Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
g6lWBM64S4.msi
|
Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Last Printed: Fri Dec 11 11:47:44
2009, Create Time/Date: Fri Dec 11 11:47:44 2009, Last Saved Time/Date: Fri Sep 18 15:06:51 2020, Security: 0, Code page:
1252, Revision Number: {E0B8551D-748E-4EB1-A05B-5BD8DF540DF9}, Number of Words: 10, Subject: UJUCERYERTY, Author: YEAYRIEMNRYTA,
Name of Creating Application: Advanced Installer 18.3 build e2a0201b, Template: ;1046, Comments: A base dados do instalador
contm a lgica e os dados necessrios para instalar o UJUCERYERTY., Title: Installation Database, Keywords: Installer, MSI,
Database, Number of Pages: 200
|
initial sample
|
 |
|
|
C:\Users\user\AppData\Local\AdvinstAnalytics\67871a621816c20044ac2e86\1.0.0\tracking.ini
|
ASCII text, with CRLF line terminators
|
dropped
|
||
|
C:\Users\user\AppData\Local\AdvinstAnalytics\67871a621816c20044ac2e86\1.0.0\{E3E53D21-CD36-4CDD-840F-84D7E898228C}.session
|
ASCII text, with CRLF line terminators
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\goldex.ses
|
ASCII text, with CRLF line terminators
|
dropped
|
||
|
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EGvKWow.lnk
|
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive,
ctime=Wed Jan 15 18:44:02 2025, mtime=Wed Jan 15 18:44:02 2025, atime=Wed Jan 15 18:44:02 2025, length=4520, window=hide
|
dropped
|
||
|
C:\Users\user\EGvKWow\EGvKWow.png
|
HTML document, ASCII text, with very long lines (394)
|
dropped
|
||
|
C:\Users\user\EGvKWow\Luo Painter.dll (copy)
|
HTML document, ASCII text, with very long lines (394)
|
dropped
|
||
|
C:\Users\user\EGvKWow\kBiTrog.exe (copy)
|
HTML document, ASCII text, with very long lines (394)
|
dropped
|
||
|
C:\Users\user\EGvKWow\kBiTrog.png
|
HTML document, ASCII text, with very long lines (394)
|
dropped
|
||
|
C:\Windows\Installer\54d8d3.msi
|
Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Last Printed: Fri Dec 11 11:47:44
2009, Create Time/Date: Fri Dec 11 11:47:44 2009, Last Saved Time/Date: Fri Sep 18 15:06:51 2020, Security: 0, Code page:
1252, Revision Number: {E0B8551D-748E-4EB1-A05B-5BD8DF540DF9}, Number of Words: 10, Subject: UJUCERYERTY, Author: YEAYRIEMNRYTA,
Name of Creating Application: Advanced Installer 18.3 build e2a0201b, Template: ;1046, Comments: A base dados do instalador
contm a lgica e os dados necessrios para instalar o UJUCERYERTY., Title: Installation Database, Keywords: Installer, MSI,
Database, Number of Pages: 200
|
dropped
|
||
|
C:\Windows\Installer\MSI1F90.tmp
|
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
|
modified
|
||
|
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log
|
Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
|
dropped
|
There are 2 hidden files, click here to show them.
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Windows\SysWOW64\msiexec.exe
|
C:\Windows\syswow64\MsiExec.exe -Embedding 196436DA6AF92AFC4A38F9C5C8CAFD36
|
|
|
|
C:\Windows\SysWOW64\shutdown.exe
|
"C:\Windows\SysWOW64\shutdown.exe" /r /f /t 15
|
|
|
|
C:\Windows\System32\msiexec.exe
|
"C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\g6lWBM64S4.msi"
|
||
|
C:\Windows\System32\msiexec.exe
|
C:\Windows\system32\msiexec.exe /V
|
||
|
C:\Windows\SysWOW64\cmd.exe
|
"C:\Windows\System32\cmd.exe" /C start /MIN reg add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v kBiTrog /t reg_sz
/d "C:\Users\user\EGvKWow\kBiTrog.exe"
|
||
|
C:\Windows\System32\conhost.exe
|
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
|
||
|
C:\Windows\SysWOW64\reg.exe
|
reg add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v kBiTrog /t reg_sz /d "C:\Users\user\EGvKWow\kBiTrog.exe"
|
||
|
C:\Windows\System32\conhost.exe
|
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
|
||
|
C:\Windows\System32\conhost.exe
|
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
|
URLs
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
https://www.advancedinstaller.com
|
unknown
|
||
|
https://situacaonssprj.com/molde/arvore.png
|
104.21.16.1
|
||
|
http://collect.installeranalytics.com
|
unknown
|
||
|
https://www.thawte.com/cps0/
|
unknown
|
||
|
https://www.thawte.com/repository0W
|
unknown
|
||
|
https://collect.installeranalytics.com
|
unknown
|
||
|
https://collect.installeranalytics.comhttp://collect.installeranalytics.comhttps://installeranalytic
|
unknown
|
||
|
https://www.cloudflare.com/5xx-error-landing
|
unknown
|
||
|
https://situacaonssprj.com/molde/calvao1.png
|
104.21.16.1
|
Domains
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
situacaonssprj.com
|
104.21.16.1
|
||
|
bg.microsoft.map.fastly.net
|
199.232.210.172
|
||
|
s-part-0017.t-0009.t-msedge.net
|
13.107.246.45
|
IPs
|
IP
|
Domain
|
Country
|
Malicious
|
|
|---|---|---|---|---|
|
104.21.16.1
|
situacaonssprj.com
|
United States
|
Registry
|
Path
|
Value
|
Malicious
|
|
|---|---|---|---|
|
HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
|
Owner
|
||
|
HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
|
SessionHash
|
||
|
HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
|
Sequence
|
||
|
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows Script\Settings
|
JITDebug
|
||
|
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows Script\Settings\Telemetry\msiexec.exe
|
JScriptSetScriptStateStarted
|
||
|
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
|
kBiTrog
|
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
D70000
|
heap
|
page read and write
|
||
|
2B5E000
|
stack
|
page read and write
|
||
|
9D7000
|
heap
|
page read and write
|
||
|
86C000
|
stack
|
page read and write
|
||
|
28CE000
|
stack
|
page read and write
|
||
|
9D0000
|
heap
|
page read and write
|
||
|
8AC000
|
stack
|
page read and write
|
||
|
2A28000
|
heap
|
page read and write
|
||
|
9BF000
|
stack
|
page read and write
|
||
|
2910000
|
heap
|
page read and write
|
||
|
25DD000
|
stack
|
page read and write
|
||
|
910000
|
heap
|
page read and write
|
||
|
290F000
|
stack
|
page read and write
|
||
|
9EB000
|
heap
|
page read and write
|
||
|
2880000
|
heap
|
page read and write
|
||
|
2C10000
|
heap
|
page read and write
|
||
|
BDE000
|
stack
|
page read and write
|
||
|
C1F000
|
stack
|
page read and write
|
||
|
2B9F000
|
stack
|
page read and write
|
||
|
95E000
|
stack
|
page read and write
|
||
|
2A20000
|
heap
|
page read and write
|
||
|
970000
|
heap
|
page read and write
|
||
|
960000
|
heap
|
page read and write
|
||
|
283D000
|
stack
|
page read and write
|
||
|
2920000
|
heap
|
page read and write
|
There are 15 hidden memdumps, click here to show them.