File a62b3855d285f62a02904792b7d20fb1b05fcc4c436df93cfdc978841aaf5d7f

Size 46.2KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 4526664e1d79c8f6b246f70f269f4d9d
SHA1 6394a841e13f124603a0be8dc229c9527794eec6
SHA256 a62b3855d285f62a02904792b7d20fb1b05fcc4c436df93cfdc978841aaf5d7f
SHA512
467dd6a9c574932180bf24b89224adedd97561ad21a9bd835098561f8b08c1aa46c85708f9fa8a4c3126cec42ae78a80f7de7efc341531b3c4928735a15737a2
CRC32 9F9D0318
ssdeep None
Yara None matched

Score

This file is very suspicious, with a score of 10 out of 10!

Please notice: The scoring system is currently still in development and should be considered an alpha feature.


Autosubmit

6157412

Feedback

Expecting different results? Send us this analysis and we will inspect it. Click here

Information on Execution

Analysis
Category Started Completed Duration Routing Logs
FILE March 24, 2025, 9:05 p.m. March 24, 2025, 9:14 p.m. 509 seconds internet Show Analyzer Log
Show Cuckoo Log

Analyzer Log

2025-03-24 10:21:35,015 [analyzer] DEBUG: Starting analyzer from: C:\tmpht3fil
2025-03-24 10:21:35,030 [analyzer] DEBUG: Pipe server name: \??\PIPE\uultuihRkPFmKSQNVAAYQ
2025-03-24 10:21:35,030 [analyzer] DEBUG: Log pipe server name: \??\PIPE\HGmXktwhWlVlDrRN
2025-03-24 10:21:35,296 [analyzer] DEBUG: Started auxiliary module Curtain
2025-03-24 10:21:35,296 [analyzer] DEBUG: Started auxiliary module DbgView
2025-03-24 10:21:35,842 [analyzer] DEBUG: Started auxiliary module Disguise
2025-03-24 10:21:36,062 [analyzer] DEBUG: Loaded monitor into process with pid 504
2025-03-24 10:21:36,062 [analyzer] DEBUG: Started auxiliary module DumpTLSMasterSecrets
2025-03-24 10:21:36,062 [analyzer] DEBUG: Started auxiliary module Human
2025-03-24 10:21:36,062 [analyzer] DEBUG: Started auxiliary module InstallCertificate
2025-03-24 10:21:36,062 [analyzer] DEBUG: Started auxiliary module Reboot
2025-03-24 10:21:36,125 [analyzer] DEBUG: Started auxiliary module RecentFiles
2025-03-24 10:21:36,125 [analyzer] DEBUG: Started auxiliary module Screenshots
2025-03-24 10:21:36,125 [analyzer] DEBUG: Started auxiliary module Sysmon
2025-03-24 10:21:36,140 [analyzer] DEBUG: Started auxiliary module LoadZer0m0n
2025-03-24 10:21:36,280 [lib.api.process] INFO: Successfully executed process from path u'C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\a62b3855d285f62a02904792b7d20fb1b05fcc4c436df93cfdc978841aaf5d7f.exe' with arguments '' and pid 172
2025-03-24 10:21:36,453 [analyzer] DEBUG: Loaded monitor into process with pid 172
2025-03-24 10:21:36,500 [analyzer] INFO: Added new file to list with pid 172 and path C:\Users\Administrator\AppData\Local\Temp\bkgrnd.exe
2025-03-24 10:21:36,640 [analyzer] INFO: Injected into process with pid 3008 and name u'bkgrnd.exe'
2025-03-24 10:21:36,796 [analyzer] DEBUG: Loaded monitor into process with pid 3008
2025-03-24 10:21:37,280 [analyzer] INFO: Process with pid 172 has terminated
2025-03-24 20:11:28,888 [analyzer] INFO: Added new file to list with pid 3008 and path C:\Users\Administrator\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D
2025-03-24 20:11:28,888 [analyzer] INFO: Added new file to list with pid 3008 and path C:\Users\Administrator\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D
2025-03-24 20:11:29,045 [analyzer] INFO: Added new file to list with pid 3008 and path C:\Users\Administrator\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
2025-03-24 20:11:29,045 [analyzer] INFO: Added new file to list with pid 3008 and path C:\Users\Administrator\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
2025-03-24 20:11:30,388 [analyzer] INFO: Added new file to list with pid 3008 and path C:\Users\Administrator\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\14232B434CF29D4C4FB335A86D7FFFE3
2025-03-24 20:11:30,388 [analyzer] INFO: Added new file to list with pid 3008 and path C:\Users\Administrator\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\14232B434CF29D4C4FB335A86D7FFFE3
2025-03-24 20:11:30,420 [analyzer] INFO: Added new file to list with pid 3008 and path C:\Users\Administrator\AppData\Local\Temp\Tar9DB4.tmp
2025-03-24 20:11:30,513 [analyzer] INFO: Added new file to list with pid 3008 and path C:\Users\Administrator\AppData\Local\Temp\Tar9E24.tmp
2025-03-24 20:11:30,701 [analyzer] INFO: Added new file to list with pid 3008 and path C:\Users\Administrator\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12
2025-03-24 20:11:30,701 [analyzer] INFO: Added new file to list with pid 3008 and path C:\Users\Administrator\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12
2025-03-24 20:11:30,763 [analyzer] INFO: Added new file to list with pid 3008 and path C:\Users\Administrator\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8
2025-03-24 20:11:30,763 [analyzer] INFO: Added new file to list with pid 3008 and path C:\Users\Administrator\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8
2025-03-24 20:11:39,654 [analyzer] INFO: Analysis timeout hit, terminating analysis.
2025-03-24 20:11:39,983 [analyzer] INFO: Terminating remaining processes before shutdown.
2025-03-24 20:11:39,983 [lib.api.process] INFO: Successfully terminated process with pid 3008.
2025-03-24 20:11:39,997 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\tar9e24.tmp' does not exist, skip.
2025-03-24 20:11:40,029 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\tar9db4.tmp' does not exist, skip.
2025-03-24 20:11:40,045 [analyzer] INFO: Analysis completed.

Cuckoo Log

2025-03-24 21:05:38,293 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:05:39,343 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:05:40,375 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:05:41,401 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:05:42,429 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:05:43,457 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:05:44,488 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:05:45,515 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:05:46,672 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:05:47,808 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:05:48,845 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:05:49,903 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:05:50,960 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:05:52,012 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:05:53,103 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:05:54,144 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:05:55,201 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:05:56,237 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:05:57,311 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:05:58,341 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:05:59,370 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:06:00,398 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:06:01,430 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:06:02,464 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:06:03,493 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:06:04,518 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:06:05,587 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:06:06,828 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:06:07,857 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:06:08,881 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:06:09,900 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:06:10,942 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:06:11,967 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:06:13,002 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:06:14,033 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:06:15,061 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:06:16,103 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:06:17,147 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:06:18,197 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:06:19,246 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:06:20,320 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:06:21,374 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:06:22,418 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:06:23,493 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:06:24,572 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:06:25,642 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:06:26,686 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:06:27,724 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:06:28,816 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:06:29,948 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:06:31,012 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:06:32,062 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:06:33,121 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:06:34,156 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:06:35,213 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:06:36,262 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:06:37,334 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:06:38,381 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:06:39,449 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:06:40,520 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:06:41,871 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:06:42,928 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:06:44,040 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:06:45,145 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:06:46,241 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:06:47,353 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:06:48,460 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:06:49,621 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:06:50,810 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:06:51,898 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:06:52,996 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:06:54,063 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:06:55,090 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:06:56,116 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:06:57,132 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:06:58,166 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:06:59,188 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:07:00,212 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:07:01,235 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:07:02,261 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:07:03,287 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:07:04,305 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:07:05,330 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:07:06,359 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:07:07,388 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:07:08,574 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:07:09,611 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:07:10,664 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:07:11,702 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:07:12,754 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:07:13,809 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:07:14,869 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:07:15,914 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:07:16,953 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:07:18,006 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:07:19,051 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:07:20,092 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:07:21,219 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:07:22,279 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:07:23,325 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:07:24,643 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:07:25,680 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:07:26,696 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:07:27,719 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:07:28,739 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:07:29,762 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:07:30,785 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:07:32,137 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:07:33,172 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:07:34,225 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:07:35,267 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:07:36,294 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:07:37,330 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:07:38,505 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:07:39,534 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:07:40,576 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:07:41,709 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:07:42,747 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:07:43,933 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:07:45,226 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:07:46,307 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:07:47,328 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:07:48,349 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:07:49,379 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:07:50,404 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:07:51,433 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:07:52,455 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:07:53,479 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:07:54,494 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:07:55,517 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:07:56,539 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:07:57,557 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:07:58,577 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:07:59,609 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:08:00,630 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:08:01,682 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:08:02,709 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:08:03,741 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:08:04,778 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:08:05,808 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:08:06,836 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:08:07,868 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:08:09,121 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:08:10,205 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:08:11,286 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:08:12,345 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:08:13,376 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:08:14,408 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:08:15,429 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:08:16,456 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:08:17,476 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:08:18,573 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:08:19,598 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:08:20,618 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:08:21,644 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:08:22,687 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:08:23,714 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:08:24,735 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:08:25,763 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:08:26,783 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:08:27,807 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:08:28,839 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:08:29,857 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:08:30,882 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:08:31,905 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:08:32,925 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:08:33,976 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:08:35,172 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:08:36,349 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:08:37,455 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:08:38,514 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:08:39,558 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:08:40,612 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:08:41,656 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:08:42,714 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:08:43,751 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:08:44,795 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:08:45,818 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:08:46,840 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:08:47,880 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:08:49,076 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:08:50,154 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:08:51,207 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:08:52,258 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:08:53,310 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:08:54,359 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:08:55,403 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:08:56,636 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:08:57,699 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:08:58,777 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:09:00,011 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:09:01,054 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:09:02,073 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:09:03,093 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:09:04,113 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:09:05,132 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:09:06,144 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:09:07,162 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:09:08,180 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:09:09,319 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:09:10,336 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:09:11,354 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:09:12,370 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:09:13,397 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:09:14,431 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:09:15,577 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:09:16,601 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:09:17,749 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:09:18,765 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:09:19,782 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:09:20,802 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:09:21,955 [cuckoo.core.scheduler] DEBUG: Task #6149849: no machine available yet
2025-03-24 21:09:23,078 [cuckoo.core.scheduler] INFO: Task #6149849: acquired machine win7x6411 (label=win7x6411)
2025-03-24 21:09:23,079 [cuckoo.core.resultserver] DEBUG: Now tracking machine 192.168.168.211 for task #6149849
2025-03-24 21:09:23,457 [cuckoo.auxiliary.sniffer] INFO: Started sniffer with PID 508366 (interface=vboxnet0, host=192.168.168.211)
2025-03-24 21:09:23,584 [cuckoo.machinery.virtualbox] DEBUG: Starting vm win7x6411
2025-03-24 21:09:30,865 [cuckoo.machinery.virtualbox] DEBUG: Restoring virtual machine win7x6411 to vmcloak
2025-03-24 21:11:01,938 [cuckoo.core.guest] INFO: Starting analysis #6149849 on guest (id=win7x6411, ip=192.168.168.211)
2025-03-24 21:11:03,031 [cuckoo.core.guest] DEBUG: win7x6411: not ready yet
2025-03-24 21:11:08,059 [cuckoo.core.guest] INFO: Guest is running Cuckoo Agent 0.10 (id=win7x6411, ip=192.168.168.211)
2025-03-24 21:11:08,137 [cuckoo.core.guest] DEBUG: Uploading analyzer to guest (id=win7x6411, ip=192.168.168.211, monitor=latest, size=6660546)
2025-03-24 21:11:09,363 [cuckoo.core.resultserver] DEBUG: Task #6149849: live log analysis.log initialized.
2025-03-24 21:11:10,371 [cuckoo.core.resultserver] DEBUG: Task #6149849 is sending a BSON stream
2025-03-24 21:11:10,746 [cuckoo.core.resultserver] DEBUG: Task #6149849 is sending a BSON stream
2025-03-24 21:11:11,093 [cuckoo.core.resultserver] DEBUG: Task #6149849 is sending a BSON stream
2025-03-24 21:11:11,622 [cuckoo.core.resultserver] DEBUG: Task #6149849: File upload for 'shots/0001.jpg'
2025-03-24 21:11:11,682 [cuckoo.core.resultserver] DEBUG: Task #6149849 uploaded file length: 133499
2025-03-24 21:11:24,159 [cuckoo.core.guest] DEBUG: win7x6411: analysis #6149849 still processing
2025-03-24 21:11:39,303 [cuckoo.core.guest] DEBUG: win7x6411: analysis #6149849 still processing
2025-03-24 21:11:39,793 [cuckoo.core.resultserver] DEBUG: Task #6149849: File upload for 'curtain/1742843499.8.curtain.log'
2025-03-24 21:11:39,796 [cuckoo.core.resultserver] DEBUG: Task #6149849 uploaded file length: 36
2025-03-24 21:11:39,958 [cuckoo.core.resultserver] DEBUG: Task #6149849: File upload for 'sysmon/1742843499.95.sysmon.xml'
2025-03-24 21:11:39,986 [cuckoo.core.resultserver] DEBUG: Task #6149849 uploaded file length: 1493794
2025-03-24 21:11:39,992 [cuckoo.core.resultserver] DEBUG: Task #6149849: File upload for 'files/dd0d1fe1b47de993_8b2b9a00839eed1dfdccc3bfc2f5df12'
2025-03-24 21:11:39,994 [cuckoo.core.resultserver] DEBUG: Task #6149849 uploaded file length: 174
2025-03-24 21:11:39,996 [cuckoo.core.resultserver] DEBUG: Task #6149849: File upload for 'files/d72761e1a334a754_94308059b57b3142e455b38a6eb92015'
2025-03-24 21:11:39,998 [cuckoo.core.resultserver] DEBUG: Task #6149849 uploaded file length: 73305
2025-03-24 21:11:40,001 [cuckoo.core.resultserver] DEBUG: Task #6149849: File upload for 'files/f157ed17fcaf8837_b46811c17859ffb409cf0e904a4aa8f8'
2025-03-24 21:11:40,003 [cuckoo.core.resultserver] DEBUG: Task #6149849 uploaded file length: 436
2025-03-24 21:11:40,006 [cuckoo.core.resultserver] DEBUG: Task #6149849: File upload for 'files/ebd41040e4bb3ec7_14232b434cf29d4c4fb335a86d7fffe3'
2025-03-24 21:11:40,008 [cuckoo.core.resultserver] DEBUG: Task #6149849 uploaded file length: 889
2025-03-24 21:11:40,010 [cuckoo.core.resultserver] DEBUG: Task #6149849: File upload for 'files/96bcec06264976f3_2d85f72862b55c4eadd9e66e06947f3d'
2025-03-24 21:11:40,012 [cuckoo.core.resultserver] DEBUG: Task #6149849 uploaded file length: 1391
2025-03-24 21:11:40,016 [cuckoo.core.resultserver] DEBUG: Task #6149849: File upload for 'files/7d97ec92fcd9af26_94308059b57b3142e455b38a6eb92015'
2025-03-24 21:11:40,018 [cuckoo.core.resultserver] DEBUG: Task #6149849 uploaded file length: 344
2025-03-24 21:11:40,021 [cuckoo.core.resultserver] DEBUG: Task #6149849: File upload for 'files/c13e8d22800c2009_8b2b9a00839eed1dfdccc3bfc2f5df12'
2025-03-24 21:11:40,022 [cuckoo.core.resultserver] DEBUG: Task #6149849 uploaded file length: 1739
2025-03-24 21:11:40,025 [cuckoo.core.resultserver] DEBUG: Task #6149849: File upload for 'files/9dfc02225dd9e28b_bkgrnd.exe'
2025-03-24 21:11:40,027 [cuckoo.core.resultserver] DEBUG: Task #6149849 uploaded file length: 47532
2025-03-24 21:11:40,030 [cuckoo.core.resultserver] DEBUG: Task #6149849: File upload for 'files/0ad6afe4d2877df8_2d85f72862b55c4eadd9e66e06947f3d'
2025-03-24 21:11:40,032 [cuckoo.core.resultserver] DEBUG: Task #6149849 uploaded file length: 192
2025-03-24 21:11:40,034 [cuckoo.core.resultserver] DEBUG: Task #6149849: File upload for 'files/7c186c1e5dca3bae_14232b434cf29d4c4fb335a86d7fffe3'
2025-03-24 21:11:40,036 [cuckoo.core.resultserver] DEBUG: Task #6149849 uploaded file length: 170
2025-03-24 21:11:40,038 [cuckoo.core.resultserver] DEBUG: Task #6149849: File upload for 'files/b0e71903cc303f84_b46811c17859ffb409cf0e904a4aa8f8'
2025-03-24 21:11:40,040 [cuckoo.core.resultserver] DEBUG: Task #6149849 uploaded file length: 170
2025-03-24 21:11:40,376 [cuckoo.core.resultserver] DEBUG: Task #6149849 had connection reset for <Context for LOG>
2025-03-24 21:11:42,315 [cuckoo.core.guest] INFO: win7x6411: analysis completed successfully
2025-03-24 21:11:42,325 [cuckoo.core.plugins] DEBUG: Stopped auxiliary module: Redsocks
2025-03-24 21:11:42,350 [cuckoo.core.plugins] DEBUG: Stopped auxiliary module: Sniffer
2025-03-24 21:11:43,355 [cuckoo.machinery.virtualbox] INFO: Successfully generated memory dump for virtual machine with label win7x6411 to path /srv/cuckoo/cwd/storage/analyses/6149849/memory.dmp
2025-03-24 21:11:43,357 [cuckoo.machinery.virtualbox] DEBUG: Stopping vm win7x6411
2025-03-24 21:14:05,369 [cuckoo.core.resultserver] DEBUG: Stopped tracking machine 192.168.168.211 for task #6149849
2025-03-24 21:14:07,202 [cuckoo.core.scheduler] DEBUG: Released database task #6149849
2025-03-24 21:14:07,570 [cuckoo.core.scheduler] INFO: Task #6149849: analysis procedure completed

Signatures

Checks if process is being debugged by a debugger (2 events)
Time & API Arguments Status Return Repeated

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0
The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)
section .htext
One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.
Creates executable files on the filesystem (1 event)
file C:\Users\Administrator\AppData\Local\Temp\bkgrnd.exe
Drops a binary and executes it (1 event)
file C:\Users\Administrator\AppData\Local\Temp\bkgrnd.exe
Drops an executable to the user AppData folder (1 event)
file C:\Users\Administrator\AppData\Local\Temp\bkgrnd.exe
A process created a hidden window (1 event)
Time & API Arguments Status Return Repeated

ShellExecuteExW

show_type: 0
filepath_r: C:\Users\ADMINI~1\AppData\Local\Temp\bkgrnd.exe
parameters:
filepath: C:\Users\Administrator\AppData\Local\Temp\bkgrnd.exe
1 1 0
Checks adapter addresses which can be used to detect virtual network interfaces (1 event)
Time & API Arguments Status Return Repeated

GetAdaptersAddresses

flags: 46
family: 0
1 0 0
Attempts to create or modify system certificates (1 event)
registry HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob
Sets or modifies WPAD proxy autoconfiguration file for traffic interception (10 events)
Time & API Arguments Status Return Repeated

RegSetValueExW

key_handle: 0x0000056c
regkey_r: WpadDecisionReason
reg_type: 4 (REG_DWORD)
value: 1
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{092F0E6C-7874-4263-8D41-969F2B667EA2}\WpadDecisionReason
1 0 0

RegSetValueExW

key_handle: 0x0000056c
regkey_r: WpadDecisionTime
reg_type: 3 (REG_BINARY)
value: ½!öœÛ
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{092F0E6C-7874-4263-8D41-969F2B667EA2}\WpadDecisionTime
1 0 0

RegSetValueExW

key_handle: 0x0000056c
regkey_r: WpadDecision
reg_type: 4 (REG_DWORD)
value: 0
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{092F0E6C-7874-4263-8D41-969F2B667EA2}\WpadDecision
1 0 0

RegSetValueExW

key_handle: 0x0000056c
regkey_r: WpadNetworkName
reg_type: 1 (REG_SZ)
value: Network
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{092F0E6C-7874-4263-8D41-969F2B667EA2}\WpadNetworkName
1 0 0

RegSetValueExW

key_handle: 0x00000574
regkey_r: WpadDecisionReason
reg_type: 4 (REG_DWORD)
value: 1
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionReason
1 0 0

RegSetValueExW

key_handle: 0x00000574
regkey_r: WpadDecisionTime
reg_type: 3 (REG_BINARY)
value: ½!öœÛ
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionTime
1 0 0

RegSetValueExW

key_handle: 0x00000574
regkey_r: WpadDecision
reg_type: 4 (REG_DWORD)
value: 0
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecision
1 0 0

RegSetValueExW

key_handle: 0x00000574
regkey_r: WpadDecisionReason
reg_type: 4 (REG_DWORD)
value: 1
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionReason
1 0 0

RegSetValueExW

key_handle: 0x00000574
regkey_r: WpadDecisionTime
reg_type: 3 (REG_BINARY)
value: ½!öœÛ
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionTime
1 0 0

RegSetValueExW

key_handle: 0x00000574
regkey_r: WpadDecision
reg_type: 4 (REG_DWORD)
value: 0
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecision
1 0 0
File has been identified by 13 AntiVirus engine on IRMA as malicious (13 events)
G Data Antivirus (Windows) Virus: Trojan.Ppatre.Gen.1 (Engine A), Win32.Trojan-Downloader.Upatre.BJ (Engine B)
Avast Core Security (Linux) Win32:Evo-gen [Trj]
C4S ClamAV (Linux) Win.Downloader.Razy-9935848-0
Trellix (Linux) Trojan-FXIX
WithSecure (Linux) Trojan.TR/Spy.Zbot.gdb
eScan Antivirus (Linux) Trojan.Ppatre.Gen.1(DB)
ESET Security (Windows) Win32/TrojanDownloader.Waski.A trojan
Sophos Anti-Virus (Linux) Mal/Generic-S
DrWeb Antivirus (Linux) Trojan.DownLoader10.51280
ClamAV (Linux) Win.Downloader.Razy-9935848-0
Bitdefender Antivirus (Linux) Trojan.Ppatre.Gen.1
Kaspersky Standard (Windows) Trojan-PSW.Win32.LdPinch.hij
Emsisoft Commandline Scanner (Windows) Trojan.Ppatre.Gen.1 (B)
File has been identified by 64 AntiVirus engines on VirusTotal as malicious (50 out of 64 events)
Bkav W32.FamVT.GeND.Trojan
Lionic Trojan.Win32.LdPinch.tntX
tehtris Generic.Malware
Cynet Malicious (score: 100)
CAT-QuickHeal Trojan.ZbotRI.S28718216
Skyhigh BehavesLike.Win32.Generic.pm
ALYac Trojan.Ppatre.Gen.1
Cylance Unsafe
VIPRE Trojan.Ppatre.Gen.1
Sangfor Trojan.Win32.Save.a
CrowdStrike win/malicious_confidence_100% (W)
BitDefender Trojan.Ppatre.Gen.1
K7GW Trojan-Downloader ( 0055c6c71 )
K7AntiVirus Trojan-Downloader ( 0055c6c71 )
Arcabit Trojan.Ppatre.Gen.1
VirIT Trojan.Win32.Generic.CJD
Symantec ML.Attribute.HighConfidence
Elastic malicious (high confidence)
ESET-NOD32 Win32/TrojanDownloader.Waski.A
APEX Malicious
Avast Win32:Evo-gen [Trj]
ClamAV Win.Downloader.Razy-9935848-0
Kaspersky Trojan-PSW.Win32.LdPinch.hij
Alibaba TrojanPSW:Win32/LdPinch.801c49bb
SUPERAntiSpyware Trojan.Agent/Gen-Upatre
MicroWorld-eScan Trojan.Ppatre.Gen.1
Rising Downloader.Waski!1.A489 (CLASSIC)
Emsisoft Trojan.Ppatre.Gen.1 (B)
F-Secure Trojan.TR/Spy.Zbot.gdb
DrWeb Trojan.DownLoader10.51280
Zillya Trojan.LdPinch.Win32.29526
McAfeeD Real Protect-LS!4526664E1D79
Trapmine malicious.moderate.ml.score
CTX exe.trojan.ldpinch
Sophos Mal/Generic-S
SentinelOne Static AI - Malicious PE
FireEye Generic.mg.4526664e1d79c8f6
Jiangmin Trojan/PSW.LdPinch.adnc
Webroot W32.Rogue.Gen
Google Detected
Avira TR/Spy.Zbot.gdb
Antiy-AVL Trojan/Win32.Waski.a
Kingsoft malware.kb.a.999
Gridinsoft Ransom.Win32.Zbot.oa!s1
Xcitium TrojWare.Win32.Kryptik.BFP@54u2z9
Microsoft Trojan:Win32/Zbot.HBAI!MTB
GData Win32.Trojan-Downloader.Upatre.BJ
Varist W32/Zbot.AEY.gen!Eldorado
AhnLab-V3 Trojan/Win.LdPinch.C5600374
Acronis suspicious
Screenshots
Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action VT Location
No hosts contacted.
Cuckoo

We're processing your submission... This could take a few seconds.