Cuckoo Sandbox

File update.exe

Summary
Download Resubmit sample

Size	302.5KB
Type	PE32+ executable (GUI) x86-64, for MS Windows
MD5	`da8fee4a89f0b7cee6c8aee970044116`
SHA1	`226a6fbd66992a0f2ddbf5d7572fab2cf8f5001e`
SHA256	`4a55da3c91388a8ea539fc750b52dd90af5d2f33f2e7269a73c2146243ed24cd`
SHA512	`9174bd1c379ed76be342400949a1e431a6430297485fd9c48ed12c60e7de94817b75d645c4ebb17b3a79d66ba813c40c36527f912e927a8ec27e4668d9c09dd8`
CRC32	`C13929A6`
ssdeep	`None`
Yara	ReflectiveLoader - Detects a unspecified hack tool, crack or malware using a reflective loader - no hard match - further investigation recommended DebuggerCheck__RemoteAPI - (no description) ThreadControl__Context - (no description) anti_dbg - Checks if being debugged inject_thread - Code injection with CreateRemoteThread in a remote process network_http - Communications over HTTP network_dropper - File downloader/dropper escalate_priv - Escalade priviledges win_mutex - Create or check mutex win_registry - Affect system registries

Score

This file is very suspicious, with a score of 10 out of 10!

Please notice: The scoring system is currently still in development and should be considered an alpha feature.

Feedback

Expecting different results? Send us this analysis and we will inspect it. Click here

Information on Execution

Analysis

Category	Started	Completed	Duration	Routing	Logs
FILE	Dec. 15, 2024, 9:46 a.m.	Dec. 15, 2024, 9:47 a.m.	63 seconds	internet	Show Analyzer Log Show Cuckoo Log

Analyzer Log

2024-12-15 08:45:56,015 [analyzer] DEBUG: Starting analyzer from: C:\tmpmdfut4
2024-12-15 08:45:56,030 [analyzer] DEBUG: Pipe server name: \??\PIPE\ggqsLmEUNSdBrBhec
2024-12-15 08:45:56,030 [analyzer] DEBUG: Log pipe server name: \??\PIPE\SIriQuIRTxRQoLTPKoSEwCWTZArTFr
2024-12-15 08:45:56,375 [analyzer] DEBUG: Started auxiliary module Curtain
2024-12-15 08:45:56,375 [analyzer] DEBUG: Started auxiliary module DbgView
2024-12-15 08:45:56,890 [analyzer] DEBUG: Started auxiliary module Disguise
2024-12-15 08:45:57,125 [analyzer] DEBUG: Loaded monitor into process with pid 504
2024-12-15 08:45:57,125 [analyzer] DEBUG: Started auxiliary module DumpTLSMasterSecrets
2024-12-15 08:45:57,125 [analyzer] DEBUG: Started auxiliary module Human
2024-12-15 08:45:57,125 [analyzer] DEBUG: Started auxiliary module InstallCertificate
2024-12-15 08:45:57,125 [analyzer] DEBUG: Started auxiliary module Reboot
2024-12-15 08:45:57,203 [analyzer] DEBUG: Started auxiliary module RecentFiles
2024-12-15 08:45:57,217 [analyzer] DEBUG: Started auxiliary module Screenshots
2024-12-15 08:45:57,217 [analyzer] DEBUG: Started auxiliary module Sysmon
2024-12-15 08:45:57,217 [analyzer] DEBUG: Started auxiliary module LoadZer0m0n
2024-12-15 08:45:57,328 [lib.api.process] INFO: Successfully executed process from path u'C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\update.exe' with arguments '' and pid 1808
2024-12-15 08:45:57,562 [analyzer] DEBUG: Loaded monitor into process with pid 1808
2024-12-15 08:45:57,592 [analyzer] CRITICAL: Unable to change memory protection of advapi32!ControlService at 0x09f2f0 7 to RWX (error code 0xc0000045)!
2024-12-15 08:45:57,608 [analyzer] CRITICAL: Unable to change memory protection of advapi32!DeleteService at 0x09f498 5 to RWX (error code 0xc0000045)!
2024-12-15 08:45:57,608 [analyzer] CRITICAL: Unable to change memory protection of advapi32!OpenSCManagerA at 0x09f336 9 to RWX (error code 0xc0000045)!
2024-12-15 08:45:57,608 [analyzer] CRITICAL: Unable to change memory protection of advapi32!OpenSCManagerW at 0x09f4a8 5 to RWX (error code 0xc0000045)!
2024-12-15 08:45:57,608 [analyzer] CRITICAL: Unable to change memory protection of advapi32!OpenServiceA at 0x09f43e 6 to RWX (error code 0xc0000045)!
2024-12-15 08:45:57,608 [analyzer] CRITICAL: Unable to change memory protection of advapi32!OpenServiceW at 0x09f488 6 to RWX (error code 0xc0000045)!
2024-12-15 08:45:57,608 [analyzer] CRITICAL: Unable to change memory protection of advapi32!RegCloseKey at 0x09f6b4 5 to RWX (error code 0xc0000045)!
2024-12-15 08:45:57,625 [analyzer] CRITICAL: Unable to change memory protection of advapi32!RegDeleteValueA at 0x09f5ee 9 to RWX (error code 0xc0000045)!
2024-12-15 08:45:57,625 [analyzer] CRITICAL: Unable to change memory protection of advapi32!RegDeleteValueW at 0x09f5dc 5 to RWX (error code 0xc0000045)!
2024-12-15 08:45:57,625 [analyzer] CRITICAL: Unable to change memory protection of advapi32!StartServiceCtrlDispatcherW at 0x09f276 6 to RWX (error code 0xc0000045)!
2024-12-15 08:45:57,625 [analyzer] CRITICAL: Unable to change memory protection of advapi32!StartServiceW at 0x09f4cc 6 to RWX (error code 0xc0000045)!
2024-12-15 08:45:57,655 [analyzer] CRITICAL: Unable to change memory protection of advapi32!ControlService at 0x09f2f0 7 to RWX (error code 0xc0000045)!
2024-12-15 08:45:57,655 [analyzer] CRITICAL: Unable to change memory protection of advapi32!DeleteService at 0x09f498 5 to RWX (error code 0xc0000045)!
2024-12-15 08:45:57,655 [analyzer] CRITICAL: Unable to change memory protection of advapi32!OpenSCManagerA at 0x09f336 9 to RWX (error code 0xc0000045)!
2024-12-15 08:45:57,671 [analyzer] CRITICAL: Unable to change memory protection of advapi32!OpenSCManagerW at 0x09f4a8 5 to RWX (error code 0xc0000045)!
2024-12-15 08:45:57,671 [analyzer] CRITICAL: Unable to change memory protection of advapi32!OpenServiceA at 0x09f43e 6 to RWX (error code 0xc0000045)!
2024-12-15 08:45:57,671 [analyzer] CRITICAL: Unable to change memory protection of advapi32!OpenServiceW at 0x09f488 6 to RWX (error code 0xc0000045)!
2024-12-15 08:45:57,671 [analyzer] CRITICAL: Unable to change memory protection of advapi32!RegCloseKey at 0x09f6b4 5 to RWX (error code 0xc0000045)!
2024-12-15 08:45:57,671 [analyzer] CRITICAL: Unable to change memory protection of advapi32!RegDeleteValueA at 0x09f5ee 9 to RWX (error code 0xc0000045)!
2024-12-15 08:45:57,671 [analyzer] CRITICAL: Unable to change memory protection of advapi32!RegDeleteValueW at 0x09f5dc 5 to RWX (error code 0xc0000045)!
2024-12-15 08:45:57,671 [analyzer] CRITICAL: Unable to change memory protection of advapi32!StartServiceCtrlDispatcherW at 0x09f276 6 to RWX (error code 0xc0000045)!
2024-12-15 08:45:57,671 [analyzer] CRITICAL: Unable to change memory protection of advapi32!StartServiceW at 0x09f4cc 6 to RWX (error code 0xc0000045)!
2024-12-15 08:45:57,671 [analyzer] CRITICAL: Unable to change memory protection of advapi32!ControlService at 0x09f2f0 7 to RWX (error code 0xc0000045)!
2024-12-15 08:45:57,671 [analyzer] CRITICAL: Unable to change memory protection of advapi32!DeleteService at 0x09f498 5 to RWX (error code 0xc0000045)!
2024-12-15 08:45:57,687 [analyzer] CRITICAL: Unable to change memory protection of advapi32!OpenSCManagerA at 0x09f336 9 to RWX (error code 0xc0000045)!
2024-12-15 08:45:57,687 [analyzer] CRITICAL: Unable to change memory protection of advapi32!OpenSCManagerW at 0x09f4a8 5 to RWX (error code 0xc0000045)!
2024-12-15 08:45:57,687 [analyzer] CRITICAL: Unable to change memory protection of advapi32!OpenServiceA at 0x09f43e 6 to RWX (error code 0xc0000045)!
2024-12-15 08:45:57,687 [analyzer] CRITICAL: Unable to change memory protection of advapi32!OpenServiceW at 0x09f488 6 to RWX (error code 0xc0000045)!
2024-12-15 08:45:57,687 [analyzer] CRITICAL: Unable to change memory protection of advapi32!RegCloseKey at 0x09f6b4 5 to RWX (error code 0xc0000045)!
2024-12-15 08:45:57,687 [analyzer] CRITICAL: Unable to change memory protection of advapi32!RegDeleteValueA at 0x09f5ee 9 to RWX (error code 0xc0000045)!
2024-12-15 08:45:57,687 [analyzer] CRITICAL: Unable to change memory protection of advapi32!RegDeleteValueW at 0x09f5dc 5 to RWX (error code 0xc0000045)!
2024-12-15 08:45:57,687 [analyzer] CRITICAL: Unable to change memory protection of advapi32!StartServiceCtrlDispatcherW at 0x09f276 6 to RWX (error code 0xc0000045)!
2024-12-15 08:45:57,687 [analyzer] CRITICAL: Unable to change memory protection of advapi32!StartServiceW at 0x09f4cc 6 to RWX (error code 0xc0000045)!
2024-12-15 08:45:57,687 [analyzer] CRITICAL: Unable to change memory protection of advapi32!ControlService at 0x09f2f0 7 to RWX (error code 0xc0000045)!
2024-12-15 08:45:57,703 [analyzer] CRITICAL: Unable to change memory protection of advapi32!DeleteService at 0x09f498 5 to RWX (error code 0xc0000045)!
2024-12-15 08:45:57,703 [analyzer] CRITICAL: Unable to change memory protection of advapi32!OpenSCManagerA at 0x09f336 9 to RWX (error code 0xc0000045)!
2024-12-15 08:45:57,703 [analyzer] CRITICAL: Unable to change memory protection of advapi32!OpenSCManagerW at 0x09f4a8 5 to RWX (error code 0xc0000045)!
2024-12-15 08:45:57,703 [analyzer] CRITICAL: Unable to change memory protection of advapi32!OpenServiceA at 0x09f43e 6 to RWX (error code 0xc0000045)!
2024-12-15 08:45:57,703 [analyzer] CRITICAL: Unable to change memory protection of advapi32!OpenServiceW at 0x09f488 6 to RWX (error code 0xc0000045)!
2024-12-15 08:45:57,703 [analyzer] CRITICAL: Unable to change memory protection of advapi32!RegCloseKey at 0x09f6b4 5 to RWX (error code 0xc0000045)!
2024-12-15 08:45:57,703 [analyzer] CRITICAL: Unable to change memory protection of advapi32!RegDeleteValueA at 0x09f5ee 9 to RWX (error code 0xc0000045)!
2024-12-15 08:45:57,703 [analyzer] CRITICAL: Unable to change memory protection of advapi32!RegDeleteValueW at 0x09f5dc 5 to RWX (error code 0xc0000045)!
2024-12-15 08:45:57,703 [analyzer] CRITICAL: Unable to change memory protection of advapi32!StartServiceCtrlDispatcherW at 0x09f276 6 to RWX (error code 0xc0000045)!
2024-12-15 08:45:57,703 [analyzer] CRITICAL: Unable to change memory protection of advapi32!StartServiceW at 0x09f4cc 6 to RWX (error code 0xc0000045)!
2024-12-15 08:45:57,717 [analyzer] CRITICAL: Unable to change memory protection of advapi32!ControlService at 0x09f2f0 7 to RWX (error code 0xc0000045)!
2024-12-15 08:45:57,717 [analyzer] CRITICAL: Unable to change memory protection of advapi32!DeleteService at 0x09f498 5 to RWX (error code 0xc0000045)!
2024-12-15 08:45:57,717 [analyzer] CRITICAL: Unable to change memory protection of advapi32!OpenSCManagerA at 0x09f336 9 to RWX (error code 0xc0000045)!
2024-12-15 08:45:57,717 [analyzer] CRITICAL: Unable to change memory protection of advapi32!OpenSCManagerW at 0x09f4a8 5 to RWX (error code 0xc0000045)!
2024-12-15 08:45:57,717 [analyzer] CRITICAL: Unable to change memory protection of advapi32!OpenServiceA at 0x09f43e 6 to RWX (error code 0xc0000045)!
2024-12-15 08:45:57,717 [analyzer] CRITICAL: Unable to change memory protection of advapi32!OpenServiceW at 0x09f488 6 to RWX (error code 0xc0000045)!
2024-12-15 08:45:57,717 [analyzer] CRITICAL: Unable to change memory protection of advapi32!RegCloseKey at 0x09f6b4 5 to RWX (error code 0xc0000045)!
2024-12-15 08:45:57,717 [analyzer] CRITICAL: Unable to change memory protection of advapi32!RegDeleteValueA at 0x09f5ee 9 to RWX (error code 0xc0000045)!
2024-12-15 08:45:57,717 [analyzer] CRITICAL: Unable to change memory protection of advapi32!RegDeleteValueW at 0x09f5dc 5 to RWX (error code 0xc0000045)!
2024-12-15 08:45:57,717 [analyzer] CRITICAL: Unable to change memory protection of advapi32!StartServiceCtrlDispatcherW at 0x09f276 6 to RWX (error code 0xc0000045)!
2024-12-15 08:45:57,733 [analyzer] CRITICAL: Unable to change memory protection of advapi32!StartServiceW at 0x09f4cc 6 to RWX (error code 0xc0000045)!
2024-12-15 08:45:58,062 [analyzer] CRITICAL: Unable to change memory protection of advapi32!ControlService at 0x09f2f0 7 to RWX (error code 0xc0000045)!
2024-12-15 08:45:58,062 [analyzer] CRITICAL: Unable to change memory protection of advapi32!DeleteService at 0x09f498 5 to RWX (error code 0xc0000045)!
2024-12-15 08:45:58,078 [analyzer] CRITICAL: Unable to change memory protection of advapi32!OpenSCManagerA at 0x09f336 9 to RWX (error code 0xc0000045)!
2024-12-15 08:45:58,078 [analyzer] CRITICAL: Unable to change memory protection of advapi32!OpenSCManagerW at 0x09f4a8 5 to RWX (error code 0xc0000045)!
2024-12-15 08:45:58,078 [analyzer] CRITICAL: Unable to change memory protection of advapi32!OpenServiceA at 0x09f43e 6 to RWX (error code 0xc0000045)!
2024-12-15 08:45:58,078 [analyzer] CRITICAL: Unable to change memory protection of advapi32!OpenServiceW at 0x09f488 6 to RWX (error code 0xc0000045)!
2024-12-15 08:45:58,078 [analyzer] CRITICAL: Unable to change memory protection of advapi32!RegCloseKey at 0x09f6b4 5 to RWX (error code 0xc0000045)!
2024-12-15 08:45:58,078 [analyzer] CRITICAL: Unable to change memory protection of advapi32!RegDeleteValueA at 0x09f5ee 9 to RWX (error code 0xc0000045)!
2024-12-15 08:45:58,078 [analyzer] CRITICAL: Unable to change memory protection of advapi32!RegDeleteValueW at 0x09f5dc 5 to RWX (error code 0xc0000045)!
2024-12-15 08:45:58,092 [analyzer] CRITICAL: Unable to change memory protection of advapi32!StartServiceCtrlDispatcherW at 0x09f276 6 to RWX (error code 0xc0000045)!
2024-12-15 08:45:58,092 [analyzer] CRITICAL: Unable to change memory protection of advapi32!StartServiceW at 0x09f4cc 6 to RWX (error code 0xc0000045)!
2024-12-15 08:45:58,092 [analyzer] CRITICAL: Unable to change memory protection of advapi32!ControlService at 0x09f2f0 7 to RWX (error code 0xc0000045)!
2024-12-15 08:45:58,092 [analyzer] CRITICAL: Unable to change memory protection of advapi32!DeleteService at 0x09f498 5 to RWX (error code 0xc0000045)!
2024-12-15 08:45:58,092 [analyzer] CRITICAL: Unable to change memory protection of advapi32!OpenSCManagerA at 0x09f336 9 to RWX (error code 0xc0000045)!
2024-12-15 08:45:58,092 [analyzer] CRITICAL: Unable to change memory protection of advapi32!OpenSCManagerW at 0x09f4a8 5 to RWX (error code 0xc0000045)!
2024-12-15 08:45:58,092 [analyzer] CRITICAL: Unable to change memory protection of advapi32!OpenServiceA at 0x09f43e 6 to RWX (error code 0xc0000045)!
2024-12-15 08:45:58,092 [analyzer] CRITICAL: Unable to change memory protection of advapi32!OpenServiceW at 0x09f488 6 to RWX (error code 0xc0000045)!
2024-12-15 08:45:58,092 [analyzer] CRITICAL: Unable to change memory protection of advapi32!RegCloseKey at 0x09f6b4 5 to RWX (error code 0xc0000045)!
2024-12-15 08:45:58,108 [analyzer] CRITICAL: Unable to change memory protection of advapi32!RegDeleteValueA at 0x09f5ee 9 to RWX (error code 0xc0000045)!
2024-12-15 08:45:58,108 [analyzer] CRITICAL: Unable to change memory protection of advapi32!RegDeleteValueW at 0x09f5dc 5 to RWX (error code 0xc0000045)!
2024-12-15 08:45:58,108 [analyzer] CRITICAL: Unable to change memory protection of advapi32!StartServiceCtrlDispatcherW at 0x09f276 6 to RWX (error code 0xc0000045)!
2024-12-15 08:45:58,108 [analyzer] CRITICAL: Unable to change memory protection of advapi32!StartServiceW at 0x09f4cc 6 to RWX (error code 0xc0000045)!
2024-12-15 08:45:58,108 [analyzer] CRITICAL: Unable to change memory protection of advapi32!ControlService at 0x09f2f0 7 to RWX (error code 0xc0000045)!
2024-12-15 08:45:58,108 [analyzer] CRITICAL: Unable to change memory protection of advapi32!DeleteService at 0x09f498 5 to RWX (error code 0xc0000045)!
2024-12-15 08:45:58,108 [analyzer] CRITICAL: Unable to change memory protection of advapi32!OpenSCManagerA at 0x09f336 9 to RWX (error code 0xc0000045)!
2024-12-15 08:45:58,108 [analyzer] CRITICAL: Unable to change memory protection of advapi32!OpenSCManagerW at 0x09f4a8 5 to RWX (error code 0xc0000045)!
2024-12-15 08:45:58,108 [analyzer] CRITICAL: Unable to change memory protection of advapi32!OpenServiceA at 0x09f43e 6 to RWX (error code 0xc0000045)!
2024-12-15 08:45:58,108 [analyzer] CRITICAL: Unable to change memory protection of advapi32!OpenServiceW at 0x09f488 6 to RWX (error code 0xc0000045)!
2024-12-15 08:45:58,125 [analyzer] CRITICAL: Unable to change memory protection of advapi32!RegCloseKey at 0x09f6b4 5 to RWX (error code 0xc0000045)!
2024-12-15 08:45:58,125 [analyzer] CRITICAL: Unable to change memory protection of advapi32!RegDeleteValueA at 0x09f5ee 9 to RWX (error code 0xc0000045)!
2024-12-15 08:45:58,125 [analyzer] CRITICAL: Unable to change memory protection of advapi32!RegDeleteValueW at 0x09f5dc 5 to RWX (error code 0xc0000045)!
2024-12-15 08:45:58,125 [analyzer] CRITICAL: Unable to change memory protection of advapi32!StartServiceCtrlDispatcherW at 0x09f276 6 to RWX (error code 0xc0000045)!
2024-12-15 08:45:58,125 [analyzer] CRITICAL: Unable to change memory protection of advapi32!StartServiceW at 0x09f4cc 6 to RWX (error code 0xc0000045)!
2024-12-15 08:45:58,125 [analyzer] CRITICAL: Unable to change memory protection of advapi32!ControlService at 0x09f2f0 7 to RWX (error code 0xc0000045)!
2024-12-15 08:45:58,125 [analyzer] CRITICAL: Unable to change memory protection of advapi32!DeleteService at 0x09f498 5 to RWX (error code 0xc0000045)!
2024-12-15 08:45:58,125 [analyzer] CRITICAL: Unable to change memory protection of advapi32!OpenSCManagerA at 0x09f336 9 to RWX (error code 0xc0000045)!
2024-12-15 08:45:58,125 [analyzer] CRITICAL: Unable to change memory protection of advapi32!OpenSCManagerW at 0x09f4a8 5 to RWX (error code 0xc0000045)!
2024-12-15 08:45:58,125 [analyzer] CRITICAL: Unable to change memory protection of advapi32!OpenServiceA at 0x09f43e 6 to RWX (error code 0xc0000045)!
2024-12-15 08:45:58,125 [analyzer] CRITICAL: Unable to change memory protection of advapi32!OpenServiceW at 0x09f488 6 to RWX (error code 0xc0000045)!
2024-12-15 08:45:58,125 [analyzer] CRITICAL: Unable to change memory protection of advapi32!RegCloseKey at 0x09f6b4 5 to RWX (error code 0xc0000045)!
2024-12-15 08:45:58,140 [analyzer] CRITICAL: Unable to change memory protection of advapi32!RegDeleteValueA at 0x09f5ee 9 to RWX (error code 0xc0000045)!
2024-12-15 08:45:58,140 [analyzer] CRITICAL: Unable to change memory protection of advapi32!RegDeleteValueW at 0x09f5dc 5 to RWX (error code 0xc0000045)!
2024-12-15 08:45:58,140 [analyzer] CRITICAL: Unable to change memory protection of advapi32!StartServiceCtrlDispatcherW at 0x09f276 6 to RWX (error code 0xc0000045)!
2024-12-15 08:45:58,140 [analyzer] CRITICAL: Unable to change memory protection of advapi32!StartServiceW at 0x09f4cc 6 to RWX (error code 0xc0000045)!
2024-12-15 08:45:58,140 [analyzer] CRITICAL: Unable to change memory protection of advapi32!ControlService at 0x09f2f0 7 to RWX (error code 0xc0000045)!
2024-12-15 08:45:58,140 [analyzer] CRITICAL: Unable to change memory protection of advapi32!DeleteService at 0x09f498 5 to RWX (error code 0xc0000045)!
2024-12-15 08:45:58,140 [analyzer] CRITICAL: Unable to change memory protection of advapi32!OpenSCManagerA at 0x09f336 9 to RWX (error code 0xc0000045)!
2024-12-15 08:45:58,140 [analyzer] CRITICAL: Unable to change memory protection of advapi32!OpenSCManagerW at 0x09f4a8 5 to RWX (error code 0xc0000045)!
2024-12-15 08:45:58,140 [analyzer] CRITICAL: Unable to change memory protection of advapi32!OpenServiceA at 0x09f43e 6 to RWX (error code 0xc0000045)!
2024-12-15 08:45:58,140 [analyzer] CRITICAL: Unable to change memory protection of advapi32!OpenServiceW at 0x09f488 6 to RWX (error code 0xc0000045)!
2024-12-15 08:45:58,140 [analyzer] CRITICAL: Unable to change memory protection of advapi32!RegCloseKey at 0x09f6b4 5 to RWX (error code 0xc0000045)!
2024-12-15 08:45:58,140 [analyzer] CRITICAL: Unable to change memory protection of advapi32!RegDeleteValueA at 0x09f5ee 9 to RWX (error code 0xc0000045)!
2024-12-15 08:45:58,155 [analyzer] CRITICAL: Unable to change memory protection of advapi32!RegDeleteValueW at 0x09f5dc 5 to RWX (error code 0xc0000045)!
2024-12-15 08:45:58,155 [analyzer] CRITICAL: Unable to change memory protection of advapi32!StartServiceCtrlDispatcherW at 0x09f276 6 to RWX (error code 0xc0000045)!
2024-12-15 08:45:58,155 [analyzer] CRITICAL: Unable to change memory protection of advapi32!StartServiceW at 0x09f4cc 6 to RWX (error code 0xc0000045)!
2024-12-15 08:45:58,155 [analyzer] CRITICAL: Unable to change memory protection of advapi32!ControlService at 0x09f2f0 7 to RWX (error code 0xc0000045)!
2024-12-15 08:45:58,155 [analyzer] CRITICAL: Unable to change memory protection of advapi32!DeleteService at 0x09f498 5 to RWX (error code 0xc0000045)!
2024-12-15 08:45:58,155 [analyzer] CRITICAL: Unable to change memory protection of advapi32!OpenSCManagerA at 0x09f336 9 to RWX (error code 0xc0000045)!
2024-12-15 08:45:58,155 [analyzer] CRITICAL: Unable to change memory protection of advapi32!OpenSCManagerW at 0x09f4a8 5 to RWX (error code 0xc0000045)!
2024-12-15 08:45:58,155 [analyzer] CRITICAL: Unable to change memory protection of advapi32!OpenServiceA at 0x09f43e 6 to RWX (error code 0xc0000045)!
2024-12-15 08:45:58,155 [analyzer] CRITICAL: Unable to change memory protection of advapi32!OpenServiceW at 0x09f488 6 to RWX (error code 0xc0000045)!
2024-12-15 08:45:58,155 [analyzer] CRITICAL: Unable to change memory protection of advapi32!RegCloseKey at 0x09f6b4 5 to RWX (error code 0xc0000045)!
2024-12-15 08:45:58,171 [analyzer] CRITICAL: Unable to change memory protection of advapi32!RegDeleteValueA at 0x09f5ee 9 to RWX (error code 0xc0000045)!
2024-12-15 08:45:58,171 [analyzer] CRITICAL: Unable to change memory protection of advapi32!RegDeleteValueW at 0x09f5dc 5 to RWX (error code 0xc0000045)!
2024-12-15 08:45:58,171 [analyzer] CRITICAL: Unable to change memory protection of advapi32!StartServiceCtrlDispatcherW at 0x09f276 6 to RWX (error code 0xc0000045)!
2024-12-15 08:45:58,171 [analyzer] CRITICAL: Unable to change memory protection of advapi32!StartServiceW at 0x09f4cc 6 to RWX (error code 0xc0000045)!
2024-12-15 08:45:58,171 [analyzer] CRITICAL: Unable to change memory protection of advapi32!ControlService at 0x09f2f0 7 to RWX (error code 0xc0000045)!
2024-12-15 08:45:58,171 [analyzer] CRITICAL: Unable to change memory protection of advapi32!DeleteService at 0x09f498 5 to RWX (error code 0xc0000045)!
2024-12-15 08:45:58,171 [analyzer] CRITICAL: Unable to change memory protection of advapi32!OpenSCManagerA at 0x09f336 9 to RWX (error code 0xc0000045)!
2024-12-15 08:45:58,171 [analyzer] CRITICAL: Unable to change memory protection of advapi32!OpenSCManagerW at 0x09f4a8 5 to RWX (error code 0xc0000045)!
2024-12-15 08:45:58,171 [analyzer] CRITICAL: Unable to change memory protection of advapi32!OpenServiceA at 0x09f43e 6 to RWX (error code 0xc0000045)!
2024-12-15 08:45:58,171 [analyzer] CRITICAL: Unable to change memory protection of advapi32!OpenServiceW at 0x09f488 6 to RWX (error code 0xc0000045)!
2024-12-15 08:45:58,171 [analyzer] CRITICAL: Unable to change memory protection of advapi32!RegCloseKey at 0x09f6b4 5 to RWX (error code 0xc0000045)!
2024-12-15 08:45:58,187 [analyzer] CRITICAL: Unable to change memory protection of advapi32!RegDeleteValueA at 0x09f5ee 9 to RWX (error code 0xc0000045)!
2024-12-15 08:45:58,187 [analyzer] CRITICAL: Unable to change memory protection of advapi32!RegDeleteValueW at 0x09f5dc 5 to RWX (error code 0xc0000045)!
2024-12-15 08:45:58,187 [analyzer] CRITICAL: Unable to change memory protection of advapi32!StartServiceCtrlDispatcherW at 0x09f276 6 to RWX (error code 0xc0000045)!
2024-12-15 08:45:58,187 [analyzer] CRITICAL: Unable to change memory protection of advapi32!StartServiceW at 0x09f4cc 6 to RWX (error code 0xc0000045)!
2024-12-15 08:45:58,187 [analyzer] CRITICAL: Unable to change memory protection of advapi32!ControlService at 0x09f2f0 7 to RWX (error code 0xc0000045)!
2024-12-15 08:45:58,187 [analyzer] CRITICAL: Unable to change memory protection of advapi32!DeleteService at 0x09f498 5 to RWX (error code 0xc0000045)!
2024-12-15 08:45:58,187 [analyzer] CRITICAL: Unable to change memory protection of advapi32!OpenSCManagerA at 0x09f336 9 to RWX (error code 0xc0000045)!
2024-12-15 08:45:58,187 [analyzer] CRITICAL: Unable to change memory protection of advapi32!OpenSCManagerW at 0x09f4a8 5 to RWX (error code 0xc0000045)!
2024-12-15 08:45:58,187 [analyzer] CRITICAL: Unable to change memory protection of advapi32!OpenServiceA at 0x09f43e 6 to RWX (error code 0xc0000045)!
2024-12-15 08:45:58,187 [analyzer] CRITICAL: Unable to change memory protection of advapi32!OpenServiceW at 0x09f488 6 to RWX (error code 0xc0000045)!
2024-12-15 08:45:58,187 [analyzer] CRITICAL: Unable to change memory protection of advapi32!RegCloseKey at 0x09f6b4 5 to RWX (error code 0xc0000045)!
2024-12-15 08:45:58,203 [analyzer] CRITICAL: Unable to change memory protection of advapi32!RegDeleteValueA at 0x09f5ee 9 to RWX (error code 0xc0000045)!
2024-12-15 08:45:58,203 [analyzer] CRITICAL: Unable to change memory protection of advapi32!RegDeleteValueW at 0x09f5dc 5 to RWX (error code 0xc0000045)!
2024-12-15 08:45:58,203 [analyzer] CRITICAL: Unable to change memory protection of advapi32!StartServiceCtrlDispatcherW at 0x09f276 6 to RWX (error code 0xc0000045)!
2024-12-15 08:45:58,203 [analyzer] CRITICAL: Unable to change memory protection of advapi32!StartServiceW at 0x09f4cc 6 to RWX (error code 0xc0000045)!
2024-12-15 08:45:58,328 [analyzer] CRITICAL: Unable to change memory protection of advapi32!ControlService at 0x09f2f0 7 to RWX (error code 0xc0000045)!
2024-12-15 08:45:58,342 [analyzer] CRITICAL: Unable to change memory protection of advapi32!DeleteService at 0x09f498 5 to RWX (error code 0xc0000045)!
2024-12-15 08:45:58,342 [analyzer] CRITICAL: Unable to change memory protection of advapi32!OpenSCManagerA at 0x09f336 9 to RWX (error code 0xc0000045)!
2024-12-15 08:45:58,358 [analyzer] CRITICAL: Unable to change memory protection of advapi32!OpenSCManagerW at 0x09f4a8 5 to RWX (error code 0xc0000045)!
2024-12-15 08:45:58,358 [analyzer] CRITICAL: Unable to change memory protection of advapi32!OpenServiceA at 0x09f43e 6 to RWX (error code 0xc0000045)!
2024-12-15 08:45:58,358 [analyzer] CRITICAL: Unable to change memory protection of advapi32!OpenServiceW at 0x09f488 6 to RWX (error code 0xc0000045)!
2024-12-15 08:45:58,358 [analyzer] CRITICAL: Unable to change memory protection of advapi32!RegCloseKey at 0x09f6b4 5 to RWX (error code 0xc0000045)!
2024-12-15 08:45:58,375 [analyzer] CRITICAL: Unable to change memory protection of advapi32!RegDeleteValueA at 0x09f5ee 9 to RWX (error code 0xc0000045)!
2024-12-15 08:45:58,375 [analyzer] CRITICAL: Unable to change memory protection of advapi32!RegDeleteValueW at 0x09f5dc 5 to RWX (error code 0xc0000045)!
2024-12-15 08:45:58,375 [analyzer] CRITICAL: Unable to change memory protection of advapi32!StartServiceCtrlDispatcherW at 0x09f276 6 to RWX (error code 0xc0000045)!
2024-12-15 08:45:58,375 [analyzer] CRITICAL: Unable to change memory protection of advapi32!StartServiceW at 0x09f4cc 6 to RWX (error code 0xc0000045)!
2024-12-15 08:46:54,408 [analyzer] INFO: Analysis timeout hit, terminating analysis.
2024-12-15 08:46:54,815 [analyzer] INFO: Terminating remaining processes before shutdown.
2024-12-15 08:46:54,815 [lib.api.process] INFO: Successfully terminated process with pid 1808.
2024-12-15 08:46:54,815 [analyzer] INFO: Analysis completed.

Cuckoo Log

2024-12-15 09:46:03,092 [cuckoo.core.scheduler] INFO: Task #5661820: acquired machine win7x644 (label=win7x644)
2024-12-15 09:46:03,093 [cuckoo.core.resultserver] DEBUG: Now tracking machine 192.168.168.204 for task #5661820
2024-12-15 09:46:03,546 [cuckoo.auxiliary.sniffer] INFO: Started sniffer with PID 1433847 (interface=vboxnet0, host=192.168.168.204)
2024-12-15 09:46:03,674 [cuckoo.machinery.virtualbox] DEBUG: Starting vm win7x644
2024-12-15 09:46:04,388 [cuckoo.machinery.virtualbox] DEBUG: Restoring virtual machine win7x644 to vmcloak
2024-12-15 09:46:16,555 [cuckoo.core.guest] INFO: Starting analysis #5661820 on guest (id=win7x644, ip=192.168.168.204)
2024-12-15 09:46:17,560 [cuckoo.core.guest] DEBUG: win7x644: not ready yet
2024-12-15 09:46:22,584 [cuckoo.core.guest] INFO: Guest is running Cuckoo Agent 0.10 (id=win7x644, ip=192.168.168.204)
2024-12-15 09:46:22,669 [cuckoo.core.guest] DEBUG: Uploading analyzer to guest (id=win7x644, ip=192.168.168.204, monitor=latest, size=6660546)
2024-12-15 09:46:24,052 [cuckoo.core.resultserver] DEBUG: Task #5661820: live log analysis.log initialized.
2024-12-15 09:46:25,127 [cuckoo.core.resultserver] DEBUG: Task #5661820 is sending a BSON stream
2024-12-15 09:46:25,455 [cuckoo.core.resultserver] DEBUG: Task #5661820 is sending a BSON stream
2024-12-15 09:46:26,411 [cuckoo.core.resultserver] DEBUG: Task #5661820: File upload for 'shots/0001.jpg'
2024-12-15 09:46:26,433 [cuckoo.core.resultserver] DEBUG: Task #5661820 uploaded file length: 133525
2024-12-15 09:46:38,645 [cuckoo.core.guest] DEBUG: win7x644: analysis #5661820 still processing
2024-12-15 09:46:53,754 [cuckoo.core.guest] DEBUG: win7x644: analysis #5661820 still processing
2024-12-15 09:46:54,695 [cuckoo.core.resultserver] DEBUG: Task #5661820: File upload for 'curtain/1734248814.69.curtain.log'
2024-12-15 09:46:54,697 [cuckoo.core.resultserver] DEBUG: Task #5661820 uploaded file length: 36
2024-12-15 09:46:54,815 [cuckoo.core.resultserver] DEBUG: Task #5661820: File upload for 'sysmon/1734248814.82.sysmon.xml'
2024-12-15 09:46:54,819 [cuckoo.core.resultserver] DEBUG: Task #5661820 uploaded file length: 175502
2024-12-15 09:46:55,322 [cuckoo.core.resultserver] DEBUG: Task #5661820 had connection reset for <Context for LOG>
2024-12-15 09:46:56,770 [cuckoo.core.guest] INFO: win7x644: analysis completed successfully
2024-12-15 09:46:56,790 [cuckoo.core.plugins] DEBUG: Stopped auxiliary module: Redsocks
2024-12-15 09:46:56,819 [cuckoo.core.plugins] DEBUG: Stopped auxiliary module: Sniffer
2024-12-15 09:46:58,072 [cuckoo.machinery.virtualbox] INFO: Successfully generated memory dump for virtual machine with label win7x644 to path /srv/cuckoo/cwd/storage/analyses/5661820/memory.dmp
2024-12-15 09:46:58,073 [cuckoo.machinery.virtualbox] DEBUG: Stopping vm win7x644
2024-12-15 09:47:06,154 [cuckoo.core.resultserver] DEBUG: Stopped tracking machine 192.168.168.204 for task #5661820
2024-12-15 09:47:06,459 [cuckoo.core.scheduler] DEBUG: Released database task #5661820
2024-12-15 09:47:06,478 [cuckoo.core.scheduler] INFO: Task #5661820: analysis procedure completed

Signatures

Yara rules detected for file (10 events)

description	Detects a unspecified hack tool, crack or malware using a reflective loader - no hard match - further investigation recommended	rule	ReflectiveLoader
description	(no description)	rule	DebuggerCheck__RemoteAPI
description	(no description)	rule	ThreadControl__Context
description	Checks if being debugged	rule	anti_dbg
description	Code injection with CreateRemoteThread in a remote process	rule	inject_thread
description	Communications over HTTP	rule	network_http
description	File downloader/dropper	rule	network_dropper
description	Escalade priviledges	rule	escalate_priv
description	Create or check mutex	rule	win_mutex
description	Affect system registries	rule	win_registry

Checks if process is being debugged by a debugger (1 event)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Dec. 15, 2024, 9:45 a.m.			0	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

.x64

Creates hidden or system file (5 events)

Time & API	Arguments	Status	Return
SetFileAttributesW Dec. 15, 2024, 9:45 a.m.	file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN) filepath_r: C:\Users\Administrator\AppData\Roaming\8447211BC8F71263800096 filepath: C:\Users\Administrator\AppData\Roaming\8447211BC8F71263800096	1	1
SetFileAttributesW Dec. 15, 2024, 9:45 a.m.	file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN) filepath_r: C:\Users\Administrator\AppData\Roaming\8447211BC8F71263800096\8447211BC8F71263800096.exe filepath: C:\Users\Administrator\AppData\Roaming\8447211BC8F71263800096\8447211BC8F71263800096.exe	1	1
SetFileAttributesW Dec. 15, 2024, 9:45 a.m.	file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN) filepath_r: C:\Users\Administrator\AppData\Roaming\8447211BC8F71263800096 filepath: C:\Users\Administrator\AppData\Roaming\8447211BC8F71263800096	1	1
SetFileAttributesW Dec. 15, 2024, 9:46 a.m.	file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN) filepath_r: C:\Users\Administrator\AppData\Roaming\8447211BC8F71263800096 filepath: C:\Users\Administrator\AppData\Roaming\8447211BC8F71263800096	1	1
SetFileAttributesW Dec. 15, 2024, 9:46 a.m.	file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN) filepath_r: C:\Users\Administrator\AppData\Roaming\8447211BC8F71263800096 filepath: C:\Users\Administrator\AppData\Roaming\8447211BC8F71263800096	1	1

Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (2 events)

Time & API	Arguments	Status	Return	Repeated
Process32NextW Dec. 15, 2024, 9:45 a.m.	snapshot_handle: 0x00000000000000a4 process_name: sysmon.exe process_identifier: 1228	1	1	0
Process32NextW Dec. 15, 2024, 9:45 a.m.	snapshot_handle: 0x00000000000000a4 process_name: taskhost.exe process_identifier: 1492	1	1	0

Installs itself for autorun at Windows startup (1 event)

reg_key

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\Services

reg_value

C:\Users\Administrator\AppData\Roaming\8447211BC8F71263800096\8447211BC8F71263800096.exe

Expresses interest in specific running processes (1 event)

process: potential process injection target

explorer.exe

File has been identified by 9 AntiVirus engine on IRMA as malicious (9 events)

G Data Antivirus (Windows)	Virus: Generic.Trojan.Loader.Marte.6.E1C75A31 (Engine A)
Avast Core Security (Linux)	Win32:Dh-A [Heur]
C4S ClamAV (Linux)	Win.Trojan.Ulise-10037990-0
Windows Defender (Windows)	Trojan:Win32/Wacatac.H!ml
eScan Antivirus (Linux)	Generic.Trojan.Loader.Marte.6.E1C75A31(DB)
ESET Security (Windows)	a variant of Win64/TrojanDownloader.Agent.BFH trojan
ClamAV (Linux)	Win.Trojan.Ulise-10037990-0
Bitdefender Antivirus (Linux)	Generic.Trojan.Loader.Marte.6.E1C75A31
Emsisoft Commandline Scanner (Windows)	Generic.Trojan.Loader.Marte.6.E1C75A31 (B)

Screenshots

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action	VT	Location
No hosts contacted.

Browser recommendation

File update.exe

Summary Download Resubmit sample

Score

Feedback

Information on Execution

Analyzer Log

Cuckoo Log

Signatures

Feedback

Summary
Download Resubmit sample