ret83d.exe

Queries for the computername (4 events)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameA March 30, 2021, 9:18 a.m.	computer_name: TEST22-PC	1	1	0
GetComputerNameA March 30, 2021, 9:19 a.m.	computer_name: TEST22-PC	1	1	0
GetComputerNameA March 30, 2021, 9:19 a.m.	computer_name: TEST22-PC	1	1	0
GetComputerNameA March 30, 2021, 9:20 a.m.	computer_name: TEST22-PC	1	1	0

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx March 30, 2021, 9:19 a.m.		1	1	0

Creates executable files on the filesystem (1 event)

file	C:\Users\test22\AppData\Local\Temp\U4X1ECC.exe

A process created a hidden window (3 events)

Time & API	Arguments	Status	Return	Repeated
CreateProcessInternalW March 30, 2021, 9:19 a.m.	thread_identifier: 3908 thread_handle: 0x00000000000000d4 process_identifier: 8340 current_directory: filepath: track: 1 command_line: cmd /c ping 8.8.7.7 -n 2 & start C:\Users\test22\AppData\Local\Temp\ret83d.exe M41OFD filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 0 process_handle: 0x00000000000000d8	1	1	0
CreateProcessInternalW March 30, 2021, 9:19 a.m.	thread_identifier: 3968 thread_handle: 0x00000000000000d4 process_identifier: 2648 current_directory: filepath: track: 1 command_line: cmd /c ping 8.8.7.7 -n 2 & start C:\Users\test22\AppData\Local\Temp\U4X1ECC.exe MLUO54B filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 0 process_handle: 0x00000000000000d8	1	1	0
CreateProcessInternalW March 30, 2021, 9:19 a.m.	thread_identifier: 9060 thread_handle: 0x00000000000000d8 process_identifier: 7352 current_directory: filepath: track: 1 command_line: cmd /c ping 8.8.7.7 -n 2 & start C:\Users\test22\AppData\Local\Temp\U4X1ECC.exe TQ8AX filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 0 process_handle: 0x00000000000000dc	1	1	0

Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (3 events)

Time & API	Arguments	Status	Return	Repeated
Process32NextW March 30, 2021, 9:19 a.m.	snapshot_handle: 0x00000000000000ac process_name: pw.exe process_identifier: 5952	1	1	0
Process32NextW March 30, 2021, 9:19 a.m.	snapshot_handle: 0x00000000000000ac process_name: taskhost.exe process_identifier: 2288	1	1	0
Process32NextW March 30, 2021, 9:19 a.m.	snapshot_handle: 0x00000000000000ac process_name: ret83d.exe process_identifier: 2352	1	1	0

File has been identified by 7 AntiVirus engines on VirusTotal as malicious (7 events)

Elastic	malicious (high confidence)
Cylance	Unsafe
Cybereason	malicious.62b108
APEX	Malicious
Microsoft	Trojan:Win32/Wacatac.B!ml
Cynet	Malicious (score: 100)
CrowdStrike	win/malicious_confidence_60% (D)

Yara rule detected in process memory (50 out of 126 events)

description	Code injection with CreateRemoteThread in a remote process				rule	inject_thread
description	Create a windows service				rule	create_service
description	Communications over UDP network				rule	network_udp_sock
description	Listen for incoming communication				rule	network_tcp_listen
description	Communications over P2P network				rule	network_p2p_win
description	Communications over HTTP				rule	network_http
description	File downloader/dropper				rule	network_dropper
description	Communications over FTP				rule	network_ftp
description	Communications over RAW socket				rule	network_tcp_socket
description	Communications use DNS				rule	network_dns
description	Communication using dga				rule	network_dga
description	Escalade priviledges				rule	escalate_priv
description	Take screenshot				rule	screenshot
description	Run a keylogger				rule	keylogger
description	Steal credential				rule	cred_local
description	Record Audio				rule	sniff_audio
description	APC queue tasks migration				rule	migrate_apc
description	Malware can spread east-west file				rule	spreading_file
description	Malware can spread east-west using share drive				rule	spreading_share
description	Create or check mutex				rule	win_mutex
description	Affect system registries				rule	win_registry
description	Affect system token				rule	win_token
description	Affect private profile				rule	win_private_profile
description	Affect private profile				rule	win_files_operation
description	Match Winsock 2 API library declaration				rule	Str_Win32_Winsock2_Library
description	Match Windows Inet API library declaration				rule	Str_Win32_Wininet_Library
description	Match Windows Inet API call				rule	Str_Win32_Internet_API
description	Match Windows Http API call				rule	Str_Win32_Http_API
description	(no description)				rule	DebuggerCheck__GlobalFlags
description	(no description)				rule	DebuggerCheck__QueryInfo
description	(no description)				rule	DebuggerCheck__RemoteAPI
description	(no description)				rule	DebuggerHiding__Thread
description	(no description)				rule	DebuggerHiding__Active
description	(no description)				rule	DebuggerException__ConsoleCtrl
description	(no description)				rule	DebuggerException__SetConsoleCtrl
description	(no description)				rule	ThreadControl__Context
description	(no description)				rule	SEH__vectored
description	(no description)				rule	Check_Dlls
description	Checks if being debugged				rule	anti_dbg
description	Anti-Sandbox checks for ThreatExpert				rule	antisb_threatExpert
description	Bypass DEP				rule	disable_dep
description	Affect hook table				rule	win_hook
description	Code injection with CreateRemoteThread in a remote process				rule	inject_thread
description	Create a windows service				rule	create_service
description	Communications over UDP network				rule	network_udp_sock
description	Listen for incoming communication				rule	network_tcp_listen
description	Communications over P2P network				rule	network_p2p_win
description	Communications over HTTP				rule	network_http
description	File downloader/dropper				rule	network_dropper
description	Communications over FTP				rule	network_ftp

Uses Windows utilities for basic Windows functionality (4 events)

cmdline	cmd /c ping 8.8.7.7 -n 2 & start C:\Users\test22\AppData\Local\Temp\U4X1ECC.exe TQ8AX
cmdline	ping 8.8.7.7 -n 2
cmdline	cmd /c ping 8.8.7.7 -n 2 & start C:\Users\test22\AppData\Local\Temp\U4X1ECC.exe MLUO54B
cmdline	cmd /c ping 8.8.7.7 -n 2 & start C:\Users\test22\AppData\Local\Temp\ret83d.exe M41OFD

Communicates with host for which no DNS query was performed (2 events)

host	172.217.25.14
host	8.8.7.7

Installs itself for autorun at Windows startup (1 event)

reg_key

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce\CRN6I0NGBZ

reg_value

cmd.exe /c reg.exe add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v W2Y5JPZ00 /t REG_SZ /d "C:\Users\test22\AppData\Local\Temp\U4X1ECC.exe TQ8AX" & start "H" C:\Users\test22\AppData\Local\Temp\U4X1ECC.exe TQ8AX

Drops a binary and executes it (1 event)

file	C:\Users\test22\AppData\Local\Temp\U4X1ECC.exe

Resumed a suspended thread in a remote process potentially indicative of process injection (6 events)

Process injection	Process 8340 resumed a thread in remote process 4120
Process injection	Process 2648 resumed a thread in remote process 6304
Process injection	Process 7352 resumed a thread in remote process 5512
Time & API	Arguments	Status	Return	Repeated
NtResumeThread March 30, 2021, 9:19 a.m.	thread_handle: 0x0000000000000064 suspend_count: 0 process_identifier: 4120	1	0	0
NtResumeThread March 30, 2021, 9:19 a.m.	thread_handle: 0x0000000000000064 suspend_count: 0 process_identifier: 6304	1	0	0
NtResumeThread March 30, 2021, 9:20 a.m.	thread_handle: 0x0000000000000064 suspend_count: 0 process_identifier: 5512	1	0	0

Generates some ICMP traffic