Exes_606063c7a04a300577e0e29a04964c9e_jpg_2019-08-23_07_10.txt

* MalFamily: "Ecjj"

* MalScore: 10.0

* File Name: "Exes_606063c7a04a300577e0e29a04964c9e.jpg"
* File Size: 1021952
* File Type: "PE32 executable (GUI) Intel 80386, for MS Windows"
* SHA256: "7c76424b56e4a678617fa9020a57c8342947ad883f747344f14520dee6f124a9"
* MD5: "606063c7a04a300577e0e29a04964c9e"
* SHA1: "b0bd7d2291be57c1645eaed12c0f6a91f79ddf61"
* SHA512: "65255bdce099391e244f9b01c3bb5ec07fb4074654051f6558640a1892eeb2eb720b7e7d9051e1ab7dbcfa33ea3dd044854491c0bfb9282531b6b2c31d86fae5"
* CRC32: "2C138485"
* SSDEEP: "24576:1AHnh+eWsN3skA4RV1Hom2KXMmHaA0Xslu5:kh+ZkldoPK8YaA0XsG"

* Process Execution:
    "Exes_606063c7a04a300577e0e29a04964c9e.jpg",
    "Exes_606063c7a04a300577e0e29a04964c9e.jpg",
    "images.exe",
    "images.exe"


* Executed Commands:

* Signatures Detected:

        "Description": "Attempts to connect to a dead IP:Port (1 unique times)",
        "Details":

                "IP": "79.134.225.71:2019"




        "Description": "Creates RWX memory",
        "Details":


        "Description": "Drops a binary and executes it",
        "Details":

                "binary": "C:\\ProgramData\\images.exe"




        "Description": "Executed a process and injected code into it, probably while unpacking",
        "Details":

                "Injection": "Exes_606063c7a04a300577e0e29a04964c9e.jpg(2580) -> Exes_606063c7a04a300577e0e29a04964c9e.jpg(2872)"




        "Description": "Attempts to remove evidence of file being downloaded from the Internet",
        "Details":

                "file": "C:\\ProgramData\\images.exe:Zone.Identifier"




        "Description": "Installs itself for autorun at Windows startup",
        "Details":

                "key": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Run\\Images"


                "data": "C:\\ProgramData\\images.exe"




        "Description": "File has been identified by 33 Antiviruses on VirusTotal as malicious",
        "Details":

                "MicroWorld-eScan": "Trojan.Agent.ECJJ"


                "FireEye": "Generic.mg.606063c7a04a3005"


                "McAfee": "Trojan-AitInject.aq"


                "Cylance": "Unsafe"


                "CrowdStrike": "win/malicious_confidence_80% (W)"


                "Arcabit": "Trojan.Agent.ECJJ"


                "Invincea": "heuristic"


                "F-Prot": "W32/Autoit.G.gen!Eldorado"


                "Symantec": "ML.Attribute.HighConfidence"


                "APEX": "Malicious"


                "Kaspersky": "UDS:DangerousObject.Multi.Generic"


                "BitDefender": "Trojan.Agent.ECJJ"


                "Paloalto": "generic.ml"


                "Ad-Aware": "Trojan.Agent.ECJJ"


                "McAfee-GW-Edition": "BehavesLike.Win32.Downloader.dh"


                "Emsisoft": "Trojan.Agent.ECJJ (B)"


                "Cyren": "W32/Autoit.G.gen!Eldorado"


                "Antiy-AVL": "Trojan/Generic.ASVCS3S.1E5"


                "Microsoft": "Trojan:Win32/Casur.A!cl"


                "Endgame": "malicious (high confidence)"


                "ZoneAlarm": "UDS:DangerousObject.Multi.Generic"


                "GData": "Trojan.Agent.ECJJ (2x)"


                "AhnLab-V3": "Malware/Win32.RL_Generic.R285826"


                "Acronis": "suspicious"


                "ALYac": "Trojan.Agent.ECJJ"


                "MAX": "malware (ai score=86)"


                "Malwarebytes": "Trojan.MalPack.AutoIt"


                "ESET-NOD32": "a variant of Win32/Injector.Autoit.EFT"


                "TrendMicro-HouseCall": "TROJ_GEN.R04AH09HM19"


                "Ikarus": "Trojan.Autoit"


                "MaxSecure": "Trojan.Malware.300983.susgen"


                "Fortinet": "AutoIt/Injector.EFR!tr"


                "Qihoo-360": "HEUR/QVM10.1.5E43.Malware.Gen"




        "Description": "Creates a copy of itself",
        "Details":

                "copy": "C:\\ProgramData\\images.exe"




        "Description": "Anomalous binary characteristics",
        "Details":

                "anomaly": "Actual checksum does not match that reported in PE header"





* Started Service:

* Mutexes:

* Modified Files:
    "C:\\ProgramData\\images.exe"


* Deleted Files:
    "C:\\ProgramData\\images.exe:Zone.Identifier"


* Modified Registry Keys:
    "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\MediaResources\\msvideo",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\MaxConnectionsPer1_0Server",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\MaxConnectionsPerServer",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\4EZ2PV29V6",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\4EZ2PV29V6\\inst",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Run\\Images"


* Deleted Registry Keys:

* DNS Communications:

        "type": "A",
        "request": "levelup.publicvm.com",
        "answers":

                "data": "79.134.225.71",
                "type": "A"





* Domains:

        "ip": "79.134.225.71",
        "domain": "levelup.publicvm.com"



* Network Communication - ICMP:

* Network Communication - HTTP:

* Network Communication - SMTP:

* Network Communication - Hosts:

* Network Communication - IRC: