Source: Lakeringernes (1).exe |
ReversingLabs: Detection: 76% |
Source: Lakeringernes (1).exe |
Virustotal: Detection: 34% |
Perma Link |
Source: Lakeringernes (1).exe |
Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE |
Source: C:\Users\user\Desktop\Lakeringernes (1).exe |
Registry value created: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\Strikketjet |
Jump to behavior |
Source: Lakeringernes (1).exe |
Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE |
Source: C:\Users\user\Desktop\Lakeringernes (1).exe |
Code function: 0_2_00405FFD FindFirstFileA,FindClose, |
0_2_00405FFD |
Source: C:\Users\user\Desktop\Lakeringernes (1).exe |
Code function: 0_2_0040559B GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose, |
0_2_0040559B |
Source: C:\Users\user\Desktop\Lakeringernes (1).exe |
Code function: 0_2_00402688 FindFirstFileA, |
0_2_00402688 |
Source: Lakeringernes (1).exe |
String found in binary or memory: http://crl.certum.pl/ctnca.crl0k |
Source: Lakeringernes (1).exe |
String found in binary or memory: http://crl.certum.pl/ctnca2.crl0l |
Source: Lakeringernes (1).exe |
String found in binary or memory: http://crl.certum.pl/ctsca2021.crl0o |
Source: Lakeringernes (1).exe |
String found in binary or memory: http://nsis.sf.net/NSIS_Error |
Source: Lakeringernes (1).exe |
String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError |
Source: Lakeringernes (1).exe |
String found in binary or memory: http://repository.certum.pl/ctnca.cer09 |
Source: Lakeringernes (1).exe |
String found in binary or memory: http://repository.certum.pl/ctnca2.cer09 |
Source: Lakeringernes (1).exe |
String found in binary or memory: http://repository.certum.pl/ctsca2021.cer0 |
Source: Lakeringernes (1).exe |
String found in binary or memory: http://subca.ocsp-certum.com01 |
Source: Lakeringernes (1).exe |
String found in binary or memory: http://subca.ocsp-certum.com02 |
Source: Lakeringernes (1).exe |
String found in binary or memory: http://subca.ocsp-certum.com05 |
Source: Lakeringernes (1).exe |
String found in binary or memory: http://www.certum.pl/CPS0 |
Source: C:\Users\user\Desktop\Lakeringernes (1).exe |
Code function: 0_2_00405050 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,ShowWindow,ShowWindow,GetDlgItem,SendMessageA,SendMessageA,SendMessageA,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageA,CreatePopupMenu,AppendMenuA,GetWindowRect,TrackPopupMenu,SendMessageA,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageA,GlobalUnlock,SetClipboardData,CloseClipboard, |
0_2_00405050 |
Source: Lakeringernes (1).exe |
Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE |
Source: C:\Users\user\Desktop\Lakeringernes (1).exe |
Code function: 0_2_004030D9 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,GetModuleHandleA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess, |
0_2_004030D9 |
Source: C:\Users\user\Desktop\Lakeringernes (1).exe |
File created: C:\Windows\resources\0409 |
Jump to behavior |
Source: C:\Users\user\Desktop\Lakeringernes (1).exe |
Code function: 0_2_0040488F |
0_2_0040488F |
Source: C:\Users\user\Desktop\Lakeringernes (1).exe |
Code function: 0_2_00406344 |
0_2_00406344 |
Source: Lakeringernes (1).exe |
Static PE information: invalid certificate |
Source: C:\Users\user\Desktop\Lakeringernes (1).exe |
Process Stats: CPU usage > 98% |
Source: Lakeringernes (1).exe |
ReversingLabs: Detection: 76% |
Source: Lakeringernes (1).exe |
Virustotal: Detection: 34% |
Source: C:\Users\user\Desktop\Lakeringernes (1).exe |
File read: C:\Users\user\Desktop\Lakeringernes (1).exe |
Jump to behavior |
Source: Lakeringernes (1).exe |
Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ |
Source: C:\Users\user\Desktop\Lakeringernes (1).exe |
Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers |
Jump to behavior |
Source: C:\Users\user\Desktop\Lakeringernes (1).exe |
Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32 |
Jump to behavior |
Source: C:\Users\user\Desktop\Lakeringernes (1).exe |
Code function: 0_2_004030D9 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,GetModuleHandleA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess, |
0_2_004030D9 |
Source: C:\Users\user\Desktop\Lakeringernes (1).exe |
File created: C:\Users\user\AppData\Local\Temp\nscFD30.tmp |
Jump to behavior |
Source: C:\Users\user\Desktop\Lakeringernes (1).exe |
File written: C:\Users\user\AppData\Local\Temp\Distressingly\Bloods\Ultraevangelical\Graviton\Kvle\Materialiseringerne\Antenneanlgget\Custom3.ini |
Jump to behavior |
Source: classification engine |
Classification label: mal68.troj.evad.winEXE@1/5@0/0 |
Source: C:\Users\user\Desktop\Lakeringernes (1).exe |
Code function: 0_2_0040205E CoCreateInstance,MultiByteToWideChar, |
0_2_0040205E |
Source: C:\Users\user\Desktop\Lakeringernes (1).exe |
File read: C:\Users\desktop.ini |
Jump to behavior |
Source: C:\Users\user\Desktop\Lakeringernes (1).exe |
Code function: 0_2_0040431C GetDlgItem,SetWindowTextA,SHBrowseForFolderA,CoTaskMemFree,lstrcmpiA,lstrcatA,SetDlgItemTextA,GetDiskFreeSpaceA,MulDiv,SetDlgItemTextA, |
0_2_0040431C |
Source: C:\Users\user\Desktop\Lakeringernes (1).exe |
Registry value created: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\Strikketjet |
Jump to behavior |
Source: Lakeringernes (1).exe |
Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE |
Source: Yara match |
File source: 00000000.00000002.828291319.0000000003260000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000000.00000002.827978780.000000000064B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: C:\Users\user\Desktop\Lakeringernes (1).exe |
Code function: 0_2_10002D20 push eax; ret |
0_2_10002D4E |
Source: C:\Users\user\Desktop\Lakeringernes (1).exe |
Code function: 0_2_10001A5D GlobalAlloc,lstrcpyA,lstrcpyA,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyA,GetModuleHandleA,LoadLibraryA,GetProcAddress,lstrlenA, |
0_2_10001A5D |
Source: C:\Users\user\Desktop\Lakeringernes (1).exe |
File created: C:\Users\user\AppData\Local\Temp\nst187.tmp\System.dll |
Jump to dropped file |
Source: C:\Users\user\Desktop\Lakeringernes (1).exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\Lakeringernes (1).exe |
RDTSC instruction interceptor: First address: 0000000003263429 second address: 0000000003263429 instructions: 0x00000000 rdtsc 0x00000002 cmp ebx, ecx 0x00000004 jc 00007FE785003503h 0x00000006 test dh, bh 0x00000008 test bl, bl 0x0000000a inc ebp 0x0000000b test ax, ax 0x0000000e inc ebx 0x0000000f rdtsc |
Source: C:\Users\user\Desktop\Lakeringernes (1).exe |
Code function: 0_2_00405FFD FindFirstFileA,FindClose, |
0_2_00405FFD |
Source: C:\Users\user\Desktop\Lakeringernes (1).exe |
Code function: 0_2_0040559B GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose, |
0_2_0040559B |
Source: C:\Users\user\Desktop\Lakeringernes (1).exe |
Code function: 0_2_00402688 FindFirstFileA, |
0_2_00402688 |
Source: C:\Users\user\Desktop\Lakeringernes (1).exe |
API call chain: ExitProcess graph end node |
Source: C:\Users\user\Desktop\Lakeringernes (1).exe |
API call chain: ExitProcess graph end node |
Source: C:\Users\user\Desktop\Lakeringernes (1).exe |
Code function: 0_2_10001A5D GlobalAlloc,lstrcpyA,lstrcpyA,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyA,GetModuleHandleA,LoadLibraryA,GetProcAddress,lstrlenA, |
0_2_10001A5D |
Source: C:\Users\user\Desktop\Lakeringernes (1).exe |
Code function: 0_2_00405D1B GetVersion,GetSystemDirectoryA,GetWindowsDirectoryA,SHGetSpecialFolderLocation,SHGetPathFromIDListA,CoTaskMemFree,lstrcatA,lstrlenA, |
0_2_00405D1B |