https://tr.ee/zyO9B8

MALICIOUS

SUSPICIOUS

• The process drops C-runtime libraries

  • msedge.exe (PID: 3820)
  • Images.png (PID: 9184)

• Process drops legitimate windows executable

  • msedge.exe (PID: 3820)
  • WinRAR.exe (PID: 8804)
  • Images.png (PID: 9184)

• Reads security settings of Internet Explorer

  • WinRAR.exe (PID: 8804)

• Likely accesses (executes) a file from the Public directory

  • cmd.exe (PID: 8968)

• Starts CMD.EXE for commands execution

  • 수사_파일의_증거.exe (PID: 8948)

• Decoding a file from Base64 using CertUtil

  • cmd.exe (PID: 8968)

• The executable file from the user directory is run by the CMD process

  • Images.png (PID: 9184)

• Starts application with an unusual extension

  • cmd.exe (PID: 8968)

• The process creates files with name similar to system file names

  • Images.png (PID: 9184)

• Executable content was dropped or overwritten

  • Images.png (PID: 9184)

• Process drops python dynamic module

  • Images.png (PID: 9184)

INFO

• Application launched itself

  • msedge.exe (PID: 3820)
  • chrome.exe (PID: 4024)

• Checks supported languages

  • identity_helper.exe (PID: 8152)
  • 수사_파일의_증거.exe (PID: 8948)
  • Images.png (PID: 9184)

• The sample compiled with english language support

  • msedge.exe (PID: 3820)
  • WinRAR.exe (PID: 8804)
  • Images.png (PID: 9184)

• Reads Environment values

  • identity_helper.exe (PID: 8152)

• Reads the computer name

  • identity_helper.exe (PID: 8152)
  • Images.png (PID: 9184)

• Reads Microsoft Office registry keys

  • msedge.exe (PID: 3820)
  • OpenWith.exe (PID: 9044)

• Executable content was dropped or overwritten

  • WinRAR.exe (PID: 8804)

• Create files in a temporary directory

  • certutil.exe (PID: 9080)

• Reads the machine GUID from the registry

  • Images.png (PID: 9184)

• Reads security settings of Internet Explorer

  • OpenWith.exe (PID: 9044)

• Checks proxy server information

  • slui.exe (PID: 8768)

• Reads the software policy settings

  • slui.exe (PID: 8768)