SmartHawk

11.2

0-day

48 个模型检测该样本为恶意！

重新分析

下载样本

cdc9bb3f7abb003f8401c8fe276b548a7ede41929ff7a354e0c42c330a345567

8827dfd90c7f1e9db50f41242a511867.exe

分析耗时

103s

最近分析

文件大小

308.1KB

静态报毒动态报毒 3TSK2DAAYGU AI SCORE=80 ATTRIBUTE CITWZ8KELLY CONFIDENCE DOWNLOADER34 ELDORADO EMOTET GENCIRC GENERICKDZ HCEJ HIGH CONFIDENCE HIGHCONFIDENCE HSEJQL ICHMM KRYPTIK MALWARE@#2YA1PTHCMK1CB PHORPIEXUPL R + TROJ R348891 TRTJ UNSAFE WACATAC 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
Baidu		20190318	1.0.0.2
Avast	Win32:Trojan-gen	20201024	18.4.3895.0
Alibaba	Trojan:Win32/Emotet.82e2477a	20190527	0.3.0.5
Kingsoft		20201024	2013.8.14.323
McAfee	Emotet-FRV!8827DFD90C7F	20201024	6.0.6.653
Tencent	Malware.Win32.Gencirc.10cdeb6c	20201024	1.0.0.1
CrowdStrike	win/malicious_confidence_60% (W)	20190702	1.0

Queries for the computername (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619693934.30725 GetComputerNameA	computer_name: OSKAR-PC	success	1	0

Uses Windows APIs to generate a cryptographic key (5 个事件)

Time & API	Arguments	Status	Return
1619693922.63525 CryptGenKey	crypto_handle: 0x00635180 algorithm_identifier: 0x0000660e () provider_handle: 0x006344a0 flags: 1 key: f[u ²É%½¹Ü-à	success	1
1619693934.30725 CryptExportKey	crypto_handle: 0x00635180 crypto_export_handle: 0x00635140 buffer: f¤Ed û@WwT®ÒBAkÿ3çÓo¼TkØ ýRÕï 'Äë¹"«ë¹ÄRÞi)ÓsëÎêªi!¦òçössÿÑy1´ÒudÌi¸ÁÄsr¯'tX blob_type: 1 flags: 64	success	1
1619693963.13525 CryptExportKey	crypto_handle: 0x00635180 crypto_export_handle: 0x00635140 buffer: f¤Èñ¢É£Â¦IxcvªÝÙjÛÒgã°N ÝUpS$ ¤ã¬PØ> øeCÇÛBbXp»3Àl>²ÇZÁ(_¼ÏÊ65ùÀuÅ«"¼Åm blob_type: 1 flags: 64	success	1
1619693968.66625 CryptExportKey	crypto_handle: 0x00635180 crypto_export_handle: 0x00635140 buffer: f¤P´U§o9ãË§Ë^Á]Cpbgâó3ªD!WÉo\îçÃTa[±"°SCü&ÑÿøEÎ\|ÿÑ9\|PæUYõ,3ée³wt0 É¥ blob_type: 1 flags: 64	success	1
1619693973.66625 CryptExportKey	crypto_handle: 0x00635180 crypto_export_handle: 0x00635140 buffer: f¤ÉbrÝÄ®xHØûMôïr'²×>WG F&ØlL§Û¶0ûþö¦É#.uKO7(9\è¤kãÇM¢c§¼Ô}íÛñaOãÝ¹¨ü¹c®MÍ¯ÉàfC§ÎK blob_type: 1 flags: 64	success	1

The executable uses a known packer (1 个事件)

packer

Armadillo v1.71

HTTP traffic contains suspicious features which may be indicative of malware related traffic (1 个事件)

suspicious_features

POST method with no referer header

suspicious_request

POST https://update.googleapis.com/service/update2?cup2key=10:981287742&cup2hreq=ba3c5e36fea49c13557a12a13b06f1e061ef135321de666f7dc2df862ff9f488

Performs some HTTP requests (4 个事件)

request	HEAD http://redirector.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe
request	HEAD http://r1---sn-j5o7dn7e.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?cms_redirect=yes&mh=ms&mip=202.100.214.100&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619664735&mv=m&mvi=1&pl=23&shardbypass=yes
request	HEAD http://r3---sn-j5o7dn7e.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=3&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=a000f327d5a1e3cb&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619664735&mv=m
request	POST https://update.googleapis.com/service/update2?cup2key=10:981287742&cup2hreq=ba3c5e36fea49c13557a12a13b06f1e061ef135321de666f7dc2df862ff9f488

Sends data using the HTTP POST Method (1 个事件)

request

POST https://update.googleapis.com/service/update2?cup2key=10:981287742&cup2hreq=ba3c5e36fea49c13557a12a13b06f1e061ef135321de666f7dc2df862ff9f488

Allocates read-write-execute memory (usually to unpack itself) (3 个事件)

Time & API	Arguments	Status
1619693917.962498 NtAllocateVirtualMemory	process_identifier: 1888 region_size: 36864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00600000	success
1619693547.435146 NtAllocateVirtualMemory	process_identifier: 1424 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0000000004190000	success
1619693922.22925 NtAllocateVirtualMemory	process_identifier: 1908 region_size: 36864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x01d10000	success

Checks whether any human activity is being performed by constantly checking whether the foreground window changed

Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (9 个事件)

Time & API	Arguments	Status	Return
1619693922.32325 Process32NextW	process_name: wsqmcons.exe snapshot_handle: 0x0000014c process_identifier: 1380	success	1
1619693922.32325 Process32NextW	process_name: sdclt.exe snapshot_handle: 0x0000014c process_identifier: 3004	success	1
1619693922.32325 Process32NextW	process_name: 8827dfd90c7f1e9db50f41242a511867.exe snapshot_handle: 0x0000014c process_identifier: 1888	success	1
1619693922.32325 Process32NextW	process_name: compobj.exe snapshot_handle: 0x0000014c process_identifier: 1908	success	1
1619693963.13525 Process32NextW	process_name: mscorsvw.exe snapshot_handle: 0x000003b8 process_identifier: 1160	success	1
1619693968.66625 Process32NextW	process_name: mscorsvw.exe snapshot_handle: 0x000003b8 process_identifier: 2516	success	1
1619693968.66625 Process32NextW	process_name: GoogleUpdate.exe snapshot_handle: 0x000003b8 process_identifier: 1976	success	1
1619693968.66625 Process32NextW	process_name: sppsvc.exe snapshot_handle: 0x000003b8 process_identifier: 2152	success	1
1619693973.66625 Process32NextW	process_name: GoogleUpdate.exe snapshot_handle: 0x000003b8 process_identifier: 600	success	1

Moves the original executable to a new location (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619693919.322498 MoveFileWithProgressW	oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\8827dfd90c7f1e9db50f41242a511867.exe newfilepath: C:\Windows\SysWOW64\fms\compobj.exe newfilepath_r: C:\Windows\SysWOW64\fms\compobj.exe flags: 3 oldfilepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\8827dfd90c7f1e9db50f41242a511867.exe	success	1	0

Checks adapter addresses which can be used to detect virtual network interfaces (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619693936.40125 GetAdaptersAddresses	flags: 0 family: 0	failed	111	0

Expresses interest in specific running processes (1 个事件)

process

compobj.exe

Reads the systems User Agent and subsequently performs requests (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619693934.79125 InternetOpenW	proxy_bypass: access_type: 0 proxy_name: flags: 0 user_agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)	success	13369348	0

Communicates with host for which no DNS query was performed (5 个事件)

host	116.202.234.183
host	172.217.24.14
host	185.94.252.104
host	69.30.203.214
host	70.121.172.89

Installs itself for autorun at Windows startup (1 个事件)

service_name

compobj

service_path

C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\"C:\Windows\SysWOW64\fms\compobj.exe"

Created a service where a service was also not started (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619693921.603498 CreateServiceW	service_start_name: start_type: 2 service_handle: 0x02a974b0 display_name: compobj error_control: 0 service_name: compobj filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\"C:\Windows\SysWOW64\fms\compobj.exe" filepath_r: "C:\Windows\SysWOW64\fms\compobj.exe" service_manager_handle: 0x02a84900 desired_access: 2 service_type: 16 password:	success	44659888	0

Sets or modifies WPAD proxy autoconfiguration file for traffic interception (8 个事件)

Time & API	Arguments	Status
1619693938.99525 RegSetValueExA	key_handle: 0x000003b8 value: 1 regkey_r: WpadDecisionReason reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionReason	success
1619693938.99525 RegSetValueExA	key_handle: 0x000003b8 value: ¹®(·<× regkey_r: WpadDecisionTime reg_type: 3 (REG_BINARY) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionTime	success
1619693938.99525 RegSetValueExA	key_handle: 0x000003b8 value: 3 regkey_r: WpadDecision reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecision	success
1619693938.99525 RegSetValueExW	key_handle: 0x000003b8 value: 网络 2 regkey_r: WpadNetworkName reg_type: 1 (REG_SZ) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadNetworkName	success
1619693938.99525 RegSetValueExA	key_handle: 0x000003cc value: 1 regkey_r: WpadDecisionReason reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionReason	success
1619693938.99525 RegSetValueExA	key_handle: 0x000003cc value: ¹®(·<× regkey_r: WpadDecisionTime reg_type: 3 (REG_BINARY) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionTime	success
1619693938.99525 RegSetValueExA	key_handle: 0x000003cc value: 3 regkey_r: WpadDecision reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecision	success
1619693939.02625 RegSetValueExW	key_handle: 0x000003b4 value: {40112ABE-63B3-43C3-BE93-1440EE3AF106} regkey_r: WpadLastNetwork reg_type: 1 (REG_SZ) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\WpadLastNetwork	success

Attempts to remove evidence of file being downloaded from the Internet (1 个事件)

file	C:\Windows\SysWOW64\fms\compobj.exe:Zone.Identifier

Generates some ICMP traffic

File has been identified by 48 AntiVirus engines on VirusTotal as malicious (48 个事件)

Bkav	W32.PhorpiexUPL.Trojan
Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.GenericKDZ.69604
FireEye	Trojan.GenericKDZ.69604
ALYac	Trojan.Agent.Emotet
Cylance	Unsafe
K7AntiVirus	Trojan ( 005600f21 )
BitDefender	Trojan.GenericKDZ.69604
K7GW	Trojan ( 005600f21 )
Cyren	W32/Emotet.AQT.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Avast	Win32:Trojan-gen
ClamAV	Win.Packed.Generickdz-9481059-0
Kaspersky	HEUR:Backdoor.Win32.Emotet.vho
Alibaba	Trojan:Win32/Emotet.82e2477a
NANO-Antivirus	Trojan.Win32.Emotet.hsejql
ViRobot	Trojan.Win32.Emotet.315392.B
AegisLab	Trojan.Win32.Emotet.trtJ
Rising	Trojan.Kryptik!8.8 (TFE:5:3tSk2dAaYGU)
Ad-Aware	Trojan.GenericKDZ.69604
Comodo	Malware@#2ya1pthcmk1cb
DrWeb	Trojan.DownLoader34.26327
VIPRE	Trojan.Win32.Generic!BT
Invincea	Mal/Generic-R + Troj/Emotet-CLN
McAfee-GW-Edition	BehavesLike.Win32.Emotet.fh
Sophos	Troj/Emotet-CLN
Ikarus	Trojan-Banker.Emotet
GData	Trojan.GenericKDZ.69604
Jiangmin	Backdoor.Emotet.sa
Avira	TR/AD.Emotet.ichmm
Arcabit	Trojan.Generic.D10FE4
ZoneAlarm	HEUR:Backdoor.Win32.Emotet.vho
Microsoft	Trojan:Win32/Emotet.PED!MTB
TACHYON	Trojan/W32.Agent.315486.D
AhnLab-V3	Trojan/Win32.Emotet.R348891
McAfee	Emotet-FRV!8827DFD90C7F
MAX	malware (ai score=80)
VBA32	Trojan.Wacatac
Panda	Trj/Agent.AJS
ESET-NOD32	Win32/Emotet.CD
Tencent	Malware.Win32.Gencirc.10cdeb6c
Yandex	Trojan.Emotet!citwZ8KEllY
Fortinet	W32/Kryptik.HCEJ!tr
AVG	Win32:Trojan-gen
Paloalto	generic.ml
CrowdStrike	win/malicious_confidence_60% (W)
Qihoo-360	Win32/Backdoor.101

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (8 个事件)

dead_host	192.168.56.101:49191
dead_host	185.94.252.104:443
dead_host	192.168.56.101:49189
dead_host	70.121.172.89:80
dead_host	116.202.234.183:8080
dead_host	172.217.24.14:443
dead_host	69.30.203.214:8080
dead_host	172.217.160.78:443

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2020-08-21 02:02:34

Imports

Library KERNEL32.dll:

• 0x42e158 CreateEventA

• 0x42e15c lstrlenA

• 0x42e160 LoadResource

• 0x42e164 FindResourceA

• 0x42e168 LockResource

• 0x42e16c GlobalFree

• 0x42e170 GlobalUnlock

• 0x42e174 lstrcpyA

• 0x42e178 GlobalFindAtomA

• 0x42e17c GlobalAddAtomA

• 0x42e180 GlobalGetAtomNameA

• 0x42e184 lstrcatA

• 0x42e188 FreeLibrary

• 0x42e18c MulDiv

• 0x42e190 lstrcpynA

• 0x42e194 LocalFree

• 0x42e198 FormatMessageA

• 0x42e19c LocalAlloc

• 0x42e1a0 GlobalHandle

• 0x42e1a4 GlobalReAlloc

• 0x42e1a8 LocalReAlloc

• 0x42e1ac GlobalFlags

• 0x42e1b0 GetPrivateProfileIntA

• 0x42e1b4 GetPrivateProfileStringA

• 0x42e1b8 WritePrivateProfileStringA

• 0x42e1bc GetCurrentDirectoryA

• 0x42e1c0 GetProcessVersion

• 0x42e1c4 SizeofResource

• 0x42e1c8 SetErrorMode

• 0x42e1cc SuspendThread

• 0x42e1d0 CreateFileA

• 0x42e1d4 LockFile

• 0x42e1d8 UnlockFile

• 0x42e1dc SetEndOfFile

• 0x42e1e0 MoveFileA

• 0x42e1e4 DeleteFileA

• 0x42e1e8 FindClose

• 0x42e1ec FindFirstFileA

• 0x42e1f0 GetVolumeInformationA

• 0x42e1f4 GetFullPathNameA

• 0x42e1f8 GetStringTypeExA

• 0x42e1fc GetThreadLocale

• 0x42e200 GetShortPathNameA

• 0x42e204 GetFileAttributesA

• 0x42e208 GetFileSize

• 0x42e20c GetFileTime

• 0x42e210 LocalFileTimeToFileTime

• 0x42e214 SystemTimeToFileTime

• 0x42e218 SetFileTime

• 0x42e21c SetFileAttributesA

• 0x42e220 FileTimeToSystemTime

• 0x42e224 FileTimeToLocalFileTime

• 0x42e228 SetThreadPriority

• 0x42e22c ResumeThread

• 0x42e230 SetEvent

• 0x42e234 WaitForSingleObject

• 0x42e238 GetLocalTime

• 0x42e23c GetSystemTime

• 0x42e240 ExitThread

• 0x42e244 CreateThread

• 0x42e248 GetProfileStringA

• 0x42e24c GlobalLock

• 0x42e250 GlobalAlloc

• 0x42e254 GlobalDeleteAtom

• 0x42e258 lstrcmpA

• 0x42e25c lstrcmpiA

• 0x42e260 SetEnvironmentVariableA

• 0x42e264 CompareStringW

• 0x42e268 CompareStringA

• 0x42e26c GetLocaleInfoW

• 0x42e270 GetTimeZoneInformation

• 0x42e274 SetConsoleCtrlHandler

• 0x42e278 GetStringTypeW

• 0x42e27c GetStringTypeA

• 0x42e280 ReadFile

• 0x42e284 SetStdHandle

• 0x42e288 LoadLibraryA

• 0x42e28c GetProcAddress

• 0x42e290 GetOEMCP

• 0x42e294 GetACP

• 0x42e298 IsBadCodePtr

• 0x42e29c IsBadReadPtr

• 0x42e2a0 GetVersionExA

• 0x42e2a4 GetUserDefaultLCID

• 0x42e2a8 EnumSystemLocalesA

• 0x42e2ac GetLocaleInfoA

• 0x42e2b0 IsValidCodePage

• 0x42e2b4 IsValidLocale

• 0x42e2b8 GetCPInfo

• 0x42e2bc CloseHandle

• 0x42e2c0 FlushFileBuffers

• 0x42e2c4 SetFilePointer

• 0x42e2c8 SetUnhandledExceptionFilter

• 0x42e2cc WriteFile

• 0x42e2d0 GetFileType

• 0x42e2d4 GetStdHandle

• 0x42e2d8 SetHandleCount

• 0x42e2dc GetEnvironmentStringsW

• 0x42e2e0 GetEnvironmentStrings

• 0x42e2e4 FreeEnvironmentStringsW

• 0x42e2e8 FreeEnvironmentStringsA

• 0x42e2ec GetModuleFileNameA

• 0x42e2f0 UnhandledExceptionFilter

• 0x42e2f4 IsBadWritePtr

• 0x42e2f8 VirtualAlloc

• 0x42e2fc VirtualFree

• 0x42e300 HeapCreate

• 0x42e304 HeapDestroy

• 0x42e308 ExitProcess

• 0x42e30c LCMapStringW

• 0x42e310 LCMapStringA

• 0x42e314 WideCharToMultiByte

• 0x42e318 GetCurrentThread

• 0x42e31c GetLastError

• 0x42e320 TlsGetValue

• 0x42e324 SetLastError

• 0x42e328 TlsFree

• 0x42e32c TlsAlloc

• 0x42e330 TlsSetValue

• 0x42e334 GetCurrentThreadId

• 0x42e338 HeapSize

• 0x42e33c HeapReAlloc

• 0x42e340 GetCurrentProcess

• 0x42e344 TerminateProcess

• 0x42e348 FatalAppExitA

• 0x42e34c RaiseException

• 0x42e350 HeapFree

• 0x42e354 GetVersion

• 0x42e358 GetCommandLineA

• 0x42e35c GetStartupInfoA

• 0x42e360 GetModuleHandleA

• 0x42e364 HeapAlloc

• 0x42e368 RtlUnwind

• 0x42e36c MultiByteToWideChar

• 0x42e370 InterlockedIncrement

• 0x42e374 InterlockedDecrement

• 0x42e378 LeaveCriticalSection

• 0x42e37c DeleteCriticalSection

• 0x42e380 InterlockedExchange

• 0x42e384 InitializeCriticalSection

• 0x42e388 Sleep

• 0x42e38c EnterCriticalSection

• 0x42e390 DuplicateHandle

Library USER32.dll:

• 0x42e3a4 EndDeferWindowPos

• 0x42e3a8 CopyRect

• 0x42e3ac BeginDeferWindowPos

• 0x42e3b0 DeferWindowPos

• 0x42e3b4 EqualRect

• 0x42e3b8 ScreenToClient

• 0x42e3bc AdjustWindowRectEx

• 0x42e3c0 SetFocus

• 0x42e3c4 GetSysColor

• 0x42e3c8 MapWindowPoints

• 0x42e3cc SendDlgItemMessageA

• 0x42e3d0 UpdateWindow

• 0x42e3d4 CheckDlgButton

• 0x42e3d8 CheckRadioButton

• 0x42e3dc GetDlgItemInt

• 0x42e3e0 GetDlgItemTextA

• 0x42e3e4 SetDlgItemInt

• 0x42e3e8 SetDlgItemTextA

• 0x42e3ec IsDlgButtonChecked

• 0x42e3f0 ScrollWindowEx

• 0x42e3f4 IsDialogMessageA

• 0x42e3f8 SetWindowTextA

• 0x42e3fc MoveWindow

• 0x42e400 wvsprintfA

• 0x42e404 LoadStringA

• 0x42e408 DestroyMenu

• 0x42e40c ClientToScreen

• 0x42e410 GetDC

• 0x42e414 ReleaseDC

• 0x42e418 GetWindowDC

• 0x42e41c BeginPaint

• 0x42e420 EndPaint

• 0x42e424 TabbedTextOutA

• 0x42e428 DrawTextA

• 0x42e42c GrayStringA

• 0x42e430 GetClassNameA

• 0x42e434 PtInRect

• 0x42e438 GetDesktopWindow

• 0x42e43c InsertMenuA

• 0x42e440 DeleteMenu

• 0x42e444 GetMenuStringA

• 0x42e448 LoadCursorA

• 0x42e44c GetSysColorBrush

• 0x42e450 GetDialogBaseUnits

• 0x42e454 CharUpperA

• 0x42e458 UnregisterClassA

• 0x42e45c ShowScrollBar

• 0x42e460 GetScrollRange

• 0x42e464 SetScrollRange

• 0x42e468 GetScrollPos

• 0x42e46c SetScrollPos

• 0x42e470 GetTopWindow

• 0x42e474 IsChild

• 0x42e478 GetCapture

• 0x42e47c WinHelpA

• 0x42e480 wsprintfA

• 0x42e484 GetClassInfoA

• 0x42e488 RegisterClassA

• 0x42e48c GetMenu

• 0x42e490 GetMenuItemCount

• 0x42e494 GetSubMenu

• 0x42e498 GetMenuItemID

• 0x42e49c TrackPopupMenu

• 0x42e4a0 SetWindowPlacement

• 0x42e4a4 GetWindowTextLengthA

• 0x42e4a8 ScrollWindow

• 0x42e4ac GetDlgCtrlID

• 0x42e4b0 DefWindowProcA

• 0x42e4b4 CreateWindowExA

• 0x42e4b8 GetClassLongA

• 0x42e4bc SetPropA

• 0x42e4c0 UnhookWindowsHookEx

• 0x42e4c4 GetPropA

• 0x42e4c8 CallWindowProcA

• 0x42e4cc RemovePropA

• 0x42e4d0 GetMessageTime

• 0x42e4d4 GetMessagePos

• 0x42e4d8 GetForegroundWindow

• 0x42e4dc SetForegroundWindow

• 0x42e4e0 GetWindow

• 0x42e4e4 SetWindowPos

• 0x42e4e8 RegisterWindowMessageA

• 0x42e4ec OffsetRect

• 0x42e4f0 IntersectRect

• 0x42e4f4 SystemParametersInfoA

• 0x42e4f8 GetWindowPlacement

• 0x42e4fc EndDialog

• 0x42e500 SetActiveWindow

• 0x42e504 IsWindow

• 0x42e508 CreateDialogIndirectParamA

• 0x42e50c DestroyWindow

• 0x42e510 GetDlgItem

• 0x42e514 OemToCharA

• 0x42e518 CharToOemA

• 0x42e51c GetMenuCheckMarkDimensions

• 0x42e520 LoadBitmapA

• 0x42e524 GetMenuState

• 0x42e528 ModifyMenuA

• 0x42e52c SetMenuItemBitmaps

• 0x42e530 CheckMenuItem

• 0x42e534 EnableMenuItem

• 0x42e538 GetFocus

• 0x42e53c GetNextDlgTabItem

• 0x42e540 GetMessageA

• 0x42e544 TranslateMessage

• 0x42e548 DispatchMessageA

• 0x42e54c GetActiveWindow

• 0x42e550 GetKeyState

• 0x42e554 CallNextHookEx

• 0x42e558 ValidateRect

• 0x42e55c IsWindowVisible

• 0x42e560 PeekMessageA

• 0x42e564 GetCursorPos

• 0x42e568 SetWindowsHookExA

• 0x42e56c GetParent

• 0x42e570 GetLastActivePopup

• 0x42e574 LoadIconA

• 0x42e578 ShowWindow

• 0x42e57c SendMessageA

• 0x42e580 AppendMenuA

• 0x42e584 HideCaret

• 0x42e588 ShowCaret

• 0x42e58c ExcludeUpdateRgn

• 0x42e590 DrawFocusRect

• 0x42e594 IsWindowEnabled

• 0x42e598 GetWindowLongA

• 0x42e59c MessageBoxA

• 0x42e5a0 SetCursor

• 0x42e5a4 ShowOwnedPopups

• 0x42e5a8 PostMessageA

• 0x42e5ac PostQuitMessage

• 0x42e5b0 EnableWindow

• 0x42e5b4 InvalidateRect

• 0x42e5b8 GetScrollInfo

• 0x42e5bc GetWindowTextA

• 0x42e5c0 SetScrollInfo

• 0x42e5c4 IsRectEmpty

• 0x42e5c8 GetWindowRect

• 0x42e5cc IsIconic

• 0x42e5d0 GetSystemMetrics

• 0x42e5d4 GetClientRect

• 0x42e5d8 DrawIcon

• 0x42e5dc GetSystemMenu

• 0x42e5e0 IsWindowUnicode

• 0x42e5e4 CharNextA

• 0x42e5e8 InflateRect

• 0x42e5ec DefDlgProcA

• 0x42e5f0 SetWindowLongA

Library GDI32.dll:

• 0x42e02c GetStockObject

• 0x42e030 SelectPalette

• 0x42e034 SetBkMode

• 0x42e038 SetPolyFillMode

• 0x42e03c SetROP2

• 0x42e040 SetStretchBltMode

• 0x42e044 SetMapMode

• 0x42e048 SetViewportOrgEx

• 0x42e04c OffsetViewportOrgEx

• 0x42e050 SetViewportExtEx

• 0x42e054 ScaleViewportExtEx

• 0x42e058 SetWindowOrgEx

• 0x42e05c OffsetWindowOrgEx

• 0x42e060 SetWindowExtEx

• 0x42e064 ScaleWindowExtEx

• 0x42e068 SelectClipRgn

• 0x42e06c ExcludeClipRect

• 0x42e070 IntersectClipRect

• 0x42e074 OffsetClipRgn

• 0x42e078 MoveToEx

• 0x42e07c LineTo

• 0x42e080 SetTextAlign

• 0x42e084 SetTextJustification

• 0x42e088 SetTextCharacterExtra

• 0x42e08c SetMapperFlags

• 0x42e090 GetCurrentPositionEx

• 0x42e094 ArcTo

• 0x42e098 SetArcDirection

• 0x42e09c PolyDraw

• 0x42e0a0 SelectObject

• 0x42e0a4 SetColorAdjustment

• 0x42e0a8 PolyBezierTo

• 0x42e0ac DeleteObject

• 0x42e0b0 GetClipRgn

• 0x42e0b4 CreateRectRgn

• 0x42e0b8 SelectClipPath

• 0x42e0bc ExtSelectClipRgn

• 0x42e0c0 PlayMetaFileRecord

• 0x42e0c4 GetObjectType

• 0x42e0c8 EnumMetaFile

• 0x42e0cc PlayMetaFile

• 0x42e0d0 GetDeviceCaps

• 0x42e0d4 GetViewportExtEx

• 0x42e0d8 GetWindowExtEx

• 0x42e0dc CreatePen

• 0x42e0e0 ExtCreatePen

• 0x42e0e4 CreateSolidBrush

• 0x42e0e8 CreateHatchBrush

• 0x42e0ec CreatePatternBrush

• 0x42e0f0 CreateDIBPatternBrushPt

• 0x42e0f4 PtVisible

• 0x42e0f8 RectVisible

• 0x42e0fc TextOutA

• 0x42e100 ExtTextOutA

• 0x42e104 Escape

• 0x42e108 GetTextExtentPoint32A

• 0x42e10c GetTextMetricsA

• 0x42e110 CreateFontIndirectA

• 0x42e114 RestoreDC

• 0x42e118 SaveDC

• 0x42e11c StartDocA

• 0x42e120 DeleteDC

• 0x42e124 GetObjectA

• 0x42e128 SetBkColor

• 0x42e12c SetTextColor

• 0x42e130 GetClipBox

• 0x42e134 GetDCOrgEx

• 0x42e138 PolylineTo

• 0x42e13c CreateDIBitmap

• 0x42e140 PatBlt

• 0x42e144 GetTextExtentPointA

• 0x42e148 BitBlt

• 0x42e14c CreateCompatibleDC

• 0x42e150 CreateBitmap

Library comdlg32.dll:

• 0x42e608 GetOpenFileNameA

• 0x42e60c GetSaveFileNameA

• 0x42e610 GetFileTitleA

Library WINSPOOL.DRV:

• 0x42e5f8 OpenPrinterA

• 0x42e5fc DocumentPropertiesA

• 0x42e600 ClosePrinter

Library ADVAPI32.dll:

• 0x42e000 RegSetValueExA

• 0x42e004 RegOpenKeyA

• 0x42e008 RegDeleteKeyA

• 0x42e00c RegDeleteValueA

• 0x42e010 RegCloseKey

• 0x42e014 RegQueryValueExA

• 0x42e018 RegOpenKeyExA

• 0x42e01c RegCreateKeyExA

Library SHELL32.dll:

• 0x42e398 DragAcceptFiles

• 0x42e39c SHGetFileInfoA

Library COMCTL32.dll:

• 0x42e024

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
r3---sn-j5o7dn7e.gvt1.com	CNAME r3.sn-j5o7dn7e.gvt1.com A 113.108.239.196	113.108.239.196
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
clients2.google.com	A 172.217.160.78 CNAME clients.l.google.com	216.58.200.238
r1---sn-j5o7dn7e.gvt1.com	A 113.108.239.194 CNAME r1.sn-j5o7dn7e.gvt1.com	113.108.239.194
redirector.gvt1.com	A 203.208.41.65	203.208.41.33
update.googleapis.com	A 203.208.41.34	203.208.41.34
teredo.ipv6.microsoft.com		127.0.0.1

TCP

Source	Source Port	Destination	Destination Port
192.168.56.101	49195	113.108.239.194 r1---sn-j5o7dn7e.gvt1.com	80
192.168.56.101	49196	113.108.239.196 r3---sn-j5o7dn7e.gvt1.com	80
192.168.56.101	49192	203.208.41.34 update.googleapis.com	443
192.168.56.101	49194	203.208.41.65 redirector.gvt1.com	80

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	50568	114.114.114.114	53
192.168.56.101	51963	114.114.114.114	53
192.168.56.101	53657	114.114.114.114	53
192.168.56.101	54178	114.114.114.114	53
192.168.56.101	54260	114.114.114.114	53
192.168.56.101	54991	114.114.114.114	53
192.168.56.101	58070	114.114.114.114	53
192.168.56.101	60123	114.114.114.114	53
192.168.56.101	60215	114.114.114.114	53
192.168.56.101	63429	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	49235	224.0.0.252	5355
192.168.56.101	50002	224.0.0.252	5355
192.168.56.101	50534	224.0.0.252	5355
192.168.56.101	51808	224.0.0.252	5355
192.168.56.101	53210	224.0.0.252	5355
192.168.56.101	53500	224.0.0.252	5355
192.168.56.101	56539	224.0.0.252	5355

HTTP & HTTPS Requests

URI	Data
http://redirector.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe	HEAD /edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.5 X-Old-UID: cnt=0 X-Last-HR: 0x0 X-Last-HTTP-Status-Code: 0 X-Retry-Count: 0 X-HTTP-Attempts: 1 Host: redirector.gvt1.com
http://r3---sn-j5o7dn7e.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=3&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=a000f327d5a1e3cb&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619664735&mv=m	HEAD /edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=3&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=a000f327d5a1e3cb&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619664735&mv=m HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.5 X-Old-UID: cnt=0 X-Last-HR: 0x0 X-Last-HTTP-Status-Code: 0 X-Retry-Count: 0 X-HTTP-Attempts: 1 Host: r3---sn-j5o7dn7e.gvt1.com
http://r1---sn-j5o7dn7e.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?cms_redirect=yes&mh=ms&mip=202.100.214.100&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619664735&mv=m&mvi=1&pl=23&shardbypass=yes	HEAD /edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?cms_redirect=yes&mh=ms&mip=202.100.214.100&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619664735&mv=m&mvi=1&pl=23&shardbypass=yes HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.5 X-Old-UID: cnt=0 X-Last-HR: 0x0 X-Last-HTTP-Status-Code: 0 X-Retry-Count: 0 X-HTTP-Attempts: 1 Host: r1---sn-j5o7dn7e.gvt1.com

URI

Data

http://redirector.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe

HEAD /edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
User-Agent: Microsoft BITS/7.5
X-Old-UID: cnt=0
X-Last-HR: 0x0
X-Last-HTTP-Status-Code: 0
X-Retry-Count: 0
X-HTTP-Attempts: 1
Host: redirector.gvt1.com

http://r3---sn-j5o7dn7e.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=3&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=a000f327d5a1e3cb&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619664735&mv=m

HEAD /edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=3&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=a000f327d5a1e3cb&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619664735&mv=m HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
User-Agent: Microsoft BITS/7.5
X-Old-UID: cnt=0
X-Last-HR: 0x0
X-Last-HTTP-Status-Code: 0
X-Retry-Count: 0
X-HTTP-Attempts: 1
Host: r3---sn-j5o7dn7e.gvt1.com

http://r1---sn-j5o7dn7e.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?cms_redirect=yes&mh=ms&mip=202.100.214.100&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619664735&mv=m&mvi=1&pl=23&shardbypass=yes

HEAD /edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?cms_redirect=yes&mh=ms&mip=202.100.214.100&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619664735&mv=m&mvi=1&pl=23&shardbypass=yes HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
User-Agent: Microsoft BITS/7.5
X-Old-UID: cnt=0
X-Last-HR: 0x0
X-Last-HTTP-Status-Code: 0
X-Retry-Count: 0
X-HTTP-Attempts: 1
Host: r1---sn-j5o7dn7e.gvt1.com

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.