer: o console_handle: 0x00000007	1	1
WriteConsoleA May 30, 2023, 3:12 p.m.	buffer: w console_handle: 0x00000007	1	1

Tries to locate where the browsers are installed (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

.Za2g

One or more processes crashed (1 event)

Time & API	Arguments	Status	Return	Repeated
__exception__ May 30, 2023, 3:12 p.m.	stacktrace: kds7uq5kknv+0x225a1 @ 0x9125a1 kds7uq5kknv+0x2252b @ 0x91252b kds7uq5kknv+0x6deb @ 0x8f6deb BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.esp: 4192556 registers.edi: 4530176 registers.eax: 2656 registers.ebp: 4192620 registers.edx: 2130566132 registers.ebx: 7680 registers.esi: 9891424 registers.ecx: 2548	1	0	0

Time & API

Arguments

Status

Return

Repeated

__exception__

May 30, 2023, 3:12 p.m.

stacktrace:

kds7uq5kknv+0x225a1 @ 0x9125a1
kds7uq5kknv+0x2252b @ 0x91252b
kds7uq5kknv+0x6deb @ 0x8f6deb
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5

exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0x0
registers.esp: 4192556
registers.edi: 4530176
registers.eax: 2656
registers.ebp: 4192620
registers.edx: 2130566132
registers.ebx: 7680
registers.esi: 9891424
registers.ecx: 2548

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

HTTP traffic contains suspicious features which may be indicative of malware related traffic (1 event)

suspicious_features

POST method with no referer header, Connection to IP address

suspicious_request

POST http://185.99.133.246/c2sock

Performs some HTTP requests (1 event)

request

POST http://185.99.133.246/c2sock

Sends data using the HTTP POST Method (1 event)

request

POST http://185.99.133.246/c2sock

Allocates read-write-execute memory (usually to unpack itself) (2 events)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory May 30, 2023, 3:12 p.m.	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00970000 process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory May 30, 2023, 3:12 p.m.	process_identifier: 2544 region_size: 344064 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1	0	0

Steals private information from local Internet browsers (50 out of 64 events)

file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Web Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Login Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000004.log
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddffflal
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbml
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\CURRENT
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local State
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcobl
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfel
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm

The binary likely contains encrypted or compressed data indicative of a packer (1 event)

section

{u'size_of_data': u'0x00050800', u'virtual_address': u'0x00031000', u'entropy': 7.353731042797757, u'name': u'.data', u'virtual_size': u'0x000515e4'}

entropy

7.3537310428

description

A section with a high entropy has been found

Queries for potentially installed applications (39 events)

Time & API	Arguments	Status
RegOpenKeyExW May 30, 2023, 3:12 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall base_handle: 0x80000002 key_handle: 0x00000210 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall	1
RegOpenKeyExW May 30, 2023, 3:12 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook base_handle: 0x80000002 key_handle: 0x0000020c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook	1
RegOpenKeyExW May 30, 2023, 3:12 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager base_handle: 0x80000002 key_handle: 0x0000020c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager	1
RegOpenKeyExW May 30, 2023, 3:12 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx base_handle: 0x80000002 key_handle: 0x0000020c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx	1
RegOpenKeyExW May 30, 2023, 3:12 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\EditPlus base_handle: 0x80000002 key_handle: 0x0000020c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\EditPlus	1
RegOpenKeyExW May 30, 2023, 3:12 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ENTERPRISE base_handle: 0x80000002 key_handle: 0x0000020c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ENTERPRISE	1
RegOpenKeyExW May 30, 2023, 3:12 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore base_handle: 0x80000002 key_handle: 0x0000020c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore	1
RegOpenKeyExW May 30, 2023, 3:12 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome base_handle: 0x80000002 key_handle: 0x0000020c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome	1
RegOpenKeyExW May 30, 2023, 3:12 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Haansoft HWord 80 Korean base_handle: 0x80000002 key_handle: 0x0000020c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Haansoft HWord 80 Korean	1
RegOpenKeyExW May 30, 2023, 3:12 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE40 base_handle: 0x80000002 key_handle: 0x0000020c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE40	1
RegOpenKeyExW May 30, 2023, 3:12 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data base_handle: 0x80000002 key_handle: 0x0000020c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data	1
RegOpenKeyExW May 30, 2023, 3:12 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX base_handle: 0x80000002 key_handle: 0x0000020c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX	1
RegOpenKeyExW May 30, 2023, 3:12 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IEData base_handle: 0x80000002 key_handle: 0x0000020c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IEData	1
RegOpenKeyExW May 30, 2023, 3:12 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack base_handle: 0x80000002 key_handle: 0x0000020c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack	1
RegOpenKeyExW May 30, 2023, 3:12 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent base_handle: 0x80000002 key_handle: 0x0000020c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent	1
RegOpenKeyExW May 30, 2023, 3:12 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WIC base_handle: 0x80000002 key_handle: 0x0000020c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WIC	1
RegOpenKeyExW May 30, 2023, 3:12 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{01B845D4-B73E-4CF7-A377-94BC7BB4F77B} base_handle: 0x80000002 key_handle: 0x0000020c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{01B845D4-B73E-4CF7-A377-94BC7BB4F77B}	1
RegOpenKeyExW May 30, 2023, 3:12 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1D91F7DA-F517-4727-9E62-B7EA978BE980} base_handle: 0x80000002 key_handle: 0x0000020c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1D91F7DA-F517-4727-9E62-B7EA978BE980}	1
RegOpenKeyExW May 30, 2023, 3:12 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA} base_handle: 0x80000002 key_handle: 0x0000020c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}	1
RegOpenKeyExW May 30, 2023, 3:12 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0015-0412-0000-0000000FF1CE} base_handle: 0x80000002 key_handle: 0x0000020c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0015-0412-0000-0000000FF1CE}	1
RegOpenKeyExW May 30, 2023, 3:12 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0016-0412-0000-0000000FF1CE} base_handle: 0x80000002 key_handle: 0x0000020c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0016-0412-0000-0000000FF1CE}	1
RegOpenKeyExW May 30, 2023, 3:12 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0018-0412-0000-0000000FF1CE} base_handle: 0x80000002 key_handle: 0x0000020c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0018-0412-0000-0000000FF1CE}	1
RegOpenKeyExW May 30, 2023, 3:12 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0019-0412-0000-0000000FF1CE} base_handle: 0x80000002 key_handle: 0x0000020c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0019-0412-0000-0000000FF1CE}	1
RegOpenKeyExW May 30, 2023, 3:12 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001A-0412-0000-0000000FF1CE} base_handle: 0x80000002 key_handle: 0x0000020c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001A-0412-0000-0000000FF1CE}	1
RegOpenKeyExW May 30, 2023, 3:12 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001B-0412-0000-0000000FF1CE} base_handle: 0x80000002 key_handle: 0x0000020c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001B-0412-0000-0000000FF1CE}	1
RegOpenKeyExW May 30, 2023, 3:12 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001F-0409-0000-0000000FF1CE} base_handle: 0x80000002 key_handle: 0x0000020c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001F-0409-0000-0000000FF1CE}	1
RegOpenKeyExW May 30, 2023, 3:12 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001F-0412-0000-0000000FF1CE} base_handle: 0x80000002 key_handle: 0x0000020c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001F-0412-0000-0000000FF1CE}	1
RegOpenKeyExW May 30, 2023, 3:12 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0028-0412-0000-0000000FF1CE} base_handle: 0x80000002 key_handle: 0x0000020c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0028-0412-0000-0000000FF1CE}	1
RegOpenKeyExW May 30, 2023, 3:12 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-002C-0412-0000-0000000FF1CE} base_handle: 0x80000002 key_handle: 0x0000020c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-002C-0412-0000-0000000FF1CE}	1
RegOpenKeyExW May 30, 2023, 3:12 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0030-0000-0000-0000000FF1CE} base_handle: 0x80000002 key_handle: 0x0000020c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0030-0000-0000-0000000FF1CE}	1
RegOpenKeyExW May 30, 2023, 3:12 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0044-0412-0000-0000000FF1CE} base_handle: 0x80000002 key_handle: 0x0000020c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0044-0412-0000-0000000FF1CE}	1
RegOpenKeyExW May 30, 2023, 3:12 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-006E-0409-0000-0000000FF1CE} base_handle: 0x80000002 key_handle: 0x0000020c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-006E-0409-0000-0000000FF1CE}	1
RegOpenKeyExW May 30, 2023, 3:12 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-006E-0412-0000-0000000FF1CE} base_handle: 0x80000002 key_handle: 0x0000020c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-006E-0412-0000-0000000FF1CE}	1
RegOpenKeyExW May 30, 2023, 3:12 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-00A1-0412-0000-0000000FF1CE} base_handle: 0x80000002 key_handle: 0x0000020c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-00A1-0412-0000-0000000FF1CE}	1
RegOpenKeyExW May 30, 2023, 3:12 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-00BA-0409-0000-0000000FF1CE} base_handle: 0x80000002 key_handle: 0x0000020c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-00BA-0409-0000-0000000FF1CE}	1
RegOpenKeyExW May 30, 2023, 3:12 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0114-0412-0000-0000000FF1CE} base_handle: 0x80000002 key_handle: 0x0000020c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0114-0412-0000-0000000FF1CE}	1
RegOpenKeyExW May 30, 2023, 3:12 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{939659F3-71D2-461F-B24D-91D05A4389B4} base_handle: 0x80000002 key_handle: 0x0000020c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{939659F3-71D2-461F-B24D-91D05A4389B4}	1
RegOpenKeyExW May 30, 2023, 3:12 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{9B84A461-3B4C-40E2-B44F-CE22E215EE40} base_handle: 0x80000002 key_handle: 0x0000020c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{9B84A461-3B4C-40E2-B44F-CE22E215EE40}	1
RegOpenKeyExW May 30, 2023, 3:12 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d992c12e-cab2-426f-bde3-fb8c53950b0d} base_handle: 0x80000002 key_handle: 0x0000020c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d992c12e-cab2-426f-bde3-fb8c53950b0d}	1

One or more of the buffers contains an embedded PE file (1 event)

buffer

Buffer with sha1: 524fd6a49e2698e0e4c4a23e3b177de62a57e757

Communicates with host for which no DNS query was performed (1 event)

host

185.99.133.246

Allocates execute permission to another process indicative of possible code injection (1 event)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory May 30, 2023, 3:12 p.m.	process_identifier: 2656 region_size: 344064 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000002c	1	0	0

Attempts to access Bitcoin/ALTCoin wallets (2 events)

file	C:\Users\test22\AppData\Roaming\Bitcoin\wallets
file	C:\Users\test22\AppData\Roaming\Electrum\wallets

Potential code injection by writing to the memory of another process (1 event)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory May 30, 2023, 3:12 p.m.	buffer: @ base_address: 0x7efde008 process_identifier: 2656 process_handle: 0x0000002c	1	1	0

Collects information about installed applications (27 events)

Time & API	Arguments	Status
RegQueryValueExW May 30, 2023, 3:12 p.m.	key_handle: 0x0000020c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: EditPlus regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\EditPlus\DisplayName	1
RegQueryValueExW May 30, 2023, 3:12 p.m.	key_handle: 0x0000020c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Enterprise 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\ENTERPRISE\DisplayName	1
RegQueryValueExW May 30, 2023, 3:12 p.m.	key_handle: 0x0000020c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Chrome regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome\DisplayName	1
RegQueryValueExW May 30, 2023, 3:12 p.m.	key_handle: 0x0000020c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: 한컴오피스 한글 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Haansoft HWord 80 Korean\DisplayName	1
RegQueryValueExW May 30, 2023, 3:12 p.m.	key_handle: 0x0000020c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: HttpWatch Professional 9.3.39 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{01B845D4-B73E-4CF7-A377-94BC7BB4F77B}\DisplayName	1
RegQueryValueExW May 30, 2023, 3:12 p.m.	key_handle: 0x0000020c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: 한컴오피스 한글 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D91F7DA-F517-4727-9E62-B7EA978BE980}\DisplayName	1
RegQueryValueExW May 30, 2023, 3:12 p.m.	key_handle: 0x0000020c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Google Update Helper regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}\DisplayName	1
RegQueryValueExW May 30, 2023, 3:12 p.m.	key_handle: 0x0000020c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Access MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0015-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW May 30, 2023, 3:12 p.m.	key_handle: 0x0000020c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Excel MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0016-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW May 30, 2023, 3:12 p.m.	key_handle: 0x0000020c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office PowerPoint MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0018-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW May 30, 2023, 3:12 p.m.	key_handle: 0x0000020c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Publisher MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0019-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW May 30, 2023, 3:12 p.m.	key_handle: 0x0000020c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Outlook MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001A-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW May 30, 2023, 3:12 p.m.	key_handle: 0x0000020c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Word MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001B-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW May 30, 2023, 3:12 p.m.	key_handle: 0x0000020c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Proof (English) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001F-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW May 30, 2023, 3:12 p.m.	key_handle: 0x0000020c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Proof (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001F-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW May 30, 2023, 3:12 p.m.	key_handle: 0x0000020c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office IME (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0028-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW May 30, 2023, 3:12 p.m.	key_handle: 0x0000020c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Proofing (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-002C-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW May 30, 2023, 3:12 p.m.	key_handle: 0x0000020c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Enterprise 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0030-0000-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW May 30, 2023, 3:12 p.m.	key_handle: 0x0000020c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office InfoPath MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0044-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW May 30, 2023, 3:12 p.m.	key_handle: 0x0000020c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Shared MUI (English) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-006E-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW May 30, 2023, 3:12 p.m.	key_handle: 0x0000020c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Shared MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-006E-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW May 30, 2023, 3:12 p.m.	key_handle: 0x0000020c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office OneNote MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-00A1-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW May 30, 2023, 3:12 p.m.	key_handle: 0x0000020c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Groove MUI (English) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-00BA-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW May 30, 2023, 3:12 p.m.	key_handle: 0x0000020c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Groove Setup Metadata MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0114-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW May 30, 2023, 3:12 p.m.	key_handle: 0x0000020c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Adobe Flash Player 13 ActiveX regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{939659F3-71D2-461F-B24D-91D05A4389B4}\DisplayName	1
RegQueryValueExW May 30, 2023, 3:12 p.m.	key_handle: 0x0000020c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Adobe Flash Player 13 NPAPI regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{9B84A461-3B4C-40E2-B44F-CE22E215EE40}\DisplayName	1
RegQueryValueExW May 30, 2023, 3:12 p.m.	key_handle: 0x0000020c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Visual C++ 2015 Redistributable (x64) - 14.0.24215 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{d992c12e-cab2-426f-bde3-fb8c53950b0d}\DisplayName	1

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2544 called NtSetContextThread to modify thread in remote process 2656
NtSetContextThread May 30, 2023, 3:12 p.m.	registers.eip: 1995571652 registers.esp: 3406080 registers.edi: 0 registers.eax: 4331148 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000020 process_identifier: 2656	1	0	0

Appends a known CryptoMix ransomware file extension to files that have been encrypted (1 event)

file	C:\Users\test22\AppData\Roaming\Exodus\exodus.wallet

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2544 resumed a thread in remote process 2656
NtResumeThread May 30, 2023, 3:12 p.m.	thread_handle: 0x00000020 suspend_count: 1 process_identifier: 2656	1	0	0

Detects Virtual Machines through their custom firmware (1 event)

Time & API	Arguments	Status	Return	Repeated
NtQuerySystemInformation May 30, 2023, 3:12 p.m.	information_class: 76 (SystemFirmwareTableInformation)		3221225507	0

Executed a process and injected code into it, probably while unpacking (7 events)

Time & API	Arguments	Status	Return
CreateProcessInternalW May 30, 2023, 3:12 p.m.	thread_identifier: 2660 thread_handle: 0x00000020 process_identifier: 2656 current_directory: filepath: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe track: 1 command_line: filepath_r: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x0000002c	1	1
NtGetContextThread May 30, 2023, 3:12 p.m.	thread_handle: 0x00000020	1	0
NtAllocateVirtualMemory May 30, 2023, 3:12 p.m.	process_identifier: 2656 region_size: 344064 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000002c	1	0
WriteProcessMemory May 30, 2023, 3:12 p.m.	buffer: base_address: 0x00400000 process_identifier: 2656 process_handle: 0x0000002c	1	1
WriteProcessMemory May 30, 2023, 3:12 p.m.	buffer: @ base_address: 0x7efde008 process_identifier: 2656 process_handle: 0x0000002c	1	1
NtSetContextThread May 30, 2023, 3:12 p.m.	registers.eip: 1995571652 registers.esp: 3406080 registers.edi: 0 registers.eax: 4331148 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000020 process_identifier: 2656	1	0
NtResumeThread May 30, 2023, 3:12 p.m.	thread_handle: 0x00000020 suspend_count: 1 process_identifier: 2656	1	0

File has been identified by 50 AntiVirus engines on VirusTotal as malicious (50 events)

Bkav	W32.AIDetectMalware
Lionic	Trojan.Win32.Stealer.12!c
MicroWorld-eScan	Trojan.GenericKD.67196563
FireEye	Generic.mg.433dbed8a7afbf15
CAT-QuickHeal	TrojanSpy.Stealer
ALYac	Trojan.GenericKD.67196563
Malwarebytes	Trojan.MalPack
VIPRE	Trojan.GenericKD.67196563
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Trojan ( 0059e8321 )
Alibaba	TrojanSpy:Win32/Stealer.b6435432
K7GW	Trojan ( 0059e8321 )
BitDefenderTheta	Gen:NN.ZexaF.36196.cEW@aiXeIDli
VirIT	Trojan.Win32.Genus.QVQ
Cyren	W32/ABRisk.WFBI-1670
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	a variant of Win32/Kryptik.HSNW
Cynet	Malicious (score: 100)
APEX	Malicious
ClamAV	Win.Packed.Lazy-10002615-0
Kaspersky	HEUR:Trojan-Spy.Win32.Stealer.gen
BitDefender	Trojan.GenericKD.67196563
Tencent	Malware.Win32.Gencirc.13b245df
F-Secure	Trojan.TR/AD.Nekark.naesy
DrWeb	Trojan.PWS.Stealer.36745
TrendMicro	Trojan.Win32.AMADEY.YXDEXZ
Trapmine	malicious.high.ml.score
Sophos	Mal/Generic-S
SentinelOne	Static AI - Malicious PE
Webroot	W32.Stealer
Avira	TR/AD.Nekark.naesy
Antiy-AVL	Trojan/Win32.Kryptik
Gridinsoft	Spy.Win32.Gen.bot
Arcabit	Trojan.Generic.D4015693
ViRobot	Trojan.Win.Z.Kryptik.2136064
ZoneAlarm	HEUR:Trojan-Spy.Win32.Stealer.gen
GData	Trojan.GenericKD.67196563
Google	Detected
AhnLab-V3	Trojan/Win.Generic.C5431970
Acronis	suspicious
VBA32	TrojanPSW.Lumma
MAX	malware (ai score=84)
Cylance	unsafe
TrendMicro-HouseCall	Trojan.Win32.AMADEY.YXDEXZ
Rising	Backdoor.Convagent!8.123DC (TFE:1:3HahcDVvmbM)
Ikarus	Trojan.Win32.Crypt
Fortinet	W32/Kryptik.HTLQ!tr
Panda	Trj/Chgt.AD
CrowdStrike	win/malicious_confidence_100% (W)

kds7uq5kknv.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All