Summary

Yara rules detected for file (5 events)

description	Take screenshot				rule	screenshot
description	Run a keylogger				rule	keylogger
description	Affect system registries				rule	win_registry
description	Affect private profile				rule	win_files_operation
description	Affect hook table				rule	win_hook

Allocates read-write-execute memory (usually to unpack itself) (2 events)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory June 21, 2025, 1:41 p.m.	process_identifier: 1892 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003f0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory June 21, 2025, 1:42 p.m.	process_identifier: 1064 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00360000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0

Command line console output was observed (1 event)

Time & API	Arguments	Status	Return	Repeated
WriteConsoleW June 21, 2025, 1:42 p.m.	buffer: The operation completed successfully. console_handle: 0x00000007	1	1	0

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx June 21, 2025, 1:42 p.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (7 events)

section	CODE\x00U
section	DATA\x00s\x1dm
section	BSS\x00\xba\x7f
section	.data2
section	.tls\x00\x7f
section	.rdata\x00\
section	.reloc\x00h

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Creates executable files on the filesystem (2 events)

file	C:\Users\Administrator\AppData\Roaming\Scegli_nome_allegato.exe
file	C:\Users\Administrator\AppData\Roaming\7D57AD13E21.exe

Drops a binary and executes it (2 events)

file	C:\Users\Administrator\AppData\Roaming\7D57AD13E21.exe
file	C:\Users\Administrator\AppData\Roaming\Scegli_nome_allegato.exe

Drops an executable to the user AppData folder (2 events)

file	C:\Users\Administrator\AppData\Roaming\Scegli_nome_allegato.exe
file	C:\Users\Administrator\AppData\Roaming\7D57AD13E21.exe

A process created a hidden window (1 event)

Time & API	Arguments	Status	Return	Repeated
ShellExecuteExW June 21, 2025, 1:42 p.m.	show_type: 0 filepath_r: reg.exe parameters: ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "Windows Update" /t REG_SZ /d "C:\Users\Administrator\AppData\Roaming\7D57AD13E21.exe" /f filepath: reg.exe	1	1	0

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section	{u'size_of_data': u'0x001a3e00', u'virtual_address': u'0x0005d000', u'entropy': 7.97621457712309, u'name': u'.rsrc', u'virtual_size': u'0x001a3c78'}				entropy	7.97621457712				description	A section with a high entropy has been found
entropy	0.827543729983				description	Overall entropy of this PE file is high

Uses Windows utilities for basic Windows functionality (2 events)

cmdline	"C:\Windows\System32\reg.exe" ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "Windows Update" /t REG_SZ /d "C:\Users\Administrator\AppData\Roaming\7D57AD13E21.exe" /f
cmdline	reg.exe ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "Windows Update" /t REG_SZ /d "C:\Users\Administrator\AppData\Roaming\7D57AD13E21.exe" /f

One or more of the buffers contains an embedded PE file (1 event)

buffer

Buffer with sha1: 8927d71b5ac3d97b23dd343f8f8c6a4992ce9f8f

Allocates execute permission to another process indicative of possible code injection (1 event)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory June 21, 2025, 1:42 p.m.	process_identifier: 2784 region_size: 679936 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE) process_handle: 0x000000ec	1	0	0

Installs itself for autorun at Windows startup (1 event)

reg_key

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\Windows Update

reg_value

C:\Users\Administrator\AppData\Roaming\7D57AD13E21.exe

Manipulates memory of a non-child process indicative of process injection (3 events)

Process injection

Process 1064 manipulating memory of non-child process 2784

Time & API	Arguments	Status	Return	Repeated
NtUnmapViewOfSection June 21, 2025, 1:42 p.m.	base_address: 0x00400000 region_size: 4096 process_identifier: 2784 process_handle: 0x000000ec	1	0	0
NtAllocateVirtualMemory June 21, 2025, 1:42 p.m.	process_identifier: 2784 region_size: 679936 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE) process_handle: 0x000000ec	1	0	0

Potential code injection by writing to the memory of another process (2 events)

Process injection

Process 1064 injected into non-child 2784

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory June 21, 2025, 1:42 p.m.	buffer: @ base_address: 0x7efde008 process_identifier: 2784 process_handle: 0x000000ec	1	1	0

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 events)

Process injection

Process 1064 called NtSetContextThread to modify thread in remote process 2784

Time & API	Arguments	Status	Return	Repeated
NtSetContextThread June 21, 2025, 1:42 p.m.	registers.eip: 2011365812 registers.esp: 1638384 registers.edi: 0 registers.eax: 4741652 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x000000e8 process_identifier: 2784	1	0	0

Executed a process and injected code into it, probably while unpacking (10 events)

Time & API	Arguments	Status	Return	Repeated
CreateProcessInternalW June 21, 2025, 1:42 p.m.	thread_identifier: 1540 thread_handle: 0x0000022c process_identifier: 2844 current_directory: C:\Users\Administrator\AppData\Local\Temp filepath: C:\Windows\System32\reg.exe track: 1 command_line: "C:\Windows\System32\reg.exe" ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "Windows Update" /t REG_SZ /d "C:\Users\Administrator\AppData\Roaming\7D57AD13E21.exe" /f filepath_r: C:\Windows\System32\reg.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x00000234	1	1	0
CreateProcessInternalW June 21, 2025, 1:42 p.m.	thread_identifier: 1768 thread_handle: 0x000002a4 process_identifier: 1064 current_directory: C:\Users\Administrator\AppData\Local\Temp filepath: C:\Users\Administrator\AppData\Roaming\7D57AD13E21.exe track: 1 command_line: "C:\Users\Administrator\AppData\Roaming\7D57AD13E21.exe" filepath_r: C:\Users\Administrator\AppData\Roaming\7D57AD13E21.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x000002a8	1	1	0
CreateProcessInternalW June 21, 2025, 1:42 p.m.	thread_identifier: 0 thread_handle: 0x00000000 process_identifier: 0 current_directory: C:\Users\Administrator\AppData\Local\Temp filepath: C:\Users\Administrator\AppData\Roaming\Scegli_nome_allegato.exe track: 0 command_line: "C:\Users\Administrator\AppData\Roaming\Scegli_nome_allegato.exe" filepath_r: C:\Users\Administrator\AppData\Roaming\Scegli_nome_allegato.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x00000000		0	0
CreateProcessInternalW June 21, 2025, 1:42 p.m.	thread_identifier: 2080 thread_handle: 0x000000e8 process_identifier: 2784 current_directory: filepath: C:\Users\Administrator\AppData\Roaming\7D57AD13E21.exe track: 1 command_line: filepath_r: C:\Users\Administrator\AppData\Roaming\7D57AD13E21.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x000000ec	1	1	0
NtGetContextThread June 21, 2025, 1:42 p.m.	thread_handle: 0x000000e8	1	0	0
NtUnmapViewOfSection June 21, 2025, 1:42 p.m.	base_address: 0x00400000 region_size: 4096 process_identifier: 2784 process_handle: 0x000000ec	1	0	0
NtAllocateVirtualMemory June 21, 2025, 1:42 p.m.	process_identifier: 2784 region_size: 679936 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE) process_handle: 0x000000ec	1	0	0
WriteProcessMemory June 21, 2025, 1:42 p.m.	buffer: base_address: 0x00400000 process_identifier: 2784 process_handle: 0x000000ec	1	1	0
WriteProcessMemory June 21, 2025, 1:42 p.m.	buffer: @ base_address: 0x7efde008 process_identifier: 2784 process_handle: 0x000000ec	1	1	0
NtSetContextThread June 21, 2025, 1:42 p.m.	registers.eip: 2011365812 registers.esp: 1638384 registers.edi: 0 registers.eax: 4741652 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x000000e8 process_identifier: 2784	1	0	0

File has been identified by 13 AntiVirus engine on IRMA as malicious (13 events)

G Data Antivirus (Windows)	Virus: Gen:Variant.Genie.689 (Engine A)
Avast Core Security (Linux)	Win32:MBRlock-DV [Trj]
C4S ClamAV (Linux)	Win.Trojan.Mbrlock-9779766-0
Trellix (Linux)	GenericRXIP-BJ
WithSecure (Linux)	Trojan.TR/Crypt.XPACK.Gen
eScan Antivirus (Linux)	Gen:Variant.Genie.689(DB)
ESET Security (Windows)	a variant of Win32/Injector.ERFT trojan
Sophos Anti-Virus (Linux)	Troj/Inject-JDR
DrWeb Antivirus (Linux)	Trojan.DownLoader6.7779
ClamAV (Linux)	Win.Trojan.Mbrlock-9779766-0
Bitdefender Antivirus (Linux)	Gen:Variant.Genie.689
Kaspersky Standard (Windows)	HEUR:Trojan-Ransom.Win32.Blocker.vho
Emsisoft Commandline Scanner (Windows)	Gen:Variant.Genie.689 (B)