Cuckoo Sandbox

File c96ebdb12684d0b47ebd0fa81aee556c8c981b942262d2169d9f63dc3b7e5a7c.exe

Summary
Download Resubmit sample

Size	802.5KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`afdd799a769a2fd3f66c2fad9f1d1026`
SHA1	`b08ec120f594b4b3c972a52bb4e7be343a62ef25`
SHA256	`c96ebdb12684d0b47ebd0fa81aee556c8c981b942262d2169d9f63dc3b7e5a7c`
SHA512	`98d4e6710c714aceb87fa2f941d549344e48fca42ca690b3e5e26f122aee29682845ce65d82980722edf25e463bf9b96fa8a822e9248872027fbee7818180cb7`
CRC32	`6193B312`
ssdeep	`None`
PDB Path	C:\pebecejikov\59\hececeboveyit kegid_xifufe\xikiricow.pdb
Yara	ThreadControl__Context - (no description) anti_dbg - Checks if being debugged

Score

This file is very suspicious, with a score of 10 out of 10!

Please notice: The scoring system is currently still in development and should be considered an alpha feature.

Feedback

Expecting different results? Send us this analysis and we will inspect it. Click here

Information on Execution

Analysis

Category	Started	Completed	Duration	Routing	Logs
FILE	Sept. 11, 2025, 10:05 a.m.	Sept. 11, 2025, 10:09 a.m.	268 seconds	internet	Show Analyzer Log Show Cuckoo Log

Analyzer Log

2025-09-11 09:58:37,000 [analyzer] DEBUG: Starting analyzer from: C:\tmpzepe2z
2025-09-11 09:58:37,015 [analyzer] DEBUG: Pipe server name: \??\PIPE\YygWTGYxgOHAfCXjTJdz
2025-09-11 09:58:37,015 [analyzer] DEBUG: Log pipe server name: \??\PIPE\EVozSOSuiKDsLjUZYUBwbiGoDseC
2025-09-11 09:58:37,328 [analyzer] DEBUG: Started auxiliary module Curtain
2025-09-11 09:58:37,328 [analyzer] DEBUG: Started auxiliary module DbgView
2025-09-11 09:58:37,733 [analyzer] DEBUG: Started auxiliary module Disguise
2025-09-11 09:58:37,953 [analyzer] DEBUG: Loaded monitor into process with pid 504
2025-09-11 09:58:37,953 [analyzer] DEBUG: Started auxiliary module DumpTLSMasterSecrets
2025-09-11 09:58:37,953 [analyzer] DEBUG: Started auxiliary module Human
2025-09-11 09:58:37,967 [analyzer] DEBUG: Started auxiliary module InstallCertificate
2025-09-11 09:58:37,967 [analyzer] DEBUG: Started auxiliary module Reboot
2025-09-11 09:58:38,015 [analyzer] DEBUG: Started auxiliary module RecentFiles
2025-09-11 09:58:38,015 [analyzer] DEBUG: Started auxiliary module Screenshots
2025-09-11 09:58:38,015 [analyzer] DEBUG: Started auxiliary module Sysmon
2025-09-11 09:58:38,015 [analyzer] DEBUG: Started auxiliary module LoadZer0m0n
2025-09-11 09:58:38,155 [lib.api.process] INFO: Successfully executed process from path u'C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\c96ebdb12684d0b47ebd0fa81aee556c8c981b942262d2169d9f63dc3b7e5a7c.exe' with arguments '' and pid 1708
2025-09-11 09:58:38,328 [analyzer] DEBUG: Loaded monitor into process with pid 1708
2025-09-11 09:07:59,697 [analyzer] INFO: Injected into process with pid 1724 and name ''
2025-09-11 09:07:59,808 [lib.api.process] ERROR: Failed to dump memory of 32-bit process with pid 1724.
2025-09-11 09:07:59,885 [lib.api.process] ERROR: Failed to dump memory of 32-bit process with pid 1708.
2025-09-11 09:07:59,947 [analyzer] INFO: Process with pid 1708 has terminated
2025-09-11 09:07:59,994 [analyzer] DEBUG: Loaded monitor into process with pid 1724
2025-09-11 09:08:02,917 [analyzer] INFO: Added new file to list with pid 1724 and path C:\Users\Administrator\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\14232B434CF29D4C4FB335A86D7FFFE3
2025-09-11 09:08:02,917 [analyzer] INFO: Added new file to list with pid 1724 and path C:\Users\Administrator\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\14232B434CF29D4C4FB335A86D7FFFE3
2025-09-11 09:08:02,933 [analyzer] INFO: Added new file to list with pid 1724 and path C:\Users\Administrator\AppData\Local\Temp\Cab4D6.tmp
2025-09-11 09:08:02,963 [analyzer] INFO: Added new file to list with pid 1724 and path C:\Users\Administrator\AppData\Local\Temp\Tar4D7.tmp
2025-09-11 09:08:03,119 [analyzer] INFO: Added new file to list with pid 1724 and path C:\Users\Administrator\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
2025-09-11 09:08:03,119 [analyzer] INFO: Added new file to list with pid 1724 and path C:\Users\Administrator\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
2025-09-11 09:08:03,135 [analyzer] INFO: Added new file to list with pid 1724 and path C:\Users\Administrator\AppData\Local\Temp\Cab5A3.tmp
2025-09-11 09:08:03,135 [analyzer] INFO: Added new file to list with pid 1724 and path C:\Users\Administrator\AppData\Local\Temp\Tar5A4.tmp
2025-09-11 09:08:03,322 [analyzer] INFO: Added new file to list with pid 1724 and path C:\Users\Administrator\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12
2025-09-11 09:08:03,338 [analyzer] INFO: Added new file to list with pid 1724 and path C:\Users\Administrator\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12
2025-09-11 09:08:03,401 [analyzer] INFO: Added new file to list with pid 1724 and path C:\Users\Administrator\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8
2025-09-11 09:08:03,417 [analyzer] INFO: Added new file to list with pid 1724 and path C:\Users\Administrator\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8
2025-09-11 09:08:03,776 [analyzer] INFO: Injected into process with pid 664 and name u'icacls.exe'
2025-09-11 09:08:03,917 [analyzer] DEBUG: Loaded monitor into process with pid 664
2025-09-11 09:08:03,994 [lib.api.process] ERROR: Failed to dump memory of 32-bit process with pid 664.
2025-09-11 09:08:10,947 [analyzer] INFO: Analysis timeout hit, terminating analysis.
2025-09-11 09:08:11,010 [lib.api.process] ERROR: Failed to dump memory of 32-bit process with pid 1724.
2025-09-11 09:08:11,010 [lib.api.process] WARNING: The process with pid 664 is not alive, memory dump aborted
2025-09-11 09:08:11,322 [analyzer] INFO: Terminating remaining processes before shutdown.
2025-09-11 09:08:11,322 [lib.api.process] INFO: Successfully terminated process with pid 1724.
2025-09-11 09:08:11,354 [analyzer] INFO: Analysis completed.

Cuckoo Log

2025-09-11 10:05:28,506 [cuckoo.core.scheduler] INFO: Task #6966063: acquired machine win7x6417 (label=win7x6417)
2025-09-11 10:05:28,506 [cuckoo.core.resultserver] DEBUG: Now tracking machine 192.168.168.217 for task #6966063
2025-09-11 10:05:29,121 [cuckoo.auxiliary.sniffer] INFO: Started sniffer with PID 3585636 (interface=vboxnet0, host=192.168.168.217)
2025-09-11 10:05:29,798 [cuckoo.machinery.virtualbox] DEBUG: Starting vm win7x6417
2025-09-11 10:05:30,769 [cuckoo.machinery.virtualbox] DEBUG: Restoring virtual machine win7x6417 to vmcloak
2025-09-11 10:07:33,082 [cuckoo.core.guest] INFO: Starting analysis #6966063 on guest (id=win7x6417, ip=192.168.168.217)
2025-09-11 10:07:34,087 [cuckoo.core.guest] DEBUG: win7x6417: not ready yet
2025-09-11 10:07:39,317 [cuckoo.core.guest] INFO: Guest is running Cuckoo Agent 0.10 (id=win7x6417, ip=192.168.168.217)
2025-09-11 10:07:39,467 [cuckoo.core.guest] DEBUG: Uploading analyzer to guest (id=win7x6417, ip=192.168.168.217, monitor=latest, size=6660546)
2025-09-11 10:07:40,773 [cuckoo.core.resultserver] DEBUG: Task #6966063: live log analysis.log initialized.
2025-09-11 10:07:41,677 [cuckoo.core.resultserver] DEBUG: Task #6966063 is sending a BSON stream
2025-09-11 10:07:42,036 [cuckoo.core.resultserver] DEBUG: Task #6966063 is sending a BSON stream
2025-09-11 10:07:42,947 [cuckoo.core.resultserver] DEBUG: Task #6966063: File upload for 'shots/0001.jpg'
2025-09-11 10:07:42,961 [cuckoo.core.resultserver] DEBUG: Task #6966063 uploaded file length: 133468
2025-09-11 10:07:55,998 [cuckoo.core.guest] DEBUG: win7x6417: analysis #6966063 still processing
2025-09-11 10:07:59,917 [cuckoo.core.resultserver] DEBUG: Task #6966063 is sending a BSON stream
2025-09-11 10:08:03,245 [cuckoo.core.resultserver] DEBUG: Task #6966063: File upload for 'files/d12dd18018f984aa_Cab4D6.tmp'
2025-09-11 10:08:03,262 [cuckoo.core.resultserver] DEBUG: Task #6966063 uploaded file length: 58383
2025-09-11 10:08:03,264 [cuckoo.core.resultserver] DEBUG: Task #6966063: File upload for 'files/78eeb661b72a34ca_Tar4D7.tmp'
2025-09-11 10:08:03,266 [cuckoo.core.resultserver] DEBUG: Task #6966063: File upload for 'files/33ba8221ff3f5211_Cab5A3.tmp'
2025-09-11 10:08:03,269 [cuckoo.core.resultserver] DEBUG: Task #6966063 uploaded file length: 73211
2025-09-11 10:08:03,270 [cuckoo.core.resultserver] DEBUG: Task #6966063: File upload for 'files/4018ab25d7d15f77_Tar5A4.tmp'
2025-09-11 10:08:03,273 [cuckoo.core.resultserver] DEBUG: Task #6966063 uploaded file length: 146584
2025-09-11 10:08:03,275 [cuckoo.core.resultserver] DEBUG: Task #6966063 uploaded file length: 189652
2025-09-11 10:08:03,848 [cuckoo.core.resultserver] DEBUG: Task #6966063 is sending a BSON stream
2025-09-11 10:08:11,108 [cuckoo.core.resultserver] DEBUG: Task #6966063: File upload for 'curtain/1757574491.1.curtain.log'
2025-09-11 10:08:11,110 [cuckoo.core.resultserver] DEBUG: Task #6966063 uploaded file length: 36
2025-09-11 10:08:11,160 [cuckoo.core.guest] DEBUG: win7x6417: analysis #6966063 still processing
2025-09-11 10:08:11,293 [cuckoo.core.resultserver] DEBUG: Task #6966063: File upload for 'sysmon/1757574491.29.sysmon.xml'
2025-09-11 10:08:11,315 [cuckoo.core.resultserver] DEBUG: Task #6966063 uploaded file length: 1734346
2025-09-11 10:08:11,322 [cuckoo.core.resultserver] DEBUG: Task #6966063: File upload for 'files/58a0a35e406f4a86_8b2b9a00839eed1dfdccc3bfc2f5df12'
2025-09-11 10:08:11,325 [cuckoo.core.resultserver] DEBUG: Task #6966063 uploaded file length: 174
2025-09-11 10:08:11,331 [cuckoo.core.resultserver] DEBUG: Task #6966063: File upload for 'files/6fb1b8e593cb0388_b46811c17859ffb409cf0e904a4aa8f8'
2025-09-11 10:08:11,333 [cuckoo.core.resultserver] DEBUG: Task #6966063 uploaded file length: 530
2025-09-11 10:08:11,334 [cuckoo.core.resultserver] DEBUG: Task #6966063: File upload for 'files/ebd41040e4bb3ec7_14232b434cf29d4c4fb335a86d7fffe3'
2025-09-11 10:08:11,336 [cuckoo.core.resultserver] DEBUG: Task #6966063 uploaded file length: 889
2025-09-11 10:08:11,338 [cuckoo.core.resultserver] DEBUG: Task #6966063: File upload for 'files/2b4b975177c96ea7_94308059b57b3142e455b38a6eb92015'
2025-09-11 10:08:11,340 [cuckoo.core.resultserver] DEBUG: Task #6966063 uploaded file length: 344
2025-09-11 10:08:11,342 [cuckoo.core.resultserver] DEBUG: Task #6966063: File upload for 'files/81b7fa53b692b4d2_8b2b9a00839eed1dfdccc3bfc2f5df12'
2025-09-11 10:08:11,361 [cuckoo.core.resultserver] DEBUG: Task #6966063 uploaded file length: 1739
2025-09-11 10:08:11,371 [cuckoo.core.resultserver] DEBUG: Task #6966063: File upload for 'files/d9974a87c551c616_14232b434cf29d4c4fb335a86d7fffe3'
2025-09-11 10:08:11,382 [cuckoo.core.resultserver] DEBUG: Task #6966063 uploaded file length: 170
2025-09-11 10:08:11,384 [cuckoo.core.resultserver] DEBUG: Task #6966063: File upload for 'files/ef93064d5a8fc039_b46811c17859ffb409cf0e904a4aa8f8'
2025-09-11 10:08:11,392 [cuckoo.core.resultserver] DEBUG: Task #6966063 uploaded file length: 170
2025-09-11 10:08:11,687 [cuckoo.core.resultserver] DEBUG: Task #6966063 had connection reset for <Context for LOG>
2025-09-11 10:08:14,173 [cuckoo.core.guest] INFO: win7x6417: analysis completed successfully
2025-09-11 10:08:14,186 [cuckoo.core.plugins] DEBUG: Stopped auxiliary module: Redsocks
2025-09-11 10:08:14,210 [cuckoo.core.plugins] DEBUG: Stopped auxiliary module: Sniffer
2025-09-11 10:08:15,724 [cuckoo.machinery.virtualbox] INFO: Successfully generated memory dump for virtual machine with label win7x6417 to path /srv/cuckoo/cwd/storage/analyses/6966063/memory.dmp
2025-09-11 10:08:15,726 [cuckoo.machinery.virtualbox] DEBUG: Stopping vm win7x6417
2025-09-11 10:09:56,516 [cuckoo.core.resultserver] DEBUG: Stopped tracking machine 192.168.168.217 for task #6966063
2025-09-11 10:09:56,921 [cuckoo.core.scheduler] DEBUG: Released database task #6966063
2025-09-11 10:09:56,943 [cuckoo.core.scheduler] INFO: Task #6966063: analysis procedure completed

Signatures

Yara rules detected for file (2 events)

description	(no description)				rule	ThreadControl__Context
description	Checks if being debugged				rule	anti_dbg

Allocates read-write-execute memory (usually to unpack itself) (2 events)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory Sept. 11, 2025, 10:58 a.m.	process_identifier: 1708 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 593920 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x021d0000 process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory Sept. 11, 2025, 10:58 a.m.	process_identifier: 1708 region_size: 1159168 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02270000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0

Queries for the computername (1 event)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameW Sept. 11, 2025, 10:08 a.m.	computer_name: UQLMVVBCPTLNMZR	1	1	0

Checks if process is being debugged by a debugger (1 event)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Sept. 11, 2025, 10:58 a.m.			0	0

This executable has a PDB path (1 event)

pdb_path

C:\pebecejikov\59\hececeboveyit kegid_xifufe\xikiricow.pdb

The file contains an unknown PE resource name possibly indicative of a packer (1 event)

resource name

AFX_DIALOG_LAYOUT

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses Sept. 11, 2025, 10:08 a.m.	flags: 46 family: 0	1	0	0

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x00099400', u'virtual_address': u'0x00001000', u'entropy': 7.987824305532955, u'name': u'.text', u'virtual_size': u'0x0009922d'}

entropy

7.98782430553

description

A section with a high entropy has been found

entropy

0.764815970056

description

Overall entropy of this PE file is high

Raised Snort alerts (5 events)

snort	ET INFO External IP Lookup Domain (2ip .ua) in DNS Lookup
snort	ET POLICY External IP Address Lookup DNS Query (2ip .ua)
snort	ETPRO INFO Observed DNS Query for Ukraine Domain (.ua)
snort	ET INFO Observed External IP Lookup Domain (api .2ip .ua in TLS SNI)
snort	ET INFO Observed External IP Lookup Domain (2ip .ua) in TLS SNI

Allocates execute permission to another process indicative of possible code injection (1 event)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory Sept. 11, 2025, 10:58 a.m.	process_identifier: 1724 region_size: 1273856 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000009c	1	0	0

Installs itself for autorun at Windows startup (1 event)

reg_key

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\SysHelper

reg_value

"C:\Users\Administrator\AppData\Local\a01930b0-e0be-4a4c-9b8f-8be52c11da66\c96ebdb12684d0b47ebd0fa81aee556c8c981b942262d2169d9f63dc3b7e5a7c.exe" --AutoStart

Potential code injection by writing to the memory of another process (1 event)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory Sept. 11, 2025, 10:58 a.m.	buffer: @ base_address: 0x7efde008 process_identifier: 1724 process_handle: 0x0000009c	1	1	0

Attempts to create or modify system certificates (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob

Sets or modifies WPAD proxy autoconfiguration file for traffic interception (10 events)

Time & API	Arguments	Status
RegSetValueExW Sept. 11, 2025, 10:08 a.m.	key_handle: 0x000002b0 regkey_r: WpadDecisionReason reg_type: 4 (REG_DWORD) value: 1 regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{092F0E6C-7874-4263-8D41-969F2B667EA2}\WpadDecisionReason	1
RegSetValueExW Sept. 11, 2025, 10:08 a.m.	key_handle: 0x000002b0 regkey_r: WpadDecisionTime reg_type: 3 (REG_BINARY) value: 'J@6#Ü regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{092F0E6C-7874-4263-8D41-969F2B667EA2}\WpadDecisionTime	1
RegSetValueExW Sept. 11, 2025, 10:08 a.m.	key_handle: 0x000002b0 regkey_r: WpadDecision reg_type: 4 (REG_DWORD) value: 0 regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{092F0E6C-7874-4263-8D41-969F2B667EA2}\WpadDecision	1
RegSetValueExW Sept. 11, 2025, 10:08 a.m.	key_handle: 0x000002b0 regkey_r: WpadNetworkName reg_type: 1 (REG_SZ) value: Network regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{092F0E6C-7874-4263-8D41-969F2B667EA2}\WpadNetworkName	1
RegSetValueExW Sept. 11, 2025, 10:08 a.m.	key_handle: 0x0000057c regkey_r: WpadDecisionReason reg_type: 4 (REG_DWORD) value: 1 regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionReason	1
RegSetValueExW Sept. 11, 2025, 10:08 a.m.	key_handle: 0x0000057c regkey_r: WpadDecisionTime reg_type: 3 (REG_BINARY) value: 'J@6#Ü regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionTime	1
RegSetValueExW Sept. 11, 2025, 10:08 a.m.	key_handle: 0x0000057c regkey_r: WpadDecision reg_type: 4 (REG_DWORD) value: 0 regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecision	1
RegSetValueExW Sept. 11, 2025, 10:08 a.m.	key_handle: 0x000002b0 regkey_r: WpadDecisionReason reg_type: 4 (REG_DWORD) value: 1 regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionReason	1
RegSetValueExW Sept. 11, 2025, 10:08 a.m.	key_handle: 0x000002b0 regkey_r: WpadDecisionTime reg_type: 3 (REG_BINARY) value: 'J@6#Ü regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionTime	1
RegSetValueExW Sept. 11, 2025, 10:08 a.m.	key_handle: 0x000002b0 regkey_r: WpadDecision reg_type: 4 (REG_DWORD) value: 0 regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecision	1

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 events)

Process injection

Process 1708 called NtSetContextThread to modify thread in remote process 1724

Time & API	Arguments	Status	Return	Repeated
NtSetContextThread Sept. 11, 2025, 10:58 a.m.	registers.eip: 2009727412 registers.esp: 1638384 registers.edi: 0 registers.eax: 4342081 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000098 process_identifier: 1724	1	0	0

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Process injection

Process 1708 resumed a thread in remote process 1724

Time & API	Arguments	Status	Return	Repeated
NtResumeThread Sept. 11, 2025, 10:58 a.m.	thread_handle: 0x00000098 suspend_count: 1 process_identifier: 1724	1	0	0

Uses suspicious command line tools or Windows utilities (1 event)

cmdline

icacls "C:\Users\Administrator\AppData\Local\a01930b0-e0be-4a4c-9b8f-8be52c11da66" /deny *S-1-1-0:(OI)(CI)(DE,DC)

Executed a process and injected code into it, probably while unpacking (10 events)

Time & API	Arguments	Status	Return
NtResumeThread Sept. 11, 2025, 10:08 a.m.	thread_handle: 0x0000055c suspend_count: 1 process_identifier: 1724	1	0
CreateProcessInternalW Sept. 11, 2025, 10:08 a.m.	thread_identifier: 2704 thread_handle: 0x00000338 process_identifier: 664 current_directory: filepath: track: 1 command_line: icacls "C:\Users\Administrator\AppData\Local\a01930b0-e0be-4a4c-9b8f-8be52c11da66" /deny *S-1-1-0:(OI)(CI)(DE,DC) filepath_r: stack_pivoted: 0 creation_flags: 72 (DETACHED_PROCESS\|IDLE_PRIORITY_CLASS) inherit_handles: 0 process_handle: 0x000002c0	1	1
CreateProcessInternalW Sept. 11, 2025, 10:08 a.m.	thread_identifier: 2360 thread_handle: 0x00000650 process_identifier: 2556 current_directory: C:\Users\Administrator\AppData\Local\Temp filepath: C:\Users\Administrator\AppData\Local\Temp\c96ebdb12684d0b47ebd0fa81aee556c8c981b942262d2169d9f63dc3b7e5a7c.exe track: 1 command_line: "C:\Users\Administrator\AppData\Local\Temp\c96ebdb12684d0b47ebd0fa81aee556c8c981b942262d2169d9f63dc3b7e5a7c.exe" --Admin IsNotAutoStart IsNotTask filepath_r: C:\Users\Administrator\AppData\Local\Temp\c96ebdb12684d0b47ebd0fa81aee556c8c981b942262d2169d9f63dc3b7e5a7c.exe stack_pivoted: 0 creation_flags: 67634196 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_SUSPENDED\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x0000064c	1	1
CreateProcessInternalW Sept. 11, 2025, 10:58 a.m.	thread_identifier: 1480 thread_handle: 0x00000098 process_identifier: 1724 current_directory: filepath: C:\Users\Administrator\AppData\Local\Temp\c96ebdb12684d0b47ebd0fa81aee556c8c981b942262d2169d9f63dc3b7e5a7c.exe track: 1 command_line: "C:\Users\Administrator\AppData\Local\Temp\c96ebdb12684d0b47ebd0fa81aee556c8c981b942262d2169d9f63dc3b7e5a7c.exe" filepath_r: C:\Users\Administrator\AppData\Local\Temp\c96ebdb12684d0b47ebd0fa81aee556c8c981b942262d2169d9f63dc3b7e5a7c.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x0000009c	1	1
NtGetContextThread Sept. 11, 2025, 10:58 a.m.	thread_handle: 0x00000098	1	0
NtUnmapViewOfSection Sept. 11, 2025, 10:58 a.m.	base_address: 0x00400000 region_size: 4096 process_identifier: 1724 process_handle: 0x0000009c	1	0
NtAllocateVirtualMemory Sept. 11, 2025, 10:58 a.m.	process_identifier: 1724 region_size: 1273856 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000009c	1	0
WriteProcessMemory Sept. 11, 2025, 10:58 a.m.	buffer: @ base_address: 0x7efde008 process_identifier: 1724 process_handle: 0x0000009c	1	1
NtSetContextThread Sept. 11, 2025, 10:58 a.m.	registers.eip: 2009727412 registers.esp: 1638384 registers.edi: 0 registers.eax: 4342081 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000098 process_identifier: 1724	1	0
NtResumeThread Sept. 11, 2025, 10:58 a.m.	thread_handle: 0x00000098 suspend_count: 1 process_identifier: 1724	1	0

File has been identified by 14 AntiVirus engine on IRMA as malicious (14 events)

G Data Antivirus (Windows)	Virus: Gen:Variant.BrResMon.280 (Engine A)
Avast Core Security (Linux)	Win32:MalwareX-gen [Pws]
C4S ClamAV (Linux)	Win.Packer.pkr_ce1a-9980177-0
Trend Micro SProtect (Linux)	Ransom.Win32.STOP.SMYXEAGZ
Trellix (Linux)	Lockbit-FSWW
WithSecure (Linux)	Heuristic.HEUR/AGEN.1371585
eScan Antivirus (Linux)	Gen:Variant.BrResMon.280(DB)
ESET Security (Windows)	a variant of Win32/Kryptik.HVYL trojan
Sophos Anti-Virus (Linux)	Troj/Krypt-VK
DrWeb Antivirus (Linux)	Trojan.Siggen23.36223
ClamAV (Linux)	Win.Packer.pkr_ce1a-9980177-0
Bitdefender Antivirus (Linux)	Gen:Variant.BrResMon.280
Kaspersky Standard (Windows)	UDS:DangerousObject.Multi.Generic
Emsisoft Commandline Scanner (Windows)	Gen:Variant.BrResMon.280 (B)

File has been identified by 63 AntiVirus engines on VirusTotal as malicious (50 out of 63 events)

Bkav	W32.AIDetectMalware
Lionic	Trojan.Win32.Stop.13!c
tehtris	Generic.Malware
Cynet	Malicious (score: 100)
CAT-QuickHeal	Ransom.Stop.P5
Skyhigh	BehavesLike.Win32.Lockbit.cc
ALYac	Trojan.Ransom.Stop
Cylance	Unsafe
VIPRE	Gen:Variant.BrResMon.280
Sangfor	Trojan.Win32.Save.a
CrowdStrike	win/malicious_confidence_100% (W)
BitDefender	Gen:Variant.BrResMon.280
K7GW	Trojan ( 0056b2c51 )
K7AntiVirus	Trojan ( 0056b2c51 )
Arcabit	Trojan.BrResMon.280
VirIT	Trojan.Win32.Genus.UWQ
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	a variant of Win32/Kryptik.HVYL
APEX	Malicious
Avast	Win32:MalwareX-gen [Pws]
ClamAV	Win.Packer.pkr_ce1a-9980177-0
Kaspersky	HEUR:Trojan.Win32.Injuke.gen
Alibaba	Trojan:Win32/Mokes.54527743
NANO-Antivirus	Trojan.Win32.Injuke.kgzaim
MicroWorld-eScan	Gen:Variant.BrResMon.280
Rising	Trojan.SmokeLoader!1.EB63 (CLASSIC)
Emsisoft	Gen:Variant.BrResMon.280 (B)
F-Secure	Heuristic.HEUR/AGEN.1371585
DrWeb	Trojan.Siggen23.36223
Zillya	Trojan.Kryptik.Win32.4557197
TrendMicro	Ransom.Win32.STOP.SMYXEAGZ
McAfeeD	ti!C96EBDB12684
Trapmine	suspicious.low.ml.score
CTX	exe.trojan.stop
Sophos	Troj/Krypt-VK
SentinelOne	Static AI - Malicious PE
Jiangmin	Backdoor.Mokes.hwz
Webroot	W32.Trojan.Gen
Google	Detected
Avira	HEUR/AGEN.1371585
Antiy-AVL	Trojan/Win32.Kryptik.hvya
Kingsoft	Win32.Troj.Unknown.a
Gridinsoft	Ransom.Win32.STOP.dg!n
Xcitium	Malware@#2gn8lmjq0ygxs
Microsoft	Trojan:Win32/Mokes.AMCC!MTB
ZoneAlarm	Troj/Krypt-VK
GData	Gen:Variant.BrResMon.280
Varist	W32/Kryptik.LGA.gen!Eldorado
AhnLab-V3	Trojan/Win.FSWW.R631044

Screenshots

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action	VT	Location
No hosts contacted.

Browser recommendation

File c96ebdb12684d0b47ebd0fa81aee556c8c981b942262d2169d9f63dc3b7e5a7c.exe

Summary Download Resubmit sample

Score

Feedback

Information on Execution

Analyzer Log

Cuckoo Log

Signatures

Feedback

Summary
Download Resubmit sample