VMRay Analyzer Report
VTI Information
VTI Score
75 / 100
VTI Database Version2.2
VTI Rule Match Count23
VTI Rule TypeDefault (PE, ...)
Detected Threats
ArrowOSModify system configuration
Disable the display of hidden files and folders.
ArrowOSModify system security configuration
Disable UAC notification.
ArrowAnti AnalysisTry to detect virtual machine
Possibly trying to detect VM via rdtsc.
ArrowProcessAllocate a page with write and execute permissions
Allocate a page with "PAGE_EXECUTE_READWRITE" permissions, often used to dynamically unpack code.
ArrowProcessCreate system object
Create mutex with name "AsEwIwsA".
Create mutex with name "TYAckMgs".
ArrowProcessCreate process with hidden window
The process "C:\Users\WI2yhmtI onvScY7Pe\ayooEMEE\XuMIAsww.exe" starts with hidden window.
The process "C:\ProgramData\VmYMsIgM\YOUMMIEo.exe" starts with hidden window.
The process "C:\Users\WI2YHM~1\AppData\Local\Temp\dWAAskwo.bat" starts with hidden window.
The process "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1" starts with hidden window.
The process "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2" starts with hidden window.
The process "reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f" starts with hidden window.
ArrowPersistenceInstall system startup script or application
Add "C:\Users\WI2yhmtI onvScY7Pe\ayooEMEE\XuMIAsww.exe" to windows startup via registry.
Add "C:\ProgramData\VmYMsIgM\YOUMMIEo.exe" to windows startup via registry.
Add "C:\Windows\system32\userinit.exe,C:\ProgramData\VmYMsIgM\YOUMMIEo.exe," to windows startup via registry.
Add "C:\ProgramData\VmYMsIgM\YOUMMIEo.exe," to windows startup via registry.
ArrowPersistenceInstall system service
Install service "cEMAEwpb" by CreateServiceW.
ArrowPEDrop PE file
Drop file "c:\users\wi2yhmti onvscy7pe\ayooemee\xumiasww.exe".
Drop file "c:\programdata\vmymsigm\yoummieo.exe".
Drop file "c:\programdata\baieaacu\xuaecwog.exe".
ArrowPEExecute dropped PE file
Execute dropped file "c:\users\wi2yhmti onvscy7pe\ayooemee\xumiasww.exe".
Execute dropped file "c:\programdata\vmymsigm\yoummieo.exe".
Execute dropped file "c:\programdata\baieaacu\xuaecwog.exe".
Function Logfile
Exit-Icon

This feature requires an online-connection to the VMRay backend.

An offline version with limited functionality is also provided.
The offline version is supported only in Mozilla Firefox with deactivated setting "security.fileuri.strict_origin_policy".


Screenshot
Expand-Icon
Exit-Icon
icon_left
icon_left
image