Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Aug. 18, 2024, 2:11 p.m.	Aug. 18, 2024, 2:13 p.m.

Size	2.7MB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`fd2defc436fc7960d6501a01c91d893e`
SHA256	`ba13da01c41fa50ec5e340061973bc912b1f41cd1f96a7cae5d40afc00ff7945`
CRC32	`3D0AA657`
ssdeep	`49152:kpiVaJ9m+8FdK1BZKVD2CMwbbIip7q18N/jH1:ks3+11vKV7Fs89jH1`
Yara	Admin_Tool_IN_Zero - Admin Tool Sysinternals PE_Header_Zero - PE File Signature IsPE32 - (no description) Generic_Malware_Zero - Generic Malware UPX_Zero - UPX packed file

3546345.exe "C:\Users\test22\AppData\Local\Temp\3546345.exe"
2556

Name	Response	Post-Analysis Lookup
thizx13vt.top	A 195.133.48.136	195.133.48.136

IP Address	Status	Action
164.124.101.2	Active	Moloch
195.133.48.136	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
UDP 192.168.56.101:59002 -> 164.124.101.2:53	2023883	ET DNS Query to a *.top domain - Likely Hostile	Potentially Bad Traffic
TCP 192.168.56.101:49162 -> 195.133.48.136:80	2054350	ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4	A Network Trojan was detected
TCP 192.168.56.101:49162 -> 195.133.48.136:80	2023882	ET INFO HTTP Request to a *.top domain	Potentially Bad Traffic
TCP 192.168.56.101:49162 -> 195.133.48.136:80	2054350	ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4	A Network Trojan was detected
TCP 192.168.56.101:49162 -> 195.133.48.136:80	2054350	ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4	A Network Trojan was detected

Suricata TLS

No Suricata TLS

Queries for the computername (1 event)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameW Aug. 18, 2024, 2:11 p.m.	computer_name: TEST22-PC	1	1	0

Tries to locate where the browsers are installed (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Aug. 18, 2024, 2:11 p.m.		1	1	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

HTTP traffic contains suspicious features which may be indicative of malware related traffic (1 event)

suspicious_features

POST method with no referer header

suspicious_request

POST http://thizx13vt.top/v1/upload.php

Performs some HTTP requests (1 event)

request

POST http://thizx13vt.top/v1/upload.php

Sends data using the HTTP POST Method (1 event)

request

POST http://thizx13vt.top/v1/upload.php

Resolves a suspicious Top Level Domain (TLD) (1 event)

domain

thizx13vt.top

description

Generic top level domain TLD

Allocates read-write-execute memory (usually to unpack itself) (1 event)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory Aug. 18, 2024, 2:11 p.m.	process_identifier: 2556 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x732e2000 process_handle: 0xffffffff	1	0	0

Steals private information from local Internet browsers (4 events)

file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Web Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local State
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Login Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Cookies

The binary likely contains encrypted or compressed data indicative of a packer (1 event)

section

{u'size_of_data': u'0x00013600', u'virtual_address': u'0x007ff000', u'entropy': 6.8184756212349145, u'name': u'.reloc', u'virtual_size': u'0x00013560'}

entropy

6.81847562123

description

A section with a high entropy has been found

Queries for potentially installed applications (50 out of 68 events)

Time & API	Arguments	Status	Return
RegOpenKeyExW Aug. 18, 2024, 2:11 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall base_handle: 0x80000001 key_handle: 0x00000000 options: 0 access: 0x00020119 regkey: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall		2
RegOpenKeyExW Aug. 18, 2024, 2:11 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall base_handle: 0x80000002 key_handle: 0x000000e8 options: 0 access: 0x00020119 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall	1	0
RegOpenKeyExW Aug. 18, 2024, 2:11 p.m.	regkey_r: 7-Zip base_handle: 0x000000e8 key_handle: 0x000000ec options: 0 access: 0x00020119 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\7-Zip	1	0
RegOpenKeyExW Aug. 18, 2024, 2:11 p.m.	regkey_r: AddressBook base_handle: 0x000000e8 key_handle: 0x000000ec options: 0 access: 0x00020119 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook	1	0
RegOpenKeyExW Aug. 18, 2024, 2:11 p.m.	regkey_r: Connection Manager base_handle: 0x000000e8 key_handle: 0x000000ec options: 0 access: 0x00020119 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager	1	0
RegOpenKeyExW Aug. 18, 2024, 2:11 p.m.	regkey_r: DirectDrawEx base_handle: 0x000000e8 key_handle: 0x000000ec options: 0 access: 0x00020119 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx	1	0
RegOpenKeyExW Aug. 18, 2024, 2:11 p.m.	regkey_r: Fontcore base_handle: 0x000000e8 key_handle: 0x000000ec options: 0 access: 0x00020119 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore	1	0
RegOpenKeyExW Aug. 18, 2024, 2:11 p.m.	regkey_r: HashTab base_handle: 0x000000e8 key_handle: 0x000000ec options: 0 access: 0x00020119 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\HashTab	1	0
RegOpenKeyExW Aug. 18, 2024, 2:11 p.m.	regkey_r: IE40 base_handle: 0x000000e8 key_handle: 0x000000ec options: 0 access: 0x00020119 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE40	1	0
RegOpenKeyExW Aug. 18, 2024, 2:11 p.m.	regkey_r: IE4Data base_handle: 0x000000e8 key_handle: 0x000000ec options: 0 access: 0x00020119 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data	1	0
RegOpenKeyExW Aug. 18, 2024, 2:11 p.m.	regkey_r: IE5BAKEX base_handle: 0x000000e8 key_handle: 0x000000ec options: 0 access: 0x00020119 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX	1	0
RegOpenKeyExW Aug. 18, 2024, 2:11 p.m.	regkey_r: IEData base_handle: 0x000000e8 key_handle: 0x000000ec options: 0 access: 0x00020119 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IEData	1	0
RegOpenKeyExW Aug. 18, 2024, 2:11 p.m.	regkey_r: MobileOptionPack base_handle: 0x000000e8 key_handle: 0x000000ec options: 0 access: 0x00020119 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack	1	0
RegOpenKeyExW Aug. 18, 2024, 2:11 p.m.	regkey_r: Mozilla Firefox 105.0.1 (x64 en-US) base_handle: 0x000000e8 key_handle: 0x000000ec options: 0 access: 0x00020119 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Mozilla Firefox 105.0.1 (x64 en-US)	1	0
RegOpenKeyExW Aug. 18, 2024, 2:11 p.m.	regkey_r: MozillaMaintenanceService base_handle: 0x000000e8 key_handle: 0x000000ec options: 0 access: 0x00020119 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MozillaMaintenanceService	1	0
RegOpenKeyExW Aug. 18, 2024, 2:11 p.m.	regkey_r: SchedulingAgent base_handle: 0x000000e8 key_handle: 0x000000ec options: 0 access: 0x00020119 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent	1	0
RegOpenKeyExW Aug. 18, 2024, 2:11 p.m.	regkey_r: WIC base_handle: 0x000000e8 key_handle: 0x000000ec options: 0 access: 0x00020119 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WIC	1	0
RegOpenKeyExW Aug. 18, 2024, 2:11 p.m.	regkey_r: {1AD147D0-BE0E-3D6C-AC11-64F6DC4163F1} base_handle: 0x000000e8 key_handle: 0x000000ec options: 0 access: 0x00020119 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1AD147D0-BE0E-3D6C-AC11-64F6DC4163F1}	1	0
RegOpenKeyExW Aug. 18, 2024, 2:11 p.m.	regkey_r: {26A24AE4-039D-4CA4-87B4-2F86417051FF} base_handle: 0x000000e8 key_handle: 0x000000ec options: 0 access: 0x00020119 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{26A24AE4-039D-4CA4-87B4-2F86417051FF}	1	0
RegOpenKeyExW Aug. 18, 2024, 2:11 p.m.	regkey_r: {3160A0D4-A4F3-39B4-B4CC-B5306F9CF9B3} base_handle: 0x000000e8 key_handle: 0x000000ec options: 0 access: 0x00020119 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3160A0D4-A4F3-39B4-B4CC-B5306F9CF9B3}	1	0
RegOpenKeyExW Aug. 18, 2024, 2:11 p.m.	regkey_r: {50A2BC33-C9CD-3BF1-A8FF-53C10A0B183C} base_handle: 0x000000e8 key_handle: 0x000000ec options: 0 access: 0x00020119 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{50A2BC33-C9CD-3BF1-A8FF-53C10A0B183C}	1	0
RegOpenKeyExW Aug. 18, 2024, 2:11 p.m.	regkey_r: {90120000-0028-0412-1000-0000000FF1CE} base_handle: 0x000000e8 key_handle: 0x000000ec options: 0 access: 0x00020119 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0028-0412-1000-0000000FF1CE}	1	0
RegOpenKeyExW Aug. 18, 2024, 2:11 p.m.	regkey_r: {90120000-002A-0000-1000-0000000FF1CE} base_handle: 0x000000e8 key_handle: 0x000000ec options: 0 access: 0x00020119 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-002A-0000-1000-0000000FF1CE}	1	0
RegOpenKeyExW Aug. 18, 2024, 2:11 p.m.	regkey_r: {90120000-002A-0409-1000-0000000FF1CE} base_handle: 0x000000e8 key_handle: 0x000000ec options: 0 access: 0x00020119 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-002A-0409-1000-0000000FF1CE}	1	0
RegOpenKeyExW Aug. 18, 2024, 2:11 p.m.	regkey_r: {90120000-002A-0412-1000-0000000FF1CE} base_handle: 0x000000e8 key_handle: 0x000000ec options: 0 access: 0x00020119 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-002A-0412-1000-0000000FF1CE}	1	0
RegOpenKeyExW Aug. 18, 2024, 2:11 p.m.	regkey_r: {92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033 base_handle: 0x000000e8 key_handle: 0x000000ec options: 0 access: 0x00020119 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033	1	0
RegOpenKeyExW Aug. 18, 2024, 2:11 p.m.	regkey_r: {92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1042 base_handle: 0x000000e8 key_handle: 0x000000ec options: 0 access: 0x00020119 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1042	1	0
RegOpenKeyExW Aug. 18, 2024, 2:11 p.m.	regkey_r: {A5F504DF-2ED9-4A2D-A2F3-9D2750DD42D6} base_handle: 0x000000e8 key_handle: 0x000000ec options: 0 access: 0x00020119 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{A5F504DF-2ED9-4A2D-A2F3-9D2750DD42D6}	1	0
RegOpenKeyExW Aug. 18, 2024, 2:11 p.m.	regkey_r: {EF1EC6A9-17DE-3DA9-B040-686A1E8A8B04} base_handle: 0x000000e8 key_handle: 0x000000ec options: 0 access: 0x00020119 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{EF1EC6A9-17DE-3DA9-B040-686A1E8A8B04}	1	0
RegOpenKeyExW Aug. 18, 2024, 2:11 p.m.	regkey_r: SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall base_handle: 0x80000002 key_handle: 0x000000e8 options: 0 access: 0x00020119 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall	1	0
RegOpenKeyExW Aug. 18, 2024, 2:11 p.m.	regkey_r: AddressBook base_handle: 0x000000e8 key_handle: 0x000000ec options: 0 access: 0x00020119 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook	1	0
RegOpenKeyExW Aug. 18, 2024, 2:11 p.m.	regkey_r: Connection Manager base_handle: 0x000000e8 key_handle: 0x000000ec options: 0 access: 0x00020119 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager	1	0
RegOpenKeyExW Aug. 18, 2024, 2:11 p.m.	regkey_r: DirectDrawEx base_handle: 0x000000e8 key_handle: 0x000000ec options: 0 access: 0x00020119 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx	1	0
RegOpenKeyExW Aug. 18, 2024, 2:11 p.m.	regkey_r: EditPlus base_handle: 0x000000e8 key_handle: 0x000000ec options: 0 access: 0x00020119 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\EditPlus	1	0
RegOpenKeyExW Aug. 18, 2024, 2:11 p.m.	regkey_r: ENTERPRISE base_handle: 0x000000e8 key_handle: 0x000000ec options: 0 access: 0x00020119 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\ENTERPRISE	1	0
RegOpenKeyExW Aug. 18, 2024, 2:11 p.m.	regkey_r: Fontcore base_handle: 0x000000e8 key_handle: 0x000000ec options: 0 access: 0x00020119 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore	1	0
RegOpenKeyExW Aug. 18, 2024, 2:11 p.m.	regkey_r: Google Chrome base_handle: 0x000000e8 key_handle: 0x000000ec options: 0 access: 0x00020119 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome	1	0
RegOpenKeyExW Aug. 18, 2024, 2:11 p.m.	regkey_r: Haansoft HWord 80 Korean base_handle: 0x000000e8 key_handle: 0x000000ec options: 0 access: 0x00020119 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Haansoft HWord 80 Korean	1	0
RegOpenKeyExW Aug. 18, 2024, 2:11 p.m.	regkey_r: IE40 base_handle: 0x000000e8 key_handle: 0x000000ec options: 0 access: 0x00020119 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE40	1	0
RegOpenKeyExW Aug. 18, 2024, 2:11 p.m.	regkey_r: IE4Data base_handle: 0x000000e8 key_handle: 0x000000ec options: 0 access: 0x00020119 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data	1	0
RegOpenKeyExW Aug. 18, 2024, 2:11 p.m.	regkey_r: IE5BAKEX base_handle: 0x000000e8 key_handle: 0x000000ec options: 0 access: 0x00020119 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX	1	0
RegOpenKeyExW Aug. 18, 2024, 2:11 p.m.	regkey_r: IEData base_handle: 0x000000e8 key_handle: 0x000000ec options: 0 access: 0x00020119 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IEData	1	0
RegOpenKeyExW Aug. 18, 2024, 2:11 p.m.	regkey_r: MobileOptionPack base_handle: 0x000000e8 key_handle: 0x000000ec options: 0 access: 0x00020119 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack	1	0
RegOpenKeyExW Aug. 18, 2024, 2:11 p.m.	regkey_r: SchedulingAgent base_handle: 0x000000e8 key_handle: 0x000000ec options: 0 access: 0x00020119 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent	1	0
RegOpenKeyExW Aug. 18, 2024, 2:11 p.m.	regkey_r: WIC base_handle: 0x000000e8 key_handle: 0x000000ec options: 0 access: 0x00020119 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\WIC	1	0
RegOpenKeyExW Aug. 18, 2024, 2:11 p.m.	regkey_r: {01B845D4-B73E-4CF7-A377-94BC7BB4F77B} base_handle: 0x000000e8 key_handle: 0x000000ec options: 0 access: 0x00020119 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{01B845D4-B73E-4CF7-A377-94BC7BB4F77B}	1	0
RegOpenKeyExW Aug. 18, 2024, 2:11 p.m.	regkey_r: {1D91F7DA-F517-4727-9E62-B7EA978BE980} base_handle: 0x000000e8 key_handle: 0x000000ec options: 0 access: 0x00020119 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D91F7DA-F517-4727-9E62-B7EA978BE980}	1	0
RegOpenKeyExW Aug. 18, 2024, 2:11 p.m.	regkey_r: {60EC980A-BDA2-4CB6-A427-B07A5498B4CA} base_handle: 0x000000e8 key_handle: 0x000000ec options: 0 access: 0x00020119 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}	1	0
RegOpenKeyExW Aug. 18, 2024, 2:11 p.m.	regkey_r: {90120000-0015-0412-0000-0000000FF1CE} base_handle: 0x000000e8 key_handle: 0x000000ec options: 0 access: 0x00020119 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0015-0412-0000-0000000FF1CE}	1	0
RegOpenKeyExW Aug. 18, 2024, 2:11 p.m.	regkey_r: {90120000-0016-0412-0000-0000000FF1CE} base_handle: 0x000000e8 key_handle: 0x000000ec options: 0 access: 0x00020119 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0016-0412-0000-0000000FF1CE}	1	0

Checks the CPU name from registry, possibly for anti-virtualization (1 event)

registry

HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString

Collects information about installed applications (44 events)

Time & API	Arguments	Status
RegQueryValueExW Aug. 18, 2024, 2:11 p.m.	key_handle: 0x000000ec regkey_r: DisplayName reg_type: 1 (REG_SZ) value: 7-Zip 19.00 (x64) regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\7-Zip\DisplayName	1
RegQueryValueExW Aug. 18, 2024, 2:11 p.m.	key_handle: 0x000000ec regkey_r: DisplayName reg_type: 1 (REG_SZ) value: HashTab 6.0.0.34 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\HashTab\DisplayName	1
RegQueryValueExW Aug. 18, 2024, 2:11 p.m.	key_handle: 0x000000ec regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Mozilla Firefox (x64 en-US) regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Mozilla Firefox 105.0.1 (x64 en-US)\DisplayName	1
RegQueryValueExW Aug. 18, 2024, 2:11 p.m.	key_handle: 0x000000ec regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Mozilla Maintenance Service regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MozillaMaintenanceService\DisplayName	1
RegQueryValueExW Aug. 18, 2024, 2:11 p.m.	key_handle: 0x000000ec regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft .NET Framework 4.5 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1AD147D0-BE0E-3D6C-AC11-64F6DC4163F1}\DisplayName	1
RegQueryValueExW Aug. 18, 2024, 2:11 p.m.	key_handle: 0x000000ec regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Java 7 Update 51 (64-bit) regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{26A24AE4-039D-4CA4-87B4-2F86417051FF}\DisplayName	1
RegQueryValueExW Aug. 18, 2024, 2:11 p.m.	key_handle: 0x000000ec regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft .NET Framework 4.5 KOR Language Pack regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3160A0D4-A4F3-39B4-B4CC-B5306F9CF9B3}\DisplayName	1
RegQueryValueExW Aug. 18, 2024, 2:11 p.m.	key_handle: 0x000000ec regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Visual C++ 2015 x64 Minimum Runtime - 14.0.24215 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{50A2BC33-C9CD-3BF1-A8FF-53C10A0B183C}\DisplayName	1
RegQueryValueExW Aug. 18, 2024, 2:11 p.m.	key_handle: 0x000000ec regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office IME (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0028-0412-1000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Aug. 18, 2024, 2:11 p.m.	key_handle: 0x000000ec regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Office 64-bit Components 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-002A-0000-1000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Aug. 18, 2024, 2:11 p.m.	key_handle: 0x000000ec regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Shared 64-bit MUI (English) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-002A-0409-1000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Aug. 18, 2024, 2:11 p.m.	key_handle: 0x000000ec regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Shared 64-bit MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-002A-0412-1000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Aug. 18, 2024, 2:11 p.m.	key_handle: 0x000000ec regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft .NET Framework 4.5 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033\DisplayName	1
RegQueryValueExW Aug. 18, 2024, 2:11 p.m.	key_handle: 0x000000ec regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft .NET Framework 4.5 한국어 언어 팩 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1042\DisplayName	1
RegQueryValueExW Aug. 18, 2024, 2:11 p.m.	key_handle: 0x000000ec regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Python 2.7.18 (64-bit) regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{A5F504DF-2ED9-4A2D-A2F3-9D2750DD42D6}\DisplayName	1
RegQueryValueExW Aug. 18, 2024, 2:11 p.m.	key_handle: 0x000000ec regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Visual C++ 2015 x64 Additional Runtime - 14.0.24215 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{EF1EC6A9-17DE-3DA9-B040-686A1E8A8B04}\DisplayName	1
RegQueryValueExW Aug. 18, 2024, 2:11 p.m.	key_handle: 0x000000ec regkey_r: DisplayName reg_type: 1 (REG_SZ) value: EditPlus regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\EditPlus\DisplayName	1
RegQueryValueExW Aug. 18, 2024, 2:11 p.m.	key_handle: 0x000000ec regkey_r: DisplayName reg_type: 1 (REG_SZ) value: EditPlus regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\EditPlus\DisplayName	1
RegQueryValueExW Aug. 18, 2024, 2:11 p.m.	key_handle: 0x000000ec regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Enterprise 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\ENTERPRISE\DisplayName	1
RegQueryValueExW Aug. 18, 2024, 2:11 p.m.	key_handle: 0x000000ec regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Chrome regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome\DisplayName	1
RegQueryValueExW Aug. 18, 2024, 2:11 p.m.	key_handle: 0x000000ec regkey_r: DisplayName reg_type: 1 (REG_SZ) value: 한컴오피스 한글 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Haansoft HWord 80 Korean\DisplayName	1
RegQueryValueExW Aug. 18, 2024, 2:11 p.m.	key_handle: 0x000000ec regkey_r: DisplayName reg_type: 1 (REG_SZ) value: HttpWatch Professional 9.3.39 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{01B845D4-B73E-4CF7-A377-94BC7BB4F77B}\DisplayName	1
RegQueryValueExW Aug. 18, 2024, 2:11 p.m.	key_handle: 0x000000ec regkey_r: DisplayName reg_type: 1 (REG_SZ) value: 한컴오피스 한글 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D91F7DA-F517-4727-9E62-B7EA978BE980}\DisplayName	1
RegQueryValueExW Aug. 18, 2024, 2:11 p.m.	key_handle: 0x000000ec regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Google Update Helper regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}\DisplayName	1
RegQueryValueExW Aug. 18, 2024, 2:11 p.m.	key_handle: 0x000000ec regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Access MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0015-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Aug. 18, 2024, 2:11 p.m.	key_handle: 0x000000ec regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Excel MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0016-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Aug. 18, 2024, 2:11 p.m.	key_handle: 0x000000ec regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office PowerPoint MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0018-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Aug. 18, 2024, 2:11 p.m.	key_handle: 0x000000ec regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Publisher MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0019-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Aug. 18, 2024, 2:11 p.m.	key_handle: 0x000000ec regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Outlook MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001A-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Aug. 18, 2024, 2:11 p.m.	key_handle: 0x000000ec regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Word MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001B-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Aug. 18, 2024, 2:11 p.m.	key_handle: 0x000000ec regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Proof (English) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001F-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Aug. 18, 2024, 2:11 p.m.	key_handle: 0x000000ec regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Proof (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001F-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Aug. 18, 2024, 2:11 p.m.	key_handle: 0x000000ec regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office IME (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0028-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Aug. 18, 2024, 2:11 p.m.	key_handle: 0x000000ec regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Proofing (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-002C-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Aug. 18, 2024, 2:11 p.m.	key_handle: 0x000000ec regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Enterprise 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0030-0000-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Aug. 18, 2024, 2:11 p.m.	key_handle: 0x000000ec regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office InfoPath MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0044-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Aug. 18, 2024, 2:11 p.m.	key_handle: 0x000000ec regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Shared MUI (English) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-006E-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Aug. 18, 2024, 2:11 p.m.	key_handle: 0x000000ec regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Shared MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-006E-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Aug. 18, 2024, 2:11 p.m.	key_handle: 0x000000ec regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office OneNote MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-00A1-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Aug. 18, 2024, 2:11 p.m.	key_handle: 0x000000ec regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Groove MUI (English) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-00BA-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Aug. 18, 2024, 2:11 p.m.	key_handle: 0x000000ec regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Groove Setup Metadata MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0114-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Aug. 18, 2024, 2:11 p.m.	key_handle: 0x000000ec regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Adobe Flash Player 13 ActiveX regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{939659F3-71D2-461F-B24D-91D05A4389B4}\DisplayName	1
RegQueryValueExW Aug. 18, 2024, 2:11 p.m.	key_handle: 0x000000ec regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Adobe Flash Player 13 NPAPI regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{9B84A461-3B4C-40E2-B44F-CE22E215EE40}\DisplayName	1
RegQueryValueExW Aug. 18, 2024, 2:11 p.m.	key_handle: 0x000000ec regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Visual C++ 2015 Redistributable (x64) - 14.0.24215 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{d992c12e-cab2-426f-bde3-fb8c53950b0d}\DisplayName	1

File has been identified by 28 AntiVirus engines on VirusTotal as malicious (28 events)

Bkav	W32.AIDetectMalware
Elastic	malicious (high confidence)
ALYac	Generic.Dacic.3594.9FB9AD5B
VIPRE	Generic.Dacic.3594.9FB9AD5B
BitDefender	Generic.Dacic.3594.9FB9AD5B
Cybereason	malicious.436fc7
Arcabit	Trojan.Zusy.D87939
ESET-NOD32	a variant of Win32/PSW.Agent.OGR
APEX	Malicious
Avast	Win32:Evo-gen [Trj]
ClamAV	Win.Malware.Barys-10032866-0
Kaspersky	VHO:Trojan-PSW.Win32.Stealer.gen
MicroWorld-eScan	Generic.Dacic.3594.9FB9AD5B
Rising	Stealer.Agent!8.C2 (TFE:5:h9aZED7bPvN)
Emsisoft	Generic.Dacic.3594.9FB9AD5B (B)
FireEye	Generic.Dacic.3594.9FB9AD5B
Google	Detected
MAX	malware (ai score=83)
Microsoft	Trojan:Win32/CryptBot.CCJD!MTB
ZoneAlarm	VHO:Trojan-PSW.Win32.Stealer.gen
GData	Generic.Dacic.3594.9FB9AD5B
AhnLab-V3	Infostealer/Win.CryptBot.R661086
BitDefenderTheta	Gen:NN.ZexaF.36810.T!Z@amDw0!f
Malwarebytes	Spyware.Stealer
Ikarus	Trojan-PSW.Agent
huorong	TrojanSpy/Stealer.lt
Fortinet	W32/Agent.OGR!tr.pws
AVG	Win32:Evo-gen [Trj]

3546345.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All