Windows Analysis Report
lzxbD4wR0g.exe

Source: C:\Users\user\Desktop\lzxbD4wR0g.exe

File created: C:\Windows\5b44de

Source: C:\Users\user\Desktop\lzxbD4wR0g.exe	Code function: 0_2_0220E329	0_2_0220E329
Source: C:\Users\user\Desktop\lzxbD4wR0g.exe	Code function: 0_2_0220B614	0_2_0220B614
Source: C:\Users\user\Desktop\lzxbD4wR0g.exe	Code function: 0_2_02216CD0	0_2_02216CD0

Source: lzxbD4wR0g.exe

Binary or memory string: OriginalFilenameWdExt.exe vs lzxbD4wR0g.exe

Source: xnpkup.exe.0.dr

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_LOCKED, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: xnpkup.exe.0.dr

Static PE information: Section .text

Source: lzxbD4wR0g.exe

Static PE information: Section: .rsrc ZLIB complexity 0.9915533685064936

Source: lzxbD4wR0g.exe	Virustotal: Detection: 77%
Source: lzxbD4wR0g.exe	ReversingLabs: Detection: 100%

Source: C:\Users\user\Desktop\lzxbD4wR0g.exe

File read: C:\Users\user\Desktop\lzxbD4wR0g.exe

Source: C:\Users\user\Desktop\lzxbD4wR0g.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: unknown	Process created: C:\Users\user\Desktop\lzxbD4wR0g.exe C:\Users\user\Desktop\lzxbD4wR0g.exe
Source: C:\Users\user\Desktop\lzxbD4wR0g.exe	Process created: C:\Windows\SysWOW64\explorer.exe explorer.exe
Source: C:\Users\user\Desktop\lzxbD4wR0g.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 1248 -s 832
Source: C:\Users\user\Desktop\lzxbD4wR0g.exe	Process created: C:\Windows\SysWOW64\explorer.exe explorer.exe	Jump to behavior

Source: C:\Users\user\Desktop\lzxbD4wR0g.exe

Code function: 0_2_02211EF6 OpenProcess,GetLastError,GetVersionExA,GetCurrentThread,OpenThreadToken,GetLastError,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,CloseHandle,GetLastError,CloseHandle,OpenProcess,AdjustTokenPrivileges,FindCloseChangeNotification,OpenProcessToken,GetTokenInformation,GetLastError,GetProcessHeap,RtlAllocateHeap,GetTokenInformation,LookupAccountSidA,lstrcmpi,lstrcmpi,lstrcmpi,CreateMutexA,VirtualAllocEx,WriteProcessMemory,CreateRemoteThread,VirtualAllocEx,lstrlen,WriteProcessMemory,CreateRemoteThread,FindCloseChangeNotification,CloseHandle,GetProcessHeap,HeapFree,

Source: C:\Users\user\Desktop\lzxbD4wR0g.exe

File created: C:\Users\user\AppData\Local\Temp\xnpkup.exe

Source: classification engine

Classification label: mal100.spre.evad.winEXE@5/2@0/1

Source: C:\Users\user\Desktop\lzxbD4wR0g.exe

File read: C:\Windows\system.ini

Source: C:\Users\user\Desktop\lzxbD4wR0g.exe

Code function: 0_2_02212514 CreateToolhelp32Snapshot,Process32First,lstrlen,lstrcpyn,lstrcpy,CharLowerA,lstrlen,wsprintfA,CreateMutexA,GetLastError,ReleaseMutex,CloseHandle,Process32Next,lstrlen,lstrcpyn,lstrcpy,CharLowerA,lstrlen,wsprintfA,CreateMutexA,GetLastError,ReleaseMutex,FindCloseChangeNotification,CloseHandle,

0_2_02212514

Source: C:\Users\user\Desktop\lzxbD4wR0g.exe	Mutant created: \Sessions\1\BaseNamedObjects\wininit.exeM_464_
Source: C:\Users\user\Desktop\lzxbD4wR0g.exe	Mutant created: \Sessions\1\BaseNamedObjects\csrss.exeM_476_
Source: C:\Users\user\Desktop\lzxbD4wR0g.exe	Mutant created: \Sessions\1\BaseNamedObjects\csrss.exeM_392_
Source: C:\Users\user\Desktop\lzxbD4wR0g.exe	Mutant created: \Sessions\1\BaseNamedObjects\winlogon.exeM_556_
Source: C:\Users\user\Desktop\lzxbD4wR0g.exe	Mutant created: \Sessions\1\BaseNamedObjects\uxJLpe1m
Source: C:\Users\user\Desktop\lzxbD4wR0g.exe	Mutant created: \Sessions\1\BaseNamedObjects\fontdrvhost.exeM_684_
Source: C:\Users\user\Desktop\lzxbD4wR0g.exe	Mutant created: \Sessions\1\BaseNamedObjects\services.exeM_564_
Source: C:\Users\user\Desktop\lzxbD4wR0g.exe	Mutant created: \Sessions\1\BaseNamedObjects\registryM_88_
Source: C:\Users\user\Desktop\lzxbD4wR0g.exe	Mutant created: \Sessions\1\BaseNamedObjects\smss.exeM_296_
Source: C:\Users\user\Desktop\lzxbD4wR0g.exe	Mutant created: \Sessions\1\BaseNamedObjects\lsass.exeM_600_

Source: lzxbD4wR0g.exe

String found in binary or memory: F-STOPW.

Source: C:\Users\user\Desktop\lzxbD4wR0g.exe

File written: C:\Windows\system.ini

Source: C:\Users\user\Desktop\lzxbD4wR0g.exe	Process created: C:\Windows\SysWOW64\explorer.exe
Source: C:\Users\user\Desktop\lzxbD4wR0g.exe	Process created: C:\Windows\SysWOW64\explorer.exe			Jump to behavior

Source: lzxbD4wR0g.exe

Static file information: File size 2111255 > 1048576

Source:	Binary string: -;E:\Git_reponse\mesworker\dist\RealUpdater.pdb source: lzxbD4wR0g.exe
Source:	Binary string: E:\Git_reponse\mesworker\dist\RealUpdater.pdb source: lzxbD4wR0g.exe

Source: C:\Users\user\Desktop\lzxbD4wR0g.exe	Code function: 0_2_00401650 push eax; ret	0_2_0040167E
Source: C:\Users\user\Desktop\lzxbD4wR0g.exe	Code function: 0_2_0043612C push esi; ret	0_2_0043612D
Source: C:\Users\user\Desktop\lzxbD4wR0g.exe	Code function: 0_2_0042543A push ebx; retf	0_2_0042544A
Source: C:\Users\user\Desktop\lzxbD4wR0g.exe	Code function: 0_2_02218060 push eax; ret	0_2_0221808E

Source: C:\Users\user\Desktop\lzxbD4wR0g.exe

Code function: 0_2_02209EEA Sleep,Sleep,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateThread,LoadLibraryA,GetProcAddress,CreateThread,RtlExitUserThread,

0_2_02209EEA

Source: initial sample	Static PE information: section name: .rsrc entropy: 7.990480623641147
Source: initial sample	Static PE information: section name: .text entropy: 7.986794508081656

Source: C:\Users\user\Desktop\lzxbD4wR0g.exe

File created: C:\Users\user\AppData\Local\Temp\xnpkup.exe

Jump to dropped file

Source: C:\Users\user\Desktop\lzxbD4wR0g.exe

Registry key value modified: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile

May modify the system service descriptor table (often done to hook functions)

Hooking and other Techniques for Hiding and Protection

Source: lzxbD4wR0g.exe	Binary or memory string: KeServiceDescriptorTable
Source: lzxbD4wR0g.exe, 00000000.00000002.317172937.0000000002200000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: KeServiceDescriptorTable

Source: C:\Users\user\Desktop\lzxbD4wR0g.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lzxbD4wR0g.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lzxbD4wR0g.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\lzxbD4wR0g.exe TID: 4228	Thread sleep time: -120000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\lzxbD4wR0g.exe TID: 5984	Thread sleep time: -67951s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\lzxbD4wR0g.exe TID: 6024	Thread sleep time: -300000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\lzxbD4wR0g.exe TID: 4736	Thread sleep time: -180000s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\lzxbD4wR0g.exe	Thread delayed: delay time: 300000			Jump to behavior
Source: C:\Users\user\Desktop\lzxbD4wR0g.exe	Thread delayed: delay time: 180000			Jump to behavior

Source: C:\Users\user\Desktop\lzxbD4wR0g.exe

Process information queried: ProcessInformation

Source: C:\Users\user\Desktop\lzxbD4wR0g.exe	Code function: 0_2_0220A2F5 Sleep,GetTempPathA,lstrlen,lstrcat,lstrlen,lstrcpy,lstrcat,FindFirstFileA,FindNextFileA,lstrcat,lstrlen,lstrlen,lstrcmpi,lstrcmpi,Sleep,FindClose,Sleep,RtlExitUserThread,		0_2_0220A2F5
Source: C:\Users\user\Desktop\lzxbD4wR0g.exe	Code function: 0_2_02211060 Sleep,lstrcat,lstrcat,FindFirstFileA,FindNextFileA,Sleep,lstrlen,lstrcat,lstrlen,lstrlen,lstrcmpi,lstrcmpi,lstrcpy,lstrcat,DeleteFileA,lstrcpy,lstrlen,lstrcmpi,FindClose,Sleep,		0_2_02211060

Source: C:\Users\user\Desktop\lzxbD4wR0g.exe	Thread delayed: delay time: 120000	Jump to behavior
Source: C:\Users\user\Desktop\lzxbD4wR0g.exe	Thread delayed: delay time: 67951	Jump to behavior
Source: C:\Users\user\Desktop\lzxbD4wR0g.exe	Thread delayed: delay time: 300000	Jump to behavior
Source: C:\Users\user\Desktop\lzxbD4wR0g.exe	Thread delayed: delay time: 180000	Jump to behavior

Source: C:\Users\user\Desktop\lzxbD4wR0g.exe

0_2_02209EEA

Source: C:\Users\user\Desktop\lzxbD4wR0g.exe

Writes to foreign memory regions

Source: C:\Users\user\Desktop\lzxbD4wR0g.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Users\user\Desktop\lzxbD4wR0g.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\lzxbD4wR0g.exe

Code function: 0_2_00401346 free,GetCurrentProcess,CloseHandle,GetThreadContext,GetThreadSelectorEntry,ReadProcessMemory,ReadProcessMemory,ReadProcessMemory,LdrInitializeThunk,ReadProcessMemory,ReadProcessMemory,

0_2_00401346

HIPS / PFW / Operating System Protection Evasion

Source: C:\Users\user\Desktop\lzxbD4wR0g.exe

Memory written: C:\Windows\System32\fontdrvhost.exe base: AE0000

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\lzxbD4wR0g.exe

Memory allocated: C:\Windows\System32\fontdrvhost.exe base: AE0000 protect: page execute and read and write

Contains functionality to inject threads in other processes

Source: C:\Users\user\Desktop\lzxbD4wR0g.exe

Source: C:\Users\user\Desktop\lzxbD4wR0g.exe

Process created: C:\Windows\SysWOW64\explorer.exe explorer.exe

Source: fontdrvhost.exe, 00000002.00000000.308024108.000001A855140000.00000002.00000001.00040000.00000000.sdmp, fontdrvhost.exe, 00000002.00000002.569834851.000001A855140000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: fontdrvhost.exe, 00000002.00000000.308024108.000001A855140000.00000002.00000001.00040000.00000000.sdmp, fontdrvhost.exe, 00000002.00000002.569834851.000001A855140000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: uProgram Manager*r
Source: fontdrvhost.exe, 00000002.00000000.308024108.000001A855140000.00000002.00000001.00040000.00000000.sdmp, fontdrvhost.exe, 00000002.00000002.569834851.000001A855140000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: fontdrvhost.exe, 00000002.00000000.308024108.000001A855140000.00000002.00000001.00040000.00000000.sdmp, fontdrvhost.exe, 00000002.00000002.569834851.000001A855140000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\Desktop\lzxbD4wR0g.exe

Code function: 0_2_0220E329 MultiByteToWideChar,RtlEnterCriticalSection,GetLocalTime,GetFileAttributesA,SetFileAttributesA,CreateFileA,GetFileSize,GetFileTime,LdrInitializeThunk,CreateFileMappingA,MapViewOfFile,lstrcpyn,lstrcmpi,GlobalAlloc,IsBadHugeWritePtr,LdrInitializeThunk,IsBadHugeWritePtr,LdrInitializeThunk,IsBadHugeWritePtr,LdrInitializeThunk,IsBadHugeWritePtr,LdrInitializeThunk,IsBadHugeWritePtr,LdrInitializeThunk,IsBadHugeWritePtr,LdrInitializeThunk,IsBadHugeWritePtr,LdrInitializeThunk,IsBadHugeWritePtr,IsBadHugeWritePtr,lstrcmpi,lstrcmpi,lstrcmpi,lstrcmpi,lstrcmpi,GetTickCount,LdrInitializeThunk,GlobalAlloc,UnmapViewOfFile,FindCloseChangeNotification,SetFilePointer,SetEndOfFile,WriteFile,GlobalFree,SetFileTime,FindCloseChangeNotification,SetFileAttributesA,DeleteFileA,GlobalFree,RtlLeaveCriticalSection,Sleep,

0_2_0220E329

Source: C:\Users\user\Desktop\lzxbD4wR0g.exe

Deletes keys which are related to windows safe boot (disables safe mode boot)

Source: C:\Users\user\Desktop\lzxbD4wR0g.exe

Code function: 0_2_02213B60 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,RegOpenKeyExA,LdrInitializeThunk,LdrInitializeThunk,RegSetValueExA,RegCloseKey,RegOpenKeyExA,LdrInitializeThunk,LdrInitializeThunk,RegSetValueExA,RegCloseKey,lstrcpy,lstrcat,RegOpenKeyExA,GetModuleFileNameA,wsprintfA,lstrlen,RegSetValueExA,RegCloseKey,RegOpenKeyExA,LdrInitializeThunk,LdrInitializeThunk,RegSetValueExA,LdrInitializeThunk,LdrInitializeThunk,RegSetValueExA,LdrInitializeThunk,LdrInitializeThunk,RegSetValueExA,RegCloseKey,GetWindowsDirectoryA,lstrlen,lstrcat,GetComputerNameA,lstrlen,lstrlen,lstrcpy,GetUserNameA,lstrlen,lstrcpy,LdrInitializeThunk,lstrlen,lstrlen,GetTempPathA,lstrlen,lstrcat,lstrcpy,lstrcpy,lstrlen,lstrlen,lstrcat,LdrInitializeThunk,CreateFileMappingA,lstrlen,GetTickCount,wsprintfA,lstrlen,wsprintfA,lstrcat,GetSystemDirectoryA,lstrlen,lstrcat,lstrcat,lstrcat,GlobalAlloc,GlobalAlloc,

0_2_02213B60

Lowering of HIPS / PFW / Operating System Security Settings

Source: C:\Users\user\Desktop\lzxbD4wR0g.exe

Registry key or value deleted: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot AlternateShell

Disables user account control notifications

Source: C:\Users\user\Desktop\lzxbD4wR0g.exe	Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center			Jump to behavior
Source: C:\Users\user\Desktop\lzxbD4wR0g.exe	Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc			Jump to behavior

Changes security center settings (notifications, updates, antivirus, firewall)

Source: C:\Users\user\Desktop\lzxbD4wR0g.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center AntiVirusOverride

Modifies the windows firewall

Source: C:\Users\user\Desktop\lzxbD4wR0g.exe

Registry key created or modified: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile DisableNotifications

Disables UAC (registry)

Source: C:\Users\user\Desktop\lzxbD4wR0g.exe

Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System EnableLUA

Source: C:\Users\user\Desktop\lzxbD4wR0g.exe	Code function: 0_2_02207A3A htons,socket,LdrInitializeThunk,setsockopt,bind,GlobalAlloc,recvfrom,CreateThread,GlobalFree,closesocket,RtlExitUserThread,		0_2_02207A3A
Source: C:\Users\user\Desktop\lzxbD4wR0g.exe	Code function: 0_2_022083C9 socket,htons,bind,listen,accept,CreateThread,closesocket,RtlExitUserThread,		0_2_022083C9

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
1 Replication Through Removable Media	1 Native API	1 Windows Service	1 Bypass User Access Control	5 Disable or Modify Tools	1 Credential API Hooking	1 System Time Discovery	1 Replication Through Removable Media	1 Archive Collected Data	Exfiltration Over Other Network Medium	1 Ingress Tool Transfer	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	1 Inhibit System Recovery
Default Accounts	2 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	1 Access Token Manipulation	2 Obfuscated Files or Information	LSASS Memory	1 Peripheral Device Discovery	Remote Desktop Protocol	1 Credential API Hooking	Exfiltration Over Bluetooth	1 Encrypted Channel	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	1 Windows Service	4 Software Packing	Security Account Manager	1 Account Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	1 Non-Standard Port	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	312 Process Injection	1 Bypass User Access Control	NTDS	3 File and Directory Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	1 File Deletion	LSA Secrets	3 System Information Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	1 Masquerading	Cached Domain Credentials	1 Security Software Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	21 Virtualization/Sandbox Evasion	DCSync	21 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	1 Access Token Manipulation	Proc Filesystem	3 Process Discovery	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	312 Process Injection	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Download Video

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
lzxbD4wR0g.exe	78%	Virustotal		Browse
lzxbD4wR0g.exe	100%	ReversingLabs	Win32.Virus.Sality
lzxbD4wR0g.exe	100%	Avira	W32/Sality.AT
lzxbD4wR0g.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\xnpkup.exe	100%	Avira	W32/Sality.AT
C:\Users\user\AppData\Local\Temp\xnpkup.exe	100%	Joe Sandbox ML

Unpacked PE Files

Source	Detection	Scanner	Label	Download
0.2.lzxbD4wR0g.exe.400000.0.unpack	100%	Avira	TR/Injector.2461429	Download File
0.2.lzxbD4wR0g.exe.21e26b0.7.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
0.2.lzxbD4wR0g.exe.21d0d88.6.unpack	100%	Avira	HEUR/AGEN.1230764	Download File
0.2.lzxbD4wR0g.exe.2200cc4.10.unpack	100%	Avira	TR/Killav.ftk	Download File
0.2.lzxbD4wR0g.exe.21e0000.9.unpack	100%	Avira	TR/Rootkit.Gen2	Download File
0.2.lzxbD4wR0g.exe.4fc564.2.unpack	100%	Avira	HEUR/AGEN.1230764	Download File
0.2.lzxbD4wR0g.exe.544c50.4.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
0.2.lzxbD4wR0g.exe.429a02.1.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
0.0.lzxbD4wR0g.exe.400000.0.unpack	100%	Avira	W32/Sality.AT	Download File
0.2.lzxbD4wR0g.exe.6034ec.5.unpack	100%	Avira	HEUR/AGEN.1230764	Download File
0.3.lzxbD4wR0g.exe.4dc55c.0.unpack	100%	Avira	HEUR/AGEN.1230764	Download File
0.3.lzxbD4wR0g.exe.51ce4c.1.unpack	100%	Avira	HEUR/AGEN.1230764	Download File

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
http://kukutrustnet987.info/home.gif	15%	Virustotal		Browse
http://89.119.67.154/testo5/http://kukutrustnet777.info/home.gifhttp://kukutrustnet888.info/home.gif	0%	Avira URL Cloud	safe
http://paaaaad.fd.fd/sobakavolos.gif	0%	Avira URL Cloud	safe
http://kukutrustnet987.info/home.gif	100%	Avira URL Cloud	malware
http://89.119.67.154/testo5/	0%	Avira URL Cloud	safe
http://www.klkjwre9fqwieluoi.info/	100%	Avira URL Cloud	malware
http://kukutrustnet777888.info/	100%	Avira URL Cloud	malware
http://89.11	0%	Avira URL Cloud	safe
http://kukutrustnet888.info/home.gif	100%	Avira URL Cloud	malware
http://www.klkjwre9fqwieluoi.info/amsint32.sysGetSystemDirectoryAdrivers	100%	Avira URL Cloud	malware
http://padrup.com.ds/sobaka1.gifhttp://paaaaad.fd.fd/sobakavolos.gifs	0%	Avira URL Cloud	safe
http://kukutrustnet777.info/home.gif	100%	Avira URL Cloud	malware
http://padrup.com.ds/sobaka1.gif	0%	Avira URL Cloud	safe
http://kukutrustnet777888.info/DisableTaskMgrSoftware	100%	Avira URL Cloud	malware
http://padrup.com.ds/sobaka1.gifhttp://paaaaad.fd.fd/sobakavolos.gif	0%	Avira URL Cloud	safe

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://89.119.67.154/testo5/http://kukutrustnet777.info/home.gifhttp://kukutrustnet888.info/home.gif	lzxbD4wR0g.exe, 00000000.00000002.317150458.00000000021E0000.00000040.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://padrup.com.ds/sobaka1.gifhttp://paaaaad.fd.fd/sobakavolos.gifs	lzxbD4wR0g.exe, 00000000.00000002.316911438.00000000021C9000.00000004.00000010.00020000.00000000.sdmp, lzxbD4wR0g.exe, 00000000.00000002.314484210.0000000000429000.00000040.00000001.01000000.00000003.sdmp, lzxbD4wR0g.exe, 00000000.00000002.315850733.0000000000603000.00000004.10000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://kukutrustnet987.info/home.gif	lzxbD4wR0g.exe, 00000000.00000002.317150458.00000000021E0000.00000040.00001000.00020000.00000000.sdmp	true	15%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://www.klkjwre9fqwieluoi.info/amsint32.sysGetSystemDirectoryAdrivers	lzxbD4wR0g.exe, 00000000.00000002.317172937.0000000002200000.00000040.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://89.11	lzxbD4wR0g.exe, 00000000.00000002.316911438.00000000021C9000.00000004.00000010.00020000.00000000.sdmp, lzxbD4wR0g.exe, 00000000.00000002.314484210.0000000000429000.00000040.00000001.01000000.00000003.sdmp, lzxbD4wR0g.exe, 00000000.00000002.317150458.00000000021E0000.00000040.00001000.00020000.00000000.sdmp, lzxbD4wR0g.exe, 00000000.00000002.315850733.0000000000603000.00000004.10000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://kukutrustnet888.info/home.gif	lzxbD4wR0g.exe, 00000000.00000002.317150458.00000000021E0000.00000040.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.klkjwre9fqwieluoi.info/	lzxbD4wR0g.exe, lzxbD4wR0g.exe, 00000000.00000002.317172937.0000000002200000.00000040.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://kukutrustnet777888.info/	lzxbD4wR0g.exe, lzxbD4wR0g.exe, 00000000.00000002.317172937.0000000002200000.00000040.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://paaaaad.fd.fd/sobakavolos.gif	lzxbD4wR0g.exe, lzxbD4wR0g.exe, 00000000.00000002.316911438.00000000021C9000.00000004.00000010.00020000.00000000.sdmp, lzxbD4wR0g.exe, 00000000.00000002.314484210.0000000000429000.00000040.00000001.01000000.00000003.sdmp, lzxbD4wR0g.exe, 00000000.00000002.315850733.0000000000603000.00000004.10000000.00040000.00000000.sdmp, lzxbD4wR0g.exe, 00000000.00000002.317383685.0000000002287000.00000040.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://89.119.67.154/testo5/	lzxbD4wR0g.exe, 00000000.00000002.317150458.00000000021E0000.00000040.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://kukutrustnet777.info/home.gif	lzxbD4wR0g.exe, 00000000.00000002.317150458.00000000021E0000.00000040.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://padrup.com.ds/sobaka1.gif	lzxbD4wR0g.exe, lzxbD4wR0g.exe, 00000000.00000002.316911438.00000000021C9000.00000004.00000010.00020000.00000000.sdmp, lzxbD4wR0g.exe, 00000000.00000002.314484210.0000000000429000.00000040.00000001.01000000.00000003.sdmp, lzxbD4wR0g.exe, 00000000.00000002.315850733.0000000000603000.00000004.10000000.00040000.00000000.sdmp, lzxbD4wR0g.exe, 00000000.00000002.317383685.0000000002287000.00000040.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://padrup.com.ds/sobaka1.gifhttp://paaaaad.fd.fd/sobakavolos.gif	lzxbD4wR0g.exe, 00000000.00000002.316911438.00000000021C9000.00000004.00000010.00020000.00000000.sdmp, lzxbD4wR0g.exe, 00000000.00000002.317383685.0000000002287000.00000040.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://kukutrustnet777888.info/DisableTaskMgrSoftware	lzxbD4wR0g.exe, 00000000.00000002.317172937.0000000002200000.00000040.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
85.85.85.85	unknown	Spain		12338	EUSKALTELES	false

General Information

Joe Sandbox Version:	36.0.0 Rainbow Opal
Analysis ID:	724697
Start date and time:	2022-10-17 18:24:36 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 7m 21s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	lzxbD4wR0g.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.spre.evad.winEXE@5/2@0/1
EGA Information:	Failed
HDC Information:	Successful, ratio: 56.8% (good quality ratio 51%) Quality average: 71% Quality standard deviation: 33.4%
HCA Information:	Successful, ratio: 100% Number of executed functions: 46 Number of non-executed functions: 50
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WerFault.exe, WMIADAP.exe, conhost.exe, svchost.exe
Not all processes where analyzed, report is missing behavior information

Simulations

Behavior and APIs

Time	Type	Description
18:25:35	API Interceptor	5x Sleep call for process: lzxbD4wR0g.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link
85.85.85.85	uSVglLsrLr.exe	Get hash	malicious	Browse
	55l6Q8D1gM.exe	Get hash	malicious	Browse
	ca08wGck0d.exe	Get hash	malicious	Browse
	f9Gqm21D8k.exe	Get hash	malicious	Browse
	0K3843bRA2.exe	Get hash	malicious	Browse
	iwV2wYLBqJ.exe	Get hash	malicious	Browse
	vrhiyc.exe	Get hash	malicious	Browse
	ucrcdh.exe	Get hash	malicious	Browse
	lrbwh.exe	Get hash	malicious	Browse
	ST6UNST.EXE	Get hash	malicious	Browse
	MrBwjWzvyi.exe	Get hash	malicious	Browse
	qdnle.exe	Get hash	malicious	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
EUSKALTELES	uSVglLsrLr.exe	Get hash	malicious	Browse	85.85.85.85
	55l6Q8D1gM.exe	Get hash	malicious	Browse	85.85.85.85
	ca08wGck0d.exe	Get hash	malicious	Browse	85.85.85.85
	f9Gqm21D8k.exe	Get hash	malicious	Browse	85.85.85.85
	0K3843bRA2.exe	Get hash	malicious	Browse	85.85.85.85
	3HpBXQ2vup.elf	Get hash	malicious	Browse	85.84.200.47
	Euskotren_v2.8.6_apkgk.com.apk	Get hash	malicious	Browse	212.142.142.207
	Euskotren_v2.8.6_apkgk.com.apk	Get hash	malicious	Browse	212.142.142.207
	notabotnet.arm.elf	Get hash	malicious	Browse	188.93.77.109
	EW2VNaHDDi.elf	Get hash	malicious	Browse	85.86.250.98
	gh4en1xAoQ.elf	Get hash	malicious	Browse	83.213.83.152
	YOQOfwoGob.elf	Get hash	malicious	Browse	37.218.91.147
	go9qYoY9kg	Get hash	malicious	Browse	83.213.158.147
	skid.arm-20220820-1521	Get hash	malicious	Browse	85.84.230.109
	3dO4zEiA96	Get hash	malicious	Browse	83.213.158.131
	Q0ckwyWEJ4	Get hash	malicious	Browse	212.142.207.103
	87W4z6rKEU	Get hash	malicious	Browse	83.213.158.134
	a8eclWvc6i	Get hash	malicious	Browse	83.213.158.150
	yHXdbnUZNz	Get hash	malicious	Browse	85.84.200.55
	PkxPgPbi8G	Get hash	malicious	Browse	85.85.85.38

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

C:\Users\user\AppData\Local\Temp\xnpkup.exe

Download File

Process:	C:\Users\user\Desktop\lzxbD4wR0g.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	66561
Entropy (8bit):	7.976654329567318
Encrypted:	false
SSDEEP:	1536:5MkiMeRlLvoiOgdq/rbHRQX/RFTJ8ynLaE2kRNM3qz+V:KSeR9wJTbHGJFt8gThRe3h
MD5:	AA4E8176CD815494ED9320F0418EEDF6
SHA1:	D777EB79D5537A8D62C4F017AF8BB9CF4EF9F32E
SHA-256:	0E66C70971E1CD2DAAF606E09224911767E93CC3B68965227DB98ADF88C1115A
SHA-512:	3A251DE3503209313AB1E026BAE770FCBB459EE3176F2C868CC42EE934C72D72E65BB220973EE16E125DD6B6085E819CA970259E753A575BF62BA645222CF7F0
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......E.r..o...o...o...o...o..cp...o...p...o..Rich.o..........PE..L....N.L..................................... ....@.......................... ..................................................(....................................................................................................................text.............................=. ................................................................Y.n..~.....W......E..M.....M..U.....U..E.....E..M.....M..U.....U..E.....E..M.....M..U.....U.h N......@.j.....@.3...]...........................................................}.ExitProcess...Sleep.d.SetErrorMode..KERNEL32.dll..............................................................................................................................................................................................................................................

C:\Windows\system.ini

Download File

Process:	C:\Users\user\Desktop\lzxbD4wR0g.exe
File Type:	Windows SYSTEM.INI
Category:	dropped
Size (bytes):	255
Entropy (8bit):	5.277111699273008
Encrypted:	false
SSDEEP:	6:aQ44VvYkDyyp3BYf1fyBcfjfKvcie0xTqFtPva:F4Yv7yk3OUBq82wqFtPva
MD5:	7120D3CA73B6C3E11650060E0EF1AF22
SHA1:	90896F3F0B849B90CA7061CDD108E58C4EC670FE
SHA-256:	20DAD6FBDD212A76C32D264654102F642D83CF37CAFD7D629E4154464731BD2B
SHA-512:	86FA4117BBAABD0316C901E51907613BA2F7CD80BED6DD73C55779781235F94A33C180D907C05628DDA4929669B1E8BAC13793314C1567B6A83015CD8865B413
Malicious:	false
Reputation:	low
Preview:	; for 16-bit app support..[386Enh]..woafont=dosapp.fon..EGA80WOA.FON=EGA80WOA.FON..EGA40WOA.FON=EGA40WOA.FON..CGA80WOA.FON=CGA80WOA.FON..CGA40WOA.FON=CGA40WOA.FON....[drivers]..wave=mmdrv.dll..timer=timer.drv....[mci]..[MCIDRV_VER]..DEVICEMB=59814062956..

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.906729863419647
TrID:	Win32 Executable (generic) a (10002005/4) 99.83% Windows Screen Saver (13104/52) 0.13% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	lzxbD4wR0g.exe
File size:	2111255
MD5:	c890f96e19ee27909df744b788477006
SHA1:	3561aaad032a7a8697763f05247b4ae80c2aaf56
SHA256:	2d0e058a8b228d5218137814147c05674d5c5ad8d0614f80cd088dba156204e2
SHA512:	4f7b7fe68d6add3301b326748c325c1587dc57eca15df340613e47cea4d09172527a24a9c9f4ffac9df0ac23dc315904f1c77363527cd96bbd2ed4089e5c044c
SSDEEP:	49152:kER9bTChxKCnFnQXBbrtgb/iQvu0UHOa5b:kK96hxvWbrtUTrUHOg
TLSH:	F7A5CD152390CD22F25FD07256D45E7870B3A4292B33DCD3AA4895311BF1EEBEBB158A
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........[....................J.......................................Rich............PE..L...c{TO...................................

File Icon


Icon Hash:	00828e8e8686b000

Static PE Info

General

Entrypoint:	0x40167f
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:
Time Stamp:	0x4F547B63 [Mon Mar 5 08:37:55 2012 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	730073214094cd328547bf1f72289752

Entrypoint Preview

Instruction
test al, 00000016h
mov cl, cl
lea ebp, dword ptr [1218237Bh]
test edi, 55D1CD1Bh
jne 00007F3980C25F85h
imul ebp, edi
cmp eax, ebx
mov eax, D46B27DBh
cmp dl, FFFFFFBEh
cmp edi, edi
call 00007F3980C25F85h
pop eax
neg ebx
neg bl
neg ebp
add edi, 000023C7h
add edi, 0000094Ah
movd mm3, eax
mov bl, dh
jmp 00007F3980C25F8Fh
imul edx, ebp, 1B9E426Ah
sub eax, ecx
cmp ah, al
movzx edx, bl
cmp ecx, edx
cmp esi, ebp
mov dl, ah
mov edi, FFFADC1Ah
xor edi, 00006B9Fh
mov ebx, edx
add edi, 0005487Bh
test edx, eax
dec ecx
movsx eax, bx
mov edx, FFFF4E63h
xor edx, 000010E0h
bswap eax
xor edx, 0000A07Bh
mov eax, 5A5AB014h
xadd edi, edx
sbb esi, A31FD8BFh
add edi, 00000109h
mov bh, 25h
cmp edi, 00000467h
jc 00007F3980C25F4Ah
movd ebp, mm3
jc 00007F3980C25F84h
not cl
test bh, dl
add ebp, 000230DEh
lea edi, dword ptr [C93D486Ah]
add ebp, 00000D3Ah
xchg dh, ah
sbb edx, edx
movsx ecx, al
xchg ah, dl
jne 00007F3980C25F88h
cmp eax, 000000D8h

Rich Headers

Programming Language:

[C++] VS98 (6.0) SP6 build 8804

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2104	0x64	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x25000	0x2c4	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0xf4	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x83c	0xa00	False	0.6125	data	5.695608564147735	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0x2000	0x5c6	0x600	False	0.515625	data	4.859194046971246	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.data	0x3000	0x22000	0x200	False	0.130859375	Matlab v4 mat-file (little endian) e, numeric, rows 0, columns 0	0.545273764156015	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x25000	0x14000	0x13400	False	0.9915533685064936	data	7.990480623641147	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country
RT_MANIFEST	0x25058	0x148	XML 1.0 document, ASCII text, with very long lines (328), with no line terminators	English	United States

Imports

DLL	Import
KERNEL32.dll	ResumeThread, WriteProcessMemory, VirtualProtectEx, GetModuleFileNameW, DuplicateHandle, GetCurrentProcess, SetFileTime, CopyFileW, GetDriveTypeW, GetFileTime, CreateFileW, SetErrorMode, GetTempFileNameW, GetTempPathW, ExitProcess, Sleep, DeleteFileW, CloseHandle, WaitForSingleObject, CreateProcessW, ReadProcessMemory, GetThreadSelectorEntry, GetThreadContext, GetLastError, lstrlenW, GetModuleHandleW, GetStartupInfoW
USER32.dll	MessageBoxA
SHELL32.dll	ShellExecuteW
MSVCRT.dll	memset, wcscpy, free, _fileno, _chsize, wcsrchr, wcscat, malloc, fclose, fread, fwrite, fseek, _wfopen, sprintf, fflush, _exit, _XcptFilter, exit, _wcmdln, __wgetmainargs, _initterm, __setusermatherr, _adjust_fdiv, __p__commode, __p__fmode, __set_app_type, _except_handler3, _controlfp

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Download Network PCAP: filtered – full

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 17, 2022 18:25:39.314019918 CEST	60842	5517	192.168.2.5	85.85.85.85

Statistics

Click to jump to process

Memory Usage

• lzxbD4wR0g.exe
• explorer.exe
• fontdrvhost.exe
• WerFault.exe

Click to jump to process

High Level Behavior Distribution

• File
• Registry
• Network

Click to dive into process behavior distribution

Behavior

• lzxbD4wR0g.exe
• explorer.exe
• fontdrvhost.exe
• WerFault.exe

Click to jump to process

System Behavior

Analysis Process: lzxbD4wR0g.exePID: 1248, Parent PID: 3324

General

Target ID:	0
Start time:	18:25:35
Start date:	17/10/2022
Path:	C:\Users\user\Desktop\lzxbD4wR0g.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\lzxbD4wR0g.exe
Imagebase:	0x400000
File size:	2111255 bytes
MD5 hash:	C890F96E19EE27909DF744B788477006
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

File Activities

File Opened

File Created

File Deleted

File Written

File Read

File Attributes Queried

Other File Operations

Device IO

Section Activities

Sections loaded by Windows

Sections loaded by Program

Registry Activities

Key Opened

Key Created

Key Value Created

Key Value Modified

Key Value Deleted

Key Value Queried

Key Value Enumerated

Key Enumerated

Mutex Activities

Mutex Created

Process Activities

Process Created

Process Information Set

Thread Activities

Thread Created

Thread Delayed

Thread Information Set

Memory Activities

Memory Read

Memory Written

Memory Allocated

Memory Protection Changed

Memory Usage Statistics

System Activities

System Information Queried

Network Activities

Socket bound

Process Token Activities

Token Adjusted

LPC Port Activities

There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

Chronological Activities

Analysis Process: explorer.exePID: 1244, Parent PID: 1248

General

Target ID:	1
Start time:	18:25:35
Start date:	17/10/2022
Path:	C:\Windows\SysWOW64\explorer.exe
Wow64 process (32bit):
Commandline:	explorer.exe
Imagebase:
File size:	3611360 bytes
MD5 hash:	166AB1B9462E5C1D6D18EC5EC0B6A5F7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Memory Activities

Memory Usage Statistics

Chronological Activities

Analysis Process: fontdrvhost.exePID: 684, Parent PID: 1248

General

Target ID:	2
Start time:	18:25:36
Start date:	17/10/2022
Path:	C:\Windows\System32\fontdrvhost.exe
Wow64 process (32bit):	false
Commandline:	fontdrvhost.exe
Imagebase:	0x7ff754630000
File size:	790304 bytes
MD5 hash:	31113981180E69C2773BCADA4051738A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate

Memory Activities

Memory Usage Statistics

Chronological Activities

Analysis Process: WerFault.exePID: 1348, Parent PID: 1248

General

Target ID:	5
Start time:	18:25:38
Start date:	17/10/2022
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 1248 -s 832
Imagebase:	0xaa0000
File size:	434592 bytes
MD5 hash:	9E2B8ACAD48ECCA55C0230D63623661B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

File Activities

There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

Section Activities

Sections loaded by Windows

Registry Activities

There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

Mutex Activities

There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

Process Activities

Process Queried

Process Information Set

Thread Activities

Thread Information Set

Memory Activities

Memory Usage Statistics

System Activities

There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

LPC Port Activities

There is hidden Windows Behavior. Click on Show Windows Behavior to show it.