905ea119...288a

VTI SCORE: 100/100

Dynamic Analysis Report

Classification:

Dropper

Threat Names:

Gen:Trojan.Heur.RP.nrX@bmcRAIki

cMtPPElYjtIPF5hA.exe

Windows Exe (x86-32)

Created at 2020-07-23T08:01:00

Remarks (1/1)

Auto Reboot Triggered (0x02000005): The operating system was rebooted during the analysis because the sample installed a new system service.

Indicators

File (27)

Filename	Hash	Operations	Category	Severity
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\cMtPPElYjtIPF5hA.exe	MD5: 2cc4534b0dd0e1c8d5b89644274a10c1 SHA1: 735ee2c15c0b7172f65d39f0fd33b9186ee69653 SHA256: 905ea119ad8d3e54cd228c458a1b5681abc1f35df782977a23812ec4efa0288a SSDeep: 3072:YbbuRdAcgqu4c61lVJLfrfYEV3g+5Up48:YbyRdlvTfLfrfYE3g+4 ImpHash: 09c4d73af3796a3e85e763e475143c5d	Access, Create, Read, Write	Sample File	Malicious
C:\Windows\TEMP\lck.log	MD5: 9e5a4ec70c937a9e35b5d15d3a0fce33 SHA1: 62eaa9cc84e94352ab7c9c211517030218a6b79f SHA256: 5b277cda904ec17cbefe703fba9fa0d84ca3429a94d07e09f606e0f2f59c9d6a SSDeep: 3:jmvCHzYQH:jmx4 ImpHash: -	Access, Create, Write	Dropped File	Unknown
\\?\C:\BOOTSECT.BAK.garminwasted	MD5: ba747f5e22df8f2b63fa5e0fd627765c SHA1: a588e53440ec0393b1cae408e73606f72e94face SHA256: 75ff1b1836fd6d04c5ea4e17b4fad1163f8059dcaf2def13f1c79c69b061a464 SSDeep: 96:vzDaidCuhFwDG+8A4PtbiW+uGGfz/+vWVrQUqDayFB3d4:7Oid3zwDGIOtbiW4q/+ZUgBN4 ImpHash: -	Access, Create, Delete	Dropped File	Unknown
\\?\C:\BOOTSECT.BAK.garminwasted_info	MD5: 75d3c13ab061436b625dae3c0921ac74 SHA1: 47ecb7399a22377a2a97f712d718f85c4c55ce2f SHA256: 3f5383b3a10eee08143fae4c8b7d26c777bbe40b3fbf8655ca69a5cfb7c99f69 SSDeep: 48:e4QhAtVo7ie/fPtET0mdUziX0I7KLtutEkjaALP1:e4GAtVpe/fJmKziyItBF1 ImpHash: -	Access, Create, Write	Dropped File	Unknown
\\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml.garminwasted	MD5: 8e75b478bdb2053fb329e9255930b469 SHA1: fdadaebfd6d544c18d0277975c674c2c24e3526b SHA256: d6f4017528c0a21eef982287dc529813f4c0adcad1fb463eeb458483522f14d1 SSDeep: 48:cjwXAoyQ7agavBmYEpYE/hCTMfY5MfXKJFMtFFK59DtWGGTMaJMM:YHoZam/iohBYa6gbWDEp ImpHash: -	Access, Create, Delete	Dropped File	Unknown
\\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml.garminwasted_info	MD5: 09472d65fcd4a8f5d1e75fa2ba9bc846 SHA1: e4b77a7771c8e8a4d810dd98a5921f19ac838b8b SHA256: 805d5a97b7256ca763e30f8cc1dea7ee4172d168d0e5d1499fdc981148d9a0e8 SSDeep: 48:e4VBIocClzoqM1din5WADxLK8+1ENnjiQuMgdoM1:e4VBFcCxoqUilLNFjcTqM1 ImpHash: -	Access, Create, Write	Dropped File	Unknown
\\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\Setup.xml.garminwasted	MD5: 12ad69413fb2305d5a5253b658631daf SHA1: 78d7d85ad8fd1343a964b101512aeb12f79caeab SHA256: 4917d9d7d078c5aea45a228d1873272a159d158a7d7486642d7336cc01aded47 SSDeep: 48:cjHpBfpx/+QSXxQ0Q16QkMfQnMfoQEMqQNQZBOQxweaeQPU2ekGkWCrAZc9Ch9QD:YJBxx/+TxPM6oBoZeeBORkq2k2Cr19C6 ImpHash: -	Access, Create, Delete	Dropped File	Unknown
\\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\Setup.xml.garminwasted_info	MD5: f69cde58f6a150f940513cc02a51bcc2 SHA1: ce2fa61455e3fedb7d7ee39552d4986a2ade1e8c SHA256: 2182e60aa5e1f2ebe1eb7796a49bdd7c4be843bae873332eb109514fe3e58b50 SSDeep: 48:e4sZ6Q+l9PNBNDSGOJ9LwlLdqvz3c5+Oh41:e4lQ0PNrDSxRwlLe1 ImpHash: -	Access, Create, Write	Dropped File	Unknown
\\?\C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PowerPointMUI.xml.garminwasted	MD5: e514cf7c3b817c21b18b5fede2308843 SHA1: ff021edacf8909ced0c5b6cf3b1c1f036ab55394 SHA256: 1b327c71698991c205ea4199b772f15240efde60ab540ca6952adcf7b2ee2928 SSDeep: 24:2djH8RBuybOaoYB/6EBhhCRpH8T2uBF2uFdb8uKBHu6OKuOQFGIlH3IlHy:cjCuy0+6E/hCRh8VBzFdrK5u/OAGGZ ImpHash: -	Access, Create, Delete	Dropped File	Unknown
\\?\C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PowerPointMUI.xml.garminwasted_info	MD5: 998b7231a12ffd8eec2926fb51e9b7dd SHA1: eac6580b373638c17e109e0eea11d53f5803a5ff SHA256: 1403ae217e374a11b08c2a96b50248b39fb084d42958ba5845b24c7bef68c863 SSDeep: 24:Q6zkdikbTUauNN2X01zqqBWmoK95uf5kVs4eYScHFv4PFQ0BVM/j9OtF9N5WY0eH:e4QSH/W5kG5iiFQ0BVMBYf5Gbhql1 ImpHash: -	Access, Create, Write	Dropped File	Unknown
\\?\C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\Setup.xml.garminwasted	MD5: 56abd6af75055e6999118e8279f9baf1 SHA1: 9aa3efef547f7cf4f764aea7b9d1f61c98116d6e SHA256: cb22a4e2fff951cbe96d88596ccf0a726c85f5f30ecb9bc25b5502589b284333 SSDeep: 48:cjfpPaDyf+QSXxQ0QlQiQNQDQ7fGyrzTuWQnVGqLq:Yhr+TxPMdmuc1PuWAGkq ImpHash: -	Access, Create, Delete	Dropped File	Unknown
\\?\C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\Setup.xml.garminwasted_info	MD5: 5dab54a4ab09ba4066b3530dbd92b85e SHA1: c693fb7585bf974f2eb29b8bdfd83f6e4962fbc9 SHA256: 8c39893c3cb77243fe8a8e3b9c78a4284483996b68527d924e356e198bc1534a SSDeep: 24:Q6zkdikbTUauNN2X01s0jSqSA6mHxI7uiQ6CklSk5yfT/gsStJrHfvAqD2O6v7Ml:e4a0jwA6LAas/gtJTHAqD2Ok73b4CNe1 ImpHash: -	Access, Create, Write	Dropped File	Unknown
\\?\C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PublisherMUI.xml.garminwasted	MD5: 36ae1e211b5a2b4f979d749769415fe7 SHA1: 7e8cbd3f1f07d7fc2b93e31ccfd80c85f92ee576 SHA256: 45ccedc9378fdfecd4b592663ec1edf21c968b8fc4655504065f05a286754be6 SSDeep: 24:2djDY7+WrhSoJB/6EBhhCgfUBF0CdqXF0Cd0F0CaBF0CKBHzSxSF0CaZMYjxZMZj:cjDYKWrrv6E/hC+C7CzCa8CK5WhCaz1s ImpHash: -	Access, Create, Delete	Dropped File	Unknown
\\?\C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PublisherMUI.xml.garminwasted_info	MD5: afab344b7f79ccb0209922afbb52483c SHA1: a7730206b9df4205813501627bdd9dc515867e8a SHA256: f304984d7de9d1f06b540a3cd371bf727962d7f4c5882ed339bdfa77f0c99097 SSDeep: 48:e4ZBe+y/2lgW5ohFmy8k1uuokKLztcVLxb0l1:e4JUptF98SuuQzixxbM1 ImpHash: -	Access, Create, Write	Dropped File	Unknown
\\?\C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\Setup.xml.garminwasted	MD5: e8da0d4f8f489f3f1e66224b734817ff SHA1: be1039c6632051633253ac54758b05f1a8d12eb3 SHA256: f8c49787bf46de01f95e08f0d5a79cb0647bce51f01b4ffb2f3485a028e91add SSDeep: 48:cj3qmfD0fQSXxQ0QxLQFrQ7YGJH0CYrOzeQuZf3Lq:Y3qYITxPA+lwYGeRf7q ImpHash: -	Access, Create, Delete	Dropped File	Unknown
\\?\C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\Setup.xml.garminwasted_info	MD5: 50f432c291790a33a96de4e3463b6731 SHA1: 3c3b8fb8aadb1c9745332f648ca097360b7b894b SHA256: 0145d5251522b7530b19f30318763732ace39d849fc1b2434d671cd26f5186dd SSDeep: 48:e4ALxJzUH91JzpFo0GuUudejqXvD5T6W4FQ1:e4AjC1N80GuNdemvxUFQ1 ImpHash: -	Access, Create, Write	Dropped File	Unknown
\\?\C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\OutlookMUI.xml.garminwasted	MD5: a05752beeae602e18857eb4627584a71 SHA1: fe35f6b15eda928246c11638678852bf3d283ae4 SHA256: 4642fbf8a6873615125be5f57812e5d1248d5c54549ed631edbfdf993eae14da SSDeep: 48:cjBEA+T1hXgXtWmGFGGmzTm1RYmh70mLtu5LQRagavm6im4hYmaqNdmCOuFYE/hP:YG/gg5nuwiqVCohzRSt5JbbJ+hDH ImpHash: -	Access, Create, Delete	Dropped File	Unknown
\\?\C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\OutlookMUI.xml.garminwasted_info	MD5: 98d0960c2f69c955d701e26a360d6cbb SHA1: 2c05fca36b99a7bc3158ee981a27557166d75e2f SHA256: f4623e88e526d5812d7ab04511bde126041a184dde4a0a56bbc9c1a2dfbbf1ca SSDeep: 24:Q6zkdikbTUauNN2X01xptprtU2RftDFVZa6vlDEfQ7qoFK3S1Esv9KMZLbylrNwt:e4Tjpe2JtBba6vlDEfQ2YEOKMZL/3h1 ImpHash: -	Access, Create, Write	Dropped File	Unknown
\\?\C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\Setup.xml.garminwasted	MD5: 587570072f4307118d7bc1fac77b51d2 SHA1: 92b327a60e3a576b7c8900cccf6cd534261481dd SHA256: 2479db39aa2065e9bc0ab7559a20cd6081e754b90e987d871922eb9d2c4386ab SSDeep: 96:YNdiTxPFH0LN1+M+U+N+0+/yZfxuRNoGNpgd/2LtkqJte2sCyNdq:cdKxtcdxNLe2sjNdq ImpHash: -	Access, Create, Delete	Dropped File	Unknown
\\?\C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\Setup.xml.garminwasted_info	MD5: c8a752525efbe9aa6a35217a3bfdd91f SHA1: 4a5a7460f84a45937bfc6efb8c3d86dea3fff776 SHA256: 63e7769567eb61562d9b12a8e6b2dcfcad2f68ae37fcc5e923bc47e148c5fc33 SSDeep: 48:e4nUg3/OM/A2kCWFGV4IA3Xh/85MgMlCFGzM1:e4nUgPOMbR92F3x052CFGzM1 ImpHash: -	Access, Create, Write	Dropped File	Unknown
\\?\C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\Setup.xml.garminwasted	MD5: eb88b9acfd97c6e28cd0cc9c404aaea0 SHA1: 3027f96198feb8a9a5c85d2bb1d635b2117c793e SHA256: 5bdc1cd5e12812f407db23cfc82d9300ee96c9f51acb04648dfcd40b02218b74 SSDeep: 48:cjcZHRcWcQSXxQ0QakQtSQkfQ4nQ63Q1a4Ql/weaeQPU2KNGA9mIG2a3Dt2sgQz5:YcZxc/TxPbkmSBfTnL3KLtkqIJ/G7AU5 ImpHash: -	Access, Create, Delete	Dropped File	Unknown
\\?\C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\Setup.xml.garminwasted_info	MD5: 7f1662e7a9caf3e8cae31b1a49e6a10d SHA1: d4c06725521d55a9a12b97392450616820223f31 SHA256: 98b3d32d37b05dee52f6e4982816b74bfd7eb349e2ee4aa096a130875bc17ff7 SSDeep: 48:e4JkPDz3AB9SAtF0paKaK71TrlnqpjUESdSbmj1:e4JkP/3EXtSp11opjUMmj1 ImpHash: -	Access, Create, Write	Dropped File	Unknown
\\?\C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\WordMUI.xml.garminwasted_info	MD5: 3a138c495b79d83cedaf4222d3a83df4 SHA1: 701c91dc27397c579ac90f3752c855f0ded263b8 SHA256: 03b6545bd1a54a9bc61148fc26df5ec54b7054118a7902b67692ffc6e200062f SSDeep: 48:ZiUvgg6t6K+/ZJjaOxtTVu5rIoYCzIisszHrD5eF2WlBbwiBKGF7rYWxEd:UEFqsJVGDH9NBC5wiB3BJU ImpHash: -	Access, Create, Write	Dropped File	Unknown
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Mpdev	MD5: 5c89afb4e22ebfb429cd1a0384c43c3d SHA1: 7c85cd8776cc66e2f8e25bb05ed7739acf751c1a SHA256: 929a930d627998617ce3c73eaa6e9c265428313b0648b1e6c78729f971b17e7d SSDeep: 6144:wIvnpHZVDRCZWvw7vkLMSroKWfUkzaX9Sj/R:wS1zIziGfF ImpHash: 73704df6adc536c6787b048324b885ae	Access, Create	Dropped File	Whitelisted
\\?\C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\WordMUI.xml.garminwasted	MD5: cf4d61ccbf565f83e919f4bef3f0e133 SHA1: 10a91eb0c531fd20f112aae5c5307bdcb7e5d58b SHA256: e15b71147e48db5567e8f166e7b8482686a00fe376a20619ea5dc430edd26171 SSDeep: 48:cjlRIsCNt+IpgLkePjRagavYE/hC/A2vER4K5ifkNRhGGWaXc:YM9kItePPohGzsWf2M ImpHash: -	Access, Create, Delete	Dropped File	Whitelisted
C:\Windows\system32\Mpdev.exe	-	Access, Create, Write		Not Available
\\?\C:\BOOTSECT.BAK.garminwasted	-	Access		Not Available

Registry (2)

Registry Key Name	Operations
HKEY_CLASSES_ROOT\interfacE\{b196b287-bab4-101a-b69c-00aa00341d07}	Access, Read
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control	Access

Mutex (1)

Mutex Name	Operations
Global\MobileSqmservice	Access

Export to TXT Export to JSON

Function Logfile

This feature requires an online-connection to the VMRay backend.

An offline version with limited functionality is also provided.
The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".

Remarks (1/1)

Indicators

Before

After