VMRay Analyzer Report

VTI Information

VTI Score 98 / 100
VTI Database Version	2.6
VTI Rule Match Count	62
VTI Rule Type	Default (PE, ...)

Detected Threats

	Anti Analysis
	Illegitimate API usage
	Internal API "CreateProcessInternalW" was used to start "C:\Windows\SysWOW64\autofmt.exe".
	Internal API "CreateProcessInternalW" was used to start "C:\Windows\SysWOW64\msiexec.exe".
	Internal API "CreateProcessInternalW" was used to start "C:\Windows\SysWOW64\cmd.exe".
	Internal API "CreateProcessInternalW" was used to start "C:\Program Files (x86)\Mozilla Firefox\Firefox.exe".
	Internal API "CreateProcessInternalW" was used to start "C:\Windows\SysWOW64\rdpclip.exe".
	Internal API "CreateProcessInternalW" was used to start "C:\Windows\SysWOW64\autochk.exe".
	Internal API "CreateProcessInternalW" was used to start "C:\Windows\SysWOW64\cmstp.exe".
	Try to detect kernel debugger
	Check via API "NtQuerySystemInformation".
	Dynamic API usage
	Resolve above average number of APIs.
	Try to detect debugger
	Check via API "NtQueryInformationProcess".
	Delay execution
	One thread sleeps more than 5 minutes.
	File System
	Handle with malicious files
	File "c:\users\5p5nrgjn0js halpmcxz\appdata\roaming\igfxonux.scr" is a known malicious file.
	Modify operating system directory
	Create file "\??\C:\Windows\SysWOW64\ntdll.dll" in the OS directory.
	Modify file "\??\C:\Windows\SysWOW64\ntdll.dll" in the OS directory.
	Create file "\??\C:\Windows\SysWOW64\msiexec.exe" in the OS directory.
	Modify file "\??\C:\Windows\SysWOW64\msiexec.exe" in the OS directory.
	Create file "\??\C:\Windows\System32\drivers\etc\hosts" in the OS directory.
	Modify file "\??\C:\Windows\System32\drivers\etc\hosts" in the OS directory.
	Create file "\??\C:\Windows\SysWOW64\cmstp.exe" in the OS directory.
	Modify file "\??\C:\Windows\SysWOW64\cmstp.exe" in the OS directory.
	Create many files
	Create above average number of files.
	Injection
	Write into memory of another process
	"c:\users\5p5nrgjn0js halpmcxz\desktop\lxqfwvdqlkd.exe" modifies memory of "c:\windows\explorer.exe"
	"c:\windows\syswow64\msiexec.exe" modifies memory of "c:\windows\explorer.exe"
	"c:\users\5p5nrgjn0js halpmcxz\desktop\lxqfwvdqlkd.exe" modifies memory of "c:\windows\syswow64\msiexec.exe"
	"c:\windows\syswow64\msiexec.exe" modifies memory of "c:\program files (x86)\mozilla firefox\firefox.exe"
	"c:\users\5p5nrgjn0js halpmcxz\appdata\roaming\igfxonux.scr" modifies memory of "c:\windows\explorer.exe"
	"c:\windows\syswow64\cmstp.exe" modifies memory of "c:\windows\explorer.exe"
	"c:\users\5p5nrgjn0js halpmcxz\appdata\roaming\igfxonux.scr" modifies memory of "c:\windows\syswow64\cmstp.exe"
	"c:\windows\syswow64\cmstp.exe" modifies memory of "c:\program files (x86)\mozilla firefox\firefox.exe"
	Modify control flow of another process
	"c:\users\5p5nrgjn0js halpmcxz\desktop\lxqfwvdqlkd.exe" alters context of "c:\windows\explorer.exe"
	"c:\windows\syswow64\msiexec.exe" alters context of "c:\windows\explorer.exe"
	"c:\users\5p5nrgjn0js halpmcxz\appdata\roaming\igfxonux.scr" alters context of "c:\windows\explorer.exe"
	"c:\windows\syswow64\cmstp.exe" alters context of "c:\windows\explorer.exe"
	Write into memory of a process running from a created or modified executable
	"c:\users\5p5nrgjn0js halpmcxz\desktop\lxqfwvdqlkd.exe" modifies memory of "c:\users\5p5nrgjn0js halpmcxz\desktop\lxqfwvdqlkd.exe"
	"c:\users\5p5nrgjn0js halpmcxz\appdata\roaming\igfxonux.scr" modifies memory of "c:\users\5p5nrgjn0js halpmcxz\appdata\roaming\igfxonux.scr"
	Modify control flow of a process running from a created or modified executable
	"c:\users\5p5nrgjn0js halpmcxz\desktop\lxqfwvdqlkd.exe" alters context of "c:\users\5p5nrgjn0js halpmcxz\desktop\lxqfwvdqlkd.exe"
	"c:\users\5p5nrgjn0js halpmcxz\appdata\roaming\igfxonux.scr" alters context of "c:\users\5p5nrgjn0js halpmcxz\appdata\roaming\igfxonux.scr"
	Network
	Read network configuration
	Read the current network configuration trough the host.conf file.
	Persistence
	Install system startup script or application
	Add "C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\igfxonux.scr" to windows startup via registry.
	Process
	Create system object
	Create nameless mutex.
	Create mutex with name "L53886-WGVVJKAFC".
	Create mutex with name "8Q-59UAVA1ZvGWMZ".
	Create mutex with name "S-1-5-21-3388679-13801793209033".
	Create mutex with name "S-1-5-21-3388679-8441793209033".
	Create process with hidden window
	The process "C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\lxqfwvdqlkd.exe" starts with hidden window.
	The process "C:\Windows\SysWOW64\autofmt.exe" starts with hidden window.
	The process "C:\Windows\SysWOW64\msiexec.exe" starts with hidden window.
	The process "C:\Windows\SysWOW64\cmd.exe" starts with hidden window.
	The process "C:\Program Files (x86)\Mozilla Firefox\Firefox.exe" starts with hidden window.
	The process "C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\igfxonux.scr" starts with hidden window.
	The process "C:\Windows\SysWOW64\rdpclip.exe" starts with hidden window.
	The process "C:\Windows\SysWOW64\autochk.exe" starts with hidden window.
	The process "C:\Windows\SysWOW64\cmstp.exe" starts with hidden window.
	Create a page with write and execute permissions
	Allocate a page in a foreign process with "PAGE_EXECUTE_READWRITE" permissions, often used to dynamically unpack code.
	Read from memory of another process
	"c:\users\5p5nrgjn0js halpmcxz\desktop\lxqfwvdqlkd.exe" reads from "c:\windows\explorer.exe".
	"c:\users\5p5nrgjn0js halpmcxz\desktop\lxqfwvdqlkd.exe" reads from "c:\windows\syswow64\msiexec.exe".
	"c:\windows\syswow64\msiexec.exe" reads from "c:\windows\explorer.exe".
	"c:\windows\syswow64\msiexec.exe" reads from "C:\Program Files (x86)\Mozilla Firefox\Firefox.exe".
	"c:\users\5p5nrgjn0js halpmcxz\appdata\roaming\igfxonux.scr" reads from "c:\windows\explorer.exe".
	"c:\users\5p5nrgjn0js halpmcxz\appdata\roaming\igfxonux.scr" reads from "c:\program files\windows nt\hungry sage sender.exe".
	"c:\windows\syswow64\cmstp.exe" reads from "c:\windows\explorer.exe".
	"c:\windows\syswow64\cmstp.exe" reads from "C:\Program Files (x86)\Mozilla Firefox\Firefox.exe".
-	Browser
-	Device
-	OS
-	Hide Tracks
-	Information Stealing
-	Kernel
-	Masquerade
-	PE
-	User
-	VBA Macro
-	YARA