Size | 52.0KB |
---|---|
Type | data |
MD5 | 3b47636cdef235d214d2d2f37816d03a |
SHA1 | 5f3c10688d5e5654c7bb2578ed7bc237ef87799f |
SHA256 | 586e74b451a12addb05f6fa8b0344d0df6e22157ff4cfd4da6c941756e5cba07 |
SHA512 |
46d2e3f62963ece6ea0ef532a28e25193077f64de6c63f4975903f5f85d8aeccfe02a9b7dc5bdb0202c9e6baa10dbb60324b420f9293477be62cfe4d9e5290e7
|
CRC32 | E6D6343B |
ssdeep | None |
Yara | None matched |
Please notice: The scoring system is currently still in development and should be considered an alpha feature.
Expecting different results? Send us this analysis and we will inspect it. Click here
Category | Started | Completed | Duration | Routing | Logs |
---|---|---|---|---|---|
FILE | Feb. 11, 2025, 8:56 p.m. | Feb. 11, 2025, 9:03 p.m. | 420 seconds | internet |
Show Analyzer Log Show Cuckoo Log |
2025-02-10 16:31:51,015 [analyzer] DEBUG: Starting analyzer from: C:\tmpdrdvpd 2025-02-10 16:31:51,015 [analyzer] DEBUG: Pipe server name: \??\PIPE\zqfEXhBlgpblRFfkDDTHztegT 2025-02-10 16:31:51,015 [analyzer] DEBUG: Log pipe server name: \??\PIPE\xpeKoDTMpaLBpYxSKvkRMgE 2025-02-10 16:31:51,015 [analyzer] DEBUG: No analysis package specified, trying to detect it automagically. 2025-02-10 16:31:51,015 [analyzer] INFO: Automatically selected analysis package "generic" 2025-02-10 16:31:51,265 [analyzer] DEBUG: Started auxiliary module Curtain 2025-02-10 16:31:51,265 [analyzer] DEBUG: Started auxiliary module DbgView 2025-02-10 16:31:51,828 [analyzer] DEBUG: Started auxiliary module Disguise 2025-02-10 16:31:52,078 [analyzer] DEBUG: Loaded monitor into process with pid 508 2025-02-10 16:31:52,078 [analyzer] DEBUG: Started auxiliary module DumpTLSMasterSecrets 2025-02-10 16:31:52,078 [analyzer] DEBUG: Started auxiliary module Human 2025-02-10 16:31:52,078 [analyzer] DEBUG: Started auxiliary module InstallCertificate 2025-02-10 16:31:52,078 [analyzer] DEBUG: Started auxiliary module Reboot 2025-02-10 16:31:52,155 [analyzer] DEBUG: Started auxiliary module RecentFiles 2025-02-10 16:31:52,155 [analyzer] DEBUG: Started auxiliary module Screenshots 2025-02-10 16:31:52,155 [analyzer] DEBUG: Started auxiliary module Sysmon 2025-02-10 16:31:52,155 [analyzer] DEBUG: Started auxiliary module LoadZer0m0n 2025-02-10 16:31:52,233 [lib.api.process] INFO: Successfully executed process from path 'C:\\Windows\\System32\\cmd.exe' with arguments ['/c', 'start', '/wait', '"RvXVDbAQEzitVPO"', u'C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\586e74b451a12addb05f6fa8b0344d0df6e22157ff4cfd4da6c941756e5cba07'] and pid 2252 2025-02-10 16:31:52,515 [analyzer] DEBUG: Loaded monitor into process with pid 2252 2025-02-10 16:31:52,937 [analyzer] CRITICAL: Unable to find closeby page for hooking! 2025-02-10 16:31:52,967 [analyzer] CRITICAL: Unable to find closeby page for hooking! 2025-02-10 16:31:53,000 [analyzer] CRITICAL: Unable to find closeby page for hooking! 2025-02-10 16:31:53,000 [analyzer] CRITICAL: Unable to find closeby page for hooking! 2025-02-10 16:31:53,000 [analyzer] CRITICAL: Unable to find closeby page for hooking! 2025-02-10 16:31:53,000 [analyzer] CRITICAL: Unable to find closeby page for hooking! 2025-02-10 16:31:53,000 [analyzer] CRITICAL: Unable to find closeby page for hooking! 2025-02-10 16:31:53,030 [analyzer] CRITICAL: Unable to find closeby page for hooking! 2025-02-10 16:31:53,046 [analyzer] CRITICAL: Unable to find closeby page for hooking! 2025-02-10 16:31:53,078 [analyzer] CRITICAL: Unable to find closeby page for hooking! 2025-02-10 16:31:53,078 [analyzer] CRITICAL: Unable to find closeby page for hooking! 2025-02-10 16:31:53,108 [analyzer] CRITICAL: Unable to find closeby page for hooking! 2025-02-10 16:31:53,108 [analyzer] CRITICAL: Unable to find closeby page for hooking! 2025-02-10 16:31:53,108 [analyzer] CRITICAL: Unable to find closeby page for hooking! 2025-02-10 16:31:53,108 [analyzer] CRITICAL: Unable to find closeby page for hooking! 2025-02-10 16:31:53,125 [analyzer] CRITICAL: Unable to find closeby page for hooking! 2025-02-10 16:31:53,125 [analyzer] CRITICAL: Unable to find closeby page for hooking! 2025-02-10 16:31:53,125 [analyzer] CRITICAL: Unable to find closeby page for hooking! 2025-02-10 16:31:53,125 [analyzer] CRITICAL: Unable to find closeby page for hooking! 2025-02-10 16:31:53,125 [analyzer] CRITICAL: Unable to find closeby page for hooking! 2025-02-10 16:31:53,125 [analyzer] CRITICAL: Unable to find closeby page for hooking! 2025-02-10 16:31:53,140 [analyzer] CRITICAL: Unable to find closeby page for hooking! 2025-02-10 16:31:53,687 [analyzer] CRITICAL: Unable to find closeby page for hooking! 2025-02-10 16:31:53,687 [analyzer] CRITICAL: Unable to find closeby page for hooking! 2025-02-10 16:31:53,703 [analyzer] CRITICAL: Unable to find closeby page for hooking! 2025-02-10 16:31:53,703 [analyzer] CRITICAL: Unable to find closeby page for hooking! 2025-02-10 16:31:53,703 [analyzer] CRITICAL: Unable to find closeby page for hooking! 2025-02-10 16:31:53,703 [analyzer] CRITICAL: Unable to find closeby page for hooking! 2025-02-10 16:31:53,703 [analyzer] CRITICAL: Unable to find closeby page for hooking! 2025-02-10 16:31:53,717 [analyzer] CRITICAL: Unable to find closeby page for hooking! 2025-02-10 16:31:53,717 [analyzer] CRITICAL: Unable to find closeby page for hooking! 2025-02-10 16:31:53,717 [analyzer] CRITICAL: Unable to find closeby page for hooking! 2025-02-10 16:31:53,717 [analyzer] CRITICAL: Unable to find closeby page for hooking! 2025-02-10 16:31:53,858 [analyzer] CRITICAL: Unable to find closeby page for hooking! 2025-02-10 16:31:53,858 [analyzer] CRITICAL: Unable to find closeby page for hooking! 2025-02-10 16:31:53,858 [analyzer] CRITICAL: Unable to find closeby page for hooking! 2025-02-10 16:31:53,858 [analyzer] CRITICAL: Unable to find closeby page for hooking! 2025-02-10 16:31:53,875 [analyzer] CRITICAL: Unable to find closeby page for hooking! 2025-02-10 16:31:53,875 [analyzer] CRITICAL: Unable to find closeby page for hooking! 2025-02-10 16:31:53,875 [analyzer] CRITICAL: Unable to find closeby page for hooking! 2025-02-10 16:31:53,890 [analyzer] CRITICAL: Unable to find closeby page for hooking! 2025-02-10 16:31:53,890 [analyzer] CRITICAL: Unable to find closeby page for hooking! 2025-02-10 16:31:53,890 [analyzer] CRITICAL: Unable to find closeby page for hooking! 2025-02-10 16:31:53,890 [analyzer] CRITICAL: Unable to find closeby page for hooking! 2025-02-10 16:31:59,592 [analyzer] CRITICAL: Unable to find closeby page for hooking! 2025-02-10 16:31:59,592 [analyzer] CRITICAL: Unable to find closeby page for hooking! 2025-02-10 16:31:59,592 [analyzer] CRITICAL: Unable to find closeby page for hooking! 2025-02-10 16:31:59,608 [analyzer] CRITICAL: Unable to find closeby page for hooking! 2025-02-10 16:31:59,608 [analyzer] CRITICAL: Unable to find closeby page for hooking! 2025-02-10 16:31:59,608 [analyzer] CRITICAL: Unable to find closeby page for hooking! 2025-02-10 16:31:59,608 [analyzer] CRITICAL: Unable to find closeby page for hooking! 2025-02-10 16:31:59,625 [analyzer] CRITICAL: Unable to find closeby page for hooking! 2025-02-10 16:31:59,625 [analyzer] CRITICAL: Unable to find closeby page for hooking! 2025-02-10 16:31:59,625 [analyzer] CRITICAL: Unable to find closeby page for hooking! 2025-02-10 16:31:59,640 [analyzer] CRITICAL: Unable to find closeby page for hooking! 2025-02-10 16:32:03,717 [analyzer] INFO: Injected into process with pid 2156 and name u'rundll32.exe' 2025-02-10 16:32:03,937 [lib.api.process] ERROR: Failed to dump memory of 64-bit process with pid 2156. 2025-02-10 16:32:04,140 [analyzer] DEBUG: Loaded monitor into process with pid 2156 2025-02-10 16:32:04,453 [analyzer] CRITICAL: Error creating function stub for advapi32!ControlService. 2025-02-10 16:32:04,467 [analyzer] CRITICAL: Unable to change memory protection of advapi32!DeleteService at 0x09f498 6 to RWX (error code 0xc0000045)! 2025-02-10 16:32:04,483 [analyzer] CRITICAL: Unable to change memory protection of advapi32!OpenSCManagerA at 0x09f336 5 to RWX (error code 0xc0000045)! 2025-02-10 16:32:04,483 [analyzer] CRITICAL: Unable to change memory protection of advapi32!OpenSCManagerW at 0x09f4a8 6 to RWX (error code 0xc0000045)! 2025-02-10 16:32:04,483 [analyzer] CRITICAL: Error creating function stub for advapi32!OpenServiceA. 2025-02-10 16:32:04,483 [analyzer] CRITICAL: Unable to change memory protection of advapi32!OpenServiceW at 0x09f488 5 to RWX (error code 0xc0000045)! 2025-02-10 16:32:04,483 [analyzer] CRITICAL: Unable to change memory protection of advapi32!RegCloseKey at 0x09f6b4 5 to RWX (error code 0xc0000045)! 2025-02-10 16:32:04,500 [analyzer] CRITICAL: Unable to change memory protection of advapi32!RegDeleteValueA at 0x09f5ee 6 to RWX (error code 0xc0000045)! 2025-02-10 16:32:04,500 [analyzer] CRITICAL: Unable to change memory protection of advapi32!RegDeleteValueW at 0x09f5dc 10 to RWX (error code 0xc0000045)! 2025-02-10 16:32:04,515 [analyzer] CRITICAL: Unable to change memory protection of advapi32!StartServiceCtrlDispatcherW at 0x09f276 6 to RWX (error code 0xc0000045)! 2025-02-10 16:32:04,515 [analyzer] CRITICAL: Error creating function stub for advapi32!StartServiceW. 2025-02-10 16:32:04,530 [analyzer] CRITICAL: Error creating function stub for advapi32!ControlService. 2025-02-10 16:32:04,530 [analyzer] CRITICAL: Unable to change memory protection of advapi32!DeleteService at 0x09f498 6 to RWX (error code 0xc0000045)! 2025-02-10 16:32:04,546 [analyzer] CRITICAL: Unable to change memory protection of advapi32!OpenSCManagerA at 0x09f336 5 to RWX (error code 0xc0000045)! 2025-02-10 16:32:04,546 [analyzer] CRITICAL: Unable to change memory protection of advapi32!OpenSCManagerW at 0x09f4a8 6 to RWX (error code 0xc0000045)! 2025-02-10 16:32:04,546 [analyzer] CRITICAL: Error creating function stub for advapi32!OpenServiceA. 2025-02-10 16:32:04,546 [analyzer] CRITICAL: Unable to change memory protection of advapi32!OpenServiceW at 0x09f488 5 to RWX (error code 0xc0000045)! 2025-02-10 16:32:04,546 [analyzer] CRITICAL: Unable to change memory protection of advapi32!RegCloseKey at 0x09f6b4 5 to RWX (error code 0xc0000045)! 2025-02-10 16:32:04,546 [analyzer] CRITICAL: Unable to change memory protection of advapi32!RegDeleteValueA at 0x09f5ee 6 to RWX (error code 0xc0000045)! 2025-02-10 16:32:04,546 [analyzer] CRITICAL: Unable to change memory protection of advapi32!RegDeleteValueW at 0x09f5dc 10 to RWX (error code 0xc0000045)! 2025-02-10 16:32:04,546 [analyzer] CRITICAL: Unable to change memory protection of advapi32!StartServiceCtrlDispatcherW at 0x09f276 6 to RWX (error code 0xc0000045)! 2025-02-10 16:32:04,546 [analyzer] CRITICAL: Error creating function stub for advapi32!StartServiceW. 2025-02-10 16:32:05,390 [analyzer] CRITICAL: Error creating function stub for advapi32!ControlService. 2025-02-10 16:32:05,390 [analyzer] CRITICAL: Unable to change memory protection of advapi32!DeleteService at 0x09f498 6 to RWX (error code 0xc0000045)! 2025-02-10 16:32:05,405 [analyzer] CRITICAL: Unable to change memory protection of advapi32!OpenSCManagerA at 0x09f336 5 to RWX (error code 0xc0000045)! 2025-02-10 16:32:05,405 [analyzer] CRITICAL: Unable to change memory protection of advapi32!OpenSCManagerW at 0x09f4a8 6 to RWX (error code 0xc0000045)! 2025-02-10 16:32:05,405 [analyzer] CRITICAL: Error creating function stub for advapi32!OpenServiceA. 2025-02-10 16:32:05,405 [analyzer] CRITICAL: Unable to change memory protection of advapi32!OpenServiceW at 0x09f488 5 to RWX (error code 0xc0000045)! 2025-02-10 16:32:05,405 [analyzer] CRITICAL: Unable to change memory protection of advapi32!RegCloseKey at 0x09f6b4 5 to RWX (error code 0xc0000045)! 2025-02-10 16:32:05,421 [analyzer] CRITICAL: Unable to change memory protection of advapi32!RegDeleteValueA at 0x09f5ee 6 to RWX (error code 0xc0000045)! 2025-02-10 16:32:05,421 [analyzer] CRITICAL: Unable to change memory protection of advapi32!RegDeleteValueW at 0x09f5dc 10 to RWX (error code 0xc0000045)! 2025-02-10 16:32:05,421 [analyzer] CRITICAL: Unable to change memory protection of advapi32!StartServiceCtrlDispatcherW at 0x09f276 6 to RWX (error code 0xc0000045)! 2025-02-10 16:32:05,437 [analyzer] CRITICAL: Error creating function stub for advapi32!StartServiceW. 2025-02-10 16:32:05,562 [analyzer] CRITICAL: Error creating function stub for advapi32!ControlService. 2025-02-10 16:32:05,562 [analyzer] CRITICAL: Unable to change memory protection of advapi32!DeleteService at 0x09f498 6 to RWX (error code 0xc0000045)! 2025-02-10 16:32:05,562 [analyzer] CRITICAL: Unable to change memory protection of advapi32!OpenSCManagerA at 0x09f336 5 to RWX (error code 0xc0000045)! 2025-02-10 16:32:05,578 [analyzer] CRITICAL: Unable to change memory protection of advapi32!OpenSCManagerW at 0x09f4a8 6 to RWX (error code 0xc0000045)! 2025-02-10 16:32:05,578 [analyzer] CRITICAL: Error creating function stub for advapi32!OpenServiceA. 2025-02-10 16:32:05,578 [analyzer] CRITICAL: Unable to change memory protection of advapi32!OpenServiceW at 0x09f488 5 to RWX (error code 0xc0000045)! 2025-02-10 16:32:05,578 [analyzer] CRITICAL: Unable to change memory protection of advapi32!RegCloseKey at 0x09f6b4 5 to RWX (error code 0xc0000045)! 2025-02-10 16:32:05,592 [analyzer] CRITICAL: Unable to change memory protection of advapi32!RegDeleteValueA at 0x09f5ee 6 to RWX (error code 0xc0000045)! 2025-02-10 16:32:05,592 [analyzer] CRITICAL: Unable to change memory protection of advapi32!RegDeleteValueW at 0x09f5dc 10 to RWX (error code 0xc0000045)! 2025-02-10 16:32:05,592 [analyzer] CRITICAL: Unable to change memory protection of advapi32!StartServiceCtrlDispatcherW at 0x09f276 6 to RWX (error code 0xc0000045)! 2025-02-10 16:32:05,608 [analyzer] CRITICAL: Error creating function stub for advapi32!StartServiceW. 2025-02-10 16:32:07,515 [analyzer] CRITICAL: Error creating function stub for advapi32!ControlService. 2025-02-10 16:32:07,515 [analyzer] CRITICAL: Unable to change memory protection of advapi32!DeleteService at 0x09f498 6 to RWX (error code 0xc0000045)! 2025-02-10 16:32:07,515 [analyzer] CRITICAL: Unable to change memory protection of advapi32!OpenSCManagerA at 0x09f336 5 to RWX (error code 0xc0000045)! 2025-02-10 16:32:07,530 [analyzer] CRITICAL: Unable to change memory protection of advapi32!OpenSCManagerW at 0x09f4a8 6 to RWX (error code 0xc0000045)! 2025-02-10 16:32:07,530 [analyzer] CRITICAL: Error creating function stub for advapi32!OpenServiceA. 2025-02-10 16:32:07,530 [analyzer] CRITICAL: Unable to change memory protection of advapi32!OpenServiceW at 0x09f488 5 to RWX (error code 0xc0000045)! 2025-02-10 16:32:07,530 [analyzer] CRITICAL: Unable to change memory protection of advapi32!RegCloseKey at 0x09f6b4 5 to RWX (error code 0xc0000045)! 2025-02-10 16:32:07,546 [analyzer] CRITICAL: Unable to change memory protection of advapi32!RegDeleteValueA at 0x09f5ee 6 to RWX (error code 0xc0000045)! 2025-02-10 16:32:07,546 [analyzer] CRITICAL: Unable to change memory protection of advapi32!RegDeleteValueW at 0x09f5dc 10 to RWX (error code 0xc0000045)! 2025-02-10 16:32:07,546 [analyzer] CRITICAL: Unable to change memory protection of advapi32!StartServiceCtrlDispatcherW at 0x09f276 6 to RWX (error code 0xc0000045)! 2025-02-10 16:32:07,546 [analyzer] CRITICAL: Error creating function stub for advapi32!StartServiceW. 2025-02-10 16:32:21,265 [analyzer] INFO: Analysis timeout hit, terminating analysis. 2025-02-10 16:32:21,671 [analyzer] INFO: Terminating remaining processes before shutdown. 2025-02-10 16:32:21,671 [lib.api.process] INFO: Successfully terminated process with pid 2252. 2025-02-10 16:32:21,671 [lib.api.process] INFO: Successfully terminated process with pid 2156. 2025-02-10 16:32:21,671 [analyzer] INFO: Analysis completed.
2025-02-11 20:56:50,631 [cuckoo.core.scheduler] INFO: Task #5923363: acquired machine win7x6412 (label=win7x6412) 2025-02-11 20:56:50,634 [cuckoo.core.resultserver] DEBUG: Now tracking machine 192.168.168.212 for task #5923363 2025-02-11 20:56:51,084 [cuckoo.auxiliary.sniffer] INFO: Started sniffer with PID 2776869 (interface=vboxnet0, host=192.168.168.212) 2025-02-11 20:56:51,136 [cuckoo.machinery.virtualbox] DEBUG: Starting vm win7x6412 2025-02-11 20:56:51,939 [cuckoo.machinery.virtualbox] DEBUG: Restoring virtual machine win7x6412 to vmcloak 2025-02-11 20:59:52,332 [cuckoo.core.guest] INFO: Starting analysis #5923363 on guest (id=win7x6412, ip=192.168.168.212) 2025-02-11 20:59:53,336 [cuckoo.core.guest] DEBUG: win7x6412: not ready yet 2025-02-11 20:59:58,358 [cuckoo.core.guest] INFO: Guest is running Cuckoo Agent 0.10 (id=win7x6412, ip=192.168.168.212) 2025-02-11 20:59:58,442 [cuckoo.core.guest] DEBUG: Uploading analyzer to guest (id=win7x6412, ip=192.168.168.212, monitor=latest, size=6660546) 2025-02-11 20:59:59,604 [cuckoo.core.resultserver] DEBUG: Task #5923363: live log analysis.log initialized. 2025-02-11 21:00:00,722 [cuckoo.core.resultserver] DEBUG: Task #5923363 is sending a BSON stream 2025-02-11 21:00:01,029 [cuckoo.core.resultserver] DEBUG: Task #5923363 is sending a BSON stream 2025-02-11 21:00:01,884 [cuckoo.core.resultserver] DEBUG: Task #5923363: File upload for 'shots/0001.jpg' 2025-02-11 21:00:01,934 [cuckoo.core.resultserver] DEBUG: Task #5923363 uploaded file length: 110732 2025-02-11 21:00:12,627 [cuckoo.core.resultserver] DEBUG: Task #5923363 is sending a BSON stream 2025-02-11 21:00:14,304 [cuckoo.core.guest] DEBUG: win7x6412: analysis #5923363 still processing 2025-02-11 21:00:29,669 [cuckoo.core.guest] DEBUG: win7x6412: analysis #5923363 still processing 2025-02-11 21:00:30,108 [cuckoo.core.resultserver] DEBUG: Task #5923363: File upload for 'curtain/1739201541.39.curtain.log' 2025-02-11 21:00:30,119 [cuckoo.core.resultserver] DEBUG: Task #5923363 uploaded file length: 36 2025-02-11 21:00:30,257 [cuckoo.core.resultserver] DEBUG: Task #5923363: File upload for 'sysmon/1739201541.64.sysmon.xml' 2025-02-11 21:00:30,290 [cuckoo.core.resultserver] DEBUG: Task #5923363 uploaded file length: 1868638 2025-02-11 21:00:30,731 [cuckoo.core.resultserver] DEBUG: Task #5923363: File upload for 'shots/0002.jpg' 2025-02-11 21:00:30,750 [cuckoo.core.resultserver] DEBUG: Task #5923363 uploaded file length: 133471 2025-02-11 21:00:30,763 [cuckoo.core.resultserver] DEBUG: Task #5923363 had connection reset for <Context for LOG> 2025-02-11 21:00:32,685 [cuckoo.core.guest] INFO: win7x6412: analysis completed successfully 2025-02-11 21:00:32,696 [cuckoo.core.plugins] DEBUG: Stopped auxiliary module: Redsocks 2025-02-11 21:00:32,727 [cuckoo.core.plugins] DEBUG: Stopped auxiliary module: Sniffer 2025-02-11 21:00:33,781 [cuckoo.machinery.virtualbox] INFO: Successfully generated memory dump for virtual machine with label win7x6412 to path /srv/cuckoo/cwd/storage/analyses/5923363/memory.dmp 2025-02-11 21:00:33,782 [cuckoo.machinery.virtualbox] DEBUG: Stopping vm win7x6412 2025-02-11 21:03:49,774 [cuckoo.core.resultserver] DEBUG: Stopped tracking machine 192.168.168.212 for task #5923363 2025-02-11 21:03:50,469 [cuckoo.core.scheduler] DEBUG: Released database task #5923363 2025-02-11 21:03:50,487 [cuckoo.core.scheduler] INFO: Task #5923363: analysis procedure completed
registry | HKEY_LOCAL_MACHINE\SOFTWARE\Clients\Mail\Microsoft Outlook\Capabilities\Hidden |
Microsoft | Trojan:HTML/Phish.DG!MTB |
MaxSecure | Trojan.WIN32.cryxos.5913 |
Fortinet | HTML/Agent.EC!tr |