What is update_player.exe?
update_player.exe is usually located in the 'c:\downloads\' folder.
Some of the anti-virus scanners at VirusTotal detected update_player.exe.
If you have additional information about the file, please share it with the FreeFixer users by posting a comment at the bottom of this page.
Vendor and version information [?]
update_player.exe does not have any version or vendor information.
Digital signatures [?]
update_player.exe is not signed.
VirusTotal report
55 of the 73 anti-virus programs at VirusTotal detected the update_player.exe file. That's a 75% detection rate.
| Scanner | Detection Name |
|---|---|
| Acronis | suspicious |
| Ad-Aware | Gen:Trojan.Brresmon.Gen.1 |
| AegisLab | Trojan.Win32.Generic.4!c |
| AhnLab-V3 | Trojan/Win32.Ransom.R196945 |
| Alibaba | Trojan:Win32/Fsysna.c2419b21 |
| Antiy-AVL | Trojan/Win32.Fsysna |
| APEX | Malicious |
| Arcabit | Trojan.Brresmon.Gen.1 |
| Avast | Win32:Evo-gen [Susp] |
| AVG | FileRepMetagen [Malware] |
| Avira | TR/Crypt.XPACK.Gen5 |
| BitDefender | Gen:Trojan.Brresmon.Gen.1 |
| Comodo | Malware@#3tl66d3mhfpvl |
| CrowdStrike | win/malicious_confidence_100% (W) |
| Cybereason | malicious.c74322 |
| Cylance | Unsafe |
| Cyren | W32/S-a94b9b9a!Eldorado |
| DrWeb | Trojan.Encoder.858 |
| eGambit | Generic.Malware |
| Emsisoft | Gen:Trojan.Brresmon.Gen.1 (B) |
| Endgame | malicious (high confidence) |
| ESET-NOD32 | a variant of Win32/Kryptik.FPQY |
| F-Prot | W32/S-a94b9b9a!Eldorado |
| F-Secure | Trojan.TR/Crypt.XPACK.Gen5 |
| FireEye | Generic.mg.5dec0ecc74322800 |
| Fortinet | W32/Kryptik.FQRB!tr |
| GData | Gen:Trojan.Brresmon.Gen.1 |
| Ikarus | Trojan.Win32.Crypt |
| Invincea | heuristic |
| Jiangmin | TrojanDownloader.Upatre.afzx |
| K7AntiVirus | Trojan ( 005088891 ) |
| K7GW | Trojan ( 005088891 ) |
| Kaspersky | Trojan.Win32.Fsysna.ehfa |
| MAX | malware (ai score=100) |
| McAfee | Emotet-FAV!5DEC0ECC7432 |
| McAfee-GW-Edition | BehavesLike.Win32.Backdoor.cc |
| Microsoft | Ransom:Win32/Troldesh.A |
| MicroWorld-eScan | Gen:Trojan.Brresmon.Gen.1 |
| NANO-Antivirus | Trojan.Win32.Fsysna.emtjaw |
| Paloalto | generic.ml |
| Panda | Trj/Genetic.gen |
| Qihoo-360 | Win32/Trojan.1e8 |
| Rising | Ransom.Troldesh!8.5D1 (CLOUD) |
| SentinelOne | DFI - Malicious PE |
| Sophos | Mal/Generic-S |
| Symantec | Ransom.Troldesh |
| Tencent | Win32.Trojan.Inject.Auto |
| Trapmine | malicious.high.ml.score |
| TrendMicro | Ransom_CRYPSHED.F117CE |
| TrendMicro-HouseCall | Ransom_CRYPSHED.F117CE |
| VIPRE | Trojan.Win32.Generic!BT |
| Webroot | W32.Trojan.Gen |
| Yandex | Trojan.Fsysna! |
| Zillya | Trojan.Kryptik.Win32.1107163 |
| ZoneAlarm | Trojan.Win32.Fsysna.ehfa |
Sandbox Report
The following information was gathered by executing the file inside Cuckoo Sandbox.
Summary
Successfully executed process in sandbox.
Summary
{
"file_created": [
"C:\\Users\\cuck\\AppData\\Local\\Temp\\6893A5D897\\lock",
"C:\\ProgramData\\Windows\\csrss.exe",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\6893A5D897\\state.tmp"
],
"regkey_written": [
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\xi",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\Client Server Runtime Subsystem",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\xVersion"
],
"dll_loaded": [
"kernel32",
"gdi32.dll",
"SHELL32.dll",
"kernel32.dll",
"oleaut32.dll",
"netapi32.dll",
"ntdll.dll",
"USER32.DLL",
"KERNEL32.DLL",
"API-MS-Win-Core-LocalRegistry-L1-1-0.dll",
"user32",
"NETAPI32.DLL",
"advapi32.dll",
"ole32.dll",
"CRYPTSP.dll",
"USER32.dll",
"ADVAPI32.dll",
"OLEAUT32.dll",
"ADVAPI32.DLL",
"shell32.dll",
"rpcrt4.dll",
"SETUPAPI.dll",
"WS2_32.dll",
"user32.dll"
],
"file_opened": [
"C:\\",
"\\\\?\\PIPE\\wkssvc",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\6893A5D897\\state.tmp",
"\\\\?\\PIPE\\srvsvc",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\d96635799d9f007dc343386df35f96eb29881d52f6f269de998e475cdcfbf031.bin",
"C:\\Windows\\SysWOW64\\en-US\\KERNELBASE.dll.mui"
],
"regkey_opened": [
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{3f5cc1b5-70f9-11e8-b07b-806e6f6e6963}\\",
"HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion",
"HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows NT\\Rpc",
"HKEY_CURRENT_USER\\SOFTWARE\\System32\\Configuration\\",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Setup",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Rpc",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{3f5cc1b6-70f9-11e8-b07b-806e6f6e6963}\\",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\System32\\Configuration\\"
],
"file_written": [
"\\\\?\\PIPE\\wkssvc",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\6893A5D897\\state.tmp",
"C:\\ProgramData\\Windows\\csrss.exe",
"\\\\?\\PIPE\\srvsvc"
],
"connects_ip": [
"76.73.17.194",
"208.83.223.34",
"127.0.0.1",
"154.35.32.5"
],
"file_exists": [
"C:\\ProgramData\\Windows\\"
],
"file_failed": [
"C:\\Users\\cuck\\AppData\\Local\\Temp\\6893A5D897\\unverified-consensus",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\sdfkmsdf",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\6893A5D897\\cached-extrainfo",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\6893A5D897\\unverified-microdesc-consensus",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\6893A5D897\\cached-microdesc-consensus",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\6893A5D897\\cached-descriptors",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\6893A5D897\\cached-certs",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\6893A5D897\\cached-microdescs.new",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\6893A5D897\\cached-microdescs",
"C:\\Users\\cuck\\AppData\\Roaming\\tor\\geoip6",
"C:\\ProgramData\\System32\\xVersion",
"C:\\Users\\cuck\\AppData\\Roaming\\System32\\xVersion",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\6893A5D897\\cached-consensus",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\6893A5D897\\router-stability",
"C:\\Users\\cuck\\AppData\\Roaming\\tor\\geoip"
],
"command_line": [
"\"C:\\Users\\cuck\\AppData\\Local\\Temp\\d96635799d9f007dc343386df35f96eb29881d52f6f269de998e475cdcfbf031.bin\" "
],
"file_read": [
"\\\\?\\PIPE\\wkssvc",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\d96635799d9f007dc343386df35f96eb29881d52f6f269de998e475cdcfbf031.bin",
"\\\\?\\PIPE\\srvsvc"
],
"regkey_read": [
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Setup\\SourcePath",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\DevicePath",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{3f5cc1b5-70f9-11e8-b07b-806e6f6e6963}\\Generation",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{3f5cc1b6-70f9-11e8-b07b-806e6f6e6963}\\Generation",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Rpc\\MaxRpcSize",
"HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\SystemSetupInProgress",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{3f5cc1b5-70f9-11e8-b07b-806e6f6e6963}\\Data",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\\DisableMetaFiles",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SQMClient\\Windows\\CEIPEnable",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{3f5cc1b6-70f9-11e8-b07b-806e6f6e6963}\\Data",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\xVersion",
"HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\OOBEInProgress",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\ComputerName\\ActiveComputerName\\ComputerName"
],
"directory_enumerated": [
"C:\\Users\\cuck\\AppData\\Local\\Temp\\6893A5D897\\cached-extrainfo.new",
"C:\\Users\\cuck\\AppData\\Roaming\\tor\\torrc",
"C:\\Users\\cuck\\AppData\\Roaming\\tor\\torrc-defaults",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\6893A5D897",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\6893A5D897\\cached-descriptors.new",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\6893A5D897\\state"
],
"directory_created": [
"C:\\Users\\cuck\\AppData\\Local\\Temp\\6893A5D897\\",
"C:\\ProgramData\\Windows\\"
]
}Dropped
[
{
"yara": [],
"sha1": "275738f8ddc8308372981f65156db60be1090b46",
"name": "d96635799d9f007d_csrss.exe",
"filepath": "C:\\ProgramData\\Windows\\csrss.exe",
"type": "PE32 executable (GUI) Intel 80386, for MS Windows",
"sha256": "d96635799d9f007dc343386df35f96eb29881d52f6f269de998e475cdcfbf031",
"urls": [],
"crc32": "A7299C56",
"path": "\/home\/hpuser\/.cuckoo\/storage\/analyses\/1466\/files\/d96635799d9f007d_csrss.exe",
"ssdeep": null,
"size": 918528,
"sha512": "f87cb32553b5e2c6b97bc5a3c67bd811f47bfe14598541df9c6eeee992f904cb7f278dc1f19170208cb751411ffb82d646feb34ea6e682da2c04868ef2f3b9ca",
"pids": [
2272
],
"md5": "5dec0ecc74322800c118851e4dfac06e"
},
{
"yara": [],
"sha1": "9b97cc691383a1540bfb97d1c89f2921f30559b1",
"name": "5b3cf94061849a7a_state",
"filepath": "c:\\users\\cuck\\appdata\\local\\temp\\6893a5d897\\state",
"type": "ASCII text, with CRLF line terminators",
"sha256": "5b3cf94061849a7aa20fab9c497bf8823b09e55126f157497a53bf7c3d7704d2",
"urls": [],
"crc32": "AF6483E7",
"path": "\/home\/hpuser\/.cuckoo\/storage\/analyses\/1466\/files\/5b3cf94061849a7a_state",
"ssdeep": null,
"size": 199,
"sha512": "2e026bf3041a47d73044d984d060ce7abaf4c6275a9952ce91764dd888eef271d46da0e89f2f189a455542b2e9a24938d937d68392ef93f4b8b7b0bcba5cdcb1",
"pids": [
2272
],
"md5": "897f830aea3e2e7c91acc3ff79b73206"
}
]Generic
[
{
"process_path": "C:\\Users\\cuck\\AppData\\Local\\Temp\\d96635799d9f007dc343386df35f96eb29881d52f6f269de998e475cdcfbf031.bin",
"process_name": "d96635799d9f007dc343386df35f96eb29881d52f6f269de998e475cdcfbf031.bin",
"pid": 2272,
"summary": {
"file_created": [
"C:\\Users\\cuck\\AppData\\Local\\Temp\\6893A5D897\\lock",
"C:\\ProgramData\\Windows\\csrss.exe",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\6893A5D897\\state.tmp"
],
"regkey_written": [
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\xi",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\Client Server Runtime Subsystem",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\xVersion"
],
"dll_loaded": [
"API-MS-Win-Core-LocalRegistry-L1-1-0.dll",
"user32.dll",
"USER32.DLL",
"NETAPI32.DLL",
"CRYPTSP.dll",
"ADVAPI32.DLL",
"kernel32.dll",
"gdi32.dll",
"SHELL32.dll",
"KERNEL32.DLL",
"shell32.dll",
"OLEAUT32.dll",
"netapi32.dll",
"advapi32.dll",
"ADVAPI32.dll",
"rpcrt4.dll",
"ole32.dll",
"SETUPAPI.dll",
"WS2_32.dll",
"USER32.dll",
"oleaut32.dll"
],
"file_opened": [
"C:\\",
"\\\\?\\PIPE\\wkssvc",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\6893A5D897\\state.tmp",
"\\\\?\\PIPE\\srvsvc",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\d96635799d9f007dc343386df35f96eb29881d52f6f269de998e475cdcfbf031.bin",
"C:\\Windows\\SysWOW64\\en-US\\KERNELBASE.dll.mui"
],
"regkey_opened": [
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{3f5cc1b5-70f9-11e8-b07b-806e6f6e6963}\\",
"HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion",
"HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows NT\\Rpc",
"HKEY_CURRENT_USER\\SOFTWARE\\System32\\Configuration\\",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Setup",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Rpc",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{3f5cc1b6-70f9-11e8-b07b-806e6f6e6963}\\",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\System32\\Configuration\\"
],
"file_written": [
"\\\\?\\PIPE\\wkssvc",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\6893A5D897\\state.tmp",
"C:\\ProgramData\\Windows\\csrss.exe",
"\\\\?\\PIPE\\srvsvc"
],
"connects_ip": [
"76.73.17.194",
"208.83.223.34",
"127.0.0.1",
"154.35.32.5"
],
"file_exists": [
"C:\\ProgramData\\Windows\\"
],
"file_failed": [
"C:\\Users\\cuck\\AppData\\Local\\Temp\\6893A5D897\\unverified-consensus",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\6893A5D897\\cached-extrainfo",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\6893A5D897\\unverified-microdesc-consensus",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\6893A5D897\\cached-microdesc-consensus",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\6893A5D897\\cached-descriptors",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\6893A5D897\\cached-certs",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\6893A5D897\\cached-microdescs.new",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\6893A5D897\\cached-microdescs",
"C:\\Users\\cuck\\AppData\\Roaming\\tor\\geoip6",
"C:\\ProgramData\\System32\\xVersion",
"C:\\Users\\cuck\\AppData\\Roaming\\System32\\xVersion",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\6893A5D897\\cached-consensus",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\6893A5D897\\router-stability",
"C:\\Users\\cuck\\AppData\\Roaming\\tor\\geoip"
],
"file_read": [
"\\\\?\\PIPE\\wkssvc",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\d96635799d9f007dc343386df35f96eb29881d52f6f269de998e475cdcfbf031.bin",
"\\\\?\\PIPE\\srvsvc"
],
"regkey_read": [
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Setup\\SourcePath",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\DevicePath",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{3f5cc1b5-70f9-11e8-b07b-806e6f6e6963}\\Generation",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{3f5cc1b6-70f9-11e8-b07b-806e6f6e6963}\\Generation",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Rpc\\MaxRpcSize",
"HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\SystemSetupInProgress",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{3f5cc1b5-70f9-11e8-b07b-806e6f6e6963}\\Data",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SQMClient\\Windows\\CEIPEnable",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{3f5cc1b6-70f9-11e8-b07b-806e6f6e6963}\\Data",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\xVersion",
"HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\OOBEInProgress",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\ComputerName\\ActiveComputerName\\ComputerName"
],
"directory_enumerated": [
"C:\\Users\\cuck\\AppData\\Local\\Temp\\6893A5D897\\cached-extrainfo.new",
"C:\\Users\\cuck\\AppData\\Roaming\\tor\\torrc",
"C:\\Users\\cuck\\AppData\\Roaming\\tor\\torrc-defaults",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\6893A5D897",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\6893A5D897\\cached-descriptors.new",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\6893A5D897\\state"
],
"directory_created": [
"C:\\Users\\cuck\\AppData\\Local\\Temp\\6893A5D897\\",
"C:\\ProgramData\\Windows\\"
]
},
"first_seen": 1564685610.6711,
"ppid": 2420
},
{
"process_path": "C:\\Users\\cuck\\AppData\\Local\\Temp\\d96635799d9f007dc343386df35f96eb29881d52f6f269de998e475cdcfbf031.bin",
"process_name": "d96635799d9f007dc343386df35f96eb29881d52f6f269de998e475cdcfbf031.bin",
"pid": 2420,
"summary": {
"file_failed": [
"C:\\Users\\cuck\\AppData\\Local\\Temp\\sdfkmsdf"
],
"command_line": [
"\"C:\\Users\\cuck\\AppData\\Local\\Temp\\d96635799d9f007dc343386df35f96eb29881d52f6f269de998e475cdcfbf031.bin\" "
],
"regkey_read": [
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\\DisableMetaFiles"
],
"dll_loaded": [
"kernel32",
"ntdll.dll",
"user32"
]
},
"first_seen": 1564685585.625,
"ppid": 1268
},
{
"process_path": "C:\\Windows\\System32\\lsass.exe",
"process_name": "lsass.exe",
"pid": 476,
"summary": {},
"first_seen": 1564685585.3281,
"ppid": 376
}
]Signatures
[
{
"markcount": 1,
"families": [],
"description": "Queries for the computername",
"severity": 1,
"marks": [
{
"call": {
"category": "misc",
"status": 1,
"stacktrace": [],
"api": "GetComputerNameW",
"return_value": 1,
"arguments": {
"computer_name": "CUCKPC"
},
"time": 1564685610.9211,
"tid": 344,
"flags": {}
},
"pid": 2272,
"type": "call",
"cid": 338
}
],
"references": [],
"name": "antivm_queries_computername"
},
{
"markcount": 1,
"families": [],
"description": "Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available",
"severity": 1,
"marks": [
{
"call": {
"category": "system",
"status": 1,
"stacktrace": [],
"api": "GlobalMemoryStatusEx",
"return_value": 1,
"arguments": {},
"time": 1564685610.9371,
"tid": 2252,
"flags": {}
},
"pid": 2272,
"type": "call",
"cid": 425
}
],
"references": [],
"name": "antivm_memory_available"
},
{
"markcount": 0,
"families": [],
"description": "One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.",
"severity": 2,
"marks": [],
"references": [],
"name": "dumped_buffer"
},
{
"markcount": 5,
"families": [],
"description": "Starts servers listening",
"severity": 2,
"marks": [
{
"call": {
"category": "network",
"status": 1,
"stacktrace": [],
"api": "bind",
"return_value": 0,
"arguments": {
"ip_address": "127.0.0.1",
"socket": 384,
"port": 0
},
"time": 1564685611.4521,
"tid": 2252,
"flags": {}
},
"pid": 2272,
"type": "call",
"cid": 5596
},
{
"call": {
"category": "network",
"status": 1,
"stacktrace": [],
"api": "listen",
"return_value": 0,
"arguments": {
"socket": 384,
"backlog": 1
},
"time": 1564685611.4521,
"tid": 2252,
"flags": {}
},
"pid": 2272,
"type": "call",
"cid": 5597
},
{
"call": {
"category": "network",
"status": 1,
"stacktrace": [],
"api": "accept",
"return_value": 452,
"arguments": {
"ip_address": "127.0.0.1",
"socket": 384,
"port": 49196
},
"time": 1564685611.4521,
"tid": 2252,
"flags": {}
},
"pid": 2272,
"type": "call",
"cid": 5601
},
{
"call": {
"category": "network",
"status": 1,
"stacktrace": [],
"api": "bind",
"return_value": 0,
"arguments": {
"ip_address": "127.0.0.1",
"socket": 384,
"port": 37288
},
"time": 1564685611.4521,
"tid": 2252,
"flags": {}
},
"pid": 2272,
"type": "call",
"cid": 5609
},
{
"call": {
"category": "network",
"status": 1,
"stacktrace": [],
"api": "listen",
"return_value": 0,
"arguments": {
"socket": 384,
"backlog": 2147483647
},
"time": 1564685611.4521,
"tid": 2252,
"flags": {}
},
"pid": 2272,
"type": "call",
"cid": 5610
}
],
"references": [],
"name": "network_bind"
},
{
"markcount": 2,
"families": [],
"description": "Allocates read-write-execute memory (usually to unpack itself)",
"severity": 2,
"marks": [
{
"call": {
"category": "process",
"status": 1,
"stacktrace": [],
"api": "NtProtectVirtualMemory",
"return_value": 0,
"arguments": {
"process_identifier": 2420,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 1,
"length": 819200,
"protection": 64,
"process_handle": "0xffffffff",
"base_address": "0x004f0000"
},
"time": 1564685608.094,
"tid": 2460,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE"
}
},
"pid": 2420,
"type": "call",
"cid": 86586
},
{
"call": {
"category": "process",
"status": 1,
"stacktrace": [],
"api": "NtProtectVirtualMemory",
"return_value": 0,
"arguments": {
"process_identifier": 2272,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 1,
"length": 4096,
"protection": 64,
"process_handle": "0xffffffff",
"base_address": "0x00400000"
},
"time": 1564685610.9051,
"tid": 344,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE"
}
},
"pid": 2272,
"type": "call",
"cid": 200
}
],
"references": [],
"name": "allocates_rwx"
},
{
"markcount": 2,
"families": [],
"description": "The binary likely contains encrypted or compressed data indicative of a packer",
"severity": 2,
"marks": [
{
"entropy": 7.9853038013248,
"section": {
"size_of_data": "0x000d6e00",
"virtual_address": "0x0000c000",
"entropy": 7.9853038013248,
"name": ".rsrc",
"virtual_size": "0x000d6c82"
},
"type": "generic",
"description": "A section with a high entropy has been found"
},
{
"entropy": 0.95926339285714,
"type": "generic",
"description": "Overall entropy of this PE file is high"
}
],
"references": [
"http:\/\/www.forensickb.com\/2013\/03\/file-entropy-explained.html",
"http:\/\/virii.es\/U\/Using%20Entropy%20Analysis%20to%20Find%20Encrypted%20and%20Packed%20Malware.pdf"
],
"name": "packer_entropy"
},
{
"markcount": 1,
"families": [],
"description": "One or more of the buffers contains an embedded PE file",
"severity": 3,
"marks": [
{
"category": "buffer",
"ioc": "Buffer with sha1: e4e8e888fd7d7ab6eb6aefab1582474269d5e6f5",
"type": "ioc",
"description": null
}
],
"references": [],
"name": "dumped_buffer2"
},
{
"markcount": 1,
"families": [],
"description": "Allocates execute permission to another process indicative of possible code injection",
"severity": 3,
"marks": [
{
"call": {
"category": "process",
"status": 1,
"stacktrace": [],
"api": "NtAllocateVirtualMemory",
"return_value": 0,
"arguments": {
"process_identifier": 2272,
"region_size": 1957888,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 0,
"protection": 64,
"process_handle": "0x0000006c",
"allocation_type": 12288,
"base_address": "0x00400000"
},
"time": 1564685608.125,
"tid": 2460,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 2420,
"type": "call",
"cid": 86615
}
],
"references": [],
"name": "allocates_execute_remote_process"
},
{
"markcount": 1,
"families": [],
"description": "Installs itself for autorun at Windows startup",
"severity": 3,
"marks": [
{
"type": "generic",
"reg_key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\Client Server Runtime Subsystem",
"reg_value": "\"C:\\ProgramData\\Windows\\csrss.exe\""
}
],
"references": [],
"name": "persistence_autorun"
},
{
"markcount": 2,
"families": [],
"description": "Potential code injection by writing to the memory of another process",
"severity": 3,
"marks": [
{
"call": {
"category": "process",
"status": 1,
"stacktrace": [],
"api": "WriteProcessMemory",
"return_value": 1,
"arguments": {
"process_identifier": 2272,
"buffer": "\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0010\u0000\u0000\u0000\u0018\u0000\u0000\u0080\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0001\u0000\u0000\u00000\u0000\u0000\u0080\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0019\u0004\u0000\u0000H\u0000\u0000\u0000\\\u00d0\u001d\u0000\u00a0\u0003\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000`\u0090\u001d\u0000\u00a0\u00034\u0000\u0000\u0000V\u0000S\u0000_\u0000V\u0000E\u0000R\u0000S\u0000I\u0000O\u0000N\u0000_\u0000I\u0000N\u0000F\u0000O\u0000\u0000\u0000\u0000\u0000\u00bd\u0004\u00ef\u00fe\u0000\u0000\u0001\u0000\u0003\u0000\u0006\u0000\u0000@\u0080%\u0003\u0000\u0006\u0000\u0000@\u0080%\u0017\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0004\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u00fe\u0002\u0000\u0000\u0001\u0000S\u0000t\u0000r\u0000i\u0000n\u0000g\u0000F\u0000i\u0000l\u0000e\u0000I\u0000n\u0000f\u0000o\u0000\u0000\u0000\u00da\u0002\u0000\u0000\u0001\u00000\u00004\u00000\u00009\u00000\u00004\u0000b\u00000\u0000\u0000\u0000L\u0000\u0016\u0000\u0001\u0000C\u0000o\u0000m\u0000p\u0000a\u0000n\u0000y\u0000N\u0000a\u0000m\u0000e\u0000\u0000\u0000\u0000\u0000M\u0000i\u0000c\u0000r\u0000o\u0000s\u0000o\u0000f\u0000t\u0000 \u0000C\u0000o\u0000r\u0000p\u0000o\u0000r\u0000a\u0000t\u0000i\u0000o\u0000n\u0000\u0000\u0000d\u0000\u001e\u0000\u0001\u0000F\u0000i\u0000l\u0000e\u0000D\u0000e\u0000s\u0000c\u0000r\u0000i\u0000p\u0000t\u0000i\u0000o\u0000n\u0000\u0000\u0000\u0000\u0000C\u0000l\u0000i\u0000e\u0000n\u0000t\u0000 \u0000S\u0000e\u0000r\u0000v\u0000e\u0000r\u0000 \u0000R\u0000u\u0000n\u0000t\u0000i\u0000m\u0000e\u0000 \u0000P\u0000r\u0000o\u0000c\u0000e\u0000s\u0000s\u0000\u0000\u0000r\u0000)\u0000\u0001\u0000F\u0000i\u0000l\u0000e\u0000V\u0000e\u0000r\u0000s\u0000i\u0000o\u0000n\u0000\u0000\u0000\u0000\u00006\u0000.\u00003\u0000.\u00009\u00006\u00000\u00000\u0000.\u00001\u00006\u00003\u00008\u00004\u0000 \u0000(\u0000w\u0000i\u0000n\u0000b\u0000l\u0000u\u0000e\u0000_\u0000r\u0000t\u0000m\u0000.\u00001\u00003\u00000\u00008\u00002\u00001\u0000-\u00001\u00006\u00002\u00003\u0000)\u0000\u0000\u0000\u0000\u00004\u0000\n\u0000\u0001\u0000I\u0000n\u0000t\u0000e\u0000r\u0000n\u0000a\u0000l\u0000N\u0000a\u0000m\u0000e\u0000\u0000\u0000C\u0000S\u0000R\u0000S\u0000S\u0000.\u0000E\u0000x\u0000e\u0000\u0000\u0000\u0080\u0000.\u0000\u0001\u0000L\u0000e\u0000g\u0000a\u0000l\u0000C\u0000o\u0000p\u0000y\u0000r\u0000i\u0000g\u0000h\u0000t\u0000\u0000\u0000\u00a9\u0000 \u0000M\u0000i\u0000c\u0000r\u0000o\u0000s\u0000o\u0000f\u0000t\u0000 \u0000C\u0000o\u0000r\u0000p\u0000o\u0000r\u0000a\u0000t\u0000i\u0000o\u0000n\u0000.\u0000 \u0000A\u0000l\u0000l\u0000 \u0000r\u0000i\u0000g\u0000h\u0000t\u0000s\u0000 \u0000r\u0000e\u0000s\u0000e\u0000r\u0000v\u0000e\u0000d\u0000.\u0000\u0000\u0000<\u0000\n\u0000\u0001\u0000O\u0000r\u0000i\u0000g\u0000i\u0000n\u0000a\u0000l\u0000F\u0000i\u0000l\u0000e\u0000n\u0000a\u0000m\u0000e\u0000\u0000\u0000C\u0000S\u0000R\u0000S\u0000S\u0000.\u0000E\u0000x\u0000e\u0000\u0000\u0000j\u0000%\u0000\u0001\u0000P\u0000r\u0000o\u0000d\u0000u\u0000c\u0000t\u0000N\u0000a\u0000m\u0000e\u0000\u0000\u0000\u0000\u0000M\u0000i\u0000c\u0000r\u0000o\u0000s\u0000o\u0000f\u0000t\u0000\u00ae\u0000 \u0000W\u0000i\u0000n\u0000d\u0000o\u0000w\u0000s\u0000\u00ae\u0000 \u0000O\u0000p\u0000e\u0000r\u0000a\u0000t\u0000i\u0000n\u0000g\u0000 \u0000S\u0000y\u0000s\u0000t\u0000e\u0000m\u0000\u0000\u0000\u0000\u0000B\u0000\u000f\u0000\u0001\u0000P\u0000r\u0000o\u0000d\u0000u\u0000c\u0000t\u0000V\u0000e\u0000r\u0000s\u0000i\u0000o\u0000n\u0000\u0000\u00006\u0000.\u00003\u0000.\u00009\u00006\u00000\u00000\u0000.\u00001\u00006\u00003\u00008\u00004\u0000\u0000\u0000\u0000\u0000D\u0000\u0000\u0000\u0001\u0000V\u0000a\u0000r\u0000F\u0000i\u0000l\u0000e\u0000I\u0000n\u0000f\u0000o\u0000\u0000\u0000\u0000\u0000$\u0000\u0004\u0000\u0000\u0000T\u0000r\u0000a\u0000n\u0000s\u0000l\u0000a\u0000t\u0000i\u0000o\u0000n\u0000\u0000\u0000\u0000\u0000\t\u0004\u00b0\u0004\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u00cc\u00d4\u001d\u0000\u0088\u00d4\u001d\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u00d9\u00d4\u001d\u0000\u00a4\u00d4\u001d\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u00e6\u00d4\u001d\u0000\u00ac\u00d4\u001d\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u00f3\u00d4\u001d\u0000\u00b4\u00d4\u001d\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u00ff\u00d4\u001d\u0000\u00bc\u00d4\u001d\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\n\u00d5\u001d\u0000\u00c4\u00d4\u001d\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0014\u00d5\u001d\u0000\"\u00d5\u001d\u00002\u00d5\u001d\u0000B\u00d5\u001d\u0000P\u00d5\u001d\u0000^\u00d5\u001d\u0000\u0000\u0000\u0000\u0000l\u00d5\u001d\u0000\u0000\u0000\u0000\u0000\u0006\u0000\u0000\u0080\u0000\u0000\u0000\u0000z\u00d5\u001d\u0000\u0000\u0000\u0000\u0000\u0088\u00d5\u001d\u0000\u0000\u0000\u0000\u0000t\u0000\u0000\u0080\u0000\u0000\u0000\u0000KERNEL32.DLL\u0000ADVAPI32.dll\u0000OLEAUT32.dll\u0000SHELL32.dll\u0000USER32.dll\u0000WS2_32.dll\u0000\u0000LoadLibraryA\u0000\u0000GetProcAddress\u0000\u0000VirtualProtect\u0000\u0000VirtualAlloc\u0000\u0000VirtualFree\u0000\u0000\u0000ExitProcess\u0000\u0000\u0000RegCloseKey\u0000\u0000\u0000SHGetMalloc\u0000\u0000\u0000MessageBoxA\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
"process_handle": "0x0000006c",
"base_address": "0x005dd000"
},
"time": 1564685608.938,
"tid": 2460,
"flags": {}
},
"pid": 2420,
"type": "call",
"cid": 86619
},
{
"call": {
"category": "process",
"status": 1,
"stacktrace": [],
"api": "WriteProcessMemory",
"return_value": 1,
"arguments": {
"process_identifier": 2272,
"buffer": "\u0000\u0000@\u0000",
"process_handle": "0x0000006c",
"base_address": "0x7efde008"
},
"time": 1564685608.938,
"tid": 2460,
"flags": {}
},
"pid": 2420,
"type": "call",
"cid": 86620
}
],
"references": [],
"name": "injection_write_memory"
},
{
"markcount": 2,
"families": [],
"description": "Used NtSetContextThread to modify a thread in a remote process indicative of process injection",
"severity": 3,
"marks": [
{
"category": "Process injection",
"ioc": "Process 2420 called NtSetContextThread to modify thread in remote process 2272",
"type": "ioc",
"description": null
},
{
"call": {
"category": "process",
"status": 1,
"stacktrace": [],
"api": "NtSetContextThread",
"return_value": 0,
"arguments": {
"thread_handle": "0x00000068",
"registers": {
"eip": 2008678852,
"esp": 1638384,
"edi": 0,
"eax": 6142336,
"ebp": 0,
"edx": 0,
"ebx": 2130567168,
"esi": 0,
"ecx": 0
},
"process_identifier": 2272
},
"time": 1564685608.938,
"tid": 2460,
"flags": {}
},
"pid": 2420,
"type": "call",
"cid": 86621
}
],
"references": [
"www.endgame.com\/blog\/technical-blog\/ten-process-injection-techniques-technical-survey-common-and-trending-process"
],
"name": "injection_ntsetcontextthread"
},
{
"markcount": 2,
"families": [],
"description": "Resumed a suspended thread in a remote process potentially indicative of process injection",
"severity": 3,
"marks": [
{
"category": "Process injection",
"ioc": "Process 2420 resumed a thread in remote process 2272",
"type": "ioc",
"description": null
},
{
"call": {
"category": "process",
"status": 1,
"stacktrace": [],
"api": "NtResumeThread",
"return_value": 0,
"arguments": {
"thread_handle": "0x00000068",
"suspend_count": 1,
"process_identifier": 2272
},
"time": 1564685610.578,
"tid": 2460,
"flags": {}
},
"pid": 2420,
"type": "call",
"cid": 86622
}
],
"references": [
"www.endgame.com\/blog\/technical-blog\/ten-process-injection-techniques-technical-survey-common-and-trending-process"
],
"name": "injection_resumethread"
},
{
"markcount": 1,
"families": [],
"description": "Installs Tor on the machine",
"severity": 3,
"marks": [
{
"category": "file",
"ioc": "C:\\Users\\cuck\\AppData\\Roaming\\tor\\geoip",
"type": "ioc",
"description": null
}
],
"references": [],
"name": "network_tor"
},
{
"markcount": 13,
"families": [],
"description": "Executed a process and injected code into it, probably while unpacking",
"severity": 5,
"marks": [
{
"call": {
"category": "process",
"status": 1,
"stacktrace": [],
"api": "CreateProcessInternalW",
"return_value": 1,
"arguments": {
"thread_identifier": 344,
"thread_handle": "0x00000068",
"process_identifier": 2272,
"current_directory": "",
"filepath": "C:\\Users\\cuck\\AppData\\Local\\Temp\\d96635799d9f007dc343386df35f96eb29881d52f6f269de998e475cdcfbf031.bin",
"track": 1,
"command_line": "\"C:\\Users\\cuck\\AppData\\Local\\Temp\\d96635799d9f007dc343386df35f96eb29881d52f6f269de998e475cdcfbf031.bin\" ",
"filepath_r": "C:\\Users\\cuck\\AppData\\Local\\Temp\\d96635799d9f007dc343386df35f96eb29881d52f6f269de998e475cdcfbf031.bin",
"stack_pivoted": 0,
"creation_flags": 4,
"process_handle": "0x0000006c",
"inherit_handles": 0
},
"time": 1564685608.125,
"tid": 2460,
"flags": {
"creation_flags": "CREATE_SUSPENDED"
}
},
"pid": 2420,
"type": "call",
"cid": 86609
},
{
"call": {
"category": "process",
"status": 1,
"stacktrace": [],
"api": "NtGetContextThread",
"return_value": 0,
"arguments": {
"thread_handle": "0x00000068"
},
"time": 1564685608.125,
"tid": 2460,
"flags": {}
},
"pid": 2420,
"type": "call",
"cid": 86612
},
{
"call": {
"category": "process",
"status": 1,
"stacktrace": [],
"api": "NtUnmapViewOfSection",
"return_value": 0,
"arguments": {
"process_identifier": 2272,
"region_size": 4096,
"process_handle": "0x0000006c",
"base_address": "0x00400000"
},
"time": 1564685608.125,
"tid": 2460,
"flags": {}
},
"pid": 2420,
"type": "call",
"cid": 86614
},
{
"call": {
"category": "process",
"status": 1,
"stacktrace": [],
"api": "NtAllocateVirtualMemory",
"return_value": 0,
"arguments": {
"process_identifier": 2272,
"region_size": 1957888,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 0,
"protection": 64,
"process_handle": "0x0000006c",
"allocation_type": 12288,
"base_address": "0x00400000"
},
"time": 1564685608.125,
"tid": 2460,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 2420,
"type": "call",
"cid": 86615
},
{
"call": {
"category": "process",
"status": 1,
"stacktrace": [],
"buffer": "e4e8e888fd7d7ab6eb6aefab1582474269d5e6f5",
"api": "WriteProcessMemory",
"return_value": 1,
"arguments": {
"process_identifier": 2272,
"buffer": "",
"process_handle": "0x0000006c",
"base_address": "0x00400000"
},
"time": 1564685608.125,
"tid": 2460,
"flags": {}
},
"pid": 2420,
"type": "call",
"cid": 86616
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 87,
"nt_status": -1073741583,
"api": "WriteProcessMemory",
"return_value": 0,
"arguments": {
"process_identifier": 2272,
"buffer": "",
"process_handle": "0x0000006c",
"base_address": "0x00401000"
},
"time": 1564685608.125,
"tid": 2460,
"flags": {}
},
"pid": 2420,
"type": "call",
"cid": 86617
},
{
"call": {
"category": "process",
"status": 1,
"stacktrace": [],
"buffer": "9eb286dc0e22b09d7ed18bc4a500ed6449419b34",
"api": "WriteProcessMemory",
"return_value": 1,
"arguments": {
"process_identifier": 2272,
"buffer": "",
"process_handle": "0x0000006c",
"base_address": "0x00516000"
},
"time": 1564685608.125,
"tid": 2460,
"flags": {}
},
"pid": 2420,
"type": "call",
"cid": 86618
},
{
"call": {
"category": "process",
"status": 1,
"stacktrace": [],
"api": "WriteProcessMemory",
"return_value": 1,
"arguments": {
"process_identifier": 2272,
"buffer": "\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0010\u0000\u0000\u0000\u0018\u0000\u0000\u0080\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0001\u0000\u0000\u00000\u0000\u0000\u0080\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0019\u0004\u0000\u0000H\u0000\u0000\u0000\\\u00d0\u001d\u0000\u00a0\u0003\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000`\u0090\u001d\u0000\u00a0\u00034\u0000\u0000\u0000V\u0000S\u0000_\u0000V\u0000E\u0000R\u0000S\u0000I\u0000O\u0000N\u0000_\u0000I\u0000N\u0000F\u0000O\u0000\u0000\u0000\u0000\u0000\u00bd\u0004\u00ef\u00fe\u0000\u0000\u0001\u0000\u0003\u0000\u0006\u0000\u0000@\u0080%\u0003\u0000\u0006\u0000\u0000@\u0080%\u0017\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0004\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u00fe\u0002\u0000\u0000\u0001\u0000S\u0000t\u0000r\u0000i\u0000n\u0000g\u0000F\u0000i\u0000l\u0000e\u0000I\u0000n\u0000f\u0000o\u0000\u0000\u0000\u00da\u0002\u0000\u0000\u0001\u00000\u00004\u00000\u00009\u00000\u00004\u0000b\u00000\u0000\u0000\u0000L\u0000\u0016\u0000\u0001\u0000C\u0000o\u0000m\u0000p\u0000a\u0000n\u0000y\u0000N\u0000a\u0000m\u0000e\u0000\u0000\u0000\u0000\u0000M\u0000i\u0000c\u0000r\u0000o\u0000s\u0000o\u0000f\u0000t\u0000 \u0000C\u0000o\u0000r\u0000p\u0000o\u0000r\u0000a\u0000t\u0000i\u0000o\u0000n\u0000\u0000\u0000d\u0000\u001e\u0000\u0001\u0000F\u0000i\u0000l\u0000e\u0000D\u0000e\u0000s\u0000c\u0000r\u0000i\u0000p\u0000t\u0000i\u0000o\u0000n\u0000\u0000\u0000\u0000\u0000C\u0000l\u0000i\u0000e\u0000n\u0000t\u0000 \u0000S\u0000e\u0000r\u0000v\u0000e\u0000r\u0000 \u0000R\u0000u\u0000n\u0000t\u0000i\u0000m\u0000e\u0000 \u0000P\u0000r\u0000o\u0000c\u0000e\u0000s\u0000s\u0000\u0000\u0000r\u0000)\u0000\u0001\u0000F\u0000i\u0000l\u0000e\u0000V\u0000e\u0000r\u0000s\u0000i\u0000o\u0000n\u0000\u0000\u0000\u0000\u00006\u0000.\u00003\u0000.\u00009\u00006\u00000\u00000\u0000.\u00001\u00006\u00003\u00008\u00004\u0000 \u0000(\u0000w\u0000i\u0000n\u0000b\u0000l\u0000u\u0000e\u0000_\u0000r\u0000t\u0000m\u0000.\u00001\u00003\u00000\u00008\u00002\u00001\u0000-\u00001\u00006\u00002\u00003\u0000)\u0000\u0000\u0000\u0000\u00004\u0000\n\u0000\u0001\u0000I\u0000n\u0000t\u0000e\u0000r\u0000n\u0000a\u0000l\u0000N\u0000a\u0000m\u0000e\u0000\u0000\u0000C\u0000S\u0000R\u0000S\u0000S\u0000.\u0000E\u0000x\u0000e\u0000\u0000\u0000\u0080\u0000.\u0000\u0001\u0000L\u0000e\u0000g\u0000a\u0000l\u0000C\u0000o\u0000p\u0000y\u0000r\u0000i\u0000g\u0000h\u0000t\u0000\u0000\u0000\u00a9\u0000 \u0000M\u0000i\u0000c\u0000r\u0000o\u0000s\u0000o\u0000f\u0000t\u0000 \u0000C\u0000o\u0000r\u0000p\u0000o\u0000r\u0000a\u0000t\u0000i\u0000o\u0000n\u0000.\u0000 \u0000A\u0000l\u0000l\u0000 \u0000r\u0000i\u0000g\u0000h\u0000t\u0000s\u0000 \u0000r\u0000e\u0000s\u0000e\u0000r\u0000v\u0000e\u0000d\u0000.\u0000\u0000\u0000<\u0000\n\u0000\u0001\u0000O\u0000r\u0000i\u0000g\u0000i\u0000n\u0000a\u0000l\u0000F\u0000i\u0000l\u0000e\u0000n\u0000a\u0000m\u0000e\u0000\u0000\u0000C\u0000S\u0000R\u0000S\u0000S\u0000.\u0000E\u0000x\u0000e\u0000\u0000\u0000j\u0000%\u0000\u0001\u0000P\u0000r\u0000o\u0000d\u0000u\u0000c\u0000t\u0000N\u0000a\u0000m\u0000e\u0000\u0000\u0000\u0000\u0000M\u0000i\u0000c\u0000r\u0000o\u0000s\u0000o\u0000f\u0000t\u0000\u00ae\u0000 \u0000W\u0000i\u0000n\u0000d\u0000o\u0000w\u0000s\u0000\u00ae\u0000 \u0000O\u0000p\u0000e\u0000r\u0000a\u0000t\u0000i\u0000n\u0000g\u0000 \u0000S\u0000y\u0000s\u0000t\u0000e\u0000m\u0000\u0000\u0000\u0000\u0000B\u0000\u000f\u0000\u0001\u0000P\u0000r\u0000o\u0000d\u0000u\u0000c\u0000t\u0000V\u0000e\u0000r\u0000s\u0000i\u0000o\u0000n\u0000\u0000\u00006\u0000.\u00003\u0000.\u00009\u00006\u00000\u00000\u0000.\u00001\u00006\u00003\u00008\u00004\u0000\u0000\u0000\u0000\u0000D\u0000\u0000\u0000\u0001\u0000V\u0000a\u0000r\u0000F\u0000i\u0000l\u0000e\u0000I\u0000n\u0000f\u0000o\u0000\u0000\u0000\u0000\u0000$\u0000\u0004\u0000\u0000\u0000T\u0000r\u0000a\u0000n\u0000s\u0000l\u0000a\u0000t\u0000i\u0000o\u0000n\u0000\u0000\u0000\u0000\u0000\t\u0004\u00b0\u0004\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u00cc\u00d4\u001d\u0000\u0088\u00d4\u001d\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u00d9\u00d4\u001d\u0000\u00a4\u00d4\u001d\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u00e6\u00d4\u001d\u0000\u00ac\u00d4\u001d\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u00f3\u00d4\u001d\u0000\u00b4\u00d4\u001d\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u00ff\u00d4\u001d\u0000\u00bc\u00d4\u001d\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\n\u00d5\u001d\u0000\u00c4\u00d4\u001d\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0014\u00d5\u001d\u0000\"\u00d5\u001d\u00002\u00d5\u001d\u0000B\u00d5\u001d\u0000P\u00d5\u001d\u0000^\u00d5\u001d\u0000\u0000\u0000\u0000\u0000l\u00d5\u001d\u0000\u0000\u0000\u0000\u0000\u0006\u0000\u0000\u0080\u0000\u0000\u0000\u0000z\u00d5\u001d\u0000\u0000\u0000\u0000\u0000\u0088\u00d5\u001d\u0000\u0000\u0000\u0000\u0000t\u0000\u0000\u0080\u0000\u0000\u0000\u0000KERNEL32.DLL\u0000ADVAPI32.dll\u0000OLEAUT32.dll\u0000SHELL32.dll\u0000USER32.dll\u0000WS2_32.dll\u0000\u0000LoadLibraryA\u0000\u0000GetProcAddress\u0000\u0000VirtualProtect\u0000\u0000VirtualAlloc\u0000\u0000VirtualFree\u0000\u0000\u0000ExitProcess\u0000\u0000\u0000RegCloseKey\u0000\u0000\u0000SHGetMalloc\u0000\u0000\u0000MessageBoxA\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
"process_handle": "0x0000006c",
"base_address": "0x005dd000"
},
"time": 1564685608.938,
"tid": 2460,
"flags": {}
},
"pid": 2420,
"type": "call",
"cid": 86619
},
{
"call": {
"category": "process",
"status": 1,
"stacktrace": [],
"api": "WriteProcessMemory",
"return_value": 1,
"arguments": {
"process_identifier": 2272,
"buffer": "\u0000\u0000@\u0000",
"process_handle": "0x0000006c",
"base_address": "0x7efde008"
},
"time": 1564685608.938,
"tid": 2460,
"flags": {}
},
"pid": 2420,
"type": "call",
"cid": 86620
},
{
"call": {
"category": "process",
"status": 1,
"stacktrace": [],
"api": "NtSetContextThread",
"return_value": 0,
"arguments": {
"thread_handle": "0x00000068",
"registers": {
"eip": 2008678852,
"esp": 1638384,
"edi": 0,
"eax": 6142336,
"ebp": 0,
"edx": 0,
"ebx": 2130567168,
"esi": 0,
"ecx": 0
},
"process_identifier": 2272
},
"time": 1564685608.938,
"tid": 2460,
"flags": {}
},
"pid": 2420,
"type": "call",
"cid": 86621
},
{
"call": {
"category": "process",
"status": 1,
"stacktrace": [],
"api": "NtResumeThread",
"return_value": 0,
"arguments": {
"thread_handle": "0x00000068",
"suspend_count": 1,
"process_identifier": 2272
},
"time": 1564685610.578,
"tid": 2460,
"flags": {}
},
"pid": 2420,
"type": "call",
"cid": 86622
},
{
"call": {
"category": "process",
"status": 1,
"stacktrace": [],
"api": "NtResumeThread",
"return_value": 0,
"arguments": {
"thread_handle": "0x000000d4",
"suspend_count": 1,
"process_identifier": 2272
},
"time": 1564685610.9211,
"tid": 344,
"flags": {}
},
"pid": 2272,
"type": "call",
"cid": 353
},
{
"call": {
"category": "process",
"status": 1,
"stacktrace": [],
"api": "NtResumeThread",
"return_value": 0,
"arguments": {
"thread_handle": "0x00000114",
"suspend_count": 1,
"process_identifier": 2272
},
"time": 1564685610.9371,
"tid": 2252,
"flags": {}
},
"pid": 2272,
"type": "call",
"cid": 440
}
],
"references": [],
"name": "injection_runpe"
}
]Yara
The Yara rules did not detect anything in the file.
Network
{
"tls": [],
"udp": [
{
"src": "192.168.56.101",
"dst": "192.168.56.255",
"offset": 546,
"time": 3.2010428905487,
"dport": 137,
"sport": 137
},
{
"src": "192.168.56.101",
"dst": "192.168.56.255",
"offset": 5226,
"time": 9.2035269737244,
"dport": 138,
"sport": 138
},
{
"src": "192.168.56.101",
"dst": "224.0.0.252",
"offset": 7070,
"time": 3.0343899726868,
"dport": 5355,
"sport": 51001
},
{
"src": "192.168.56.101",
"dst": "224.0.0.252",
"offset": 7398,
"time": 1.0400240421295,
"dport": 5355,
"sport": 53595
},
{
"src": "192.168.56.101",
"dst": "224.0.0.252",
"offset": 7726,
"time": 3.1523418426514,
"dport": 5355,
"sport": 53848
},
{
"src": "192.168.56.101",
"dst": "224.0.0.252",
"offset": 8054,
"time": 1.550302028656,
"dport": 5355,
"sport": 54255
},
{
"src": "192.168.56.101",
"dst": "224.0.0.252",
"offset": 8382,
"time": -0.089483976364136,
"dport": 5355,
"sport": 55314
},
{
"src": "192.168.56.101",
"dst": "239.255.255.250",
"offset": 8710,
"time": 1.1082849502563,
"dport": 1900,
"sport": 1900
},
{
"src": "192.168.56.101",
"dst": "239.255.255.250",
"offset": 28120,
"time": 1.0586719512939,
"dport": 3702,
"sport": 49152
},
{
"src": "192.168.56.101",
"dst": "239.255.255.250",
"offset": 36504,
"time": 3.1515140533447,
"dport": 1900,
"sport": 53598
}
],
"dns_servers": [],
"http": [],
"icmp": [],
"smtp": [],
"tcp": [],
"smtp_ex": [],
"mitm": [],
"hosts": [],
"pcap_sha256": "e49e0a6f96991e9f93945ff4464b6ad86964570c57cde3034edc5e9e440fa966",
"dns": [],
"http_ex": [],
"domains": [],
"dead_hosts": [],
"sorted_pcap_sha256": "bca5a5e3aa4e81d05686c72cd64dc13ccd1cc6777bedd2d2a7ec08cd84b20e77",
"irc": [],
"https_ex": []
}Screenshots
update_player.exe removal instructions
The instructions below shows how to remove update_player.exe with help from the FreeFixer removal tool. Basically, you install FreeFixer, scan your computer, check the update_player.exe file for removal, restart your computer and scan it again to verify that update_player.exe has been successfully removed. Here are the removal instructions in more detail:
- Download and install FreeFixer: http://www.freefixer.com/download.html
- Start FreeFixer and press the Start Scan button. The scan will finish in approximately five minutes.
- When the scan is finished, locate update_player.exe in the scan result and tick the checkbox next to the update_player.exe file. Do not check any other file for removal unless you are 100% sure you want to delete it. Tip: Press CTRL-F to open up FreeFixer's search dialog to quickly locate update_player.exe in the scan result.
c:\downloads\update_player.exe 
- Scroll down to the bottom of the scan result and press the Fix button. FreeFixer will now delete the update_player.exe file.
- Restart your computer.
- Start FreeFixer and scan your computer again. If update_player.exe still remains in the scan result, proceed with the next step. If update_player.exe is gone from the scan result you're done.
- If update_player.exe still remains in the scan result, check its checkbox again in the scan result and click Fix.
- Restart your computer.
- Start FreeFixer and scan your computer again. Verify that update_player.exe no longer appear in the scan result.
Hashes [?]
| Property | Value |
|---|---|
| MD5 | 5dec0ecc74322800c118851e4dfac06e |
| SHA256 | d96635799d9f007dc343386df35f96eb29881d52f6f269de998e475cdcfbf031 |
Error Messages
These are some of the error messages that can appear related to update_player.exe:
update_player.exe has encountered a problem and needs to close. We are sorry for the inconvenience.
update_player.exe - Application Error. The instruction at "0xXXXXXXXX" referenced memory at "0xXXXXXXXX". The memory could not be "read/written". Click on OK to terminate the program.
update_player.exe has stopped working.
End Program - update_player.exe. This program is not responding.
update_player.exe is not a valid Win32 application.
update_player.exe - Application Error. The application failed to initialize properly (0xXXXXXXXX). Click OK to terminate the application.
What will you do with the file?
To help other users, please let us know what you will do with the file:
Comments
Please share with the other users what you think about this file. What does this file do? Is it legitimate or something that your computer is better without? Do you know how it was installed on your system? Did you install it yourself or did it come bundled with some other software? Is it running smoothly or do you get some error message? Any information that will help to document this file is welcome. Thank you for your contributions.
I'm reading all new comments so don't hesitate to post a question about the file. If I don't have the answer perhaps another user can help you.
No comments posted yet.