Windows Analysis Report
CKC6pZyjtH.exe

Overview

General Information

Sample name:	CKC6pZyjtH.exe renamed because original name is a hash value
Original sample name:	0a467ca96c01689eba7fd5c085d0691dfc13b3951a2c50e800220f6f3207455b.exe
Analysis ID:	1501761
MD5:	ebcd0fb65db6edae2c57ff204aceae76
SHA1:	94a10604b7016cccd6867cfe3e7f371caaf83d5f
SHA256:	0a467ca96c01689eba7fd5c085d0691dfc13b3951a2c50e800220f6f3207455b
Tags:	120-46-149-112exe
Infos:

Detection

Score:	60
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

AI detected suspicious sample

Machine Learning detection for sample

Uses known network protocols on non-standard ports

AV process strings found (often used to terminate AV products)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

IP address seen in connection with other malware

One or more processes crash

Sigma detected: Communication To Uncommon Destination Ports

Classification

Signatures

AV Detection

Multi AV Scanner detection for submitted file

Source: CKC6pZyjtH.exe	Virustotal: Detection: 16%			Perma Link
Source: CKC6pZyjtH.exe	ReversingLabs: Detection: 13%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: CKC6pZyjtH.exe

Joe Sandbox ML: detected

Source: CKC6pZyjtH.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:

Binary string: E:\Project\verysafe\x64\Release\verysafe.pdb source: CKC6pZyjtH.exe

Networking

Uses known network protocols on non-standard ports

Source: unknown

Network traffic detected: HTTP traffic on port 49730 -> 8888

Detected TCP or UDP traffic on non-standard ports

Source: global traffic

TCP traffic: 192.168.2.4:49730 -> 120.46.149.112:8888

IP address seen in connection with other malware

Source: Joe Sandbox View

IP Address: 120.46.149.112 120.46.149.112

Source: unknown	TCP traffic detected without corresponding DNS query: 120.46.149.112
Source: unknown	TCP traffic detected without corresponding DNS query: 120.46.149.112
Source: unknown	TCP traffic detected without corresponding DNS query: 120.46.149.112
Source: unknown	TCP traffic detected without corresponding DNS query: 120.46.149.112
Source: unknown	TCP traffic detected without corresponding DNS query: 120.46.149.112

Source: C:\Users\user\Desktop\CKC6pZyjtH.exe

Code function: 0_2_00007FF6EC471000 malloc,InternetOpenW,InternetOpenUrlA,InternetReadFile,HeapCreate,RtlAllocateHeap,memcpy,CreateThread,WaitForSingleObject,

0_2_00007FF6EC471000

Source: global traffic

HTTP traffic detected: GET /safekey HTTP/1.1User-Agent: myappHost: 120.46.149.112:8888Cache-Control: no-cache

Source: CKC6pZyjtH.exe, 00000000.00000002.1864268103.000001E4408C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://120.46.149.112/
Source: CKC6pZyjtH.exe, 00000000.00000002.1863241680.0000002DE46FA000.00000004.00000010.00020000.00000000.sdmp, CKC6pZyjtH.exe, 00000000.00000002.1864268103.000001E4408DD000.00000004.00000020.00020000.00000000.sdmp, CKC6pZyjtH.exe, 00000000.00000002.1864268103.000001E44084C000.00000004.00000020.00020000.00000000.sdmp, CKC6pZyjtH.exe, 00000000.00000002.1864268103.000001E4408C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://120.46.149.112:8888/safekey
Source: CKC6pZyjtH.exe, 00000000.00000002.1864268103.000001E4408DD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://120.46.149.112:8888/safekey;
Source: CKC6pZyjtH.exe, 00000000.00000002.1864268103.000001E4408DD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://120.46.149.112:8888/safekeyB
Source: CKC6pZyjtH.exe, 00000000.00000002.1864268103.000001E4408DD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://120.46.149.112:8888/safekeyX
Source: CKC6pZyjtH.exe, 00000000.00000002.1864268103.000001E4408DD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://120.46.149.112:8888/safekeya
Source: CKC6pZyjtH.exe, 00000000.00000002.1863241680.0000002DE46FA000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://120.46.149.112:8888/safekeybrQ
Source: CKC6pZyjtH.exe, 00000000.00000002.1864268103.000001E4408DD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://120.46.149.112:8888/safekeynamic
Source: Amcache.hve.3.dr	String found in binary or memory: http://upx.sf.net

Detected potential crypto function

Source: C:\Users\user\Desktop\CKC6pZyjtH.exe

Code function: 0_2_00007FF6EC471000

0_2_00007FF6EC471000

One or more processes crash

Source: C:\Users\user\Desktop\CKC6pZyjtH.exe

Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 6992 -s 1116

Source: classification engine

Classification label: mal60.troj.winEXE@2/5@0/1

Source: C:\Windows\System32\WerFault.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6992

Source: C:\Windows\System32\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\8aa4e936-f0db-40e3-9fad-8fa94e18416b

Jump to behavior

Source: CKC6pZyjtH.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\CKC6pZyjtH.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: CKC6pZyjtH.exe	Virustotal: Detection: 16%
Source: CKC6pZyjtH.exe	ReversingLabs: Detection: 13%

Source: unknown	Process created: C:\Users\user\Desktop\CKC6pZyjtH.exe "C:\Users\user\Desktop\CKC6pZyjtH.exe"
Source: C:\Users\user\Desktop\CKC6pZyjtH.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 6992 -s 1116

Source: C:\Users\user\Desktop\CKC6pZyjtH.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\CKC6pZyjtH.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\CKC6pZyjtH.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\CKC6pZyjtH.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\CKC6pZyjtH.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\CKC6pZyjtH.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\CKC6pZyjtH.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\CKC6pZyjtH.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\CKC6pZyjtH.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\CKC6pZyjtH.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\CKC6pZyjtH.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\CKC6pZyjtH.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\CKC6pZyjtH.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\CKC6pZyjtH.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\CKC6pZyjtH.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\CKC6pZyjtH.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\CKC6pZyjtH.exe	Section loaded: netutils.dll	Jump to behavior

Source: C:\Users\user\Desktop\CKC6pZyjtH.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: CKC6pZyjtH.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: CKC6pZyjtH.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: CKC6pZyjtH.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: CKC6pZyjtH.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: CKC6pZyjtH.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: CKC6pZyjtH.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: CKC6pZyjtH.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: CKC6pZyjtH.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: CKC6pZyjtH.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:

Binary string: E:\Project\verysafe\x64\Release\verysafe.pdb source: CKC6pZyjtH.exe

Source: CKC6pZyjtH.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: CKC6pZyjtH.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: CKC6pZyjtH.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: CKC6pZyjtH.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: CKC6pZyjtH.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown

Network traffic detected: HTTP traffic on port 49730 -> 8888

Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: Amcache.hve.3.dr	Binary or memory string: VMware
Source: Amcache.hve.3.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.3.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.3.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.3.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.3.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.3.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.3.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: CKC6pZyjtH.exe, 00000000.00000002.1864268103.000001E440904000.00000004.00000020.00020000.00000000.sdmp, CKC6pZyjtH.exe, 00000000.00000002.1864268103.000001E4408C1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Amcache.hve.3.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.3.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.3.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.3.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.3.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.3.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.3.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.3.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.3.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.3.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.3.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.3.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.3.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.3.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.3.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.3.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.3.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.3.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.3.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.3.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.3.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Source: C:\Users\user\Desktop\CKC6pZyjtH.exe

Code function: 0_2_00007FF6EC471998 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00007FF6EC471998

Source: C:\Users\user\Desktop\CKC6pZyjtH.exe	Code function: 0_2_00007FF6EC471998 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF6EC471998
Source: C:\Users\user\Desktop\CKC6pZyjtH.exe	Code function: 0_2_00007FF6EC4714A4 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00007FF6EC4714A4
Source: C:\Users\user\Desktop\CKC6pZyjtH.exe	Code function: 0_2_00007FF6EC471B40 SetUnhandledExceptionFilter,	0_2_00007FF6EC471B40

Source: C:\Users\user\Desktop\CKC6pZyjtH.exe

Code function: 0_2_00007FF6EC471870 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00007FF6EC471870

AV process strings found (often used to terminate AV products)

Source: Amcache.hve.3.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.3.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.3.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.3.dr	Binary or memory string: MsMpEng.exe

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
120.46.149.112	unknown	China		4847	CNIX-APChinaNetworksInter-ExchangeCN	false

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://120.46.149.112:8888/safekey	false	4%, Virustotal, Browse Avira URL Cloud: safe	unknown

ID:	1501761
Product:	CloudBasic
Start time:	12:45:50
Start date:	30.08.2024
Sample:	CKC6pZyjtH.exe
Cookbook:	default.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	ebcd0fb65db6edae2c57ff204aceae76
SHA1:	94a10604b7016cccd6867cfe3e7f371caaf83d5f
SHA256:	0a467ca96c01689eba7fd5c085d0691dfc13b3951a2c50e800220f6f3207455b
Filetype:	Win64 Executable GUI (202006/5) 92.65%

Name	Type	MD5	SHA1	SHA256
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_CKC6pZyjtH.exe_4db2fe3b4407049757773b20af787af682cfd_ddc56f46_817ec8b7-851b-476f-95aa-6a126bf1ee59\Report.wer	Unicode text, UTF-16, little-endian text, with CRLF line terminators	32E448BD8B309CE18020513D4B452F86	9FBF8976FC7664270E461546BB02F2CEE2A5011A	66196A820C627C2304F411CECD0BCE9F858F2BA56B9AB4E36BB1F5FE9A8B7AC8
C:\ProgramData\Microsoft\Windows\WER\Temp\WER408B.tmp.dmp	Mini DuMP crash report, 14 streams, Fri Aug 30 10:46:43 2024, 0x1205a4 type	1EBD5B5B479227B7953A7E44D57752D4	64F96FA0EEB60DD3159403E2D10AA835A75297BA	8DD30BE31356317F9EF88AD28CA881257732038DD7B7DAC1CFCB6ED822F005F8
C:\ProgramData\Microsoft\Windows\WER\Temp\WER4138.tmp.WERInternalMetadata.xml	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators	55759E70123B32936C105F8E28F048F4	8F4886D5C33245F476DC4A2D666567137D157AFD	4164E394391AA319030B1C393853353774126A30BB7E6172C0FCFD6629FFA255
C:\ProgramData\Microsoft\Windows\WER\Temp\WER4168.tmp.xml	XML 1.0 document, ASCII text, with CRLF line terminators	F289ACFE944267B01EA4FF74D3A50457	EC3E4C93820417012B0A3272F6887D4DE89AE95E	7F26F2B4810A178363E5DD1E58A113506693E523339BE65CEA9A58996AF6D85F
C:\Windows\appcompat\Programs\Amcache.hve	MS Windows registry file, NT/2000 or above	0C918F873AB1B1F06C62864AC56C483D	9505F37AC3331DA88C0FFE630163826317354499	2D70146F821057E669B22BF6BD5167F32AF9BF807875EF9948B998EEB1F9B824

Windows Analysis Report
CKC6pZyjtH.exe

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection

Compliance

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted URLs

Windows Analysis Report CKC6pZyjtH.exe

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection

Compliance

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted URLs

Windows Analysis Report
CKC6pZyjtH.exe