Attempts to repeatedly call a single API many times in order to delay analysis time
- Spam:
- 0e46e7cb4bd9cd1a4dcd8b44ce08deba45786c84c54f6e1353fce990c22268ab.exe (2432) called API NtSetInformationFile 15762 times
- Spam:
- 0e46e7cb4bd9cd1a4dcd8b44ce08deba45786c84c54f6e1353fce990c22268ab.exe (2976) called API NtSetInformationFile 15762 times
- Spam:
- 0e46e7cb4bd9cd1a4dcd8b44ce08deba45786c84c54f6e1353fce990c22268ab.exe (2532) called API NtSetInformationFile 15762 times
- Spam:
- 0e46e7cb4bd9cd1a4dcd8b44ce08deba45786c84c54f6e1353fce990c22268ab.exe (2924) called API NtSetInformationFile 15762 times
- Spam:
- 0e46e7cb4bd9cd1a4dcd8b44ce08deba45786c84c54f6e1353fce990c22268ab.exe (2316) called API NtSetInformationFile 15762 times
- Spam:
- 0e46e7cb4bd9cd1a4dcd8b44ce08deba45786c84c54f6e1353fce990c22268ab.exe (2872) called API NtSetInformationFile 15762 times
- Spam:
- 0e46e7cb4bd9cd1a4dcd8b44ce08deba45786c84c54f6e1353fce990c22268ab.exe (2768) called API NtSetInformationFile 15762 times
- Spam:
- winmgr.exe (2488) called API NtSetInformationFile 15762 times
- Spam:
- 0e46e7cb4bd9cd1a4dcd8b44ce08deba45786c84c54f6e1353fce990c22268ab.exe (2820) called API NtSetInformationFile 15762 times
- Spam:
- 0e46e7cb4bd9cd1a4dcd8b44ce08deba45786c84c54f6e1353fce990c22268ab.exe (2684) called API NtSetInformationFile 15762 times
A process attempted to delay the analysis task.
- Description:
- winmgr.exe tried to sleep 243 seconds, actually delayed analysis time by 243 seconds
Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available
| PID |
API |
Arguments |
| 2432 |
GlobalMemoryStatusEx |
N/A |
One or more AV tool detects this sample as malicious: Ransom:Win32/Gandcrab.D!MTB
- Description:
- Ransom:Win32/Gandcrab.D!MTB
Connects to an IRC server, possibly part of a botnet
Operates on local firewall's policies and settings
- Registry:
- HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\
One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.
Attempts to remove evidence of file being downloaded from the Internet
Sample contacts servers at uncommon ports
- Connection:
- 92.63.197.106:5050
- Registration:
- Registration of port 5050 reported as Unregistered
The executable has PE anomalies (could be a false positive)
Allocates read-write-execute memory (usually to unpack itself)
| PID |
API |
Arguments |
| 2432 |
NtProtectVirtualMemory |
- process_identifier:
- 2316
- stack_dep_bypass:
- 0
- stack_pivoted:
- 0
- heap_dep_bypass:
- 1
- length:
- 20480
- protection:
- 64
- base_address:
- 0x00689000
- process_handle:
- 0xffffffff
|
The binary likely contains encrypted or compressed data.
- Section:
- .rsrc, at virtual address 0x00037000
- Entropy:
- 7.13618944731
- Description:
- A section with a high entropy has been found
- Entropy:
- 0.451048951049
- Description:
- Overall entropy of this PE file is high
Creates an Alternate Data Stream (ADS)
- File:
- C:\Users\Virtual\AppData\Local\Temp\0e46e7cb4bd9cd1a4dcd8b44ce08deba45786c84c54f6e1353fce990c22268ab.exe:Zone.Identifier
- File:
- C:\Windows\M-5050050640745700375076006680\winmgr.exe:Zone.Identifier
Installs itself for autorun at Windows startup
- Registry:
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows Manager
More than %50 of the external calls do not go through the import address table
This sample contains high entropy sections
- Section:
- .rsrc, at virtual address 0x00037000
- Entropy:
- 7.13618944731
Anomalous binary characteristics
- Anomaly:
- Timestamp on binary predates the release date of the OS version it requires by at least a year
Possible date expiration check, exits too soon after checking local time
Creates a hidden or system file
- File:
- C:\Users\Virtual\AppData\Roaming\winmgr.txt
