Attempts to repeatedly call a single API many times in order to delay analysis time
Spam:
0100704d57f45d0db395959a1235933a8883015cdbeb85a004cf28e96ba7f17e.exe (2496) called API FindResourceExW 225792 times
Spam:
0100704d57f45d0db395959a1235933a8883015cdbeb85a004cf28e96ba7f17e.exe (2312) called API FindResourceExW 225792 times
Spam:
0100704d57f45d0db395959a1235933a8883015cdbeb85a004cf28e96ba7f17e.exe (1340) called API FindResourceExW 225792 times
Attempts to identify installed AV products by registry key
Registry:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Microsoft AntiMalware\SpyNet\SubmitSamplesConsent
Registry:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Microsoft AntiMalware\SpyNet\SpyNetReporting
Registry:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Microsoft AntiMalware\SpyNet
Queries for the computername
PID
API
Arguments
2312
GetComputerNameW
computer_name:
VIRTUAL-PC
2312
GetComputerNameW
computer_name:
VIRTUAL-PC
Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available
PID
API
Arguments
1512
GlobalMemoryStatusEx
N/A
Detects VMWare through the in instruction feature
PID
API
Arguments
2496
__exception__
stacktrace:
[u'0100704d57f45d0db395959a1235933a8883015cdbeb85a004cf28e96ba7f17e+0x3f07 @ 0x403f07', u'0100704d57f45d0db395959a1235933a8883015cdbeb85a004cf28e96ba7f17e+0x1b25 @ 0x401b25', u'BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x7dd733ca', u'RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x7dea9ed2', u'RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x7dea9ea5']
exception:
{u'instruction_r': u'ed 89 5d e4 89 4d e0 5a 59 5b 58 83 4d fc ff eb', u'symbol': u'0100704d57f45d0db395959a1235933a8883015cdbeb85a004cf28e96ba7f17e+0x3449', u'instruction': u'in eax, dx', u'module': u'0100704d57f45d0db395959a1235933a8883015cdbeb85a004cf28e96ba7f17e.exe', u'exception_code': u'0xc0000096', u'offset': 13385, u'address': u'0x403449'}
registers:
{u'esp': 1637624, u'edi': 0, u'eax': 1447909480, u'ebp': 1637684, u'edx': 22104, u'ebx': 1, u'esi': 5542000, u'ecx': 10}
2496
__exception__
stacktrace:
[u'0100704d57f45d0db395959a1235933a8883015cdbeb85a004cf28e96ba7f17e+0x3f10 @ 0x403f10', u'0100704d57f45d0db395959a1235933a8883015cdbeb85a004cf28e96ba7f17e+0x1b25 @ 0x401b25', u'BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x7dd733ca', u'RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x7dea9ed2', u'RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x7dea9ea5']
exception:
{u'instruction_r': u'ed 89 45 e4 5a 59 5b 58 83 4d fc ff eb 11 33 c0', u'symbol': u'0100704d57f45d0db395959a1235933a8883015cdbeb85a004cf28e96ba7f17e+0x34e2', u'instruction': u'in eax, dx', u'module': u'0100704d57f45d0db395959a1235933a8883015cdbeb85a004cf28e96ba7f17e.exe', u'exception_code': u'0xc0000096', u'offset': 13538, u'address': u'0x4034e2'}
registers:
{u'esp': 1637628, u'edi': 0, u'eax': 1447909480, u'ebp': 1637684, u'edx': 22104, u'ebx': 1, u'esi': 5542000, u'ecx': 20}
This executable is signed
Creates executable files on the filesystem
File:
C:\Users\Virtual\nmaunfyqjxpnqtoz.vbs
Reads data out of its own binary image
Self Read:
process: cscript.exe, pid: 3020, offset: 0x00000000, length: 0x00000142
Executed a process and injected code into it, probably while unpacking
PID
API
Arguments
2356
CreateProcessInternalW
thread_identifier:
2548
thread_handle:
0x00000140
process_identifier:
2544
current_directory:
filepath:
track:
1
command_line:
C:\Users\Virtual\AppData\Local\Temp\0100704d57f45d0db395959a1235933a8883015cdbeb85a004cf28e96ba7f17e.exe /C
filepath_r:
stack_pivoted:
0
creation_flags:
134217728
inherit_handles:
0
process_handle:
0x00000144
2356
CreateProcessInternalW
thread_identifier:
3024
thread_handle:
0x00000248
process_identifier:
3020
current_directory:
C:\Users\Virtual\AppData\Local\Temp
filepath:
C:\Windows\System32\cscript.exe
track:
1
command_line:
"C:\Windows\System32\cscript.exe" "C:\Users\Virtual\nmaunfyqjxpnqtoz.vbs"
filepath_r:
C:\Windows\System32\cscript.exe
stack_pivoted:
0
creation_flags:
67634192
inherit_handles:
0
process_handle:
0x00000264
2356
CreateProcessInternalW
thread_identifier:
2216
thread_handle:
0x00000298
process_identifier:
2220
current_directory:
C:\Users\Virtual\AppData\Local\Temp
filepath:
C:\Windows\System32\cmd.exe
track:
1
command_line:
"C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Virtual\AppData\Local\Temp\0100704d57f45d0db395959a1235933a8883015cdbeb85a004cf28e96ba7f17e.exe"
filepath_r:
C:\Windows\System32\cmd.exe
stack_pivoted:
0
creation_flags:
67634192
inherit_handles:
0
process_handle:
0x000002a8
2220
CreateProcessInternalW
thread_identifier:
2364
thread_handle:
0x00000080
process_identifier:
2368
current_directory:
C:\Users\Virtual\AppData\Local\Temp
filepath:
C:\Windows\System32\PING.EXE
track:
1
command_line:
ping.exe -n 6 127.0.0.1
filepath_r:
C:\Windows\system32\PING.EXE
stack_pivoted:
0
creation_flags:
524288
inherit_handles:
1
process_handle:
0x00000084
2264
CreateProcessInternalW
thread_identifier:
1536
thread_handle:
0x00000144
process_identifier:
1064
current_directory:
filepath:
track:
1
command_line:
C:\Windows\SysWOW64\explorer.exe
filepath_r:
stack_pivoted:
0
creation_flags:
4
inherit_handles:
0
process_handle:
0x00000148
2264
NtMapViewOfSection
section_handle:
0x00000150
process_identifier:
1064
commit_size:
0
win32_protect:
64
buffer:
base_address:
0x00130000
allocation_type:
0
section_offset:
0
view_size:
241664
process_handle:
0x00000148
2264
NtGetContextThread
thread_handle:
0x00000144
2264
NtResumeThread
thread_handle:
0x00000144
suspend_count:
1
process_identifier:
1064
2368
NtResumeThread
thread_handle:
0x000000d4
suspend_count:
1
process_identifier:
2368
1064
CreateProcessInternalW
thread_identifier:
1032
thread_handle:
0x000001fc
process_identifier:
1036
current_directory:
filepath:
track:
1
command_line:
"C:\Users\Virtual\AppData\Local\Temp\0100704d57f45d0db395959a1235933a8883015cdbeb85a004cf28e96ba7f17e.exe" /W
filepath_r:
stack_pivoted:
0
creation_flags:
134217728
inherit_handles:
0
process_handle:
0x00000200
Unconventionial language used in binary resources
The executable has PE anomalies (could be a false positive)
Section:
ggga32
Section:
a322
Allocates read-write-execute memory (usually to unpack itself)
PID
API
Arguments
2312
NtAllocateVirtualMemory
process_identifier:
2312
region_size:
229376
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
protection:
64
base_address:
0x002c0000
allocation_type:
12288
process_handle:
0xffffffff
2312
NtAllocateVirtualMemory
process_identifier:
2312
region_size:
225280
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
protection:
64
base_address:
0x00760000
allocation_type:
12288
process_handle:
0xffffffff
Creates a suspicious process
Cmdline:
"C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Virtual\AppData\Local\Temp\0100704d57f45d0db395959a1235933a8883015cdbeb85a004cf28e96ba7f17e.exe"
Cmdline:
cmd.exe /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Virtual\AppData\Local\Temp\0100704d57f45d0db395959a1235933a8883015cdbeb85a004cf28e96ba7f17e.exe"
The binary likely contains encrypted or compressed data.
Section:
.text, at virtual address 0x00001000
Entropy:
7.45092704364
Description:
A section with a high entropy has been found
Entropy:
0.5
Description:
Overall entropy of this PE file is high
Installs itself for autorun at Windows startup
Registry:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\sqsyydb
Creates known SpyNet files, registry changes and/or mutexes.
Registry:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\SpyNet
This sample contains high entropy sections
Section:
.text, at virtual address 0x00001000
Entropy:
7.45092704364
Anomalous binary characteristics
Anomaly:
Actual checksum does not match that reported in PE header
Strings possibly contain hardcoded URLs
Possible Url:
http://schemas.microsoft.com/SMI/2005/WindowsSettings">true</dpiAware></windowsSettings></application></assembly>
A process created a hidden window
Process:
0100704d57f45d0db395959a1235933a8883015cdbeb85a004cf28e96ba7f17e.exe -> C:\Users\Virtual\AppData\Local\Temp\0100704d57f45d0db395959a1235933a8883015cdbeb85a004cf28e96ba7f17e.exe /C
Process:
0100704d57f45d0db395959a1235933a8883015cdbeb85a004cf28e96ba7f17e.exe -> C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Microsoft AntiMalware\SpyNet" /f /t REG_DWORD /v "SpyNetReporting" /d "0"
Process:
0100704d57f45d0db395959a1235933a8883015cdbeb85a004cf28e96ba7f17e.exe -> C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Microsoft AntiMalware\SpyNet" /f /t REG_DWORD /v "SubmitSamplesConsent" /d "2"
Process:
0100704d57f45d0db395959a1235933a8883015cdbeb85a004cf28e96ba7f17e.exe -> C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Wow6432Node\Microsoft AntiMalware\SpyNet" /f /t REG_DWORD /v "SpyNetReporting" /d "0"
Process:
0100704d57f45d0db395959a1235933a8883015cdbeb85a004cf28e96ba7f17e.exe -> C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Wow6432Node\Microsoft AntiMalware\SpyNet" /f /t REG_DWORD /v "SubmitSamplesConsent" /d "2"
Process:
0100704d57f45d0db395959a1235933a8883015cdbeb85a004cf28e96ba7f17e.exe -> C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\SpyNet" /f /t REG_DWORD /v "SpyNetReporting" /d "0"
Process:
0100704d57f45d0db395959a1235933a8883015cdbeb85a004cf28e96ba7f17e.exe -> C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\SpyNet" /f /t REG_DWORD /v "SubmitSamplesConsent" /d "2"
Process:
0100704d57f45d0db395959a1235933a8883015cdbeb85a004cf28e96ba7f17e.exe -> C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Spynet" /f /t REG_DWORD /v "SpyNetReporting" /d "0"
Process:
0100704d57f45d0db395959a1235933a8883015cdbeb85a004cf28e96ba7f17e.exe -> C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Spynet" /f /t REG_DWORD /v "SubmitSamplesConsent" /d "2"
Process:
0100704d57f45d0db395959a1235933a8883015cdbeb85a004cf28e96ba7f17e.exe -> cmd.exe
Executes one or more WMI queries
Wmi:
Select * From CIM_DataFile Where Name = 'C:\\Users\\Virtual\\AppData\\Local\\Temp\\0100704d57f45d0db395959a1235933a8883015cdbeb85a004cf28e96ba7f17e.exe'
