IntelFIVE.txt

Queries for the computername (1 event)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameW March 17, 2021, 11:10 p.m.	computer_name: WIN7-PC	1	1	0

Command line console output was observed (1 event)

Time & API	Arguments	Status	Return	Repeated
WriteConsoleW March 17, 2021, 11:10 p.m.	buffer: 성공: 예약된 작업 "IntelFIVE"을(를) 만들었습니다. console_handle: 0x00000007	1	1	0

This executable has a PDB path (1 event)

pdb_path

D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

.didat

The file contains an unknown PE resource name possibly indicative of a packer (1 event)

resource name

PNG

Allocates read-write-execute memory (usually to unpack itself) (1 event)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory March 17, 2021, 11:10 p.m.	process_identifier: 6272 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72322000 process_handle: 0xffffffff	1	0	0

Creates executable files on the filesystem (1 event)

file	C:\ProgramData\Intel\IntelFIVE.exe

Creates a suspicious process (2 events)

cmdline	"C:\Windows\System32\schtasks.exe" /CREATE /SC HOURLY /MO 1 /TN IntelFIVE /TR C:\ProgramData\Intel\IntelFIVE.exe /F
cmdline	SCHTASKS /CREATE /SC HOURLY /MO 1 /TN IntelFIVE /TR C:\ProgramData\Intel\IntelFIVE.exe /F

Yara rule detected in process memory (12 events)

description	Listen for incoming communication				rule	network_tcp_listen
description	Affect system registries				rule	win_registry
description	Affect system token				rule	win_token
description	Affect private profile				rule	win_files_operation
description	Match Winsock 2 API library declaration				rule	Str_Win32_Winsock2_Library
description	(no description)				rule	DebuggerCheck__GlobalFlags
description	(no description)				rule	DebuggerCheck__QueryInfo
description	(no description)				rule	DebuggerHiding__Thread
description	(no description)				rule	DebuggerHiding__Active
description	(no description)				rule	SEH__vectored
description	Checks if being debugged				rule	anti_dbg
description	Bypass DEP				rule	disable_dep

Uses Windows utilities for basic Windows functionality (2 events)

cmdline	"C:\Windows\System32\schtasks.exe" /CREATE /SC HOURLY /MO 1 /TN IntelFIVE /TR C:\ProgramData\Intel\IntelFIVE.exe /F
cmdline	SCHTASKS /CREATE /SC HOURLY /MO 1 /TN IntelFIVE /TR C:\ProgramData\Intel\IntelFIVE.exe /F

Installs itself for autorun at Windows startup (2 events)

cmdline	"C:\Windows\System32\schtasks.exe" /CREATE /SC HOURLY /MO 1 /TN IntelFIVE /TR C:\ProgramData\Intel\IntelFIVE.exe /F
cmdline	SCHTASKS /CREATE /SC HOURLY /MO 1 /TN IntelFIVE /TR C:\ProgramData\Intel\IntelFIVE.exe /F

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Process injection	Process 6272 resumed a thread in remote process 5088
Time & API	Arguments	Status	Return	Repeated
NtResumeThread March 17, 2021, 11:10 p.m.	thread_handle: 0x00000278 suspend_count: 1 process_identifier: 5088	1	0	0

File has been identified by 22 AntiVirus engines on VirusTotal as malicious (22 events)

Bkav	W32.AIDetect.malware2
Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.Symmi.44298
FireEye	Generic.mg.eb39c3a8f12a353c
Sangfor	Trojan.Win32.Save.a
Cybereason	malicious.8f12a3
Arcabit	Trojan.Symmi.DAD0A
Cyren	W32/Trojan.REOR-6425
APEX	Malicious
Kaspersky	HEUR:Backdoor.Win32.Xaparo.gen
BitDefender	Gen:Variant.Symmi.44298
Rising	Trojan.TaskRun/SFX!1.D3EF (CLASSIC)
Sophos	ML/PE-A
Zillya	Trojan.ScriptKD.JS.10
McAfee-GW-Edition	BehavesLike.Win32.Generic.bc
Emsisoft	Gen:Variant.Symmi.44298 (B)
MAX	malware (ai score=85)
ZoneAlarm	HEUR:Backdoor.Win32.Xaparo.gen
GData	Gen:Variant.Symmi.44298
Cynet	Malicious (score: 100)
ALYac	Gen:Variant.Symmi.44298
Malwarebytes	Malware.Heuristic.1001