Installs a browser addon or extension
- Key:
- HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Locked
Attempts to repeatedly call a single API many times in order to delay analysis time
- Spam:
- explorer.exe (1048) called API GetSystemMetrics 67730 times
- Spam:
- iexplore.exe (1716) called API GetSystemMetrics 13138 times
- Spam:
- iexplore.exe (1716) called API GetKeyState 12034 times
- Spam:
- iexplore.exe (732) called API GetSystemMetrics 14855 times
Attempts to stop active services
Checks whether any human activity is being performed by constantly checking whether the foreground window changed
Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available
| PID |
API |
Arguments |
| 2888 |
GlobalMemoryStatusEx |
N/A |
Checks adapter addresses which can be used to detect virtual network interfaces
| PID |
API |
Arguments |
| 1796 |
GetAdaptersAddresses |
- flags:
- 0
- family:
- 0
|
| 1796 |
GetAdaptersAddresses |
- flags:
- 0
- family:
- 0
|
Attempts to modify proxy settings
Drops a binary and executes it
- File:
- C:\Users\Virtual\AppData\Local\Temp\UPKeyXSetup-B482144A23-x86_64\UPKeyXInst.exe
Sample writes a large amount of files (Over 100)
One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.
Creates executable files on the filesystem
- File:
- C:\Users\Virtual\AppData\Local\Temp\7zSECBE.tmp\Katran\9\UPKeyInst.exe
- File:
- C:\Users\Virtual\AppData\Local\Temp\7zS3EB4.tmp\Katran\10\upkey-10.1.11.701-r525.exe
- File:
- C:\Users\Virtual\AppData\Local\Temp\UPKeyXSetup-9342153BA2-x86_64\WdfCoInstaller01009.dll
- File:
- C:\Users\Virtual\AppData\Local\Temp\7zSECBE.tmp\Katran\10\upkey-10.1.11.701-r525.exe
- File:
- C:\Users\Virtual\AppData\Local\Temp\7zS1045.tmp\SetupProtect.exe
- File:
- C:\Users\Virtual\AppData\Local\Temp\7zS13DD.tmp\Katran\license\LicenceServer.exe
- File:
- C:\Users\Virtual\AppData\Local\Temp\is-FSNIA.tmp\callbackctrl.dll
- File:
- C:\Users\Virtual\AppData\Local\Temp\7zS1045.tmp\Katran\10\upkey-10.1.11.701-r525.exe
- File:
- C:\Users\Virtual\AppData\Local\Temp\7zS1045.tmp\Katran\license\LicenceAddIn.exe
- File:
- C:\Users\Virtual\AppData\Local\Temp\UPKeyXSetup-9342153BA2-x86_64\UPKeyXInst.exe
- File:
- C:\Users\Virtual\AppData\Local\Temp\7zS1BBA.tmp\Katran\10\upkey-10.1.11.701-r525.exe
- File:
- C:\Users\Virtual\AppData\Local\Temp\is-6GH6K.tmp\callbackctrl.dll
- File:
- C:\Users\Virtual\AppData\Local\Temp\7zS13DD.tmp\Katran\10\upkey-10.1.11.701-r525.exe
- File:
- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Licence\3.0\Manuals\Licences types and descriptions (Russian).lnk
- File:
- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Licence\3.0\Manuals\Administrator's manual (Russian).lnk
- File:
- C:\Users\Virtual\AppData\Local\Temp\7zS13DD.tmp\Katran\9\UPKeyInst.exe
- File:
- C:\Users\Virtual\AppData\Local\Temp\7zS1BBA.tmp\SetupProtect.exe
- File:
- C:\Users\Virtual\AppData\Local\Temp\7zS1BBA.tmp\LicServer.exe
- File:
- C:\Users\Virtual\AppData\Local\Temp\7zSECBE.tmp\Katran\license\LicenceServer.exe
- File:
- C:\Users\Virtual\AppData\Local\Temp\7zS3EB4.tmp\SetupProtect.exe
- File:
- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Licence\3.0\Manuals\Update manual (Russian).lnk
- File:
- C:\Users\Virtual\AppData\Local\Temp\7zS13DD.tmp\Katran\license\LicenceAddIn.exe
- File:
- C:\Users\Virtual\AppData\Local\Temp\7zS13DD.tmp\LicServer.exe
- File:
- C:\Users\Virtual\AppData\Local\Temp\7zS1BBA.tmp\Katran\license\LicenceServer.exe
- File:
- C:\Users\Virtual\AppData\Local\Temp\7zS13DD.tmp\SetupProtect.exe
- File:
- C:\Users\Virtual\AppData\Local\Temp\7zSECBE.tmp\Katran\license\LicenceAddIn.exe
- File:
- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Licence\3.0\Manuals\Licences activation manual (Russian).lnk
- File:
- C:\Users\Virtual\AppData\Local\Temp\UPKeyXSetup-B482144A23-x86_64\WdfCoInstaller01009.dll
- File:
- C:\Users\Virtual\AppData\Local\Temp\7zS1045.tmp\Katran\9\UPKeyInst.exe
- File:
- C:\Users\Virtual\AppData\Local\Temp\7zS3EB4.tmp\Katran\license\LicenceServer.exe
- File:
- C:\Users\Virtual\AppData\Local\Temp\is-GUTU2.tmp\callbackctrl.dll
- File:
- C:\Users\Virtual\AppData\Local\Temp\7zS1045.tmp\Katran\license\LicenceServer.exe
- File:
- C:\Users\Virtual\AppData\Local\Temp\7zSECBE.tmp\SetupProtect.exe
- File:
- C:\Users\Virtual\AppData\Local\Temp\7zS3EB4.tmp\LicServer.exe
- File:
- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Licence\3.0\LicenceServer Console (default browser).lnk
- File:
- C:\Users\Virtual\AppData\Local\Temp\7zS1BBA.tmp\Katran\license\LicenceAddIn.exe
- File:
- C:\Users\Virtual\AppData\Local\Temp\7zS1045.tmp\LicServer.exe
- File:
- C:\Users\Virtual\AppData\Local\Temp\7zS3EB4.tmp\Katran\9\UPKeyInst.exe
- File:
- C:\Users\Virtual\AppData\Local\Temp\7zSECBE.tmp\LicServer.exe
- File:
- C:\Users\Virtual\AppData\Local\Temp\7zS3EB4.tmp\Katran\license\LicenceAddIn.exe
- File:
- C:\Users\Virtual\AppData\Local\Temp\7zS1BBA.tmp\Katran\9\UPKeyInst.exe
- File:
- C:\Users\Virtual\AppData\Local\Temp\is-0SOTG.tmp\callbackctrl.dll
- File:
- C:\Users\Virtual\AppData\Local\Temp\UPKeyXSetup-B482144A23-x86_64\UPKeyXInst.exe
Reads data out of its own binary image
- Self Read:
- process: 9c544a7c52553e62951b2aa2b33402c93be09f2f0fdb442f5790bb4d983f0b21.exe, pid: 2480, offset: 0x00000000, length: 0x00000020
- Self Read:
- process: 9c544a7c52553e62951b2aa2b33402c93be09f2f0fdb442f5790bb4d983f0b21.exe, pid: 2480, offset: 0x00000000, length: 0x00001000
- Self Read:
- process: 9c544a7c52553e62951b2aa2b33402c93be09f2f0fdb442f5790bb4d983f0b21.exe, pid: 2480, offset: 0x00000020, length: 0x0000ffe0
- Self Read:
- process: 9c544a7c52553e62951b2aa2b33402c93be09f2f0fdb442f5790bb4d983f0b21.exe, pid: 2480, offset: 0x00001000, length: 0x0000fef0
- Self Read:
- process: 9c544a7c52553e62951b2aa2b33402c93be09f2f0fdb442f5790bb4d983f0b21.exe, pid: 2480, offset: 0x00010000, length: 0x0000ffe0
- Self Read:
- process: 9c544a7c52553e62951b2aa2b33402c93be09f2f0fdb442f5790bb4d983f0b21.exe, pid: 2480, offset: 0x00010ef0, length: 0x0000fef0
- Self Read:
- process: 9c544a7c52553e62951b2aa2b33402c93be09f2f0fdb442f5790bb4d983f0b21.exe, pid: 2480, offset: 0x0001ffe0, length: 0x0000ffe0
- Self Read:
- process: 9c544a7c52553e62951b2aa2b33402c93be09f2f0fdb442f5790bb4d983f0b21.exe, pid: 2480, offset: 0x00020de0, length: 0x00001fde
- Self Read:
- process: 9c544a7c52553e62951b2aa2b33402c93be09f2f0fdb442f5790bb4d983f0b21.exe, pid: 2480, offset: 0x0002ffc0, length: 0x00b4a014
- Self Read:
- process: 9c544a7c52553e62951b2aa2b33402c93be09f2f0fdb442f5790bb4d983f0b21.exe, pid: 2576, offset: 0x00000000, length: 0x00000020
- Self Read:
- process: 9c544a7c52553e62951b2aa2b33402c93be09f2f0fdb442f5790bb4d983f0b21.exe, pid: 2576, offset: 0x00000000, length: 0x00001000
- Self Read:
- process: 9c544a7c52553e62951b2aa2b33402c93be09f2f0fdb442f5790bb4d983f0b21.exe, pid: 2576, offset: 0x00000020, length: 0x0000ffe0
- Self Read:
- process: 9c544a7c52553e62951b2aa2b33402c93be09f2f0fdb442f5790bb4d983f0b21.exe, pid: 2576, offset: 0x00001000, length: 0x0000fef0
- Self Read:
- process: 9c544a7c52553e62951b2aa2b33402c93be09f2f0fdb442f5790bb4d983f0b21.exe, pid: 2576, offset: 0x00010000, length: 0x0000ffe0
- Self Read:
- process: 9c544a7c52553e62951b2aa2b33402c93be09f2f0fdb442f5790bb4d983f0b21.exe, pid: 2576, offset: 0x00010ef0, length: 0x0000fef0
- Self Read:
- process: 9c544a7c52553e62951b2aa2b33402c93be09f2f0fdb442f5790bb4d983f0b21.exe, pid: 2576, offset: 0x0001ffe0, length: 0x0000ffe0
- Self Read:
- process: 9c544a7c52553e62951b2aa2b33402c93be09f2f0fdb442f5790bb4d983f0b21.exe, pid: 2576, offset: 0x00020de0, length: 0x00001fde
- Self Read:
- process: 9c544a7c52553e62951b2aa2b33402c93be09f2f0fdb442f5790bb4d983f0b21.exe, pid: 2576, offset: 0x0002ffc0, length: 0x00b4a014
- Self Read:
- process: 9c544a7c52553e62951b2aa2b33402c93be09f2f0fdb442f5790bb4d983f0b21.exe, pid: 2724, offset: 0x00000000, length: 0x00000020
- Self Read:
- process: 9c544a7c52553e62951b2aa2b33402c93be09f2f0fdb442f5790bb4d983f0b21.exe, pid: 2724, offset: 0x00000000, length: 0x00001000
- Self Read:
- process: 9c544a7c52553e62951b2aa2b33402c93be09f2f0fdb442f5790bb4d983f0b21.exe, pid: 2724, offset: 0x00000020, length: 0x0000ffe0
- Self Read:
- process: 9c544a7c52553e62951b2aa2b33402c93be09f2f0fdb442f5790bb4d983f0b21.exe, pid: 2724, offset: 0x00001000, length: 0x0000fef0
- Self Read:
- process: 9c544a7c52553e62951b2aa2b33402c93be09f2f0fdb442f5790bb4d983f0b21.exe, pid: 2724, offset: 0x00010000, length: 0x0000ffe0
- Self Read:
- process: 9c544a7c52553e62951b2aa2b33402c93be09f2f0fdb442f5790bb4d983f0b21.exe, pid: 2724, offset: 0x00010ef0, length: 0x0000fef0
- Self Read:
- process: 9c544a7c52553e62951b2aa2b33402c93be09f2f0fdb442f5790bb4d983f0b21.exe, pid: 2724, offset: 0x0001ffe0, length: 0x0000ffe0
- Self Read:
- process: 9c544a7c52553e62951b2aa2b33402c93be09f2f0fdb442f5790bb4d983f0b21.exe, pid: 2724, offset: 0x00020de0, length: 0x00001fde
- Self Read:
- process: 9c544a7c52553e62951b2aa2b33402c93be09f2f0fdb442f5790bb4d983f0b21.exe, pid: 2724, offset: 0x0002ffc0, length: 0x00000025
- Self Read:
- process: 9c544a7c52553e62951b2aa2b33402c93be09f2f0fdb442f5790bb4d983f0b21.exe, pid: 2784, offset: 0x00000000, length: 0x00000020
- Self Read:
- process: 9c544a7c52553e62951b2aa2b33402c93be09f2f0fdb442f5790bb4d983f0b21.exe, pid: 2784, offset: 0x00000000, length: 0x00001000
- Self Read:
- process: 9c544a7c52553e62951b2aa2b33402c93be09f2f0fdb442f5790bb4d983f0b21.exe, pid: 2784, offset: 0x00000020, length: 0x0000ffe0
- Self Read:
- process: 9c544a7c52553e62951b2aa2b33402c93be09f2f0fdb442f5790bb4d983f0b21.exe, pid: 2784, offset: 0x00001000, length: 0x0000fef0
- Self Read:
- process: 9c544a7c52553e62951b2aa2b33402c93be09f2f0fdb442f5790bb4d983f0b21.exe, pid: 2784, offset: 0x00010000, length: 0x0000ffe0
- Self Read:
- process: 9c544a7c52553e62951b2aa2b33402c93be09f2f0fdb442f5790bb4d983f0b21.exe, pid: 2784, offset: 0x00010ef0, length: 0x0000fef0
- Self Read:
- process: 9c544a7c52553e62951b2aa2b33402c93be09f2f0fdb442f5790bb4d983f0b21.exe, pid: 2784, offset: 0x0001ffe0, length: 0x0000ffe0
- Self Read:
- process: 9c544a7c52553e62951b2aa2b33402c93be09f2f0fdb442f5790bb4d983f0b21.exe, pid: 2784, offset: 0x00020de0, length: 0x00001fde
- Self Read:
- process: 9c544a7c52553e62951b2aa2b33402c93be09f2f0fdb442f5790bb4d983f0b21.exe, pid: 2784, offset: 0x0002ffc0, length: 0x00b4a014
- Self Read:
- process: upkey-10.1.11.701-r525.exe, pid: 2888, offset: 0x00000000, length: 0x0079cae0
- Self Read:
- process: LicenceAddIn.exe, pid: 3052, offset: 0x00000000, length: 0x00065e17
- Self Read:
- process: LicenceAddIn.tmp, pid: 2060, offset: 0x00000000, length: 0x00125f18
- Self Read:
- process: LicenceServer.exe, pid: 684, offset: 0x00000000, length: 0x00065caf
- Self Read:
- process: LicenceServer.tmp, pid: 1796, offset: 0x00000000, length: 0x00125f18
- Self Read:
- process: 9c544a7c52553e62951b2aa2b33402c93be09f2f0fdb442f5790bb4d983f0b21.exe, pid: 1928, offset: 0x00000000, length: 0x00000020
- Self Read:
- process: 9c544a7c52553e62951b2aa2b33402c93be09f2f0fdb442f5790bb4d983f0b21.exe, pid: 1928, offset: 0x00000000, length: 0x00001000
- Self Read:
- process: 9c544a7c52553e62951b2aa2b33402c93be09f2f0fdb442f5790bb4d983f0b21.exe, pid: 1928, offset: 0x00000020, length: 0x0000ffe0
- Self Read:
- process: 9c544a7c52553e62951b2aa2b33402c93be09f2f0fdb442f5790bb4d983f0b21.exe, pid: 1928, offset: 0x00001000, length: 0x0000fef0
- Self Read:
- process: 9c544a7c52553e62951b2aa2b33402c93be09f2f0fdb442f5790bb4d983f0b21.exe, pid: 1928, offset: 0x00010000, length: 0x0000ffe0
- Self Read:
- process: 9c544a7c52553e62951b2aa2b33402c93be09f2f0fdb442f5790bb4d983f0b21.exe, pid: 1928, offset: 0x00010ef0, length: 0x0000fef0
- Self Read:
- process: 9c544a7c52553e62951b2aa2b33402c93be09f2f0fdb442f5790bb4d983f0b21.exe, pid: 1928, offset: 0x0001ffe0, length: 0x0000ffe0
- Self Read:
- process: 9c544a7c52553e62951b2aa2b33402c93be09f2f0fdb442f5790bb4d983f0b21.exe, pid: 1928, offset: 0x00020de0, length: 0x00001fde
- Self Read:
- process: 9c544a7c52553e62951b2aa2b33402c93be09f2f0fdb442f5790bb4d983f0b21.exe, pid: 1928, offset: 0x0002ffc0, length: 0x00000025
Uses Windows utilities for basic Windows functionality
- Cmdline:
- "C:\Windows\system32\netsh" advfirewall firewall add rule name="LicenceServer30" dir=out action=allow program="C:\Program Files (x86)\1C\Licence\3.0\licenceserver.exe" enable=yes
- Cmdline:
- "C:\Windows\system32\netsh" advfirewall firewall delete rule name="LicenceServer30"
- Cmdline:
- "C:\Windows\system32\netsh" advfirewall firewall add rule name="LicenceServer30" dir=in action=allow program="C:\Program Files (x86)\1C\Licence\3.0\licenceserver.exe" enable=yes
Installs an hook procedure to monitor for mouse events
| PID |
API |
Arguments |
| 732 |
SetWindowsHookExW |
- thread_identifier:
- 2508
- callback_function:
- 0x766a3e83
- hook_identifier:
- 7
- module_address:
- 0x00000000
|
Performs some HTTP requests
- Request:
- GET http://prom.licencecenter.ru/series
- Request:
- GET http://www.bing.com/favicon.ico
Attempts to connect to dead IP:Port(s)
Performs some DNS requests
- Dns :
- Request: prom.licencecenter.ru IP: 109.120.144.140
- Dns :
- Request: go.microsoft.com IP: 104.111.87.125
- Dns :
- Request: www.bing.com IP: 204.79.197.200
Network activity contains more than one unique useragent.
The executable has PE anomalies (could be a false positive)
Allocates read-write-execute memory (usually to unpack itself)
| PID |
API |
Arguments |
| 2568 |
NtProtectVirtualMemory |
- process_identifier:
- 2480
- stack_dep_bypass:
- 0
- stack_pivoted:
- 0
- heap_dep_bypass:
- 0
- length:
- 4096
- protection:
- 64
- base_address:
- 0x6f771000
- process_handle:
- 0xffffffff
|
Creates an Alternate Data Stream (ADS)
- File:
- C:\Users\Virtual\AppData\Local\Temp\UPKeyXSetup-9342153BA2-x86_64\UPKeyXInst.exe:Zone.Identifier
- File:
- C:\Users\Virtual\AppData\Local\Temp\UPKeyXSetup-B482144A23-x86_64\UPKeyXInst.exe:Zone.Identifier
Creates known Dexter registry keys and/or mutexes
- Regkey:
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Associations
This sample modifies many files through suspicious ways, likely a polymorphic virus or a ransomware
| PID |
API |
Arguments |
| 2060 |
MoveFileWithProgressW |
- newfilepath_r:
- C:\Program Files (x86)\1C\Licence\3.0\unins000.exe
- flags:
- 2
- oldfilepath_r:
- C:\Program Files (x86)\1C\Licence\3.0\is-HKNR6.tmp
- newfilepath:
- C:\Program Files (x86)\1C\Licence\3.0\unins000.exe
- oldfilepath:
- C:\Program Files (x86)\1C\Licence\3.0\is-HKNR6.tmp
|
| 2060 |
MoveFileWithProgressW |
- newfilepath_r:
- C:\Program Files (x86)\1C\Licence\3.0\licenceaddin.dll
- flags:
- 2
- oldfilepath_r:
- C:\Program Files (x86)\1C\Licence\3.0\is-PVRMS.tmp
- newfilepath:
- C:\Program Files (x86)\1C\Licence\3.0\licenceaddin.dll
- oldfilepath:
- C:\Program Files (x86)\1C\Licence\3.0\is-PVRMS.tmp
|
| 2060 |
MoveFileWithProgressW |
- newfilepath_r:
- C:\Program Files (x86)\1C\Licence\3.0\licenceaddin-x86_64.dll
- flags:
- 2
- oldfilepath_r:
- C:\Program Files (x86)\1C\Licence\3.0\is-F755H.tmp
- newfilepath:
- C:\Program Files (x86)\1C\Licence\3.0\licenceaddin-x86_64.dll
- oldfilepath:
- C:\Program Files (x86)\1C\Licence\3.0\is-F755H.tmp
|
| 2060 |
MoveFileWithProgressW |
- newfilepath_r:
- C:\ProgramData\1C\Licence\3.0\licenceaddin.conf
- flags:
- 2
- oldfilepath_r:
- C:\ProgramData\1C\Licence\3.0\is-H6B44.tmp
- newfilepath:
- C:\ProgramData\1C\Licence\3.0\licenceaddin.conf
- oldfilepath:
- C:\ProgramData\1C\Licence\3.0\is-H6B44.tmp
|
| 2060 |
MoveFileWithProgressW |
- newfilepath_r:
- C:\Program Files (x86)\1C\Licence\3.0\licenceaddin-loader.dll
- flags:
- 2
- oldfilepath_r:
- C:\Program Files (x86)\1C\Licence\3.0\is-I527C.tmp
- newfilepath:
- C:\Program Files (x86)\1C\Licence\3.0\licenceaddin-loader.dll
- oldfilepath:
- C:\Program Files (x86)\1C\Licence\3.0\is-I527C.tmp
|
| 2060 |
MoveFileWithProgressW |
- newfilepath_r:
- C:\Program Files (x86)\1C\Licence\3.0\licenceaddin-loader-helper.exe
- flags:
- 2
- oldfilepath_r:
- C:\Program Files (x86)\1C\Licence\3.0\is-HUSAO.tmp
- newfilepath:
- C:\Program Files (x86)\1C\Licence\3.0\licenceaddin-loader-helper.exe
- oldfilepath:
- C:\Program Files (x86)\1C\Licence\3.0\is-HUSAO.tmp
|
| 2060 |
MoveFileWithProgressW |
- newfilepath_r:
- C:\Program Files (x86)\1C\Licence\3.0\licenceaddin-loader-x86_64.dll
- flags:
- 2
- oldfilepath_r:
- C:\Program Files (x86)\1C\Licence\3.0\is-5S7S0.tmp
- newfilepath:
- C:\Program Files (x86)\1C\Licence\3.0\licenceaddin-loader-x86_64.dll
- oldfilepath:
- C:\Program Files (x86)\1C\Licence\3.0\is-5S7S0.tmp
|
| 2060 |
MoveFileWithProgressW |
- newfilepath_r:
- C:\Program Files (x86)\1C\Licence\3.0\licenceaddin-loader-helper-x86_64.exe
- flags:
- 2
- oldfilepath_r:
- C:\Program Files (x86)\1C\Licence\3.0\is-V4MJF.tmp
- newfilepath:
- C:\Program Files (x86)\1C\Licence\3.0\licenceaddin-loader-helper-x86_64.exe
- oldfilepath:
- C:\Program Files (x86)\1C\Licence\3.0\is-V4MJF.tmp
|
| 2060 |
MoveFileWithProgressW |
- newfilepath_r:
- C:\Program Files (x86)\1C\Licence\3.0\licenceaddin-loader-service.exe
- flags:
- 2
- oldfilepath_r:
- C:\Program Files (x86)\1C\Licence\3.0\is-K4HF2.tmp
- newfilepath:
- C:\Program Files (x86)\1C\Licence\3.0\licenceaddin-loader-service.exe
- oldfilepath:
- C:\Program Files (x86)\1C\Licence\3.0\is-K4HF2.tmp
|
| 2060 |
MoveFileWithProgressW |
- newfilepath_r:
- C:\Program Files (x86)\1C\Licence\3.0\callbackctrl.dll
- flags:
- 2
- oldfilepath_r:
- C:\Program Files (x86)\1C\Licence\3.0\is-9TLO8.tmp
- newfilepath:
- C:\Program Files (x86)\1C\Licence\3.0\callbackctrl.dll
- oldfilepath:
- C:\Program Files (x86)\1C\Licence\3.0\is-9TLO8.tmp
|
Queries for the computername
| PID |
API |
Arguments |
| 2060 |
GetComputerNameW |
- computer_name:
- VIRTUAL-PC
|
| PID |
API |
Arguments |
| 2388 |
CreateServiceA |
- service_start_name:
- start_type:
- 2
- password:
- display_name:
- LicenceAddIn Loader Daemon
- filepath:
- C:\Program Files (x86)\1C\Licence\3.0\"C:\Program Files (x86)\1C\Licence\3.0\licenceaddin-loader-service.exe" --run -r
- service_name:
- LicenceAddInLoader
- filepath_r:
- "C:\Program Files (x86)\1C\Licence\3.0\licenceaddin-loader-service.exe" --run -r
- desired_access:
- 983551
- service_handle:
- 0x0025cf18
- error_control:
- 0
- service_type:
- 16
- service_manager_handle:
- 0x00316fb8
|
This sample contains low entropy sections
- Section:
- .sxdata, at virtual address 0x00026000
- Entropy:
- 0.0203931352361
Presents an Authenticode digital signature
A process created a hidden window
- Process:
- upkey-10.1.11.701-r525.exe -> C:\Users\Virtual\AppData\Local\Temp\UPKeyXSetup-B482144A23-x86_64\UPKeyXInst.exe
- Process:
- upkey-10.1.11.701-r525.exe -> C:\Users\Virtual\AppData\Local\Temp\UPKeyXSetup-9342153BA2-x86_64\UPKeyXInst.exe
Deletes its original binary from disk
- File:
- C:\Users\Virtual\AppData\Local\Temp\is-40QBM.tmp\LicenceServer.tmp
- File:
- C:\Users\Virtual\AppData\Local\Temp\UPKeyXSetup-9342153BA2-x86_64\UPKeyXInst.exe
- File:
- C:\Users\Virtual\AppData\Local\Temp\UPKeyXSetup-B482144A23-x86_64\UPKeyXInst.exe
- File:
- C:\Users\Virtual\AppData\Local\Temp\is-KO77R.tmp\LicenceServer.tmp
- File:
- C:\Users\Virtual\AppData\Local\Temp\is-RG4UG.tmp\LicenceAddIn.tmp
- File:
- C:\Users\Virtual\AppData\Local\Temp\is-ONI69.tmp\LicenceAddIn.tmp
Resolves .RU Russia TLD, Possibly Malicious
- Domain:
- prom.licencecenter.ru
