Summary

a35a1007490e73a1_mediacenter.exe

File a35a1007490e73a1_mediacenter.exe

Summary
Download Resubmit sample Download yara

Size 58.0KB
Type MS-DOS executable PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
MD5 71f667341a805f46ea1fc501911f03c6
SHA1 c1ed49fbd9cd01a7b491b744144aee89bcfd67ab
SHA256 a35a1007490e73a1e6536a43c2d173cd176ac91601526e164ba44360765e73d0
SHA512
7c8f3e2f91934b70ae1c28b9b49d56ab298cd302b834d1be3af4c35bfddfaa5f6d77fd4b2711203e5e045193944e0512369e03838f86f51a6ce790f02ae34947
CRC32 0931B086
ssdeep None
Yara
  • suspicious_packer_section - The packer/protector section names/keywords

Score

This file is very suspicious, with a score of 10 out of 10!

Please notice: The scoring system is currently still in development and should be considered an alpha feature.

Autosubmit

Parent_Task_ID:6496903

Feedback

Expecting different results? Send us this analysis and we will inspect it. Click here

Information on Execution

Analysis
Category Started Completed Duration Routing Logs
FILE May 22, 2025, 1:32 a.m. May 22, 2025, 1:39 a.m. 393 seconds internet Show Analyzer Log
Show Cuckoo Log

Analyzer Log

2025-05-20 14:08:47,000 [analyzer] DEBUG: Starting analyzer from: C:\tmptisd8w
2025-05-20 14:08:47,000 [analyzer] DEBUG: Pipe server name: \??\PIPE\IeTqxehNNnMlhlXzaBcBYbV
2025-05-20 14:08:47,000 [analyzer] DEBUG: Log pipe server name: \??\PIPE\LHdCHFMAsrwsqZwlPX
2025-05-20 14:08:47,000 [analyzer] DEBUG: No analysis package specified, trying to detect it automagically.
2025-05-20 14:08:47,000 [analyzer] INFO: Automatically selected analysis package "exe"
2025-05-20 14:08:47,265 [analyzer] DEBUG: Started auxiliary module Curtain
2025-05-20 14:08:47,265 [analyzer] DEBUG: Started auxiliary module DbgView
2025-05-20 14:08:47,687 [analyzer] DEBUG: Started auxiliary module Disguise
2025-05-20 14:08:47,890 [analyzer] DEBUG: Loaded monitor into process with pid 508
2025-05-20 14:08:47,890 [analyzer] DEBUG: Started auxiliary module DumpTLSMasterSecrets
2025-05-20 14:08:47,890 [analyzer] DEBUG: Started auxiliary module Human
2025-05-20 14:08:47,890 [analyzer] DEBUG: Started auxiliary module InstallCertificate
2025-05-20 14:08:47,890 [analyzer] DEBUG: Started auxiliary module Reboot
2025-05-20 14:08:47,983 [analyzer] DEBUG: Started auxiliary module RecentFiles
2025-05-20 14:08:47,983 [analyzer] DEBUG: Started auxiliary module Screenshots
2025-05-20 14:08:47,983 [analyzer] DEBUG: Started auxiliary module Sysmon
2025-05-20 14:08:47,983 [analyzer] DEBUG: Started auxiliary module LoadZer0m0n
2025-05-20 14:08:48,108 [lib.api.process] INFO: Successfully executed process from path u'C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\a35a1007490e73a1_mediacenter.exe' with arguments '' and pid 2492
2025-05-20 14:08:48,312 [analyzer] DEBUG: Loaded monitor into process with pid 2492
2025-05-20 14:08:48,312 [analyzer] INFO: Added new file to list with pid 2492 and path C:\Users\Administrator\AppData\Local\Temp\MicroMedia\MediaCenter.exe
2025-05-20 14:08:48,375 [analyzer] INFO: Injected into process with pid 1052 and name u'MediaCenter.exe'
2025-05-20 14:08:48,546 [analyzer] DEBUG: Loaded monitor into process with pid 1052
2025-05-20 14:09:19,108 [analyzer] INFO: Injected into process with pid 1672 and name u'explorer.exe'
2025-05-20 14:09:19,280 [analyzer] INFO: Injected into process with pid 2888 and name u'cmd.exe'
2025-05-20 14:09:19,312 [analyzer] DEBUG: Loaded monitor into process with pid 1672
2025-05-20 14:09:19,467 [analyzer] DEBUG: Loaded monitor into process with pid 2888
2025-05-20 14:09:19,530 [analyzer] INFO: Injected into process with pid 3052 and name u'PING.EXE'
2025-05-20 14:09:19,687 [analyzer] DEBUG: Loaded monitor into process with pid 3052
2025-05-20 14:09:20,108 [analyzer] INFO: Process with pid 2492 has terminated
2025-05-20 14:09:23,108 [analyzer] INFO: Process with pid 2888 has terminated
2025-05-20 14:09:24,108 [analyzer] INFO: Process with pid 3052 has terminated
2025-05-20 14:12:07,108 [analyzer] INFO: Analysis timeout hit, terminating analysis.
2025-05-20 14:12:08,233 [analyzer] INFO: Terminating remaining processes before shutdown.
2025-05-20 14:12:08,250 [lib.api.process] INFO: Successfully terminated process with pid 1052.
2025-05-20 14:12:08,250 [lib.api.process] INFO: Successfully terminated process with pid 1672.
2025-05-20 14:12:08,250 [analyzer] INFO: Analysis completed.

Cuckoo Log

2025-05-22 01:32:38,538 [cuckoo.core.scheduler] INFO: Task #6507179: acquired machine win7x647 (label=win7x647)
2025-05-22 01:32:38,539 [cuckoo.core.resultserver] DEBUG: Now tracking machine 192.168.168.207 for task #6507179
2025-05-22 01:32:38,799 [cuckoo.auxiliary.sniffer] INFO: Started sniffer with PID 534387 (interface=vboxnet0, host=192.168.168.207)
2025-05-22 01:32:39,041 [cuckoo.machinery.virtualbox] DEBUG: Starting vm win7x647
2025-05-22 01:32:39,524 [cuckoo.machinery.virtualbox] DEBUG: Restoring virtual machine win7x647 to vmcloak
2025-05-22 01:34:34,959 [cuckoo.core.guest] INFO: Starting analysis #6507179 on guest (id=win7x647, ip=192.168.168.207)
2025-05-22 01:34:35,964 [cuckoo.core.guest] DEBUG: win7x647: not ready yet
2025-05-22 01:34:40,986 [cuckoo.core.guest] INFO: Guest is running Cuckoo Agent 0.10 (id=win7x647, ip=192.168.168.207)
2025-05-22 01:34:41,056 [cuckoo.core.guest] DEBUG: Uploading analyzer to guest (id=win7x647, ip=192.168.168.207, monitor=latest, size=6660546)
2025-05-22 01:34:42,186 [cuckoo.core.resultserver] DEBUG: Task #6507179: live log analysis.log initialized.
2025-05-22 01:34:43,031 [cuckoo.core.resultserver] DEBUG: Task #6507179 is sending a BSON stream
2025-05-22 01:34:43,438 [cuckoo.core.resultserver] DEBUG: Task #6507179 is sending a BSON stream
2025-05-22 01:34:43,673 [cuckoo.core.resultserver] DEBUG: Task #6507179 is sending a BSON stream
2025-05-22 01:34:44,286 [cuckoo.core.resultserver] DEBUG: Task #6507179: File upload for 'shots/0001.jpg'
2025-05-22 01:34:44,297 [cuckoo.core.resultserver] DEBUG: Task #6507179 uploaded file length: 133494
2025-05-22 01:34:56,844 [cuckoo.core.guest] DEBUG: win7x647: analysis #6507179 still processing
2025-05-22 01:35:11,931 [cuckoo.core.guest] DEBUG: win7x647: analysis #6507179 still processing
2025-05-22 01:35:14,379 [cuckoo.core.resultserver] DEBUG: Task #6507179 is sending a BSON stream
2025-05-22 01:35:14,610 [cuckoo.core.resultserver] DEBUG: Task #6507179 is sending a BSON stream
2025-05-22 01:35:14,812 [cuckoo.core.resultserver] DEBUG: Task #6507179 is sending a BSON stream
2025-05-22 01:35:17,962 [cuckoo.core.resultserver] DEBUG: Task #6507179: File upload for 'files/a35a1007490e73a1_a35a1007490e73a1_mediacenter.exe'
2025-05-22 01:35:17,989 [cuckoo.core.resultserver] DEBUG: Task #6507179 uploaded file length: 59392
2025-05-22 01:35:27,047 [cuckoo.core.guest] DEBUG: win7x647: analysis #6507179 still processing
2025-05-22 01:35:42,176 [cuckoo.core.guest] DEBUG: win7x647: analysis #6507179 still processing
2025-05-22 01:35:57,259 [cuckoo.core.guest] DEBUG: win7x647: analysis #6507179 still processing
2025-05-22 01:36:12,329 [cuckoo.core.guest] DEBUG: win7x647: analysis #6507179 still processing
2025-05-22 01:36:27,479 [cuckoo.core.guest] DEBUG: win7x647: analysis #6507179 still processing
2025-05-22 01:36:42,680 [cuckoo.core.guest] DEBUG: win7x647: analysis #6507179 still processing
2025-05-22 01:36:57,827 [cuckoo.core.guest] DEBUG: win7x647: analysis #6507179 still processing
2025-05-22 01:37:12,933 [cuckoo.core.guest] DEBUG: win7x647: analysis #6507179 still processing
2025-05-22 01:37:28,012 [cuckoo.core.guest] DEBUG: win7x647: analysis #6507179 still processing
2025-05-22 01:37:43,138 [cuckoo.core.guest] DEBUG: win7x647: analysis #6507179 still processing
2025-05-22 01:37:58,234 [cuckoo.core.guest] DEBUG: win7x647: analysis #6507179 still processing
2025-05-22 01:38:02,450 [cuckoo.core.resultserver] DEBUG: Task #6507179: File upload for 'curtain/1747743127.23.curtain.log'
2025-05-22 01:38:02,453 [cuckoo.core.resultserver] DEBUG: Task #6507179 uploaded file length: 36
2025-05-22 01:38:03,368 [cuckoo.core.resultserver] DEBUG: Task #6507179: File upload for 'sysmon/1747743128.16.sysmon.xml'
2025-05-22 01:38:03,451 [cuckoo.core.resultserver] DEBUG: Task #6507179 uploaded file length: 14705314
2025-05-22 01:38:03,479 [cuckoo.core.resultserver] DEBUG: Task #6507179: File upload for 'files/67be0fe952193c7b_mediacenter.exe'
2025-05-22 01:38:03,481 [cuckoo.core.resultserver] DEBUG: Task #6507179 uploaded file length: 59392
2025-05-22 01:38:03,484 [cuckoo.core.resultserver] DEBUG: Task #6507179 had connection reset for <Context for LOG>
2025-05-22 01:38:04,267 [cuckoo.core.guest] INFO: win7x647: analysis completed successfully
2025-05-22 01:38:04,280 [cuckoo.core.plugins] DEBUG: Stopped auxiliary module: Redsocks
2025-05-22 01:38:04,304 [cuckoo.core.plugins] DEBUG: Stopped auxiliary module: Sniffer
2025-05-22 01:38:04,997 [cuckoo.machinery.virtualbox] INFO: Successfully generated memory dump for virtual machine with label win7x647 to path /srv/cuckoo/cwd/storage/analyses/6507179/memory.dmp
2025-05-22 01:38:04,998 [cuckoo.machinery.virtualbox] DEBUG: Stopping vm win7x647
2025-05-22 01:39:10,924 [cuckoo.core.resultserver] DEBUG: Stopped tracking machine 192.168.168.207 for task #6507179
2025-05-22 01:39:11,811 [cuckoo.core.scheduler] DEBUG: Released database task #6507179
2025-05-22 01:39:11,843 [cuckoo.core.scheduler] INFO: Task #6507179: analysis procedure completed

Signatures

Yara rule detected for file (1 event)
description The packer/protector section names/keywords rule suspicious_packer_section
Queries for the computername (2 events)
Time & API Arguments Status Return Repeated

GetComputerNameA

 computer_name: VPAMMTQMAZS
1 1 0

GetComputerNameA

 computer_name: VPAMMTQMAZS
1 1 0
Command line console output was observed (20 events)
Time & API Arguments Status Return Repeated

WriteConsoleA

 buffer: Pinging 127.0.0.1
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: with 32 bytes of data:
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: Reply from 127.0.0.1:
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: bytes=32
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: time<1ms
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: TTL=128
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: Reply from 127.0.0.1:
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: bytes=32
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: time<1ms
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: TTL=128
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: Reply from 127.0.0.1:
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: bytes=32
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: time<1ms
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: TTL=128
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: Reply from 127.0.0.1:
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: bytes=32
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: time<1ms
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: TTL=128
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: Ping statistics for 127.0.0.1: Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: Approximate round trip times in milli-seconds: Minimum = 0ms, Maximum = 0ms, Average = 0ms
console_handle: 0x00000007
1 1 0
Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
The executable contains unknown PE section names indicative of a packer (could be a false positive) (2 events)
section .MPRESS1
section .MPRESS2
The file contains an unknown PE resource name possibly indicative of a packer (1 event)
resource name DAT
A process attempted to delay the analysis task. (1 event)
description MediaCenter.exe tried to sleep 163 seconds, actually delayed analysis time by 163 seconds
Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation (1 event)
Time & API Arguments Status Return Repeated

GetDiskFreeSpaceExW

 total_number_of_free_bytes: 246075326464
free_bytes_available: 246075326464
root_path: C:\
total_number_of_bytes: 274561232896
1 1 0
Foreign language identified in PE resource (2 events)
name DAT language LANG_CHINESE filetype empty sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x00015490 size 0x00001600
name DAT language LANG_CHINESE filetype empty sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x00015490 size 0x00001600
Creates executable files on the filesystem (1 event)
file C:\Users\Administrator\AppData\Local\Temp\MicroMedia\MediaCenter.exe
Creates a suspicious process (2 events)
cmdline "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Administrator\AppData\Local\Temp\a35a1007490e73a1_mediacenter.exe"
cmdline cmd.exe /c ping 127.0.0.1 & del /q "C:\Users\Administrator\AppData\Local\Temp\a35a1007490e73a1_mediacenter.exe"
A process created a hidden window (1 event)
Time & API Arguments Status Return Repeated

ShellExecuteExW

 show_type: 0
filepath_r: cmd.exe
parameters: /c ping 127.0.0.1 & del /q "C:\Users\Administrator\AppData\Local\Temp\a35a1007490e73a1_mediacenter.exe"
filepath: cmd.exe
1 1 0
Checks adapter addresses which can be used to detect virtual network interfaces (1 event)
Time & API Arguments Status Return Repeated

GetAdaptersAddresses

 flags: 46
family: 0
1 0 0
The binary likely contains encrypted or compressed data indicative of a packer (2 events)
section {u'size_of_data': u'0x00007a00', u'virtual_address': u'0x00001000', u'entropy': 7.992040524828031, u'name': u'.MPRESS1', u'virtual_size': u'0x00017000'} entropy 7.99204052483 description A section with a high entropy has been found
entropy 0.884057971014 description Overall entropy of this PE file is high
Uses Windows utilities for basic Windows functionality (3 events)
cmdline "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Administrator\AppData\Local\Temp\a35a1007490e73a1_mediacenter.exe"
cmdline cmd.exe /c ping 127.0.0.1 & del /q "C:\Users\Administrator\AppData\Local\Temp\a35a1007490e73a1_mediacenter.exe"
cmdline ping 127.0.0.1
Installs itself for autorun at Windows startup (1 event)
reg_key HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia reg_value C:\Users\ADMINI~1\AppData\Local\Temp\MicroMedia\MediaCenter.exe
Creates an executable file in a user folder (2 events)
file C:\Users\Administrator\AppData\Local\Temp\a35a1007490e73a1_mediacenter.exe
file C:\Users\Administrator\AppData\Local\Temp\MicroMedia\MediaCenter.exe
Sets or modifies WPAD proxy autoconfiguration file for traffic interception (38 events)
Time & API Arguments Status Return Repeated

RegSetValueExW

 key_handle: 0x00000294
regkey_r: WpadDecisionReason
reg_type: 4 (REG_DWORD)
value: 1
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{092F0E6C-7874-4263-8D41-969F2B667EA2}\WpadDecisionReason
1 0 0

RegSetValueExW

 key_handle: 0x00000294
regkey_r: WpadDecisionTime
reg_type: 3 (REG_BINARY)
value: ð«ïµÉÛ
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{092F0E6C-7874-4263-8D41-969F2B667EA2}\WpadDecisionTime
1 0 0

RegSetValueExW

 key_handle: 0x00000294
regkey_r: WpadDecision
reg_type: 4 (REG_DWORD)
value: 0
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{092F0E6C-7874-4263-8D41-969F2B667EA2}\WpadDecision
1 0 0

RegSetValueExW

 key_handle: 0x00000294
regkey_r: WpadNetworkName
reg_type: 1 (REG_SZ)
value: Network
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{092F0E6C-7874-4263-8D41-969F2B667EA2}\WpadNetworkName
1 0 0

RegSetValueExW

 key_handle: 0x000002e8
regkey_r: WpadDecisionReason
reg_type: 4 (REG_DWORD)
value: 1
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionReason
1 0 0

RegSetValueExW

 key_handle: 0x000002e8
regkey_r: WpadDecisionTime
reg_type: 3 (REG_BINARY)
value: ð«ïµÉÛ
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionTime
1 0 0

RegSetValueExW

 key_handle: 0x000002e8
regkey_r: WpadDecision
reg_type: 4 (REG_DWORD)
value: 0
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecision
1 0 0

RegSetValueExW

 key_handle: 0x000002e8
regkey_r: WpadDecisionReason
reg_type: 4 (REG_DWORD)
value: 1
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionReason
1 0 0

RegSetValueExW

 key_handle: 0x000002e8
regkey_r: WpadDecisionTime
reg_type: 3 (REG_BINARY)
value: ð«ïµÉÛ
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionTime
1 0 0

RegSetValueExW

 key_handle: 0x000002e8
regkey_r: WpadDecision
reg_type: 4 (REG_DWORD)
value: 0
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecision
1 0 0

RegSetValueExW

 key_handle: 0x000002f4
regkey_r: WpadDecisionReason
reg_type: 4 (REG_DWORD)
value: 1
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionReason
1 0 0

RegSetValueExW

 key_handle: 0x000002f4
regkey_r: WpadDecisionTime
reg_type: 3 (REG_BINARY)
value: ð«ïµÉÛ
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionTime
1 0 0

RegSetValueExW

 key_handle: 0x000002f4
regkey_r: WpadDecision
reg_type: 4 (REG_DWORD)
value: 0
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecision
1 0 0

RegSetValueExW

 key_handle: 0x000002f4
regkey_r: WpadDetectedUrl
reg_type: 1 (REG_SZ)
value:
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDetectedUrl
1 0 0

RegSetValueExW

 key_handle: 0x0000023c
regkey_r: WpadDecisionReason
reg_type: 4 (REG_DWORD)
value: 1
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{092F0E6C-7874-4263-8D41-969F2B667EA2}\WpadDecisionReason
1 0 0

RegSetValueExW

 key_handle: 0x0000023c
regkey_r: WpadDecisionTime
reg_type: 3 (REG_BINARY)
value: J¿ú!µÉÛ
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{092F0E6C-7874-4263-8D41-969F2B667EA2}\WpadDecisionTime
1 0 0

RegSetValueExW

 key_handle: 0x0000023c
regkey_r: WpadDecision
reg_type: 4 (REG_DWORD)
value: 0
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{092F0E6C-7874-4263-8D41-969F2B667EA2}\WpadDecision
1 0 0

RegSetValueExW

 key_handle: 0x0000023c
regkey_r: WpadNetworkName
reg_type: 1 (REG_SZ)
value: Network
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{092F0E6C-7874-4263-8D41-969F2B667EA2}\WpadNetworkName
1 0 0

RegSetValueExW

 key_handle: 0x000002f0
regkey_r: WpadDecisionReason
reg_type: 4 (REG_DWORD)
value: 1
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionReason
1 0 0

RegSetValueExW

 key_handle: 0x000002f0
regkey_r: WpadDecisionTime
reg_type: 3 (REG_BINARY)
value: J¿ú!µÉÛ
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionTime
1 0 0

RegSetValueExW

 key_handle: 0x000002f0
regkey_r: WpadDecision
reg_type: 4 (REG_DWORD)
value: 0
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecision
1 0 0

RegSetValueExW

 key_handle: 0x000002f0
regkey_r: WpadDecisionReason
reg_type: 4 (REG_DWORD)
value: 1
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionReason
1 0 0

RegSetValueExW

 key_handle: 0x000002f0
regkey_r: WpadDecisionTime
reg_type: 3 (REG_BINARY)
value: J¿ú!µÉÛ
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionTime
1 0 0

RegSetValueExW

 key_handle: 0x000002f0
regkey_r: WpadDecision
reg_type: 4 (REG_DWORD)
value: 0
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecision
1 0 0

RegSetValueExW

 key_handle: 0x000002b0
regkey_r: WpadDecisionReason
reg_type: 4 (REG_DWORD)
value: 1
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionReason
1 0 0

RegSetValueExW

 key_handle: 0x000002b0
regkey_r: WpadDecisionTime
reg_type: 3 (REG_BINARY)
value: J¿ú!µÉÛ
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionTime
1 0 0

RegSetValueExW

 key_handle: 0x000002b0
regkey_r: WpadDecision
reg_type: 4 (REG_DWORD)
value: 0
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecision
1 0 0

RegSetValueExW

 key_handle: 0x000002b0
regkey_r: WpadDetectedUrl
reg_type: 1 (REG_SZ)
value:
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDetectedUrl
1 0 0

RegSetValueExW

 key_handle: 0x00000270
regkey_r: WpadDecisionReason
reg_type: 4 (REG_DWORD)
value: 1
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{092F0E6C-7874-4263-8D41-969F2B667EA2}\WpadDecisionReason
1 0 0

RegSetValueExW

 key_handle: 0x00000270
regkey_r: WpadDecisionTime
reg_type: 3 (REG_BINARY)
value: ÿŸlµÉÛ
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{092F0E6C-7874-4263-8D41-969F2B667EA2}\WpadDecisionTime
1 0 0

RegSetValueExW

 key_handle: 0x00000270
regkey_r: WpadDecision
reg_type: 4 (REG_DWORD)
value: 0
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{092F0E6C-7874-4263-8D41-969F2B667EA2}\WpadDecision
1 0 0

RegSetValueExW

 key_handle: 0x00000270
regkey_r: WpadNetworkName
reg_type: 1 (REG_SZ)
value: Network
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{092F0E6C-7874-4263-8D41-969F2B667EA2}\WpadNetworkName
1 0 0

RegSetValueExW

 key_handle: 0x0000023c
regkey_r: WpadDecisionReason
reg_type: 4 (REG_DWORD)
value: 1
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionReason
1 0 0

RegSetValueExW

 key_handle: 0x0000023c
regkey_r: WpadDecisionTime
reg_type: 3 (REG_BINARY)
value: ÿŸlµÉÛ
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionTime
1 0 0

RegSetValueExW

 key_handle: 0x0000023c
regkey_r: WpadDecision
reg_type: 4 (REG_DWORD)
value: 0
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecision
1 0 0

RegSetValueExW

 key_handle: 0x0000023c
regkey_r: WpadDecisionReason
reg_type: 4 (REG_DWORD)
value: 1
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionReason
1 0 0

RegSetValueExW

 key_handle: 0x0000023c
regkey_r: WpadDecisionTime
reg_type: 3 (REG_BINARY)
value: ÿŸlµÉÛ
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionTime
1 0 0

RegSetValueExW

 key_handle: 0x0000023c
regkey_r: WpadDecision
reg_type: 4 (REG_DWORD)
value: 0
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecision
1 0 0
File has been identified by 13 AntiVirus engine on IRMA as malicious (13 events)
G Data Antivirus (Windows) Virus: Gen:Trojan.Heur.GM.01C0010402 (Engine A)
Avast Core Security (Linux) Win32:Trojan-gen
C4S ClamAV (Linux) Win.Malware.Scar-6745903-0
Trellix (Linux) Trojan-FRKD
WithSecure (Linux) Trojan.TR/Dropper.Gen
eScan Antivirus (Linux) Gen:Trojan.Heur.GM.01C0010402(DB)
ESET Security (Windows) a variant of Win32/Shyape.G trojan
Sophos Anti-Virus (Linux) Troj/Kelihos-BS
DrWeb Antivirus (Linux) Trojan.DownLoad3.19306
ClamAV (Linux) Win.Malware.Scar-6745903-0
Bitdefender Antivirus (Linux) Gen:Trojan.Heur.GM.01C0010402
Kaspersky Standard (Windows) Trojan.Win32.Scar.okdf
Emsisoft Commandline Scanner (Windows) Gen:Trojan.Heur.GM.01C0010402 (B)
Screenshots
Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action VT Location
No hosts contacted.
Cuckoo

We're processing your submission... This could take a few seconds.