What is ravroron.exe?
ravroron.exe is part of Rising RavRoron and developed by Beijing Rising Tech. Co., Ltd. according to the ravroron.exe version information.
ravroron.exe's description is "RavRoron"
ravroron.exe is usually located in the 'c:\downloads\' folder.
Some of the anti-virus scanners at VirusTotal detected ravroron.exe.
If you have additional information about the file, please share it with the FreeFixer users by posting a comment at the bottom of this page.
Vendor and version information [?]
The following is the available information on ravroron.exe:
| Property | Value |
|---|---|
| Product name | Rising RavRoron |
| Company name | Beijing Rising Tech. Co., Ltd. |
| File description | RavRoron |
| Internal name | RavRoron |
| Original filename | RavRoron.exe |
| Legal copyright | Copyright ? 2003 |
| Product version | 1, 0, 0, 6 |
| File version | 1, 0, 0, 6 |
Here's a screenshot of the file properties when displayed by Windows Explorer:
| Product name | Rising RavRoron |
| Company name | Beijing Rising Tech. Co., Ltd. |
| File description | RavRoron |
| Internal name | RavRoron |
| Original filename | RavRoron.exe |
| Legal copyright | Copyright ? 2003 |
| Product version | 1, 0, 0, 6 |
| File version | 1, 0, 0, 6 |
Digital signatures [?]
ravroron.exe is not signed.
VirusTotal report
11 of the 73 anti-virus programs at VirusTotal detected the ravroron.exe file. That's a 15% detection rate.
| Scanner | Detection Name |
|---|---|
| AegisLab | Trojan.Win32.Generic.4!c |
| CrowdStrike | win/malicious_confidence_80% (W) |
| Cylance | Unsafe |
| FireEye | Generic.mg.6c8a1805ea953825 |
| McAfee | Artemis!6C8A1805EA95 |
| McAfee-GW-Edition | BehavesLike.Win32.BadFile.lc |
| Microsoft | Trojan:Win32/Zpevdo.B |
| Symantec | ML.Attribute.HighConfidence |
| TheHacker | Posible_Worm32 |
| VBA32 | BScope.Trojan.Click |
| Webroot | W32.Malware.Gen |
Sandbox Report
The following information was gathered by executing the file inside Cuckoo Sandbox.
Summary
Successfully executed process in sandbox.
Summary
{
"dll_loaded": [
"Kernel32.dll",
"dwmapi.dll",
"C:\\Windows\\system32\\uxtheme.dll",
"C:\\Windows\\syswow64\\MSCTF.dll",
"kernel32.dll",
"GDI32.dll",
"SHELL32.dll",
"KERNEL32.DLL",
"OLEAUT32.DLL",
"C:\\Windows\\system32\\ole32.dll",
"ADVAPI32.dll",
"NTDll.dll",
"Psapi.dll",
"comctl32.dll",
"USER32.dll",
"COMCTL32.dll"
],
"file_opened": [
"C:\\Windows\\SysWOW64\\CRYPTBASE.dll",
"C:\\Windows\\SysWOW64\\user32.dll",
"C:\\$Recycle.Bin\\",
"C:\\Windows\\SysWOW64\\advapi32.dll",
"C:\\Windows\\SysWOW64\\msctf.dll",
"C:\\Users\\cuck\\AppData\\Local\\Temp",
"C:\\Windows\\SysWOW64\\sspicli.dll",
"C:\\Windows\\SysWOW64\\kernel32.dll",
"C:\\Windows\\SysWOW64\\msvcrt.dll",
"C:\\Windows\\SysWOW64\\shlwapi.dll",
"C:\\cuckoo-agent\\",
"C:\\Windows\\System32\\dwmapi.dll",
"C:\\",
"C:\\Windows\\SysWOW64\\psapi.dll",
"C:\\cuckoo-agent\\agent.py",
"C:\\Windows\\SysWOW64\\shell32.dll",
"C:\\Windows\\SysWOW64\\lpk.dll",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\a9f0a61264f4a377f48fed715ab2c29cc20e789e7f1f8713f1f8bb1dc9e0a286.bin",
"C:\\Documents and Settings\\",
"C:\\Windows\\SysWOW64\\ntdll.dll",
"C:\\Windows\\SysWOW64\\usp10.dll",
"C:\\Windows\\SysWOW64\\sechost.dll",
"C:\\Windows\\System32\\imm32.dll",
"C:\\Windows\\SysWOW64\\gdi32.dll",
"C:\\Windows\\Globalization\\Sorting\\sortdefault.nls",
"C:\\Windows\\SysWOW64\\rpcrt4.dll",
"C:\\Windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\\comctl32.dll",
"C:\\Windows\\System32\\ole32.dll",
"C:\\Windows\\SysWOW64\\oleaut32.dll",
"C:\\Windows\\SysWOW64\\KERNELBASE.dll",
"C:\\Windows\\System32\\uxtheme.dll"
],
"regkey_opened": [
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{8613E14C-D0C0-4161-AC0F-1DD2563286BC}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\OLE\\Tracing",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{0000897b-83df-4b96-be07-0fb58b01c4a4}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\CTF\\TIP\\{0000897b-83df-4b96-be07-0fb58b01c4a4}\\LanguageProfile\\0x00000000\\{0001bea3-ed56-483d-a2e2-aeae25577436}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{C1EE01F2-B3B6-4A6A-9DDD-E988C088EC82}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{F25E9F57-2FC8-4EB3-A41A-CCE5F08541E6}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{07EB03D6-B001-41DF-9192-BF9B841EE71F}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{AE6BE008-07FB-400D-8BEB-337A64F7051F}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\OLE",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{E429B25A-E5D3-4D1F-9BE3-0C608477E3A1}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
"HKEY_CURRENT_USER\\Software\\Microsoft\\CTF\\DirectSwitchHotkeys",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback",
"HKEY_CURRENT_USER\\Software\\Microsoft\\CTF\\LayoutIcon\\0409\\0000041d",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\SimSun",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{F89E9E58-BD2F-4008-9AC2-0F816C09F4EE}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{DCBD6FA8-032F-11D3-B5B1-00C04FC324A1}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\OLEAUT",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{3697C5FA-60DD-4B56-92D4-74A569205C16}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\Compatibility\\a9f0a61264f4a377f48fed715ab2c29cc20e789e7f1f8713f1f8bb1dc9e0a286.bin",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{531FDEBF-9B4C-4A43-A2AA-960E8FCDC732}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{A028AE76-01B1-46C2-99C4-ACD9858AE02F}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{81D4E9C9-1D3B-41BC-9E6C-4B40BF79E35E}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{03B5835F-F03C-411B-9CE2-AA23E1171E36}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes",
"HKEY_CURRENT_USER\\Keyboard Layout\\Toggle",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{78CB5B0E-26ED-4FCC-854C-77E8F3D1AA80}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}"
],
"file_failed": [
"C:\\pagefile.sys"
],
"file_read": [
"C:\\Users\\cuck\\AppData\\Local\\Temp\\a9f0a61264f4a377f48fed715ab2c29cc20e789e7f1f8713f1f8bb1dc9e0a286.bin"
],
"regkey_read": [
"HKEY_CURRENT_USER\\Keyboard Layout\\Toggle\\Language Hotkey",
"HKEY_CURRENT_USER\\Keyboard Layout\\Toggle\\Hotkey",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\OLE\\PageAllocatorUseSystemHeap",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{0000897b-83df-4b96-be07-0fb58b01c4a4}\\LanguageProfile\\0x00000000\\{0001bea3-ed56-483d-a2e2-aeae25577436}\\Enable",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\SimSun\\Plane6",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\SimSun\\Plane7",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\SimSun\\Plane4",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\SimSun\\Plane5",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\SimSun\\Plane2",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\CustomLocale\\en-US",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Locale\\00000409",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Segoe UI",
"HKEY_CURRENT_USER\\Keyboard Layout\\Toggle\\Layout Hotkey",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\SimSun\\Plane8",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\SimSun\\Plane9",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\CTF\\EnableAnchorContext",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Language Groups\\1",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\SimSun\\Plane14",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\ExtendedLocale\\en-US",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\OLE\\PageAllocatorSystemHeapIsPrivate",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\SimSun\\Plane3",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\SimSun\\Plane1",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\UseDoubleClickTimer",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\\u5b8b\u4f53",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\SimSun\\Plane15",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\SimSun\\Plane16",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\SimSun\\Plane10",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\SimSun\\Plane11",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\SimSun\\Plane12",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\SimSun\\Plane13"
],
"directory_enumerated": [
"C:\\$Recycle.Bin\\*",
"C:\\*",
"C:\\Documents and Settings\\*",
"C:\\cuckoo-agent\\*"
]
}Generic
[
{
"process_path": "C:\\Users\\cuck\\AppData\\Local\\Temp\\a9f0a61264f4a377f48fed715ab2c29cc20e789e7f1f8713f1f8bb1dc9e0a286.bin",
"process_name": "a9f0a61264f4a377f48fed715ab2c29cc20e789e7f1f8713f1f8bb1dc9e0a286.bin",
"pid": 2816,
"summary": {
"dll_loaded": [
"Kernel32.dll",
"dwmapi.dll",
"C:\\Windows\\system32\\uxtheme.dll",
"C:\\Windows\\syswow64\\MSCTF.dll",
"kernel32.dll",
"GDI32.dll",
"SHELL32.dll",
"KERNEL32.DLL",
"OLEAUT32.DLL",
"C:\\Windows\\system32\\ole32.dll",
"ADVAPI32.dll",
"NTDll.dll",
"Psapi.dll",
"comctl32.dll",
"USER32.dll",
"COMCTL32.dll"
],
"file_opened": [
"C:\\Windows\\SysWOW64\\CRYPTBASE.dll",
"C:\\Windows\\SysWOW64\\user32.dll",
"C:\\$Recycle.Bin\\",
"C:\\Windows\\SysWOW64\\advapi32.dll",
"C:\\Windows\\SysWOW64\\msctf.dll",
"C:\\Users\\cuck\\AppData\\Local\\Temp",
"C:\\Windows\\SysWOW64\\sspicli.dll",
"C:\\Windows\\SysWOW64\\kernel32.dll",
"C:\\Windows\\SysWOW64\\msvcrt.dll",
"C:\\Windows\\SysWOW64\\shlwapi.dll",
"C:\\cuckoo-agent\\",
"C:\\Windows\\System32\\dwmapi.dll",
"C:\\",
"C:\\Windows\\SysWOW64\\psapi.dll",
"C:\\cuckoo-agent\\agent.py",
"C:\\Windows\\SysWOW64\\shell32.dll",
"C:\\Windows\\SysWOW64\\lpk.dll",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\a9f0a61264f4a377f48fed715ab2c29cc20e789e7f1f8713f1f8bb1dc9e0a286.bin",
"C:\\Documents and Settings\\",
"C:\\Windows\\SysWOW64\\ntdll.dll",
"C:\\Windows\\SysWOW64\\usp10.dll",
"C:\\Windows\\SysWOW64\\sechost.dll",
"C:\\Windows\\System32\\imm32.dll",
"C:\\Windows\\SysWOW64\\gdi32.dll",
"C:\\Windows\\Globalization\\Sorting\\sortdefault.nls",
"C:\\Windows\\SysWOW64\\rpcrt4.dll",
"C:\\Windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\\comctl32.dll",
"C:\\Windows\\System32\\ole32.dll",
"C:\\Windows\\SysWOW64\\oleaut32.dll",
"C:\\Windows\\SysWOW64\\KERNELBASE.dll",
"C:\\Windows\\System32\\uxtheme.dll"
],
"regkey_opened": [
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{8613E14C-D0C0-4161-AC0F-1DD2563286BC}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\OLE\\Tracing",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{0000897b-83df-4b96-be07-0fb58b01c4a4}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\CTF\\TIP\\{0000897b-83df-4b96-be07-0fb58b01c4a4}\\LanguageProfile\\0x00000000\\{0001bea3-ed56-483d-a2e2-aeae25577436}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{C1EE01F2-B3B6-4A6A-9DDD-E988C088EC82}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{F25E9F57-2FC8-4EB3-A41A-CCE5F08541E6}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{07EB03D6-B001-41DF-9192-BF9B841EE71F}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{AE6BE008-07FB-400D-8BEB-337A64F7051F}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\OLE",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{E429B25A-E5D3-4D1F-9BE3-0C608477E3A1}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
"HKEY_CURRENT_USER\\Software\\Microsoft\\CTF\\DirectSwitchHotkeys",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback",
"HKEY_CURRENT_USER\\Software\\Microsoft\\CTF\\LayoutIcon\\0409\\0000041d",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\SimSun",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{F89E9E58-BD2F-4008-9AC2-0F816C09F4EE}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{DCBD6FA8-032F-11D3-B5B1-00C04FC324A1}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\OLEAUT",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{3697C5FA-60DD-4B56-92D4-74A569205C16}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\Compatibility\\a9f0a61264f4a377f48fed715ab2c29cc20e789e7f1f8713f1f8bb1dc9e0a286.bin",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{531FDEBF-9B4C-4A43-A2AA-960E8FCDC732}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{A028AE76-01B1-46C2-99C4-ACD9858AE02F}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{81D4E9C9-1D3B-41BC-9E6C-4B40BF79E35E}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{03B5835F-F03C-411B-9CE2-AA23E1171E36}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes",
"HKEY_CURRENT_USER\\Keyboard Layout\\Toggle",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{78CB5B0E-26ED-4FCC-854C-77E8F3D1AA80}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}"
],
"file_failed": [
"C:\\pagefile.sys"
],
"file_read": [
"C:\\Users\\cuck\\AppData\\Local\\Temp\\a9f0a61264f4a377f48fed715ab2c29cc20e789e7f1f8713f1f8bb1dc9e0a286.bin"
],
"regkey_read": [
"HKEY_CURRENT_USER\\Keyboard Layout\\Toggle\\Language Hotkey",
"HKEY_CURRENT_USER\\Keyboard Layout\\Toggle\\Hotkey",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\OLE\\PageAllocatorUseSystemHeap",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{0000897b-83df-4b96-be07-0fb58b01c4a4}\\LanguageProfile\\0x00000000\\{0001bea3-ed56-483d-a2e2-aeae25577436}\\Enable",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\SimSun\\Plane6",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\SimSun\\Plane7",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\SimSun\\Plane4",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\SimSun\\Plane5",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\SimSun\\Plane2",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\CustomLocale\\en-US",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Locale\\00000409",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Segoe UI",
"HKEY_CURRENT_USER\\Keyboard Layout\\Toggle\\Layout Hotkey",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\SimSun\\Plane8",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\SimSun\\Plane9",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\CTF\\EnableAnchorContext",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Language Groups\\1",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\SimSun\\Plane14",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\ExtendedLocale\\en-US",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\OLE\\PageAllocatorSystemHeapIsPrivate",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\SimSun\\Plane3",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\SimSun\\Plane1",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\UseDoubleClickTimer",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\\u5b8b\u4f53",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\SimSun\\Plane15",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\SimSun\\Plane16",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\SimSun\\Plane10",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\SimSun\\Plane11",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\SimSun\\Plane12",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\SimSun\\Plane13"
],
"directory_enumerated": [
"C:\\$Recycle.Bin\\*",
"C:\\*",
"C:\\Documents and Settings\\*",
"C:\\cuckoo-agent\\*"
]
},
"first_seen": 1563281584.6562,
"ppid": 2016
},
{
"process_path": "C:\\Windows\\System32\\lsass.exe",
"process_name": "lsass.exe",
"pid": 476,
"summary": {},
"first_seen": 1563281584.3281,
"ppid": 376
}
]Signatures
[
{
"markcount": 1,
"families": [],
"description": "Checks if process is being debugged by a debugger",
"severity": 1,
"marks": [
{
"call": {
"category": "system",
"status": 0,
"stacktrace": [],
"last_error": 0,
"nt_status": 0,
"api": "IsDebuggerPresent",
"return_value": 0,
"arguments": {},
"time": 1563281584.7503,
"tid": 2420,
"flags": {}
},
"pid": 2816,
"type": "call",
"cid": 174
}
],
"references": [],
"name": "checks_debugger"
},
{
"markcount": 1,
"families": [],
"description": "The executable uses a known packer",
"severity": 1,
"marks": [
{
"category": "packer",
"ioc": "UPX 2.90 [LZMA] -> Markus Oberhumer, Laszlo Molnar & John Reiser",
"type": "ioc",
"description": null
}
],
"references": [],
"name": "peid_packer"
},
{
"markcount": 78,
"families": [],
"description": "Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation",
"severity": 2,
"marks": [
{
"call": {
"category": "misc",
"status": 1,
"stacktrace": [],
"api": "GetDiskFreeSpaceExW",
"return_value": 1,
"arguments": {
"root_path": "C:\\",
"free_bytes_available": 23513751552,
"total_number_of_free_bytes": 23513751552,
"total_number_of_bytes": 34252779520
},
"time": 1563281586.6253,
"tid": 2384,
"flags": {}
},
"pid": 2816,
"type": "call",
"cid": 1174
},
{
"call": {
"category": "misc",
"status": 1,
"stacktrace": [],
"api": "GetDiskFreeSpaceW",
"return_value": 1,
"arguments": {
"root_path": "C:\\",
"sectors_per_cluster": 8,
"number_of_free_clusters": 5740662,
"total_number_of_clusters": 8362495,
"bytes_per_sector": 512
},
"time": 1563281586.6253,
"tid": 2384,
"flags": {}
},
"pid": 2816,
"type": "call",
"cid": 1176
},
{
"call": {
"category": "misc",
"status": 1,
"stacktrace": [],
"api": "GetDiskFreeSpaceExW",
"return_value": 1,
"arguments": {
"root_path": "C:\\",
"free_bytes_available": 23513743360,
"total_number_of_free_bytes": 23513743360,
"total_number_of_bytes": 34252779520
},
"time": 1563281589.7503,
"tid": 1468,
"flags": {}
},
"pid": 2816,
"type": "call",
"cid": 1882
},
{
"call": {
"category": "misc",
"status": 1,
"stacktrace": [],
"api": "GetDiskFreeSpaceW",
"return_value": 1,
"arguments": {
"root_path": "C:\\",
"sectors_per_cluster": 8,
"number_of_free_clusters": 5740660,
"total_number_of_clusters": 8362495,
"bytes_per_sector": 512
},
"time": 1563281589.7503,
"tid": 1468,
"flags": {}
},
"pid": 2816,
"type": "call",
"cid": 1884
},
{
"call": {
"category": "misc",
"status": 1,
"stacktrace": [],
"api": "GetDiskFreeSpaceExW",
"return_value": 1,
"arguments": {
"root_path": "C:\\",
"free_bytes_available": 23513743360,
"total_number_of_free_bytes": 23513743360,
"total_number_of_bytes": 34252779520
},
"time": 1563281592.8433,
"tid": 1744,
"flags": {}
},
"pid": 2816,
"type": "call",
"cid": 2589
},
{
"call": {
"category": "misc",
"status": 1,
"stacktrace": [],
"api": "GetDiskFreeSpaceW",
"return_value": 1,
"arguments": {
"root_path": "C:\\",
"sectors_per_cluster": 8,
"number_of_free_clusters": 5740660,
"total_number_of_clusters": 8362495,
"bytes_per_sector": 512
},
"time": 1563281592.8433,
"tid": 1744,
"flags": {}
},
"pid": 2816,
"type": "call",
"cid": 2591
},
{
"call": {
"category": "misc",
"status": 1,
"stacktrace": [],
"api": "GetDiskFreeSpaceExW",
"return_value": 1,
"arguments": {
"root_path": "C:\\",
"free_bytes_available": 23513690112,
"total_number_of_free_bytes": 23513690112,
"total_number_of_bytes": 34252779520
},
"time": 1563281595.9372,
"tid": 316,
"flags": {}
},
"pid": 2816,
"type": "call",
"cid": 3304
},
{
"call": {
"category": "misc",
"status": 1,
"stacktrace": [],
"api": "GetDiskFreeSpaceW",
"return_value": 1,
"arguments": {
"root_path": "C:\\",
"sectors_per_cluster": 8,
"number_of_free_clusters": 5740647,
"total_number_of_clusters": 8362495,
"bytes_per_sector": 512
},
"time": 1563281595.9372,
"tid": 316,
"flags": {}
},
"pid": 2816,
"type": "call",
"cid": 3306
},
{
"call": {
"category": "misc",
"status": 1,
"stacktrace": [],
"api": "GetDiskFreeSpaceExW",
"return_value": 1,
"arguments": {
"root_path": "C:\\",
"free_bytes_available": 23513690112,
"total_number_of_free_bytes": 23513690112,
"total_number_of_bytes": 34252779520
},
"time": 1563281599.0622,
"tid": 2740,
"flags": {}
},
"pid": 2816,
"type": "call",
"cid": 4012
},
{
"call": {
"category": "misc",
"status": 1,
"stacktrace": [],
"api": "GetDiskFreeSpaceW",
"return_value": 1,
"arguments": {
"root_path": "C:\\",
"sectors_per_cluster": 8,
"number_of_free_clusters": 5740647,
"total_number_of_clusters": 8362495,
"bytes_per_sector": 512
},
"time": 1563281599.0622,
"tid": 2740,
"flags": {}
},
"pid": 2816,
"type": "call",
"cid": 4014
},
{
"call": {
"category": "misc",
"status": 1,
"stacktrace": [],
"api": "GetDiskFreeSpaceExW",
"return_value": 1,
"arguments": {
"root_path": "C:\\",
"free_bytes_available": 23513690112,
"total_number_of_free_bytes": 23513690112,
"total_number_of_bytes": 34252779520
},
"time": 1563281602.1402,
"tid": 2244,
"flags": {}
},
"pid": 2816,
"type": "call",
"cid": 4714
},
{
"call": {
"category": "misc",
"status": 1,
"stacktrace": [],
"api": "GetDiskFreeSpaceW",
"return_value": 1,
"arguments": {
"root_path": "C:\\",
"sectors_per_cluster": 8,
"number_of_free_clusters": 5740647,
"total_number_of_clusters": 8362495,
"bytes_per_sector": 512
},
"time": 1563281602.1402,
"tid": 2244,
"flags": {}
},
"pid": 2816,
"type": "call",
"cid": 4716
},
{
"call": {
"category": "misc",
"status": 1,
"stacktrace": [],
"api": "GetDiskFreeSpaceExW",
"return_value": 1,
"arguments": {
"root_path": "C:\\",
"free_bytes_available": 23513690112,
"total_number_of_free_bytes": 23513690112,
"total_number_of_bytes": 34252779520
},
"time": 1563281605.2183,
"tid": 3020,
"flags": {}
},
"pid": 2816,
"type": "call",
"cid": 5416
},
{
"call": {
"category": "misc",
"status": 1,
"stacktrace": [],
"api": "GetDiskFreeSpaceW",
"return_value": 1,
"arguments": {
"root_path": "C:\\",
"sectors_per_cluster": 8,
"number_of_free_clusters": 5740647,
"total_number_of_clusters": 8362495,
"bytes_per_sector": 512
},
"time": 1563281605.2183,
"tid": 3020,
"flags": {}
},
"pid": 2816,
"type": "call",
"cid": 5418
},
{
"call": {
"category": "misc",
"status": 1,
"stacktrace": [],
"api": "GetDiskFreeSpaceExW",
"return_value": 1,
"arguments": {
"root_path": "C:\\",
"free_bytes_available": 23513690112,
"total_number_of_free_bytes": 23513690112,
"total_number_of_bytes": 34252779520
},
"time": 1563281608.2812,
"tid": 2252,
"flags": {}
},
"pid": 2816,
"type": "call",
"cid": 6125
},
{
"call": {
"category": "misc",
"status": 1,
"stacktrace": [],
"api": "GetDiskFreeSpaceW",
"return_value": 1,
"arguments": {
"root_path": "C:\\",
"sectors_per_cluster": 8,
"number_of_free_clusters": 5740647,
"total_number_of_clusters": 8362495,
"bytes_per_sector": 512
},
"time": 1563281608.2812,
"tid": 2252,
"flags": {}
},
"pid": 2816,
"type": "call",
"cid": 6127
},
{
"call": {
"category": "misc",
"status": 1,
"stacktrace": [],
"api": "GetDiskFreeSpaceExW",
"return_value": 1,
"arguments": {
"root_path": "C:\\",
"free_bytes_available": 23513690112,
"total_number_of_free_bytes": 23513690112,
"total_number_of_bytes": 34252779520
},
"time": 1563281611.3593,
"tid": 2484,
"flags": {}
},
"pid": 2816,
"type": "call",
"cid": 6828
},
{
"call": {
"category": "misc",
"status": 1,
"stacktrace": [],
"api": "GetDiskFreeSpaceW",
"return_value": 1,
"arguments": {
"root_path": "C:\\",
"sectors_per_cluster": 8,
"number_of_free_clusters": 5740647,
"total_number_of_clusters": 8362495,
"bytes_per_sector": 512
},
"time": 1563281611.3593,
"tid": 2484,
"flags": {}
},
"pid": 2816,
"type": "call",
"cid": 6830
},
{
"call": {
"category": "misc",
"status": 1,
"stacktrace": [],
"api": "GetDiskFreeSpaceExW",
"return_value": 1,
"arguments": {
"root_path": "C:\\",
"free_bytes_available": 23513690112,
"total_number_of_free_bytes": 23513690112,
"total_number_of_bytes": 34252779520
},
"time": 1563281614.4372,
"tid": 1348,
"flags": {}
},
"pid": 2816,
"type": "call",
"cid": 7538
},
{
"call": {
"category": "misc",
"status": 1,
"stacktrace": [],
"api": "GetDiskFreeSpaceW",
"return_value": 1,
"arguments": {
"root_path": "C:\\",
"sectors_per_cluster": 8,
"number_of_free_clusters": 5740647,
"total_number_of_clusters": 8362495,
"bytes_per_sector": 512
},
"time": 1563281614.4372,
"tid": 1348,
"flags": {}
},
"pid": 2816,
"type": "call",
"cid": 7540
},
{
"call": {
"category": "misc",
"status": 1,
"stacktrace": [],
"api": "GetDiskFreeSpaceExW",
"return_value": 1,
"arguments": {
"root_path": "C:\\",
"free_bytes_available": 23513690112,
"total_number_of_free_bytes": 23513690112,
"total_number_of_bytes": 34252779520
},
"time": 1563281617.5152,
"tid": 624,
"flags": {}
},
"pid": 2816,
"type": "call",
"cid": 8243
},
{
"call": {
"category": "misc",
"status": 1,
"stacktrace": [],
"api": "GetDiskFreeSpaceW",
"return_value": 1,
"arguments": {
"root_path": "C:\\",
"sectors_per_cluster": 8,
"number_of_free_clusters": 5740647,
"total_number_of_clusters": 8362495,
"bytes_per_sector": 512
},
"time": 1563281617.5152,
"tid": 624,
"flags": {}
},
"pid": 2816,
"type": "call",
"cid": 8245
},
{
"call": {
"category": "misc",
"status": 1,
"stacktrace": [],
"api": "GetDiskFreeSpaceExW",
"return_value": 1,
"arguments": {
"root_path": "C:\\",
"free_bytes_available": 23513690112,
"total_number_of_free_bytes": 23513690112,
"total_number_of_bytes": 34252779520
},
"time": 1563281620.6093,
"tid": 2280,
"flags": {}
},
"pid": 2816,
"type": "call",
"cid": 8945
},
{
"call": {
"category": "misc",
"status": 1,
"stacktrace": [],
"api": "GetDiskFreeSpaceW",
"return_value": 1,
"arguments": {
"root_path": "C:\\",
"sectors_per_cluster": 8,
"number_of_free_clusters": 5740647,
"total_number_of_clusters": 8362495,
"bytes_per_sector": 512
},
"time": 1563281620.6093,
"tid": 2280,
"flags": {}
},
"pid": 2816,
"type": "call",
"cid": 8947
},
{
"call": {
"category": "misc",
"status": 1,
"stacktrace": [],
"api": "GetDiskFreeSpaceExW",
"return_value": 1,
"arguments": {
"root_path": "C:\\",
"free_bytes_available": 23513690112,
"total_number_of_free_bytes": 23513690112,
"total_number_of_bytes": 34252779520
},
"time": 1563281623.6562,
"tid": 2600,
"flags": {}
},
"pid": 2816,
"type": "call",
"cid": 9647
},
{
"call": {
"category": "misc",
"status": 1,
"stacktrace": [],
"api": "GetDiskFreeSpaceW",
"return_value": 1,
"arguments": {
"root_path": "C:\\",
"sectors_per_cluster": 8,
"number_of_free_clusters": 5740647,
"total_number_of_clusters": 8362495,
"bytes_per_sector": 512
},
"time": 1563281623.6562,
"tid": 2600,
"flags": {}
},
"pid": 2816,
"type": "call",
"cid": 9649
},
{
"call": {
"category": "misc",
"status": 1,
"stacktrace": [],
"api": "GetDiskFreeSpaceExW",
"return_value": 1,
"arguments": {
"root_path": "C:\\",
"free_bytes_available": 23513690112,
"total_number_of_free_bytes": 23513690112,
"total_number_of_bytes": 34252779520
},
"time": 1563281626.7652,
"tid": 1776,
"flags": {}
},
"pid": 2816,
"type": "call",
"cid": 10349
},
{
"call": {
"category": "misc",
"status": 1,
"stacktrace": [],
"api": "GetDiskFreeSpaceW",
"return_value": 1,
"arguments": {
"root_path": "C:\\",
"sectors_per_cluster": 8,
"number_of_free_clusters": 5740647,
"total_number_of_clusters": 8362495,
"bytes_per_sector": 512
},
"time": 1563281626.7652,
"tid": 1776,
"flags": {}
},
"pid": 2816,
"type": "call",
"cid": 10351
},
{
"call": {
"category": "misc",
"status": 1,
"stacktrace": [],
"api": "GetDiskFreeSpaceExW",
"return_value": 1,
"arguments": {
"root_path": "C:\\",
"free_bytes_available": 23513690112,
"total_number_of_free_bytes": 23513690112,
"total_number_of_bytes": 34252779520
},
"time": 1563281629.8122,
"tid": 2204,
"flags": {}
},
"pid": 2816,
"type": "call",
"cid": 11051
},
{
"call": {
"category": "misc",
"status": 1,
"stacktrace": [],
"api": "GetDiskFreeSpaceW",
"return_value": 1,
"arguments": {
"root_path": "C:\\",
"sectors_per_cluster": 8,
"number_of_free_clusters": 5740647,
"total_number_of_clusters": 8362495,
"bytes_per_sector": 512
},
"time": 1563281629.8122,
"tid": 2204,
"flags": {}
},
"pid": 2816,
"type": "call",
"cid": 11053
},
{
"call": {
"category": "misc",
"status": 1,
"stacktrace": [],
"api": "GetDiskFreeSpaceExW",
"return_value": 1,
"arguments": {
"root_path": "C:\\",
"free_bytes_available": 23513690112,
"total_number_of_free_bytes": 23513690112,
"total_number_of_bytes": 34252779520
},
"time": 1563281632.8902,
"tid": 2568,
"flags": {}
},
"pid": 2816,
"type": "call",
"cid": 11753
},
{
"call": {
"category": "misc",
"status": 1,
"stacktrace": [],
"api": "GetDiskFreeSpaceW",
"return_value": 1,
"arguments": {
"root_path": "C:\\",
"sectors_per_cluster": 8,
"number_of_free_clusters": 5740647,
"total_number_of_clusters": 8362495,
"bytes_per_sector": 512
},
"time": 1563281632.8902,
"tid": 2568,
"flags": {}
},
"pid": 2816,
"type": "call",
"cid": 11755
},
{
"call": {
"category": "misc",
"status": 1,
"stacktrace": [],
"api": "GetDiskFreeSpaceExW",
"return_value": 1,
"arguments": {
"root_path": "C:\\",
"free_bytes_available": 23513690112,
"total_number_of_free_bytes": 23513690112,
"total_number_of_bytes": 34252779520
},
"time": 1563281635.9683,
"tid": 2584,
"flags": {}
},
"pid": 2816,
"type": "call",
"cid": 12455
},
{
"call": {
"category": "misc",
"status": 1,
"stacktrace": [],
"api": "GetDiskFreeSpaceW",
"return_value": 1,
"arguments": {
"root_path": "C:\\",
"sectors_per_cluster": 8,
"number_of_free_clusters": 5740647,
"total_number_of_clusters": 8362495,
"bytes_per_sector": 512
},
"time": 1563281635.9683,
"tid": 2584,
"flags": {}
},
"pid": 2816,
"type": "call",
"cid": 12457
},
{
"call": {
"category": "misc",
"status": 1,
"stacktrace": [],
"api": "GetDiskFreeSpaceExW",
"return_value": 1,
"arguments": {
"root_path": "C:\\",
"free_bytes_available": 23513690112,
"total_number_of_free_bytes": 23513690112,
"total_number_of_bytes": 34252779520
},
"time": 1563281639.0782,
"tid": 344,
"flags": {}
},
"pid": 2816,
"type": "call",
"cid": 13164
},
{
"call": {
"category": "misc",
"status": 1,
"stacktrace": [],
"api": "GetDiskFreeSpaceW",
"return_value": 1,
"arguments": {
"root_path": "C:\\",
"sectors_per_cluster": 8,
"number_of_free_clusters": 5740647,
"total_number_of_clusters": 8362495,
"bytes_per_sector": 512
},
"time": 1563281639.0782,
"tid": 344,
"flags": {}
},
"pid": 2816,
"type": "call",
"cid": 13166
},
{
"call": {
"category": "misc",
"status": 1,
"stacktrace": [],
"api": "GetDiskFreeSpaceExW",
"return_value": 1,
"arguments": {
"root_path": "C:\\",
"free_bytes_available": 23513690112,
"total_number_of_free_bytes": 23513690112,
"total_number_of_bytes": 34252779520
},
"time": 1563281642.1253,
"tid": 2824,
"flags": {}
},
"pid": 2816,
"type": "call",
"cid": 13867
},
{
"call": {
"category": "misc",
"status": 1,
"stacktrace": [],
"api": "GetDiskFreeSpaceW",
"return_value": 1,
"arguments": {
"root_path": "C:\\",
"sectors_per_cluster": 8,
"number_of_free_clusters": 5740647,
"total_number_of_clusters": 8362495,
"bytes_per_sector": 512
},
"time": 1563281642.1253,
"tid": 2824,
"flags": {}
},
"pid": 2816,
"type": "call",
"cid": 13869
},
{
"call": {
"category": "misc",
"status": 1,
"stacktrace": [],
"api": "GetDiskFreeSpaceExW",
"return_value": 1,
"arguments": {
"root_path": "C:\\",
"free_bytes_available": 23513690112,
"total_number_of_free_bytes": 23513690112,
"total_number_of_bytes": 34252779520
},
"time": 1563281645.2503,
"tid": 2384,
"flags": {}
},
"pid": 2816,
"type": "call",
"cid": 14569
},
{
"call": {
"category": "misc",
"status": 1,
"stacktrace": [],
"api": "GetDiskFreeSpaceW",
"return_value": 1,
"arguments": {
"root_path": "C:\\",
"sectors_per_cluster": 8,
"number_of_free_clusters": 5740647,
"total_number_of_clusters": 8362495,
"bytes_per_sector": 512
},
"time": 1563281645.2503,
"tid": 2384,
"flags": {}
},
"pid": 2816,
"type": "call",
"cid": 14571
},
{
"call": {
"category": "misc",
"status": 1,
"stacktrace": [],
"api": "GetDiskFreeSpaceExW",
"return_value": 1,
"arguments": {
"root_path": "C:\\",
"free_bytes_available": 23513690112,
"total_number_of_free_bytes": 23513690112,
"total_number_of_bytes": 34252779520
},
"time": 1563281648.4062,
"tid": 2248,
"flags": {}
},
"pid": 2816,
"type": "call",
"cid": 15271
},
{
"call": {
"category": "misc",
"status": 1,
"stacktrace": [],
"api": "GetDiskFreeSpaceW",
"return_value": 1,
"arguments": {
"root_path": "C:\\",
"sectors_per_cluster": 8,
"number_of_free_clusters": 5740647,
"total_number_of_clusters": 8362495,
"bytes_per_sector": 512
},
"time": 1563281648.4062,
"tid": 2248,
"flags": {}
},
"pid": 2816,
"type": "call",
"cid": 15273
},
{
"call": {
"category": "misc",
"status": 1,
"stacktrace": [],
"api": "GetDiskFreeSpaceExW",
"return_value": 1,
"arguments": {
"root_path": "C:\\",
"free_bytes_available": 23513690112,
"total_number_of_free_bytes": 23513690112,
"total_number_of_bytes": 34252779520
},
"time": 1563281651.5312,
"tid": 588,
"flags": {}
},
"pid": 2816,
"type": "call",
"cid": 15973
},
{
"call": {
"category": "misc",
"status": 1,
"stacktrace": [],
"api": "GetDiskFreeSpaceW",
"return_value": 1,
"arguments": {
"root_path": "C:\\",
"sectors_per_cluster": 8,
"number_of_free_clusters": 5740647,
"total_number_of_clusters": 8362495,
"bytes_per_sector": 512
},
"time": 1563281651.5312,
"tid": 588,
"flags": {}
},
"pid": 2816,
"type": "call",
"cid": 15975
},
{
"call": {
"category": "misc",
"status": 1,
"stacktrace": [],
"api": "GetDiskFreeSpaceExW",
"return_value": 1,
"arguments": {
"root_path": "C:\\",
"free_bytes_available": 23513690112,
"total_number_of_free_bytes": 23513690112,
"total_number_of_bytes": 34252779520
},
"time": 1563281654.6402,
"tid": 2208,
"flags": {}
},
"pid": 2816,
"type": "call",
"cid": 16675
},
{
"call": {
"category": "misc",
"status": 1,
"stacktrace": [],
"api": "GetDiskFreeSpaceW",
"return_value": 1,
"arguments": {
"root_path": "C:\\",
"sectors_per_cluster": 8,
"number_of_free_clusters": 5740647,
"total_number_of_clusters": 8362495,
"bytes_per_sector": 512
},
"time": 1563281654.6402,
"tid": 2208,
"flags": {}
},
"pid": 2816,
"type": "call",
"cid": 16677
},
{
"call": {
"category": "misc",
"status": 1,
"stacktrace": [],
"api": "GetDiskFreeSpaceExW",
"return_value": 1,
"arguments": {
"root_path": "C:\\",
"free_bytes_available": 23513690112,
"total_number_of_free_bytes": 23513690112,
"total_number_of_bytes": 34252779520
},
"time": 1563281657.7503,
"tid": 2292,
"flags": {}
},
"pid": 2816,
"type": "call",
"cid": 17367
},
{
"call": {
"category": "misc",
"status": 1,
"stacktrace": [],
"api": "GetDiskFreeSpaceW",
"return_value": 1,
"arguments": {
"root_path": "C:\\",
"sectors_per_cluster": 8,
"number_of_free_clusters": 5740647,
"total_number_of_clusters": 8362495,
"bytes_per_sector": 512
},
"time": 1563281657.7503,
"tid": 2292,
"flags": {}
},
"pid": 2816,
"type": "call",
"cid": 17369
},
{
"call": {
"category": "misc",
"status": 1,
"stacktrace": [],
"api": "GetDiskFreeSpaceExW",
"return_value": 1,
"arguments": {
"root_path": "C:\\",
"free_bytes_available": 23513690112,
"total_number_of_free_bytes": 23513690112,
"total_number_of_bytes": 34252779520
},
"time": 1563281660.8902,
"tid": 2892,
"flags": {}
},
"pid": 2816,
"type": "call",
"cid": 18059
},
{
"call": {
"category": "misc",
"status": 1,
"stacktrace": [],
"api": "GetDiskFreeSpaceW",
"return_value": 1,
"arguments": {
"root_path": "C:\\",
"sectors_per_cluster": 8,
"number_of_free_clusters": 5740647,
"total_number_of_clusters": 8362495,
"bytes_per_sector": 512
},
"time": 1563281660.8902,
"tid": 2892,
"flags": {}
},
"pid": 2816,
"type": "call",
"cid": 18061
}
],
"references": [],
"name": "antivm_disk_size"
},
{
"markcount": 20,
"families": [],
"description": "Foreign language identified in PE resource",
"severity": 2,
"marks": [
{
"name": "RT_BITMAP",
"language": "LANG_CHINESE",
"offset": "0x00015800",
"filetype": "empty",
"sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
"type": "generic",
"size": "0x0000a51e"
},
{
"name": "RT_ICON",
"language": "LANG_CHINESE",
"offset": "0x00026ce8",
"filetype": "data",
"sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
"type": "generic",
"size": "0x000010a8"
},
{
"name": "RT_ICON",
"language": "LANG_CHINESE",
"offset": "0x00026ce8",
"filetype": "data",
"sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
"type": "generic",
"size": "0x000010a8"
},
{
"name": "RT_ICON",
"language": "LANG_CHINESE",
"offset": "0x00026ce8",
"filetype": "data",
"sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
"type": "generic",
"size": "0x000010a8"
},
{
"name": "RT_ICON",
"language": "LANG_CHINESE",
"offset": "0x00026ce8",
"filetype": "data",
"sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
"type": "generic",
"size": "0x000010a8"
},
{
"name": "RT_ICON",
"language": "LANG_CHINESE",
"offset": "0x00026ce8",
"filetype": "data",
"sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
"type": "generic",
"size": "0x000010a8"
},
{
"name": "RT_ICON",
"language": "LANG_CHINESE",
"offset": "0x00026ce8",
"filetype": "data",
"sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
"type": "generic",
"size": "0x000010a8"
},
{
"name": "RT_ICON",
"language": "LANG_CHINESE",
"offset": "0x00026ce8",
"filetype": "data",
"sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
"type": "generic",
"size": "0x000010a8"
},
{
"name": "RT_ICON",
"language": "LANG_CHINESE",
"offset": "0x00026ce8",
"filetype": "data",
"sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
"type": "generic",
"size": "0x000010a8"
},
{
"name": "RT_ICON",
"language": "LANG_CHINESE",
"offset": "0x00026ce8",
"filetype": "data",
"sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
"type": "generic",
"size": "0x000010a8"
},
{
"name": "RT_ICON",
"language": "LANG_CHINESE",
"offset": "0x00026ce8",
"filetype": "data",
"sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
"type": "generic",
"size": "0x000010a8"
},
{
"name": "RT_ICON",
"language": "LANG_CHINESE",
"offset": "0x00026ce8",
"filetype": "data",
"sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
"type": "generic",
"size": "0x000010a8"
},
{
"name": "RT_ICON",
"language": "LANG_CHINESE",
"offset": "0x00026ce8",
"filetype": "data",
"sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
"type": "generic",
"size": "0x000010a8"
},
{
"name": "RT_ICON",
"language": "LANG_CHINESE",
"offset": "0x00026ce8",
"filetype": "data",
"sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
"type": "generic",
"size": "0x000010a8"
},
{
"name": "RT_DIALOG",
"language": "LANG_CHINESE",
"offset": "0x00015628",
"filetype": "empty",
"sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
"type": "generic",
"size": "0x000001d8"
},
{
"name": "RT_DIALOG",
"language": "LANG_CHINESE",
"offset": "0x00015628",
"filetype": "empty",
"sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
"type": "generic",
"size": "0x000001d8"
},
{
"name": "RT_GROUP_ICON",
"language": "LANG_CHINESE",
"offset": "0x00027d90",
"filetype": "data",
"sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
"type": "generic",
"size": "0x00000022"
},
{
"name": "RT_GROUP_ICON",
"language": "LANG_CHINESE",
"offset": "0x00027d90",
"filetype": "data",
"sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
"type": "generic",
"size": "0x00000022"
},
{
"name": "RT_GROUP_ICON",
"language": "LANG_CHINESE",
"offset": "0x00027d90",
"filetype": "data",
"sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
"type": "generic",
"size": "0x00000022"
},
{
"name": "RT_VERSION",
"language": "LANG_CHINESE",
"offset": "0x00031068",
"filetype": "data",
"sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
"type": "generic",
"size": "0x0000036c"
}
],
"references": [],
"name": "origin_langid"
},
{
"markcount": 1,
"families": [],
"description": "Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping",
"severity": 2,
"marks": [
{
"call": {
"category": "process",
"status": 1,
"stacktrace": [],
"api": "Process32NextW",
"return_value": 1,
"arguments": {
"process_name": "SearchProtocolHost.exe",
"snapshot_handle": "0x00000130",
"process_identifier": 3004
},
"time": 1563281586.5933,
"tid": 2384,
"flags": {}
},
"pid": 2816,
"type": "call",
"cid": 644
}
],
"references": [],
"name": "injection_process_search"
},
{
"markcount": 2,
"families": [],
"description": "The binary likely contains encrypted or compressed data indicative of a packer",
"severity": 2,
"marks": [
{
"entropy": 7.9218100640301,
"section": {
"size_of_data": "0x0000d000",
"virtual_address": "0x0001e000",
"entropy": 7.9218100640301,
"name": "UPX1",
"virtual_size": "0x0000d000"
},
"type": "generic",
"description": "A section with a high entropy has been found"
},
{
"entropy": 0.67096774193548,
"type": "generic",
"description": "Overall entropy of this PE file is high"
}
],
"references": [
"http:\/\/www.forensickb.com\/2013\/03\/file-entropy-explained.html",
"http:\/\/virii.es\/U\/Using%20Entropy%20Analysis%20to%20Find%20Encrypted%20and%20Packed%20Malware.pdf"
],
"name": "packer_entropy"
},
{
"markcount": 1,
"families": [],
"description": "Checks for the Locally Unique Identifier on the system for a suspicious privilege",
"severity": 2,
"marks": [
{
"call": {
"category": "system",
"status": 1,
"stacktrace": [],
"api": "LookupPrivilegeValueW",
"return_value": 1,
"arguments": {
"system_name": "",
"privilege_name": "SeDebugPrivilege"
},
"time": 1563281584.7503,
"tid": 2420,
"flags": {}
},
"pid": 2816,
"type": "call",
"cid": 149
}
],
"references": [],
"name": "privilege_luid_check"
},
{
"markcount": 1,
"families": [],
"description": "Expresses interest in specific running processes",
"severity": 2,
"marks": [
{
"category": "process",
"ioc": "a9f0a61264f4a377f48fed715ab2c29cc20e789e7f1f8713f1f8bb1dc9e0a286.bin",
"type": "ioc",
"description": null
}
],
"references": [],
"name": "process_interest"
},
{
"markcount": 39,
"families": [],
"description": "Repeatedly searches for a not-found process, you may want to run a web browser during analysis",
"severity": 2,
"marks": [
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 18,
"nt_status": -1073741811,
"api": "Process32NextW",
"return_value": 0,
"arguments": {
"process_name": "a9f0a61264f4a377f48fed715ab2c29cc20e789e7f1f8713f1f8bb1dc9e0a286.bin",
"snapshot_handle": "0x00000130",
"process_identifier": 2816
},
"time": 1563281586.5933,
"tid": 2384,
"flags": {}
},
"pid": 2816,
"type": "call",
"cid": 647
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 18,
"nt_status": -1073741811,
"api": "Process32NextW",
"return_value": 0,
"arguments": {
"process_name": "a9f0a61264f4a377f48fed715ab2c29cc20e789e7f1f8713f1f8bb1dc9e0a286.bin",
"snapshot_handle": "0x00000140",
"process_identifier": 2816
},
"time": 1563281589.7183,
"tid": 1468,
"flags": {}
},
"pid": 2816,
"type": "call",
"cid": 1356
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 18,
"nt_status": -1073741811,
"api": "Process32NextW",
"return_value": 0,
"arguments": {
"process_name": "a9f0a61264f4a377f48fed715ab2c29cc20e789e7f1f8713f1f8bb1dc9e0a286.bin",
"snapshot_handle": "0x00000144",
"process_identifier": 2816
},
"time": 1563281592.8122,
"tid": 1744,
"flags": {}
},
"pid": 2816,
"type": "call",
"cid": 2063
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 18,
"nt_status": -1073741811,
"api": "Process32NextW",
"return_value": 0,
"arguments": {
"process_name": "a9f0a61264f4a377f48fed715ab2c29cc20e789e7f1f8713f1f8bb1dc9e0a286.bin",
"snapshot_handle": "0x0000013c",
"process_identifier": 2816
},
"time": 1563281595.9213,
"tid": 316,
"flags": {}
},
"pid": 2816,
"type": "call",
"cid": 2778
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 18,
"nt_status": -1073741811,
"api": "Process32NextW",
"return_value": 0,
"arguments": {
"process_name": "a9f0a61264f4a377f48fed715ab2c29cc20e789e7f1f8713f1f8bb1dc9e0a286.bin",
"snapshot_handle": "0x0000001c",
"process_identifier": 2816
},
"time": 1563281599.0152,
"tid": 2740,
"flags": {}
},
"pid": 2816,
"type": "call",
"cid": 3486
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 18,
"nt_status": -1073741811,
"api": "Process32NextW",
"return_value": 0,
"arguments": {
"process_name": "a9f0a61264f4a377f48fed715ab2c29cc20e789e7f1f8713f1f8bb1dc9e0a286.bin",
"snapshot_handle": "0x00000130",
"process_identifier": 2816
},
"time": 1563281602.0933,
"tid": 2244,
"flags": {}
},
"pid": 2816,
"type": "call",
"cid": 4192
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 18,
"nt_status": -1073741811,
"api": "Process32NextW",
"return_value": 0,
"arguments": {
"process_name": "a9f0a61264f4a377f48fed715ab2c29cc20e789e7f1f8713f1f8bb1dc9e0a286.bin",
"snapshot_handle": "0x00000140",
"process_identifier": 2816
},
"time": 1563281605.1713,
"tid": 3020,
"flags": {}
},
"pid": 2816,
"type": "call",
"cid": 4894
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 18,
"nt_status": -1073741811,
"api": "Process32NextW",
"return_value": 0,
"arguments": {
"process_name": "a9f0a61264f4a377f48fed715ab2c29cc20e789e7f1f8713f1f8bb1dc9e0a286.bin",
"snapshot_handle": "0x00000144",
"process_identifier": 2816
},
"time": 1563281608.2343,
"tid": 2252,
"flags": {}
},
"pid": 2816,
"type": "call",
"cid": 5603
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 18,
"nt_status": -1073741811,
"api": "Process32NextW",
"return_value": 0,
"arguments": {
"process_name": "a9f0a61264f4a377f48fed715ab2c29cc20e789e7f1f8713f1f8bb1dc9e0a286.bin",
"snapshot_handle": "0x0000013c",
"process_identifier": 2816
},
"time": 1563281611.3122,
"tid": 2484,
"flags": {}
},
"pid": 2816,
"type": "call",
"cid": 6306
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 18,
"nt_status": -1073741811,
"api": "Process32NextW",
"return_value": 0,
"arguments": {
"process_name": "a9f0a61264f4a377f48fed715ab2c29cc20e789e7f1f8713f1f8bb1dc9e0a286.bin",
"snapshot_handle": "0x0000001c",
"process_identifier": 2816
},
"time": 1563281614.4062,
"tid": 1348,
"flags": {}
},
"pid": 2816,
"type": "call",
"cid": 7016
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 18,
"nt_status": -1073741811,
"api": "Process32NextW",
"return_value": 0,
"arguments": {
"process_name": "a9f0a61264f4a377f48fed715ab2c29cc20e789e7f1f8713f1f8bb1dc9e0a286.bin",
"snapshot_handle": "0x00000130",
"process_identifier": 2816
},
"time": 1563281617.4683,
"tid": 624,
"flags": {}
},
"pid": 2816,
"type": "call",
"cid": 7721
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 18,
"nt_status": -1073741811,
"api": "Process32NextW",
"return_value": 0,
"arguments": {
"process_name": "a9f0a61264f4a377f48fed715ab2c29cc20e789e7f1f8713f1f8bb1dc9e0a286.bin",
"snapshot_handle": "0x00000140",
"process_identifier": 2816
},
"time": 1563281620.5622,
"tid": 2280,
"flags": {}
},
"pid": 2816,
"type": "call",
"cid": 8423
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 18,
"nt_status": -1073741811,
"api": "Process32NextW",
"return_value": 0,
"arguments": {
"process_name": "a9f0a61264f4a377f48fed715ab2c29cc20e789e7f1f8713f1f8bb1dc9e0a286.bin",
"snapshot_handle": "0x000000a4",
"process_identifier": 2816
},
"time": 1563281623.6402,
"tid": 2600,
"flags": {}
},
"pid": 2816,
"type": "call",
"cid": 9125
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 18,
"nt_status": -1073741811,
"api": "Process32NextW",
"return_value": 0,
"arguments": {
"process_name": "a9f0a61264f4a377f48fed715ab2c29cc20e789e7f1f8713f1f8bb1dc9e0a286.bin",
"snapshot_handle": "0x0000013c",
"process_identifier": 2816
},
"time": 1563281626.7183,
"tid": 1776,
"flags": {}
},
"pid": 2816,
"type": "call",
"cid": 9827
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 18,
"nt_status": -1073741811,
"api": "Process32NextW",
"return_value": 0,
"arguments": {
"process_name": "a9f0a61264f4a377f48fed715ab2c29cc20e789e7f1f8713f1f8bb1dc9e0a286.bin",
"snapshot_handle": "0x0000001c",
"process_identifier": 2816
},
"time": 1563281629.7963,
"tid": 2204,
"flags": {}
},
"pid": 2816,
"type": "call",
"cid": 10529
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 18,
"nt_status": -1073741811,
"api": "Process32NextW",
"return_value": 0,
"arguments": {
"process_name": "a9f0a61264f4a377f48fed715ab2c29cc20e789e7f1f8713f1f8bb1dc9e0a286.bin",
"snapshot_handle": "0x00000130",
"process_identifier": 2816
},
"time": 1563281632.8753,
"tid": 2568,
"flags": {}
},
"pid": 2816,
"type": "call",
"cid": 11231
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 18,
"nt_status": -1073741811,
"api": "Process32NextW",
"return_value": 0,
"arguments": {
"process_name": "a9f0a61264f4a377f48fed715ab2c29cc20e789e7f1f8713f1f8bb1dc9e0a286.bin",
"snapshot_handle": "0x00000140",
"process_identifier": 2816
},
"time": 1563281635.9532,
"tid": 2584,
"flags": {}
},
"pid": 2816,
"type": "call",
"cid": 11933
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 18,
"nt_status": -1073741811,
"api": "Process32NextW",
"return_value": 0,
"arguments": {
"process_name": "a9f0a61264f4a377f48fed715ab2c29cc20e789e7f1f8713f1f8bb1dc9e0a286.bin",
"snapshot_handle": "0x000000a4",
"process_identifier": 2816
},
"time": 1563281639.0312,
"tid": 344,
"flags": {}
},
"pid": 2816,
"type": "call",
"cid": 12642
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 18,
"nt_status": -1073741811,
"api": "Process32NextW",
"return_value": 0,
"arguments": {
"process_name": "a9f0a61264f4a377f48fed715ab2c29cc20e789e7f1f8713f1f8bb1dc9e0a286.bin",
"snapshot_handle": "0x0000013c",
"process_identifier": 2816
},
"time": 1563281642.1093,
"tid": 2824,
"flags": {}
},
"pid": 2816,
"type": "call",
"cid": 13345
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 18,
"nt_status": -1073741811,
"api": "Process32NextW",
"return_value": 0,
"arguments": {
"process_name": "a9f0a61264f4a377f48fed715ab2c29cc20e789e7f1f8713f1f8bb1dc9e0a286.bin",
"snapshot_handle": "0x0000001c",
"process_identifier": 2816
},
"time": 1563281645.2183,
"tid": 2384,
"flags": {}
},
"pid": 2816,
"type": "call",
"cid": 14047
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 18,
"nt_status": -1073741811,
"api": "Process32NextW",
"return_value": 0,
"arguments": {
"process_name": "a9f0a61264f4a377f48fed715ab2c29cc20e789e7f1f8713f1f8bb1dc9e0a286.bin",
"snapshot_handle": "0x00000130",
"process_identifier": 2816
},
"time": 1563281648.3593,
"tid": 2248,
"flags": {}
},
"pid": 2816,
"type": "call",
"cid": 14749
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 18,
"nt_status": -1073741811,
"api": "Process32NextW",
"return_value": 0,
"arguments": {
"process_name": "a9f0a61264f4a377f48fed715ab2c29cc20e789e7f1f8713f1f8bb1dc9e0a286.bin",
"snapshot_handle": "0x00000140",
"process_identifier": 2816
},
"time": 1563281651.5152,
"tid": 588,
"flags": {}
},
"pid": 2816,
"type": "call",
"cid": 15451
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 18,
"nt_status": -1073741811,
"api": "Process32NextW",
"return_value": 0,
"arguments": {
"process_name": "a9f0a61264f4a377f48fed715ab2c29cc20e789e7f1f8713f1f8bb1dc9e0a286.bin",
"snapshot_handle": "0x000000a4",
"process_identifier": 2816
},
"time": 1563281654.6253,
"tid": 2208,
"flags": {}
},
"pid": 2816,
"type": "call",
"cid": 16153
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 18,
"nt_status": -1073741811,
"api": "Process32NextW",
"return_value": 0,
"arguments": {
"process_name": "a9f0a61264f4a377f48fed715ab2c29cc20e789e7f1f8713f1f8bb1dc9e0a286.bin",
"snapshot_handle": "0x0000013c",
"process_identifier": 2816
},
"time": 1563281657.7343,
"tid": 2292,
"flags": {}
},
"pid": 2816,
"type": "call",
"cid": 16853
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 18,
"nt_status": -1073741811,
"api": "Process32NextW",
"return_value": 0,
"arguments": {
"process_name": "a9f0a61264f4a377f48fed715ab2c29cc20e789e7f1f8713f1f8bb1dc9e0a286.bin",
"snapshot_handle": "0x0000001c",
"process_identifier": 2816
},
"time": 1563281660.8433,
"tid": 2892,
"flags": {}
},
"pid": 2816,
"type": "call",
"cid": 17545
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 18,
"nt_status": -1073741811,
"api": "Process32NextW",
"return_value": 0,
"arguments": {
"process_name": "a9f0a61264f4a377f48fed715ab2c29cc20e789e7f1f8713f1f8bb1dc9e0a286.bin",
"snapshot_handle": "0x00000130",
"process_identifier": 2816
},
"time": 1563281663.9213,
"tid": 1704,
"flags": {}
},
"pid": 2816,
"type": "call",
"cid": 18237
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 18,
"nt_status": -1073741811,
"api": "Process32NextW",
"return_value": 0,
"arguments": {
"process_name": "a9f0a61264f4a377f48fed715ab2c29cc20e789e7f1f8713f1f8bb1dc9e0a286.bin",
"snapshot_handle": "0x00000140",
"process_identifier": 2816
},
"time": 1563281667.0003,
"tid": 2792,
"flags": {}
},
"pid": 2816,
"type": "call",
"cid": 18936
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 18,
"nt_status": -1073741811,
"api": "Process32NextW",
"return_value": 0,
"arguments": {
"process_name": "a9f0a61264f4a377f48fed715ab2c29cc20e789e7f1f8713f1f8bb1dc9e0a286.bin",
"snapshot_handle": "0x000000a4",
"process_identifier": 2816
},
"time": 1563281670.1253,
"tid": 2600,
"flags": {}
},
"pid": 2816,
"type": "call",
"cid": 19636
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 18,
"nt_status": -1073741811,
"api": "Process32NextW",
"return_value": 0,
"arguments": {
"process_name": "a9f0a61264f4a377f48fed715ab2c29cc20e789e7f1f8713f1f8bb1dc9e0a286.bin",
"snapshot_handle": "0x0000013c",
"process_identifier": 2816
},
"time": 1563281673.2032,
"tid": 2440,
"flags": {}
},
"pid": 2816,
"type": "call",
"cid": 20336
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 18,
"nt_status": -1073741811,
"api": "Process32NextW",
"return_value": 0,
"arguments": {
"process_name": "a9f0a61264f4a377f48fed715ab2c29cc20e789e7f1f8713f1f8bb1dc9e0a286.bin",
"snapshot_handle": "0x0000001c",
"process_identifier": 2816
},
"time": 1563281676.2812,
"tid": 368,
"flags": {}
},
"pid": 2816,
"type": "call",
"cid": 21029
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 18,
"nt_status": -1073741811,
"api": "Process32NextW",
"return_value": 0,
"arguments": {
"process_name": "a9f0a61264f4a377f48fed715ab2c29cc20e789e7f1f8713f1f8bb1dc9e0a286.bin",
"snapshot_handle": "0x00000130",
"process_identifier": 2816
},
"time": 1563281679.3753,
"tid": 2348,
"flags": {}
},
"pid": 2816,
"type": "call",
"cid": 21721
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 18,
"nt_status": -1073741811,
"api": "Process32NextW",
"return_value": 0,
"arguments": {
"process_name": "a9f0a61264f4a377f48fed715ab2c29cc20e789e7f1f8713f1f8bb1dc9e0a286.bin",
"snapshot_handle": "0x00000148",
"process_identifier": 2816
},
"time": 1563281682.4532,
"tid": 2844,
"flags": {}
},
"pid": 2816,
"type": "call",
"cid": 22431
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 18,
"nt_status": -1073741811,
"api": "Process32NextW",
"return_value": 0,
"arguments": {
"process_name": "a9f0a61264f4a377f48fed715ab2c29cc20e789e7f1f8713f1f8bb1dc9e0a286.bin",
"snapshot_handle": "0x00000140",
"process_identifier": 2816
},
"time": 1563281685.5463,
"tid": 2596,
"flags": {}
},
"pid": 2816,
"type": "call",
"cid": 23124
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 18,
"nt_status": -1073741811,
"api": "Process32NextW",
"return_value": 0,
"arguments": {
"process_name": "a9f0a61264f4a377f48fed715ab2c29cc20e789e7f1f8713f1f8bb1dc9e0a286.bin",
"snapshot_handle": "0x0000001c",
"process_identifier": 2816
},
"time": 1563281688.6093,
"tid": 2392,
"flags": {}
},
"pid": 2816,
"type": "call",
"cid": 23824
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 18,
"nt_status": -1073741811,
"api": "Process32NextW",
"return_value": 0,
"arguments": {
"process_name": "a9f0a61264f4a377f48fed715ab2c29cc20e789e7f1f8713f1f8bb1dc9e0a286.bin",
"snapshot_handle": "0x00000138",
"process_identifier": 2816
},
"time": 1563281691.7183,
"tid": 2140,
"flags": {}
},
"pid": 2816,
"type": "call",
"cid": 24533
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 18,
"nt_status": -1073741811,
"api": "Process32NextW",
"return_value": 0,
"arguments": {
"process_name": "a9f0a61264f4a377f48fed715ab2c29cc20e789e7f1f8713f1f8bb1dc9e0a286.bin",
"snapshot_handle": "0x00000130",
"process_identifier": 2816
},
"time": 1563281694.8122,
"tid": 1704,
"flags": {}
},
"pid": 2816,
"type": "call",
"cid": 25237
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 18,
"nt_status": -1073741811,
"api": "Process32NextW",
"return_value": 0,
"arguments": {
"process_name": "a9f0a61264f4a377f48fed715ab2c29cc20e789e7f1f8713f1f8bb1dc9e0a286.bin",
"snapshot_handle": "0x00000148",
"process_identifier": 2816
},
"time": 1563281697.9213,
"tid": 2104,
"flags": {}
},
"pid": 2816,
"type": "call",
"cid": 25938
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 18,
"nt_status": -1073741811,
"api": "Process32NextW",
"return_value": 0,
"arguments": {
"process_name": "a9f0a61264f4a377f48fed715ab2c29cc20e789e7f1f8713f1f8bb1dc9e0a286.bin",
"snapshot_handle": "0x00000140",
"process_identifier": 2816
},
"time": 1563281701.0152,
"tid": 916,
"flags": {}
},
"pid": 2816,
"type": "call",
"cid": 26649
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 18,
"nt_status": -1073741811,
"api": "Process32NextW",
"return_value": 0,
"arguments": {
"process_name": "a9f0a61264f4a377f48fed715ab2c29cc20e789e7f1f8713f1f8bb1dc9e0a286.bin",
"snapshot_handle": "0x0000001c",
"process_identifier": 2816
},
"time": 1563281704.1253,
"tid": 1508,
"flags": {}
},
"pid": 2816,
"type": "call",
"cid": 27351
}
],
"references": [],
"name": "process_needed"
},
{
"markcount": 2,
"families": [],
"description": "The executable is compressed using UPX",
"severity": 2,
"marks": [
{
"section": "UPX0",
"type": "generic",
"description": "Section name indicates UPX"
},
{
"section": "UPX1",
"type": "generic",
"description": "Section name indicates UPX"
}
],
"references": [],
"name": "packer_upx"
},
{
"markcount": 1,
"families": [],
"description": "Attempts to detect Cuckoo Sandbox through the presence of a file",
"severity": 3,
"marks": [
{
"category": "file",
"ioc": "C:\\cuckoo-agent\\agent.py",
"type": "ioc",
"description": null
}
],
"references": [],
"name": "antisandbox_cuckoo_files"
}
]Yara
The Yara rules did not detect anything in the file.
Network
{
"tls": [],
"udp": [
{
"src": "192.168.56.101",
"dst": "192.168.56.255",
"offset": 546,
"time": 3.0789861679077,
"dport": 137,
"sport": 137
},
{
"src": "192.168.56.101",
"dst": "192.168.56.255",
"offset": 5226,
"time": 9.0794999599457,
"dport": 138,
"sport": 138
},
{
"src": "192.168.56.101",
"dst": "224.0.0.252",
"offset": 7070,
"time": 3.01478099823,
"dport": 5355,
"sport": 51001
},
{
"src": "192.168.56.101",
"dst": "224.0.0.252",
"offset": 7398,
"time": 1.0227100849152,
"dport": 5355,
"sport": 53595
},
{
"src": "192.168.56.101",
"dst": "224.0.0.252",
"offset": 7726,
"time": 3.0237340927124,
"dport": 5355,
"sport": 53848
},
{
"src": "192.168.56.101",
"dst": "224.0.0.252",
"offset": 8054,
"time": 1.5359871387482,
"dport": 5355,
"sport": 54255
},
{
"src": "192.168.56.101",
"dst": "224.0.0.252",
"offset": 8382,
"time": -0.090831995010376,
"dport": 5355,
"sport": 55314
},
{
"src": "192.168.56.101",
"dst": "239.255.255.250",
"offset": 8710,
"time": 1.5325040817261,
"dport": 1900,
"sport": 1900
},
{
"src": "192.168.56.101",
"dst": "239.255.255.250",
"offset": 28120,
"time": 1.0437200069427,
"dport": 3702,
"sport": 49152
},
{
"src": "192.168.56.101",
"dst": "239.255.255.250",
"offset": 36504,
"time": 3.1103310585022,
"dport": 1900,
"sport": 53598
}
],
"dns_servers": [],
"http": [],
"icmp": [],
"smtp": [],
"tcp": [],
"smtp_ex": [],
"mitm": [],
"hosts": [],
"pcap_sha256": "e698a643a0fc43a49c7297d275aaf81ad2b564632bd82458de475b78e12f529b",
"dns": [],
"http_ex": [],
"domains": [],
"dead_hosts": [],
"sorted_pcap_sha256": "fc373fbb9c82971248c6b060ed095087a523464a25a14950330a46f19f23ab9c",
"irc": [],
"https_ex": []
}Screenshots
ravroron.exe removal instructions
The instructions below shows how to remove ravroron.exe with help from the FreeFixer removal tool. Basically, you install FreeFixer, scan your computer, check the ravroron.exe file for removal, restart your computer and scan it again to verify that ravroron.exe has been successfully removed. Here are the removal instructions in more detail:
- Download and install FreeFixer: http://www.freefixer.com/download.html
- Start FreeFixer and press the Start Scan button. The scan will finish in approximately five minutes.
- When the scan is finished, locate ravroron.exe in the scan result and tick the checkbox next to the ravroron.exe file. Do not check any other file for removal unless you are 100% sure you want to delete it. Tip: Press CTRL-F to open up FreeFixer's search dialog to quickly locate ravroron.exe in the scan result.
c:\downloads\ravroron.exe 
- Scroll down to the bottom of the scan result and press the Fix button. FreeFixer will now delete the ravroron.exe file.
- Restart your computer.
- Start FreeFixer and scan your computer again. If ravroron.exe still remains in the scan result, proceed with the next step. If ravroron.exe is gone from the scan result you're done.
- If ravroron.exe still remains in the scan result, check its checkbox again in the scan result and click Fix.
- Restart your computer.
- Start FreeFixer and scan your computer again. Verify that ravroron.exe no longer appear in the scan result.
Hashes [?]
| Property | Value |
|---|---|
| MD5 | 6c8a1805ea953825d9e5790f85189994 |
| SHA256 | a9f0a61264f4a377f48fed715ab2c29cc20e789e7f1f8713f1f8bb1dc9e0a286 |
Error Messages
These are some of the error messages that can appear related to ravroron.exe:
ravroron.exe has encountered a problem and needs to close. We are sorry for the inconvenience.
ravroron.exe - Application Error. The instruction at "0xXXXXXXXX" referenced memory at "0xXXXXXXXX". The memory could not be "read/written". Click on OK to terminate the program.
RavRoron has stopped working.
End Program - ravroron.exe. This program is not responding.
ravroron.exe is not a valid Win32 application.
ravroron.exe - Application Error. The application failed to initialize properly (0xXXXXXXXX). Click OK to terminate the application.
What will you do with ravroron.exe?
To help other users, please let us know what you will do with ravroron.exe:
Comments
Please share with the other users what you think about this file. What does this file do? Is it legitimate or something that your computer is better without? Do you know how it was installed on your system? Did you install it yourself or did it come bundled with some other software? Is it running smoothly or do you get some error message? Any information that will help to document this file is welcome. Thank you for your contributions.
I'm reading all new comments so don't hesitate to post a question about the file. If I don't have the answer perhaps another user can help you.
No comments posted yet.