SmartHawk

10.8

0-day

51 个模型检测该样本为恶意！

重新分析

下载样本

c9fd4c3958a4814467ee8ed424d5fe5bc35cb5609317331dbf0734f12d8bdeb6

bb4865408eadbea6489e83b00dadadaa.exe

分析耗时

129s

最近分析

文件大小

436.0KB

静态报毒动态报毒 1CDBGKB 3QPQ8BCDBJK AI SCORE=100 AIDETECTVM BSCOPE CJQI ELDORADO EMOTET GENCIRC GENERICKDZ GENETIC GENKRYPTIK HCEJ HIGH CONFIDENCE HSIVUE HYNAMER KRYPTIK MALWARE1 R + TROJ SCORE SUSGEN THIOGBO UNSAFE XRYYI 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
McAfee	Emotet-FRV!BB4865408EAD	20200913	6.0.6.653
Alibaba	Trojan:Win32/Emotet.3b0395f4	20190527	0.3.0.5
Baidu		20190318	1.0.0.2
Kingsoft		20200914	2013.8.14.323
Tencent	Malware.Win32.Gencirc.10cde9da	20200914	1.0.0.1
CrowdStrike		20190702	1.0

Queries for the computername (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619895292.436626 GetComputerNameA	computer_name: OSKAR-PC	success	1	0

Uses Windows APIs to generate a cryptographic key (6 个事件)

Time & API	Arguments	Status	Return
1619895280.905626 CryptGenKey	crypto_handle: 0x0058b4f0 algorithm_identifier: 0x0000660e () provider_handle: 0x0058aa98 flags: 1 key: fFèP4+ÉÈ+Ý$Ù	success	1
1619895292.436626 CryptExportKey	crypto_handle: 0x0058b4f0 crypto_export_handle: 0x0058b398 buffer: f¤¯úZè¥pW¤&v¦þÓtÒÞÿËÛPïJÅÊÀÚ0qÐª2³!ªçZÀ³C«àÎfG?ÉUú¯¬´mcM<Z®äõùÊ;ÂÙßåI·NÍ*>ú`q°&Ë© blob_type: 1 flags: 64	success	1
1619895319.796626 CryptExportKey	crypto_handle: 0x0058b4f0 crypto_export_handle: 0x0058b398 buffer: f¤£·ZeãÞÀÑí7°ÐùéÖMUªBÃ(°±Íñì4ùÒ®à]Ö÷Wª b8ì=áìþq`(8GHªhTXÄÝínYüðfÝä>6. blob_type: 1 flags: 64	success	1
1619895323.608626 CryptExportKey	crypto_handle: 0x0058b4f0 crypto_export_handle: 0x0058b398 buffer: f¤ò\|¶î÷§×ÝªÈçÕ3?L¢÷úGÁp¦¼#È\ ËØwtr¾R"Æ3ÜRV²¥®q&Í>IvªFJ_:-i>¿kKK^q]ùÃÍ¥J®±5¨Ìu blob_type: 1 flags: 64	success	1
1619895329.233626 CryptExportKey	crypto_handle: 0x0058b4f0 crypto_export_handle: 0x0058b398 buffer: f¤¬^Bhð@Yç ¢w0vÏ=½ ne I×E\|ß0Ñ\|T7¯36Wø«iÑ8,nWAëóÁõP§-¬¦7Þ¿<ä¨Â~ë£$5£ blob_type: 1 flags: 64	success	1
1619895353.249626 CryptExportKey	crypto_handle: 0x0058b4f0 crypto_export_handle: 0x0058b398 buffer: f¤xÄ^5´o,\|X\/GæG¾`ÔùÏÊ9B¯)°9ø2ó4WXs%Á±;\W«<0æ^¥£AÛËX>Åu)¾ºói"euônÐÍþ®©ÖóC4Ø'\ blob_type: 1 flags: 64	success	1

The executable uses a known packer (1 个事件)

packer

Armadillo v1.71

HTTP traffic contains suspicious features which may be indicative of malware related traffic (1 个事件)

suspicious_features

POST method with no referer header

suspicious_request

POST https://update.googleapis.com/service/update2?cup2key=10:326914886&cup2hreq=c217f08f56f4ac674b30d3672fad556b7074bdb979f5227f51f085858968d086

Performs some HTTP requests (4 个事件)

request	HEAD http://redirector.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe
request	HEAD http://r1---sn-j5o7dn7e.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?cms_redirect=yes&mh=ms&mip=202.100.214.100&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619866341&mv=m&mvi=1&pl=23&shardbypass=yes
request	HEAD http://r3---sn-j5o7dn7e.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=3&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=cda8403cc637f4c6&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619866101&mv=m
request	POST https://update.googleapis.com/service/update2?cup2key=10:326914886&cup2hreq=c217f08f56f4ac674b30d3672fad556b7074bdb979f5227f51f085858968d086

Sends data using the HTTP POST Method (1 个事件)

request

POST https://update.googleapis.com/service/update2?cup2key=10:326914886&cup2hreq=c217f08f56f4ac674b30d3672fad556b7074bdb979f5227f51f085858968d086

Allocates read-write-execute memory (usually to unpack itself) (3 个事件)

Time & API	Arguments	Status
1619895274.421125 NtAllocateVirtualMemory	process_identifier: 1056 region_size: 36864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x01cf0000	success
1619895325.671501 NtAllocateVirtualMemory	process_identifier: 1424 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00000000040b0000	success
1619895280.639626 NtAllocateVirtualMemory	process_identifier: 2960 region_size: 36864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00530000	success

Checks whether any human activity is being performed by constantly checking whether the foreground window changed

Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619895353.249626 Process32NextW	process_name: inject-x64.exe snapshot_handle: 0x00000318 process_identifier: 692	success	1	0

Moves the original executable to a new location (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619895275.452125 MoveFileWithProgressW	oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\bb4865408eadbea6489e83b00dadadaa.exe newfilepath: C:\Windows\SysWOW64\NlsData001d\comcat.exe newfilepath_r: C:\Windows\SysWOW64\NlsData001d\comcat.exe flags: 3 oldfilepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\bb4865408eadbea6489e83b00dadadaa.exe	success	1	0

Checks adapter addresses which can be used to detect virtual network interfaces (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619895292.983626 GetAdaptersAddresses	flags: 0 family: 0	failed	111	0

Expresses interest in specific running processes (1 个事件)

process

comcat.exe

Reads the systems User Agent and subsequently performs requests (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619895292.671626 InternetOpenW	proxy_bypass: access_type: 0 proxy_name: flags: 0 user_agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)	success	13369348	0

Uses Windows utilities for basic Windows functionality (1 个事件)

cmdline

C:\Windows\SysWOW64\NlsData001d\comcat.exe

Communicates with host for which no DNS query was performed (7 个事件)

host	116.202.234.183
host	172.217.24.14
host	185.94.252.104
host	64.183.73.122
host	69.30.203.214
host	70.121.172.89
host	203.208.41.66

Installs itself for autorun at Windows startup (1 个事件)

service_name

comcat

service_path

C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\"C:\Windows\SysWOW64\NlsData001d\comcat.exe"

Created a service where a service was also not started (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619895276.483125 CreateServiceW	service_start_name: start_type: 2 service_handle: 0x02b535b0 display_name: comcat error_control: 0 service_name: comcat filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\"C:\Windows\SysWOW64\NlsData001d\comcat.exe" filepath_r: "C:\Windows\SysWOW64\NlsData001d\comcat.exe" service_manager_handle: 0x02b4f3b8 desired_access: 2 service_type: 16 password:	success	45430192	0

Sets or modifies WPAD proxy autoconfiguration file for traffic interception (8 个事件)

Time & API	Arguments	Status
1619895295.546626 RegSetValueExA	key_handle: 0x000003c0 value: 1 regkey_r: WpadDecisionReason reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionReason	success
1619895295.546626 RegSetValueExA	key_handle: 0x000003c0 value: ÉH/>× regkey_r: WpadDecisionTime reg_type: 3 (REG_BINARY) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionTime	success
1619895295.546626 RegSetValueExA	key_handle: 0x000003c0 value: 3 regkey_r: WpadDecision reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecision	success
1619895295.546626 RegSetValueExW	key_handle: 0x000003c0 value: 网络 2 regkey_r: WpadNetworkName reg_type: 1 (REG_SZ) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadNetworkName	success
1619895295.546626 RegSetValueExA	key_handle: 0x000003d8 value: 1 regkey_r: WpadDecisionReason reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionReason	success
1619895295.546626 RegSetValueExA	key_handle: 0x000003d8 value: ÉH/>× regkey_r: WpadDecisionTime reg_type: 3 (REG_BINARY) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionTime	success
1619895295.546626 RegSetValueExA	key_handle: 0x000003d8 value: 3 regkey_r: WpadDecision reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecision	success
1619895295.546626 RegSetValueExW	key_handle: 0x000003bc value: {40112ABE-63B3-43C3-BE93-1440EE3AF106} regkey_r: WpadLastNetwork reg_type: 1 (REG_SZ) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\WpadLastNetwork	success

Attempts to remove evidence of file being downloaded from the Internet (1 个事件)

file	C:\Windows\SysWOW64\NlsData001d\comcat.exe:Zone.Identifier

File has been identified by 51 AntiVirus engines on VirusTotal as malicious (50 out of 51 个事件)

Bkav	W32.AIDetectVM.malware1
Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.GenericKDZ.69579
FireEye	Generic.mg.bb4865408eadbea6
CAT-QuickHeal	Trojan.Emotet
McAfee	Emotet-FRV!BB4865408EAD
Cylance	Unsafe
Zillya	Trojan.Emotet.Win32.24748
K7AntiVirus	Riskware ( 0040eff71 )
Alibaba	Trojan:Win32/Emotet.3b0395f4
K7GW	Riskware ( 0040eff71 )
Arcabit	Trojan.Generic.D10FCB
Invincea	Mal/Generic-R + Troj/Emotet-CLK
Cyren	W32/Emotet.AQO.gen!Eldorado
Symantec	Trojan.Emotet
APEX	Malicious
Cynet	Malicious (score: 85)
Kaspersky	Backdoor.Win32.Emotet.cjqi
BitDefender	Trojan.GenericKDZ.69579
NANO-Antivirus	Trojan.Win32.Emotet.hsivue
AegisLab	Trojan.Win32.Generic.4!c
Rising	Trojan.Kryptik!8.8 (TFE:5:3QPq8bCDbJK)
Ad-Aware	Trojan.GenericKDZ.69579
F-Secure	Trojan.TR/Emotet.xryyi
DrWeb	Trojan.Emotet.1003
VIPRE	Trojan.Win32.Generic!BT
TrendMicro	TrojanSpy.Win32.EMOTET.THIOGBO
Sophos	Troj/Emotet-CLK
Jiangmin	Backdoor.Emotet.se
Avira	TR/Emotet.xryyi
MAX	malware (ai score=100)
Antiy-AVL	Trojan/Win32.Emotet
Microsoft	Trojan:Win32/Emotet.PED!MTB
ViRobot	Trojan.Win32.Z.Emotet.446464.CN
ZoneAlarm	Backdoor.Win32.Emotet.cjqi
GData	Win32.Trojan.PSE.1CDBGKB
AhnLab-V3	Trojan/Win32.Emotet.C4183466
VBA32	BScope.Trojan.Hynamer
ALYac	Trojan.GenericKDZ.69579
TACHYON	Trojan/W32.Agent.446464.WF
Malwarebytes	Trojan.Emotet
ESET-NOD32	Win32/Emotet.CD
TrendMicro-HouseCall	TrojanSpy.Win32.EMOTET.THIOGBO
Tencent	Malware.Win32.Gencirc.10cde9da
Yandex	Trojan.GenKryptik!
Ikarus	Trojan-Banker.Emotet
MaxSecure	Trojan.Malware.105527951.susgen
Fortinet	W32/Kryptik.HCEJ!tr
AVG	Win32:Trojan-gen
Panda	Trj/Genetic.gen

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (9 个事件)

dead_host	172.217.160.110:443
dead_host	192.168.56.101:49188
dead_host	172.217.27.142:443
dead_host	185.94.252.104:443
dead_host	172.217.24.14:443
dead_host	116.202.234.183:8080
dead_host	69.30.203.214:8080
dead_host	192.168.56.101:49186
dead_host	70.121.172.89:80

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2020-08-20 02:22:34

Imports

Library KERNEL32.dll:

• 0x459c4c RtlUnwind

• 0x459c50 HeapAlloc

• 0x459c54 GetStartupInfoA

• 0x459c58 GetCommandLineA

• 0x459c5c RaiseException

• 0x459c60 HeapFree

• 0x459c64 TerminateProcess

• 0x459c68 CreateThread

• 0x459c6c ExitThread

• 0x459c70 HeapReAlloc

• 0x459c74 HeapSize

• 0x459c78 GetACP

• 0x459c7c GetTimeZoneInformation

• 0x459c80 GetSystemTime

• 0x459c84 GetLocalTime

• 0x459c88 FatalAppExitA

• 0x459c8c LCMapStringA

• 0x459c90 LCMapStringW

• 0x459c94 Sleep

• 0x459c98 HeapDestroy

• 0x459c9c HeapCreate

• 0x459ca0 VirtualFree

• 0x459ca4 VirtualAlloc

• 0x459ca8 IsBadWritePtr

• 0x459cac UnhandledExceptionFilter

• 0x459cb0 FreeEnvironmentStringsA

• 0x459cb4 FileTimeToLocalFileTime

• 0x459cb8 GetEnvironmentStrings

• 0x459cbc GetEnvironmentStringsW

• 0x459cc0 SetHandleCount

• 0x459cc4 GetStdHandle

• 0x459cc8 GetFileType

• 0x459ccc SetUnhandledExceptionFilter

• 0x459cd0 GetStringTypeA

• 0x459cd4 GetStringTypeW

• 0x459cd8 IsBadReadPtr

• 0x459cdc IsBadCodePtr

• 0x459ce0 IsValidLocale

• 0x459ce4 IsValidCodePage

• 0x459ce8 GetLocaleInfoA

• 0x459cec EnumSystemLocalesA

• 0x459cf0 GetUserDefaultLCID

• 0x459cf4 GetVersionExA

• 0x459cf8 SetConsoleCtrlHandler

• 0x459cfc GetLocaleInfoW

• 0x459d00 CompareStringA

• 0x459d04 CompareStringW

• 0x459d08 SetEnvironmentVariableA

• 0x459d0c FileTimeToSystemTime

• 0x459d10 SetFileAttributesA

• 0x459d14 SetFileTime

• 0x459d18 SetStdHandle

• 0x459d1c GetProfileStringA

• 0x459d20 InterlockedExchange

• 0x459d24 SystemTimeToFileTime

• 0x459d28 LocalFileTimeToFileTime

• 0x459d2c GetFileTime

• 0x459d30 GetFileSize

• 0x459d34 GetFileAttributesA

• 0x459d38 GetShortPathNameA

• 0x459d3c GetThreadLocale

• 0x459d40 GetStringTypeExA

• 0x459d44 GetFullPathNameA

• 0x459d48 GetVolumeInformationA

• 0x459d4c FindFirstFileA

• 0x459d50 FindClose

• 0x459d54 DeleteFileA

• 0x459d58 MoveFileA

• 0x459d5c SetEndOfFile

• 0x459d60 UnlockFile

• 0x459d64 LockFile

• 0x459d68 FlushFileBuffers

• 0x459d6c SetFilePointer

• 0x459d70 WriteFile

• 0x459d74 ReadFile

• 0x459d78 CreateFileA

• 0x459d7c GetCurrentProcess

• 0x459d80 DuplicateHandle

• 0x459d84 SetErrorMode

• 0x459d88 WritePrivateProfileStringA

• 0x459d8c GetPrivateProfileStringA

• 0x459d90 GetPrivateProfileIntA

• 0x459d94 GetOEMCP

• 0x459d98 GetCPInfo

• 0x459d9c GetProcessVersion

• 0x459da0 TlsGetValue

• 0x459da4 LocalReAlloc

• 0x459da8 TlsSetValue

• 0x459dac EnterCriticalSection

• 0x459db0 GlobalReAlloc

• 0x459db4 LeaveCriticalSection

• 0x459db8 TlsFree

• 0x459dbc GlobalHandle

• 0x459dc0 DeleteCriticalSection

• 0x459dc4 TlsAlloc

• 0x459dc8 InitializeCriticalSection

• 0x459dcc LocalFree

• 0x459dd0 LocalAlloc

• 0x459dd4 SizeofResource

• 0x459dd8 GetLastError

• 0x459ddc GlobalFlags

• 0x459de0 lstrcpynA

• 0x459de4 SetLastError

• 0x459de8 CreateEventA

• 0x459dec SuspendThread

• 0x459df0 SetThreadPriority

• 0x459df4 ResumeThread

• 0x459df8 SetEvent

• 0x459dfc WaitForSingleObject

• 0x459e00 CloseHandle

• 0x459e04 GetModuleFileNameA

• 0x459e08 GlobalAlloc

• 0x459e0c lstrcmpA

• 0x459e10 GetCurrentThread

• 0x459e14 MultiByteToWideChar

• 0x459e18 WideCharToMultiByte

• 0x459e1c lstrlenA

• 0x459e20 InterlockedDecrement

• 0x459e24 InterlockedIncrement

• 0x459e28 MulDiv

• 0x459e2c GetVersion

• 0x459e30 lstrcatA

• 0x459e34 GetCurrentThreadId

• 0x459e38 GlobalGetAtomNameA

• 0x459e3c lstrcmpiA

• 0x459e40 GlobalAddAtomA

• 0x459e44 GlobalFindAtomA

• 0x459e48 GlobalDeleteAtom

• 0x459e4c lstrcpyA

• 0x459e50 GetModuleHandleA

• 0x459e54 GetProcAddress

• 0x459e58 GlobalLock

• 0x459e5c GlobalUnlock

• 0x459e60 GlobalFree

• 0x459e64 LockResource

• 0x459e68 FindResourceA

• 0x459e6c LoadResource

• 0x459e70 WinExec

• 0x459e74 GetWindowsDirectoryA

• 0x459e78 LoadLibraryA

• 0x459e7c FreeLibrary

• 0x459e80 ExitProcess

• 0x459e84 GetCurrentDirectoryA

• 0x459e88 FreeEnvironmentStringsW

Library USER32.dll:

• 0x459f84 GetDlgItemInt

• 0x459f88 GetDlgItemTextA

• 0x459f8c SetDlgItemInt

• 0x459f90 SetDlgItemTextA

• 0x459f94 IsDlgButtonChecked

• 0x459f98 ScrollWindowEx

• 0x459f9c IsDialogMessageA

• 0x459fa0 EnableMenuItem

• 0x459fa4 CheckMenuItem

• 0x459fa8 SetMenuItemBitmaps

• 0x459fac ModifyMenuA

• 0x459fb0 GetMenuState

• 0x459fb4 LoadBitmapA

• 0x459fb8 GetMenuCheckMarkDimensions

• 0x459fbc wvsprintfA

• 0x459fc0 CharToOemA

• 0x459fc4 OemToCharA

• 0x459fc8 LoadStringA

• 0x459fcc PostQuitMessage

• 0x459fd0 ShowOwnedPopups

• 0x459fd4 GetCursorPos

• 0x459fd8 ValidateRect

• 0x459fdc TranslateMessage

• 0x459fe0 GetMessageA

• 0x459fe4 ClientToScreen

• 0x459fe8 GetWindowDC

• 0x459fec BeginPaint

• 0x459ff0 EndPaint

• 0x459ff4 TabbedTextOutA

• 0x459ff8 DrawTextA

• 0x459ffc GrayStringA

• 0x45a000 DestroyMenu

• 0x45a004 WindowFromPoint

• 0x45a008 GetClassNameA

• 0x45a00c GetDesktopWindow

• 0x45a010 GetDialogBaseUnits

• 0x45a014 GetSysColorBrush

• 0x45a018 SetCapture

• 0x45a01c ReleaseCapture

• 0x45a020 WaitMessage

• 0x45a024 GetWindowThreadProcessId

• 0x45a028 InsertMenuA

• 0x45a02c DeleteMenu

• 0x45a030 GetMenuStringA

• 0x45a034 SetRectEmpty

• 0x45a038 LoadAcceleratorsA

• 0x45a03c TranslateAcceleratorA

• 0x45a040 LoadMenuA

• 0x45a044 SetMenu

• 0x45a048 ReuseDDElParam

• 0x45a04c UnpackDDElParam

• 0x45a050 BringWindowToTop

• 0x45a054 CharUpperA

• 0x45a058 EqualRect

• 0x45a05c DeferWindowPos

• 0x45a060 BeginDeferWindowPos

• 0x45a064 CopyRect

• 0x45a068 EndDeferWindowPos

• 0x45a06c IsWindowVisible

• 0x45a070 ScrollWindow

• 0x45a074 GetScrollInfo

• 0x45a078 SetScrollInfo

• 0x45a07c ShowScrollBar

• 0x45a080 GetScrollRange

• 0x45a084 SetScrollRange

• 0x45a088 GetScrollPos

• 0x45a08c SetScrollPos

• 0x45a090 GetTopWindow

• 0x45a094 MessageBoxA

• 0x45a098 IsChild

• 0x45a09c GetCapture

• 0x45a0a0 WinHelpA

• 0x45a0a4 CheckRadioButton

• 0x45a0a8 GetClassInfoA

• 0x45a0ac RegisterClassA

• 0x45a0b0 GetMenu

• 0x45a0b4 GetMenuItemCount

• 0x45a0b8 GetMenuItemID

• 0x45a0bc TrackPopupMenu

• 0x45a0c0 SetWindowPlacement

• 0x45a0c4 GetWindowTextLengthA

• 0x45a0c8 GetWindowTextA

• 0x45a0cc GetDlgCtrlID

• 0x45a0d0 GetKeyState

• 0x45a0d4 DefWindowProcA

• 0x45a0d8 CreateWindowExA

• 0x45a0dc SetWindowsHookExA

• 0x45a0e0 CallNextHookEx

• 0x45a0e4 GetClassLongA

• 0x45a0e8 SetPropA

• 0x45a0ec UnhookWindowsHookEx

• 0x45a0f0 GetPropA

• 0x45a0f4 CallWindowProcA

• 0x45a0f8 RemovePropA

• 0x45a0fc GetMessageTime

• 0x45a100 GetLastActivePopup

• 0x45a104 GetForegroundWindow

• 0x45a108 SetForegroundWindow

• 0x45a10c GetWindow

• 0x45a110 SetWindowPos

• 0x45a114 OffsetRect

• 0x45a118 IntersectRect

• 0x45a11c SystemParametersInfoA

• 0x45a120 GetWindowPlacement

• 0x45a124 GetNextDlgTabItem

• 0x45a128 EndDialog

• 0x45a12c GetActiveWindow

• 0x45a130 SetActiveWindow

• 0x45a134 CreateDialogIndirectParamA

• 0x45a138 DestroyWindow

• 0x45a13c IsWindowEnabled

• 0x45a140 GetParent

• 0x45a144 KillTimer

• 0x45a148 SetTimer

• 0x45a14c InvalidateRect

• 0x45a150 ReleaseDC

• 0x45a154 GetDC

• 0x45a158 InflateRect

• 0x45a15c PtInRect

• 0x45a160 LoadCursorA

• 0x45a164 CopyIcon

• 0x45a168 IsWindow

• 0x45a16c SetCursor

• 0x45a170 GetMessagePos

• 0x45a174 MessageBeep

• 0x45a178 DestroyCursor

• 0x45a17c RegisterWindowMessageA

• 0x45a180 RedrawWindow

• 0x45a184 FillRect

• 0x45a188 GetSysColor

• 0x45a18c EnableWindow

• 0x45a190 GetDlgItem

• 0x45a194 SetWindowTextA

• 0x45a198 UnregisterClassA

• 0x45a19c HideCaret

• 0x45a1a0 ShowCaret

• 0x45a1a4 LoadIconA

• 0x45a1a8 IsIconic

• 0x45a1ac GetSystemMenu

• 0x45a1b0 AppendMenuA

• 0x45a1b4 DrawIcon

• 0x45a1b8 ScreenToClient

• 0x45a1bc FindWindowExA

• 0x45a1c0 GetWindowRect

• 0x45a1c4 MoveWindow

• 0x45a1c8 ShowWindow

• 0x45a1cc CheckDlgButton

• 0x45a1d0 PostMessageA

• 0x45a1d4 UpdateWindow

• 0x45a1d8 SendDlgItemMessageA

• 0x45a1dc MapWindowPoints

• 0x45a1e0 PeekMessageA

• 0x45a1e4 DispatchMessageA

• 0x45a1e8 GetFocus

• 0x45a1ec SetFocus

• 0x45a1f0 wsprintfA

• 0x45a1f4 AdjustWindowRectEx

• 0x45a1f8 GetClientRect

• 0x45a1fc GetSystemMetrics

• 0x45a200 ExcludeUpdateRgn

• 0x45a204 DrawFocusRect

• 0x45a208 DefDlgProcA

• 0x45a20c GetWindowLongA

• 0x45a210 SetWindowLongA

• 0x45a214 SendMessageA

• 0x45a218 IsWindowUnicode

• 0x45a21c CharNextA

• 0x45a220 GetSubMenu

Library GDI32.dll:

• 0x459aa0 CreateBitmap

• 0x459aa4 StartDocA

• 0x459aa8 SaveDC

• 0x459aac RestoreDC

• 0x459ab0 SelectObject

• 0x459ab4 SelectPalette

• 0x459ab8 SetBkMode

• 0x459abc SetPolyFillMode

• 0x459ac0 SetROP2

• 0x459ac4 SetStretchBltMode

• 0x459ac8 SetMapMode

• 0x459acc SetViewportOrgEx

• 0x459ad0 OffsetViewportOrgEx

• 0x459ad4 SetViewportExtEx

• 0x459ad8 ScaleViewportExtEx

• 0x459adc SetWindowOrgEx

• 0x459ae0 OffsetWindowOrgEx

• 0x459ae4 SetWindowExtEx

• 0x459ae8 ScaleWindowExtEx

• 0x459aec SelectClipRgn

• 0x459af0 ExcludeClipRect

• 0x459af4 IntersectClipRect

• 0x459af8 OffsetClipRgn

• 0x459afc MoveToEx

• 0x459b00 LineTo

• 0x459b04 SetTextAlign

• 0x459b08 SetTextJustification

• 0x459b0c SetTextCharacterExtra

• 0x459b10 SetMapperFlags

• 0x459b14 GetCurrentPositionEx

• 0x459b18 ArcTo

• 0x459b1c SetArcDirection

• 0x459b20 SetBkColor

• 0x459b24 PolylineTo

• 0x459b28 SetColorAdjustment

• 0x459b2c PolyBezierTo

• 0x459b30 DeleteObject

• 0x459b34 GetClipRgn

• 0x459b38 CreateRectRgn

• 0x459b3c SelectClipPath

• 0x459b40 ExtSelectClipRgn

• 0x459b44 PlayMetaFileRecord

• 0x459b48 GetObjectType

• 0x459b4c EnumMetaFile

• 0x459b50 PlayMetaFile

• 0x459b54 GetViewportExtEx

• 0x459b58 GetWindowExtEx

• 0x459b5c CreatePen

• 0x459b60 ExtCreatePen

• 0x459b64 CreateHatchBrush

• 0x459b68 CreatePatternBrush

• 0x459b6c CreateDIBPatternBrushPt

• 0x459b70 PtVisible

• 0x459b74 RectVisible

• 0x459b78 TextOutA

• 0x459b7c ExtTextOutA

• 0x459b80 Escape

• 0x459b84 GetMapMode

• 0x459b88 PatBlt

• 0x459b8c SetRectRgn

• 0x459b90 CombineRgn

• 0x459b94 CreateRectRgnIndirect

• 0x459b98 DPtoLP

• 0x459b9c GetTextMetricsA

• 0x459ba0 SetTextColor

• 0x459ba4 GetClipBox

• 0x459ba8 GetDCOrgEx

• 0x459bac GetTextExtentPoint32A

• 0x459bb0 CreateSolidBrush

• 0x459bb4 GetObjectA

• 0x459bb8 CreateFontIndirectA

• 0x459bbc GetStockObject

• 0x459bc0 CreateDCA

• 0x459bc4 GetDeviceCaps

• 0x459bc8 PolyDraw

• 0x459bcc CreateDIBitmap

• 0x459bd0 GetTextExtentPointA

• 0x459bd4 BitBlt

• 0x459bd8 CreateCompatibleDC

• 0x459bdc DeleteDC

Library comdlg32.dll:

• 0x45a30c GetFileTitleA

Library WINSPOOL.DRV:

• 0x45a2d4 ClosePrinter

• 0x45a2d8 DocumentPropertiesA

• 0x45a2dc OpenPrinterA

Library ADVAPI32.dll:

• 0x459a1c RegSetValueExA

• 0x459a20 RegOpenKeyA

• 0x459a24 RegDeleteKeyA

• 0x459a28 RegDeleteValueA

• 0x459a2c RegCloseKey

• 0x459a30 RegQueryValueExA

• 0x459a34 RegCreateKeyExA

• 0x459a38 RegOpenKeyExA

• 0x459a3c RegQueryValueA

Library SHELL32.dll:

• 0x459f28 DragFinish

• 0x459f2c DragAcceptFiles

• 0x459f30 ShellExecuteA

• 0x459f34 SHGetFileInfoA

• 0x459f38 SHGetSpecialFolderLocation

• 0x459f3c SHGetSpecialFolderPathA

• 0x459f40 SHBrowseForFolderA

• 0x459f44 SHGetPathFromIDListA

• 0x459f48 SHGetMalloc

• 0x459f4c DragQueryFileA

Library COMCTL32.dll:

• 0x459a70

Library ole32.dll:

• 0x45a33c CoUninitialize

• 0x45a340 CoInitialize

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
r3---sn-j5o7dn7e.gvt1.com	CNAME r3.sn-j5o7dn7e.gvt1.com A 113.108.239.196	113.108.239.196
redirector.gvt1.com	A 203.208.41.33	203.208.41.33
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
r1---sn-j5o7dn7e.gvt1.com	A 113.108.239.194 CNAME r1.sn-j5o7dn7e.gvt1.com	113.108.239.194
clients2.google.com	CNAME clients.l.google.com A 172.217.27.142 A 172.217.160.110	172.217.160.78
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
update.googleapis.com	A 203.208.40.98	203.208.41.34
teredo.ipv6.microsoft.com		127.0.0.1

TCP

Source	Source Port	Destination	Destination Port
192.168.56.101	49195	113.108.239.194 r1---sn-j5o7dn7e.gvt1.com	80
192.168.56.101	49196	113.108.239.196 r3---sn-j5o7dn7e.gvt1.com	80
192.168.56.101	49192	203.208.40.98 update.googleapis.com	443
192.168.56.101	49194	203.208.41.33 redirector.gvt1.com	80

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	51808	114.114.114.114	53
192.168.56.101	53500	114.114.114.114	53
192.168.56.101	54991	114.114.114.114	53
192.168.56.101	56743	114.114.114.114	53
192.168.56.101	58070	114.114.114.114	53
192.168.56.101	60123	114.114.114.114	53
192.168.56.101	60221	114.114.114.114	53
192.168.56.101	60384	114.114.114.114	53
192.168.56.101	62191	114.114.114.114	53
192.168.56.101	63429	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	49713	224.0.0.252	5355
192.168.56.101	51378	224.0.0.252	5355
192.168.56.101	53237	224.0.0.252	5355
192.168.56.101	53380	224.0.0.252	5355
192.168.56.101	54260	224.0.0.252	5355
192.168.56.101	55368	224.0.0.252	5355
192.168.56.101	56539	224.0.0.252	5355

HTTP & HTTPS Requests

URI	Data
http://r1---sn-j5o7dn7e.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?cms_redirect=yes&mh=ms&mip=202.100.214.100&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619866341&mv=m&mvi=1&pl=23&shardbypass=yes	HEAD /edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?cms_redirect=yes&mh=ms&mip=202.100.214.100&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619866341&mv=m&mvi=1&pl=23&shardbypass=yes HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.5 X-Old-UID: cnt=0 X-Last-HR: 0x0 X-Last-HTTP-Status-Code: 0 X-Retry-Count: 0 X-HTTP-Attempts: 1 Host: r1---sn-j5o7dn7e.gvt1.com
http://redirector.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe	HEAD /edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.5 X-Old-UID: cnt=0 X-Last-HR: 0x0 X-Last-HTTP-Status-Code: 0 X-Retry-Count: 0 X-HTTP-Attempts: 1 Host: redirector.gvt1.com
http://r3---sn-j5o7dn7e.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=3&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=cda8403cc637f4c6&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619866101&mv=m	HEAD /edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=3&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=cda8403cc637f4c6&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619866101&mv=m HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.5 X-Old-UID: cnt=0 X-Last-HR: 0x0 X-Last-HTTP-Status-Code: 0 X-Retry-Count: 0 X-HTTP-Attempts: 1 Host: r3---sn-j5o7dn7e.gvt1.com

URI

Data

http://r1---sn-j5o7dn7e.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?cms_redirect=yes&mh=ms&mip=202.100.214.100&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619866341&mv=m&mvi=1&pl=23&shardbypass=yes

HEAD /edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?cms_redirect=yes&mh=ms&mip=202.100.214.100&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619866341&mv=m&mvi=1&pl=23&shardbypass=yes HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
User-Agent: Microsoft BITS/7.5
X-Old-UID: cnt=0
X-Last-HR: 0x0
X-Last-HTTP-Status-Code: 0
X-Retry-Count: 0
X-HTTP-Attempts: 1
Host: r1---sn-j5o7dn7e.gvt1.com

http://redirector.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe

HEAD /edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
User-Agent: Microsoft BITS/7.5
X-Old-UID: cnt=0
X-Last-HR: 0x0
X-Last-HTTP-Status-Code: 0
X-Retry-Count: 0
X-HTTP-Attempts: 1
Host: redirector.gvt1.com

http://r3---sn-j5o7dn7e.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=3&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=cda8403cc637f4c6&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619866101&mv=m

HEAD /edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=3&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=cda8403cc637f4c6&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619866101&mv=m HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
User-Agent: Microsoft BITS/7.5
X-Old-UID: cnt=0
X-Last-HR: 0x0
X-Last-HTTP-Status-Code: 0
X-Retry-Count: 0
X-HTTP-Attempts: 1
Host: r3---sn-j5o7dn7e.gvt1.com

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.