Xcitium Cloud Verdict

File Name: db1666bf21e0ce2110ad319e29edf930a8fec7e2d53b5daa6f4c1eafcea50a79.ex

File Type: PE32 executable (GUI) Intel 80386, for MS Windows

SHA1: 2fe9b1b874c6bc2bf266e81d3ff9a483b50ec40c

MD5: 6b4a58489c8865a8033895d4f12ccd3a

Download Kill Chain Report

Accessed Files

\Device\KsecDD
C:\Users\user\AppData\Local\Temp\2fe9b1b874c6bc2bf266e81d3ff9a483b50ec40c.exe.cfg
C:\Windows\sysnative\C_932.NLS
C:\Windows\sysnative\C_949.NLS
C:\Windows\sysnative\C_950.NLS
- C:\Windows\sysnative\C_936.NLS
- C:\Users\user\AppData\Local\Temp\2fe9b1b874c6bc2bf266e81d3ff9a483b50ec40c.exe
- C:\Users\user\nioocem.exe
- \??\MountPointManager
- \Device\Afd\AsyncSelectHlp
- C:\Users\user\nioocem.exe.cfg
Show More 6

Read Registry Keys

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\Windows Error Reporting\WMR\Disable
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SESSION MANAGER\SafeProcessSearchMode
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CodePage\932
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CodePage\949
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CodePage\950
- HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CodePage\936
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{d35f944c-ffec-11e6-bdeb-806e6f6e6963}\Data
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{d35f944c-ffec-11e6-bdeb-806e6f6e6963}\Generation
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{2400a2c4-ccb0-11e5-b7bd-806e6f6e6963}\Data
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{2400a2c4-ccb0-11e5-b7bd-806e6f6e6963}\Generation
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{2400a2c5-ccb0-11e5-b7bd-806e6f6e6963}\Data
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{2400a2c5-ccb0-11e5-b7bd-806e6f6e6963}\Generation
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{2400a2c6-ccb0-11e5-b7bd-806e6f6e6963}\Data
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{2400a2c6-ccb0-11e5-b7bd-806e6f6e6963}\Generation
Show More 9

Modified Files

C:\Users\user\nioocem.exe
\Device\Afd\AsyncSelectHlp

Resolved APIs

cryptbase.dll.SystemFunction036
uxtheme.dll.ThemeInitApiHook
user32.dll.IsProcessDPIAware
oleaut32.dll.OleLoadPictureEx
oleaut32.dll.DispCallFunc
- oleaut32.dll.LoadTypeLibEx
- oleaut32.dll.UnRegisterTypeLib
- oleaut32.dll.CreateTypeLib2
- oleaut32.dll.VarDateFromUdate
- oleaut32.dll.VarUdateFromDate
- oleaut32.dll.GetAltMonthNames
- oleaut32.dll.VarNumFromParseNum
- oleaut32.dll.VarParseNumFromStr
- oleaut32.dll.VarDecFromR4
- oleaut32.dll.VarDecFromR8
- oleaut32.dll.VarDecFromDate
- oleaut32.dll.VarDecFromI4
- oleaut32.dll.VarDecFromCy
- oleaut32.dll.VarR4FromDec
- oleaut32.dll.GetRecordInfoFromTypeInfo
- oleaut32.dll.GetRecordInfoFromGuids
- oleaut32.dll.SafeArrayGetRecordInfo
- oleaut32.dll.SafeArraySetRecordInfo
- oleaut32.dll.SafeArrayGetIID
- oleaut32.dll.SafeArraySetIID
- oleaut32.dll.SafeArrayCopyData
- oleaut32.dll.SafeArrayAllocDescriptorEx
- oleaut32.dll.SafeArrayCreateEx
- oleaut32.dll.VarFormat
- oleaut32.dll.VarFormatDateTime
- oleaut32.dll.VarFormatNumber
- oleaut32.dll.VarFormatPercent
- oleaut32.dll.VarFormatCurrency
- oleaut32.dll.VarWeekdayName
- oleaut32.dll.VarMonthName
- oleaut32.dll.VarAdd
- oleaut32.dll.VarAnd
- oleaut32.dll.VarCat
- oleaut32.dll.VarDiv
- oleaut32.dll.VarEqv
- oleaut32.dll.VarIdiv
- oleaut32.dll.VarImp
- oleaut32.dll.VarMod
- oleaut32.dll.VarMul
- oleaut32.dll.VarOr
- oleaut32.dll.VarPow
- oleaut32.dll.VarSub
- oleaut32.dll.VarXor
- oleaut32.dll.VarAbs
- oleaut32.dll.VarFix
- oleaut32.dll.VarInt
- oleaut32.dll.VarNeg
- oleaut32.dll.VarNot
- oleaut32.dll.VarRound
- oleaut32.dll.VarCmp
- oleaut32.dll.VarDecAdd
- oleaut32.dll.VarDecCmp
- oleaut32.dll.VarBstrCat
- oleaut32.dll.VarCyMulI4
- oleaut32.dll.VarBstrCmp
- ole32.dll.CoCreateInstanceEx
- ole32.dll.CLSIDFromProgIDEx
- sxs.dll.SxsOleAut32MapIIDOrCLSIDToTypeLibrary
- user32.dll.GetSystemMetrics
- user32.dll.MonitorFromWindow
- user32.dll.MonitorFromRect
- user32.dll.MonitorFromPoint
- user32.dll.EnumDisplayMonitors
- user32.dll.GetMonitorInfoA
- user32.dll.GetKeyboardLayoutList
- kernel32.dll.GetModuleFileNameW
- user32.dll.CallWindowProcW
- kernel32.dll.Sleep
- shell32.dll.SHGetSpecialFolderPathW
- advapi32.dll.GetUserNameW
- kernel32.dll.OpenMutexW
- kernel32.dll.CreateMutexW
- kernel32.dll.ReleaseMutex
- kernel32.dll.CloseHandle
- kernel32.dll.SetFileAttributesW
- shell32.dll.ShellExecuteW
- setupapi.dll.CM_Get_Device_Interface_List_Size_ExW
- setupapi.dll.CM_Get_Device_Interface_List_ExW
- kernel32.dll.CreateToolhelp32Snapshot
- kernel32.dll.Process32First
- kernel32.dll.Process32Next
- kernel32.dll.GetCurrentProcessId
- kernel32.dll.OpenProcess
- kernel32.dll.GetModuleHandleW
- kernel32.dll.GetProcAddress
- kernel32.dll.TerminateProcess
- kernel32.dll.TerminateThread
- kernel32.dll.WriteProcessMemory
- advapi32.dll.RegCreateKeyExW
- advapi32.dll.RegSetValueExW
- advapi32.dll.RegCloseKey
- user32.dll.RegisterClassW
- user32.dll.CreateWindowExW
- user32.dll.DefWindowProcW
- dwmapi.dll.DwmIsCompositionEnabled
- user32.dll.ShowWindow
- user32.dll.SetWindowLongW
- ws2_32.dll.WSAStartup
- ws2_32.dll.htons
- ws2_32.dll.gethostbyname
- kernel32.dll.RtlMoveMemory
- ws2_32.dll.socket
- ws2_32.dll.connect
- ws2_32.dll.WSAAsyncSelect
- user32.dll.GetMessageW
- kernel32.dll.GetLogicalDriveStringsW
- kernel32.dll.GetDriveTypeW
- user32.dll.SetTimer
- kernel32.dll.GetLogicalDrives
Show More 109

Registry Keys

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Windows Error Reporting\WMR
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\Windows Error Reporting\WMR\Disable
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SESSION MANAGER\SafeProcessSearchMode
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\Codepage
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CodePage\932
- HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CodePage\949
- HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CodePage\950
- HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CodePage\936
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\VBA\Monitors
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellCompatibility\Applications\2fe9b1b874c6bc2bf266e81d3ff9a483b50ec40c.exe
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{d35f944c-ffec-11e6-bdeb-806e6f6e6963}\
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{d35f944c-ffec-11e6-bdeb-806e6f6e6963}\Data
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{d35f944c-ffec-11e6-bdeb-806e6f6e6963}\Generation
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{2400a2c4-ccb0-11e5-b7bd-806e6f6e6963}\
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{2400a2c4-ccb0-11e5-b7bd-806e6f6e6963}\Data
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{2400a2c4-ccb0-11e5-b7bd-806e6f6e6963}\Generation
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{2400a2c5-ccb0-11e5-b7bd-806e6f6e6963}\
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{2400a2c5-ccb0-11e5-b7bd-806e6f6e6963}\Data
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{2400a2c5-ccb0-11e5-b7bd-806e6f6e6963}\Generation
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{2400a2c6-ccb0-11e5-b7bd-806e6f6e6963}\
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{2400a2c6-ccb0-11e5-b7bd-806e6f6e6963}\Data
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{2400a2c6-ccb0-11e5-b7bd-806e6f6e6963}\Generation
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\nioocem
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden
- HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
- HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU\NoAutoUpdate
Show More 24

Read Files

\Device\KsecDD
C:\Users\user\AppData\Local\Temp\2fe9b1b874c6bc2bf266e81d3ff9a483b50ec40c.exe
\Device\Afd\AsyncSelectHlp
C:\Users\user\nioocem.exe

Modified Registry Keys

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\nioocem
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU\NoAutoUpdate

Loading...