87c3639e...284f

VTI SCORE: 100/100

Dynamic Analysis Report

Classification:

Threat Names:

TOUfuwC8NKj1u2xe.exe

Windows Exe (x86-32)

Created at 2020-06-27T13:07:00

Remarks (2/2)

Auto Reboot Triggered (0x02000004): The operating system was rebooted during the analysis because the sample installed a startup script, task or application for persistence.

Anti-Sleep Triggered (0x0200003A): A task was rescheduled ahead of time to reveal dormant functionality.

Indicators

File (1)

Filename	Hash	Operations	Category	Severity
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\TOUfuwC8NKj1u2xe.exe	MD5: 463ec4206aa2907a0c17cf9804ac1f49 SHA1: dae9632d2ae206abfd0a54c5d77a073fd2f6fb3c SHA256: 87c3639e83b5ea1d26b75215a974c5126185017bf9392601ceb41fc5aa58284f SSDeep: 12288:uT4371F+qcslNuJ9ifOsQVg5bHXUAhhT79gnREJYcNd3:uTq1aqNuUQq5bHkAnT79gn2qcN ImpHash: de3e7ca625eb49c0d33b0d11381fd2d5	Access, Create	Sample File	Malicious

Registry (12)

Registry Key Name	Operations
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run	Access, Create
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\update	Access, Write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Wbem\CIMOM	Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Wbem\CIMOM\Log File Max Size	Access, Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Wbem\CIMOM\Logging	Access, Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Wbem\CIMOM\Logging Directory	Access, Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin	Access, Write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Access, Write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections	Access, Write
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run	Access, Create
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\update	Access, Write

Mutex (1)

Mutex Name	Operations
{9EA46438-E4A6-41EA-AFE2-1098849AF83E}	Access

Domain (1)

Domain	Sources	Severity
api.myip.com	Function Log	Unknown

URL (1)

URL	Operations	Category	Severity
api.myip.com/	GET	Contacted	Unknown

IP (1)

IP	Protocols	Sources
104.31.67.68	HTTPS, TCP	Function Log, PCAP

Export to TXT Export to JSON

Function Logfile

This feature requires an online-connection to the VMRay backend.

An offline version with limited functionality is also provided.
The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".

Remarks (2/2)

Indicators

Before

After