formatfactory 4.6.2.0

Git Commits

Osquery has some really exciting table updates! There is a much anticipated for macOS, this table is the replacement for , and uses the current Apple APIs. Additionally, several tables have improved their cross-platform support.

Representing commits from 14 contributors! Thank you all.

New Features

• Add denylist mechanism to distributed queries (#)

Table Changes

• Add column to table on Linux (#)
• Add column to table on Windows. (#)
• Add table for macOS (UAL) (#, #)
• Port table to Windows (#)
• Port table to M1 Macs (#)
• Restore macOS table on modern macOS (#)
• Update table on macOS m1 with correct raw battery max and current capacity (#)
• Update query timeout to 30 seconds (#)
• Update macos table to use use as sentinel value for column (#)
• Update parsing of file (#)
• Update the table to be case insensitive for (#)

Under the Hood improvements

• Add a mechanism to reduce memory retained on Linux (#)
• Add denylist mechanism to distributed queries (#)
• Add table spec support for (#)
• Improve Pidfile handling (#)
• Prevent the audit event system from using too much memory (#)
• carves: use full pathnames while creating an archive (#)

Bug Fixes

• Fix for Windows table (#)
• Fix bug where values were out of date (#)
• Fix a crash when parsing ATC config with no columns (#)
• Fix bug in GetHomeDirectories filesystem function (#)

Documentation

• Add core to the type column description of osquery_extensions schema (#)
• Add documentation about 3rd-party dependency security (#)
• Add example for hostname form in table (#)
• Adds info on how to use GTEST_FILTER on windows (#)
• Changelog (#)
• Describe user-context-related caveat for screenlock table (#)
• Update schema for (#)
• Update schema to reflect columns not available in Windows (#)

Build

• Add validation integration test for memory_devices (#)
• Temporarily disable memory_devices integration test (#)
• Update minimum macOS support from to (#)
• ci: Update and temporarily disable the macOS Catalina test job (#)
• cmake: Prevent defining some Linux only targets on other platforms (#)
• libs: Update libxml2 to v (#)
• libs: Update sqlite to version (#)
• test: Fix nkc.com.pk_sanity flakyness (#)

Git Commits

Representing commits from 15 contributors! Thank you all.

New Features

• We're extending macOS Endpoint Security to include File Integrity monitoring. Check out the new table. (#)
• Add Docker build scripts and configuration (#)

Deprecation Notices

• Prevent CLI_FLAGs to be set via config (#)
• Remove the table (#)

Table Changes

• New Table: for macOS Endpoint Security based FIM (#)
• New Table: table for macOS (#)
• New Table: (#)
• Add to linux table (#)
• Port the table to linux (#)
• Remove the table (#)
• Update table to not sisplay arch info in the package name (#)
• Update in the table on Apple M1 machines to report correctly (#)
• Update table to add type names, fix type/maximum_allowed handling (#)

Under the Hood improvements

• Expand env vars before trying to enumerate crashes in table (#)
• Implement a split and trim function using std::string_view (#)
• Improve scheduled query denylisting and scheduler shutdown (#)
• Prevent CLI_FLAGs to be set via config (#)
• Remove unnecessary string copy (#)

Bug Fixes

• Add linwin to list of supported PLATFORM_DIRS (#)
• Fix AWS certificate verification failing on all services (#)
• Fix MBCS support on Windows (#)
• Fix column in the table on Windows (#)
• Fix table to support unicode on Windows (#)
• Fix multiple Yara leaks (#)
• Fix std::bad_alloc on pci_devices on Apple Silicon macs (#)
• Fix tables spec files to specify and not (#)
• Fix thrift server shutting down when dropping privileges (#)

Documentation

• CHANGELOG (#)
• Exclude when generating documentation (#)
• Fix a UUID typo in the table (#)
• Fix spelling of the word "owned" (#)
• Fix typo in FIM docs for Windows (#)
• Update the "new release" issue template (#)
• clarify browser_plugins table is referencing basically unsupported CNPAPI tech (#)

Build

• Add an option to build with the leak sanitizer (#)
• Fix check for PIE support (#)
• Fix nkc.com.pk_scheduler_drift_accumulation flakyness (#)
• Improve config parsing and osqueryfuzz-config performance (#)
• Initialize users and groups services on all tests that need them (#)
• ci: Update osquery-packaging commit to the latest one (#)
• cmake: Add an option to enable or disable using ccache (#)
• libs: Update OpenSSL to version o (#)
• libs: Update OpenSSL to version q (#)
• libs: Update libarchive to version (#)
• libs: Update sqlite to version (#)

Git Commits

osquery brings several table improvements and bugfixes.
Worth mentioning also the deprecation of the table
and the new warning added when incorrectly configuring a CLI only flag
via the config file. In the next release CLI only flags will not be
configurable through the config file or refresh anymore.

This release represents commits from 15 contributors! Thank you all.

Deprecation Notices

• Deprecate unmaintainable legacy table, #

New Features

• Add the option to prevent status logs from being sent via TLS #
• Add SQLite function to check if IPv4/v6 addresses are within the supplied CIDR block #

Table Changes

• Add the column to the table to parse package databases on different paths #
• Implement and fix on macOS Big Sur and newer #
• Add windows/darwin support to #
• Move and tables to linux only #
• Add homebrew paths to the table #
• Mark column in as hidden #
• Add new metrics and improve description of existing ones in #
• Add the column in the table #
• Implement for #
• table: Use additional instead of index for the column #
• table: Add Linux support #
• Add column to table to indicate whether the process is running under Apple Rosetta #
• Add the "internet password" type to the macOS table #
• Add column to table on Windows #

Bug Fixes

• Fix watchdog not killing unhealthy worker/extension fast enough #
• Fix the option #
• Update for python3 #
• Fixes osquery tls connections to aws kinesis when tls_server_certs is set #
• Fix parsing issue when a backslash as the last character on sudoers file line #
• Change the JSON of the results coming from an event scheduled query to an array #
• Fix globToRegex truncating UTF16 characters #
• Prevent hanging when the WMI server does not respond #
• Fix table so that it lists python packages from any user Python installations #
• Set string size limit on thrift protocol factory to prevent a crash #
• Fix driver image path in table #
• Do not remove nonblocking flag when reading "special" files, to prevent hangs #
• Fix crash due to interaction between distributed and config plugin #
• bpf: Disable the BPF publisher in case of error #
• Warn about setting CLI_FLAGs in the config #
• Explicitly set context for the tables reading utmpx databases #
• bpf: Improve socket event handling #
• certificates: Refactor the OpenSSL utilities #
• Fix shared_resources accessing uninitialized variables #

Under the Hood improvements

• Implement a performant cache for users and groups on Windows #
• Replace WmiRequest constructor with static factory method to improve error handling and prevent crashes #
• Remove redundant string conversion #

Build

• Fix nkc.com.pk_sanity test when the column is empty #
• libs: Update libdpkg from version v to v #
• CI: Restore some release checks #
• Prevent ebpfpub linking against the system zlib #
• Fix nkc.com.pk_sanity flaky behavior #
• Enable fuzzing and Asan on Windows, enable Asan on macOS #
• Update cppcheck to version and skip analysis for third party code #
• Change test to expect at least one socket, not just one #
• Fix third party libraries flags leaking to osquery targets #
• Add third party libraries target #
• Do not run clang-tidy on third party libraries #
• CI: Create github workflow target to gate mergeability #
• Fix some warnings about unrecognized special characters in the Windows event log test #
• Change where the macOS nkc.com.pk is generated #
• Add OSQUERY_ENABLE_THREAD_SANITIZER to optionally enable TSan #
• Add an option to specify a path to the openssl archive #
• packs: Update reverse shell query pack to check for a valid remote_port #
• Remove the test_daemon_sighup test #

Documentation

• docs: remove FreeBSD #
• Pin Jinja2 ReadTheDocs dependency to #
• CHANGELOG #
• CHANGELOG #
• Bump mkdocs from to in /docs #
• Replace OS X with macOS in table specs #
• Update to omit the CLI only flags #

Git Commits

Osquery is a security update that focuses on updating some third-party libraries
which contained CVEs that could affect osquery.
Additionally some other third-party libraries and tables have been dropped,
since they were not maintained or considered safe anymore.

Deprecation Notices

• Remove the table #
• Remove the ssdeep library and remove its support in the table #
• Remove the libelfin library and elf parsing tables #

Hardening

• libs: Update OpenSSL from version l to n #
• libs: Update zlib from v to v #
• Update librpm to #
• libs: Update expat from version to #

Osquery brings native Apple Silicon (M1) support to the macOS platform. It also represents a comprehensive review and update of our third-party dependencies. To support this work, the developer docs have been updated, as have several parts of the build system

This release represents commits from 24 contributors! Thank you all.

New Features

• Apple Silicon support (#)

Deprecation Notices

• The table is x86 only. See #
• The table has been deprecated, and is not included in the m1 builds. See #
• The table has been deprecated, and is not included in the m1 builds. See #

Table Changes

• Update table to always reflect UTC values (#, #, #)
• Hide the deprecated column in (#)
• Add table for windows (#)

Bug Fixes

• Update the ATC table

Risk Assessment

MITRE ATT&CK™ Techniques Detection

This report has 8 indicators that were mapped to 8 attack techniques and 5 tactics. View all details

Not all malicious and suspicious indicators are displayed. Get your own cloud service or the full version to view all details.

• Anti-Detection/Stealthyness
  • Possibly checks for the presence of an Antivirus engine

    details

    "Guardian antivirus" (Indicator: "antivirus")
    "Kaspersky " (Indicator: "kaspersky")
    "Kaspersky " (Indicator: "kaspersky")
    "Kaspersky Key gen" (Indicator: "kaspersky")
    "Kaspersky KIS " (Indicator: "kaspersky")
    "Kaspersky Pure" (Indicator: "kaspersky")
    "Avast " (Indicator: "avast")
    "Avast " (Indicator: "avast")
    "Avast " (Indicator: "avast")
    "Avast 5" (Indicator: "avast")
    "Avast " (Indicator: "avast")
    "Avast 6" (Indicator: "avast")
    "Avast Antivirus" (Indicator: "antivirus")
    "Avast antivirus 6" (Indicator: "antivirus")
    "Avast! antivirus 6" (Indicator: "antivirus")
    "Avg antivirus" (Indicator: "antivirus")
    "Avg antivirus " (Indicator: "antivirus")
    "Avg antivirus " (Indicator: "antivirus")
    "Avg antivirus 9" (Indicator: "antivirus")
    "Avira" (Indicator: "avira")

    source

    String

    relevance

    3/10

    ATT&CK ID

    T (Show technique in the MITRE ATT&CK™ matrix)

  • Queries kernel debugger information

    details

    "Universal_KeyGen_nkc.com.pk" at

    source

    API Call

    relevance

    6/10

• Anti-Reverse Engineering
  • Creates guarded memory regions (anti-debugging trick to avoid memory dumping)

    details

    "Universal_KeyGen_nkc.com.pk" is allocating memory with PAGE_GUARD access rights

    source

    API Call

    relevance

    10/10

  • Possibly checks for known debuggers/analysis tools

    details

    "Printers Apprentice v" (Indicator: "ntice")
    "Printers Apprentice v" (Indicator: "ntice")
    "Printers Apprentice v" (Indicator: "ntice")
    "Printers Apprentice v" (Indicator: "ntice")
    "Printers Apprentice v" (Indicator: "ntice")
    "Printers Apprentice v" (Indicator: "ntice")
    "prentice v" (Indicator: "ntice")
    "prentice v" (Indicator: "ntice")
    "prentice v" (Indicator: "ntice")

    source

    String

    relevance

    2/10

• Environment Awareness
  • Possibly tries to implement anti-virtualization techniques

    details

    "Sandboxie " (Indicator: "sandboxie")
    "Sandboxie x64x86" (Indicator: "sandboxie")
    "Sandboxie Control" (Indicator: "sandboxie")
    "SandBoxie v " (Indicator: "sandboxie")
    "Sandboxie v" (Indicator: "sandboxie")
    "Sandboxie v" (Indicator: "sandboxie")
    "Sandboxie v" (Indicator: "sandboxie")
    "VirtualBox All" (Indicator: "virtualbox")
    "Vmware 6" (Indicator: "vmware")
    "Vmware " (Indicator: "vmware")
    "Vmware 7 Linux" (Indicator: "vmware")
    "Vmware 8 Windows" (Indicator: "vmware")
    "VMware Fusion " (Indicator: "vmware")
    "Vmware Fusion " (Indicator: "vmware")
    "VMWare Fusion v3 MacOSX" (Indicator: "vmware")
    "VMware Infrastructure v" (Indicator: "vmware")
    "Vmware server " (Indicator: "vmware")
    "VMWare Server " (Indicator: "vmware")
    "VMware ThinApp Enterprise " (Indicator: "vmware")
    "VMWare ThinApp v" (Indicator: "vmware")

    source

    String

    relevance

    4/10

  • Reads the cryptographic machine GUID

    details

    "Universal_KeyGen_nkc.com.pk" (Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY"; Key: "MACHINEGUID")

    source

    Registry Access

    relevance

    10/10

    ATT&CK ID

    T (Show technique in the MITRE ATT&CK™ matrix)

• Network Related
  • Found potential IP address in binary/memory

    details

    Heuristic match: "ABBYY FineReader "
    Heuristic match: "ABBYY FineReader "
    Heuristic match: "Advanced Registry Clear "
    Heuristic match: "Advanced SYSTEM CARE V "
    Heuristic match: "Advanced SystemCare Pro Final"
    Heuristic match: "Advanced SystemCare Pro "
    Heuristic match: "Advanced SystemCare Pro "
    Heuristic match: "Advanced SystemCare Pro "
    Heuristic match: "Aimersoft DVD Creator version "
    Heuristic match: "Aimersoft Video Converter Ultimate v by zirobyte"
    Heuristic match: "Aiprosoft Multikeygen All Products "
    Heuristic match: "Alive Flash Slideshow Maker v "
    Heuristic match: "Alive Internet Eraser "
    Heuristic match: "ALZip - % working"
    Heuristic match: "AnyDVD "
    Heuristic match: "Anydvd hd "
    Heuristic match: "Arcsoft TotalMedia Theatre "
    Heuristic match: "Color7 Video Converter "
    Heuristic match: "CoolwareMax Face Off Max v"
    Heuristic match: "CoolwareMax MSN Slide Max v"
    Heuristic match: "CopyToDVD "
    Heuristic match: "CopyToDVD "
    Heuristic match: "CopyToDVD by hiller"
    Heuristic match: "CopyToDVD "
    Heuristic match: "CoreAVC "
    Heuristic match: "CoreAVC "
    Heuristic match: "Corel Digital Studio "
    Heuristic match: "Corel Paint Shop Pro Photo Ultimate X3 "
    Heuristic match: "cucusoft "
    Heuristic match: "Daniusoft video converter ultimate "
    Heuristic match: "Data Doctor Bulk SMS "
    Heuristic match: "DAZ Studio Pro x86 x64"
    Heuristic match: "DDR-PenDrive Recovery(demo) +crack, serial, keygen,"
    Heuristic match: "Diverboost "
    Heuristic match: "Divx converter 8 ()"
    Heuristic match: "DivX Plus Pro "
    Heuristic match: "DivX Plus Pro v Build "
    Heuristic match: "DivX Plus Pro vBuild "
    Heuristic match: "DivX Plus Pro vBuild "
    Heuristic match: "DivX Plus v Pro Build "
    Heuristic match: "DivX Plus vBuild "
    Heuristic match: "DivX Plus vBuild "
    Heuristic match: "Dolphin Safe Software NFL Office Pool v"
    Heuristic match: "Dolphin Safe Software NFL Office Pool v"
    Heuristic match: "Dolphin Safe Software NFL Office Pool v"
    Heuristic match: "Dolphin Safe Software NFL Office Pool v"
    Heuristic match: "Dolphin Safe Software NFL Office Pool v"
    Heuristic match: "Duplicate File Cleaner "
    Heuristic match: "DVDFab 2D to 3D Converter "
    Heuristic match: "DVDFab 2D to 3D Converter "
    Heuristic match: "DVDFab 2D to 3D Converter "
    Heuristic match: "DVDFab Multilingual"
    Heuristic match: "Dvdfab "
    Heuristic match: "DVDFab Qt"
    Heuristic match: "DVDFab Passkey "
    Heuristic match: "East-Tec Eraser "
    Heuristic match: "Easy Boot "
    Heuristic match: "Easy Driver Pro-Version: "
    Heuristic match: "ESET SMART SECURITY "
    Heuristic match: "Eset smart security + license "
    Heuristic match: "Eset Smart Security "
    Heuristic match: "Eset smart security "
    Heuristic match: "Eset smart security busines edition "
    Heuristic match: "ESET Smart Security"
    Heuristic match: "Exolon Episode II New Wave v"
    Heuristic match: "File Manager Pro "
    Heuristic match: "File Recover "
    Heuristic match: "FixCleaner v"
    Heuristic match: "FLASH GALLERY FACTORY DELUXE "
    Heuristic match: "folder lock "
    Heuristic match: "Foldermarkerpro "
    Heuristic match: "GameHouse Jewel Quest Mysteries: Curse of the Emerald Tear "
    Heuristic match: "GameHouse Monopoly Here & Now Edition "
    Heuristic match: "GameJack "
    Heuristic match: "Genesis_v"
    Heuristic match: "GetFLV Pro "
    Heuristic match: "Hamachi "
    Heuristic match: "IDM versi "
    Heuristic match: "Internet download manager "
    Heuristic match: "Internet download manager "
    Heuristic match: "IsoBuster "
    Heuristic match: "Kaspersky PURE "
    Heuristic match: "Light Image Resizer "
    Heuristic match: "Light Image Resizer "
    Heuristic match: "Loaris Trojan Removerv "
    Heuristic match: "Nero HD Ultra Edition"
    Heuristic match: "Nero "
    Heuristic match: "Nero [Full Work]"
    Heuristic match: "Nero "
    Heuristic match: "Nero Multimedia Suite "
    Heuristic match: "Nero v"
    Heuristic match: "Adguard "
    Heuristic match: "AdGuard "
    Heuristic match: "AthTek Skype Recorder "
    Heuristic match: "Atmosphere Deluxe "
    Heuristic match: "Audio Edit Magic Version "
    Heuristic match: "Aurora Web Editor Professional "
    Heuristic match: "Auslogics BoostSpeed "
    Heuristic match: "Auslogics BoostSpeed "
    Heuristic match: "Auto Hide IP "
    Heuristic match: "AutoRun Pro Enterprise II "
    Heuristic match: "AVG "
    Heuristic match: "Avid Sibelius x86 x64"
    Heuristic match: "AVS Media Player "
    Heuristic match: "AVS Photo Editor "
    Heuristic match: "Avs video editor serial"
    Heuristic match: "AVS Video Editor "
    Heuristic match: "Axialis CursorWorkshop Pro "
    Heuristic match: "Azureus (Vuze)Turbo Accelerator "
    Heuristic match: "BDlot dvd clone ultimate "
    Heuristic match: "BlindWrite 6 "
    Heuristic match: "Bluesoleil "
    Heuristic match: "CloneDVD "
    Heuristic match: "Driver dedective "
    Heuristic match: "Driver Detective "
    Heuristic match: "Driver detective "
    Heuristic match: "Driver Detective "
    Heuristic match: "Driver Detective "
    Heuristic match: "Driver Detective "
    Heuristic match: "Driver detective "
    Heuristic match: "Driver Detective Version: "
    Heuristic match: "Driver Genius Professional by zirobyte"
    Heuristic match: "Driver Genius Professional Edition "
    Heuristic match: "Driver Genius Professional Edition "
    Heuristic match: "Driver Genius Professional Edition "
    Heuristic match: "Driver Genius Professional Edition "
    Heuristic match: "Driver Genius Professional v"
    Heuristic match: "Driver scanner ()v "
    Heuristic match: "Driver scanner "
    Heuristic match: "Driver Scanner ()"
    Heuristic match: "Driver scanner version "
    Heuristic match: "Driver Updater Pro "
    Heuristic match: "Driver Whiz-Ausf?hrung: "
    Heuristic match: "Driverboost "
    Heuristic match: "DriverBoost: "
    Heuristic match: "DriverDetective "
    Heuristic match: "DriverScanner "
    Heuristic match: "DriverScanner "
    Heuristic match: "Emsisoft Anti-Malware "
    Heuristic match: "Eset NOD 32 "
    Heuristic match: "ESET NOD32 "
    Heuristic match: "ESET NOD32 Antivirus "
    Heuristic match: "ESET NOD32 Antivirus "
    Heuristic match: "ESET NOD32 Antivirus X86"
    Heuristic match: "ESET NOD32 v. "
    Heuristic match: "Eset smart "
    Heuristic match: "IObit Advanced System Care Pro "
    Heuristic match: "Macro Express Pro "
    Heuristic match: "Magic Audio Recorder "
    Heuristic match: "Magic MP3 CD Burner "
    Heuristic match: "Magic Video Converter "
    Heuristic match: "Melodyne "
    Heuristic match: "MOBILedit! Russian"
    Heuristic match: "Monitoring Cameras v"
    Heuristic match: "Multimedia Builder MP3 "
    Heuristic match: "Net Limiter 3 Pro "
    Heuristic match: "Netlimiter Pro"
    Heuristic match: "NetLimiter 3 Pro x64"
    Heuristic match: "Nitro PDF Professional "
    Heuristic match: "Nitro PDF Professional "
    Heuristic match: "Nitro Pro "
    Heuristic match: "NOD32 "
    Heuristic match: "NOD32 "
    Heuristic match: "NOD32 Serials "
    Heuristic match: "Norton "
    Heuristic match: "Norton inernet security v "
    Heuristic match: "Norton Internet Security "
    Heuristic match: "Norton Internet Security "
    Heuristic match: "Norton Internet Security "
    Heuristic match: "PC Tools Desktop Maestro "
    Heuristic match: "PC Tools Disk Suite "
    Heuristic match: "PC Tools Disk Suite Abc"
    Heuristic match: "PC tools file recover "
    Heuristic match: "PDF To JPG Converter (PDF2JPG)"
    Heuristic match: "Perfect Uninstaller "
    Heuristic match: "Powerdesk Pro "
    Heuristic match: "Process Lasso Pro "
    Heuristic match: "Rar password recovery magic "
    Heuristic match: "Real hide ip "
    Heuristic match: "RealPlayer "
    Heuristic match: "Reasonable NoClone Enterprise "
    Heuristic match: "Regcure "
    Heuristic match: "RegGenie "
    Heuristic match: "Registry Booster "
    Heuristic match: "Registry Booster "
    Heuristic match: "Registry Booster "
    Heuristic match: "Registry booster v "
    Heuristic match: "Registry Booster ()"
    Heuristic match: "Registry Booster "
    Heuristic match: "Registry Mechanic "
    Heuristic match: "Registry winner nkc.com.pker-CORE"
    Heuristic match: "Registry winner "
    Heuristic match: "RegistryBooster Vers. "
    Heuristic match: "RegistryBooster "
    Heuristic match: "RegistryBooster"
    Heuristic match: "Scanitto Pro "
    Heuristic match: "Scanitto pro "
    Heuristic match: "Scramby v "
    Heuristic match: "See Password "
    Heuristic match: "Serial key maker "
    Heuristic match: "Serif MoviePlus X5 "
    Heuristic match: "Slysoft AnyDVD HD "
    Heuristic match: "Solo Antivirus "
    Heuristic match: "Sonne Video Converter "
    Heuristic match: "SPAM MONITOR "
    Heuristic match: "Specialty "
    Heuristic match: "Speed mp3 downloader "
    Heuristic match: "SpeedOptimizer "
    Heuristic match: "SpeedUpMyPC "
    Heuristic match: "SpeedUpmyPC "
    Heuristic match: "SpeedUpMyPC "
    Heuristic match: "SpeedUpMyPc "
    Heuristic match: "Spyware Terminator "
    Heuristic match: "Spyware Terminator "
    Heuristic match: "Super mp3 download "
    Heuristic match: "SuperEasy SpeedUp "
    Heuristic match: "SyncBack Pro "
    Heuristic match: "The Bat "
    Heuristic match: "TMPGEnc Video Mastering Works "
    Heuristic match: "Trsquittungen V "
    Heuristic match: "Uniblue Driver Scanner "
    Heuristic match: "Uniblue Driver Scanner "
    Heuristic match: "Uniblue Driver Scanner "
    Heuristic match: "Uniblue Driverscanner "
    Heuristic match: "Uniblue DriverScanner "
    Heuristic match: "Uniblue DriverScanner v "
    Heuristic match: "Uniblue DriverScanner "
    Heuristic match: "Uniblue PowerSuite "
    Heuristic match: "Uniblue Register Booster "
    Heuristic match: "Uniblue Registry Booster "
    Heuristic match: "Uniblue Registry Booster "
    Heuristic match: "Uniblue Registry Booster "
    Heuristic match: "Uniblue RegistryBooster "
    Heuristic match: "Uniblue Registy Booster "
    Heuristic match: "Uniblue SpeedUpMyPC "
    Heuristic match: "USB Disk Security "
    Heuristic match: "USB Disk Security "
    Heuristic match: "USB DISK SECURITY "
    Heuristic match: "USB disk SECURITY "
    Heuristic match: "Usb disk security "
    Heuristic match: "USB Disk Security "
    Heuristic match: "Usb disk security "
    Heuristic match: "USB SECURITY "
    Heuristic match: "Useesoft Total Video Converter + Serial - Bidjan"
    Heuristic match: "Utorrent turbo accelatorv"
    Heuristic match: "uTorrent Turbo Accelerator v"
    Heuristic match: "Veronisoft IP Monitor "
    Heuristic match: "Video Convert Master "
    Heuristic match: "Video convert master v "
    Heuristic match: "Video2web "
    Heuristic match: "VideoConvertMaster "
    Heuristic match: "VideoGet "
    Heuristic match: "Vit Registry Fix Professional "
    Heuristic match: "VSO BlindWrite "
    Heuristic match: "VSO DVD Converter Ultimate "
    Heuristic match: "VSO Image Resizer "
    Heuristic match: "Vso photodvd "
    Heuristic match: "VSO PhotoDVD V"
    Heuristic match: "Webcam Max v"
    Heuristic match: "Webcammax "
    Heuristic match: "WebcamXP PRO by iLgiNcH ?"
    Heuristic match: "webrooot complete "
    Heuristic match: "Webroot AntiVirus with Spy Sweeper "
    Heuristic match: "Webroot secure anywhere "
    Heuristic match: "nkc.com.pkr"
    Heuristic match: "WinMPG_VideoConvert "
    Heuristic match: "Wise installation studio "
    Heuristic match: "WMV Merger "
    Heuristic match: "Wondershare Flash Gallery Factory Deluxe by Krishnendu"
    Heuristic match: "Wondershare HD Video Converter "
    Heuristic match: "Wondershare LiveBoot v "
    Heuristic match: "Xeneo Web Server "
    Heuristic match: "Zemana AntiLogger "
    Heuristic match: "Zemana AntiLogger "
    Heuristic match: "ZIP Password Recovery Magic "
    Heuristic match: "r "
    ""
    ""
    Heuristic match: "guard "
    Heuristic match: "SYSTEM CARE V "
    Heuristic match: "SystemCare Pro Final"
    Heuristic match: "vanced SystemCare Pro "
    Heuristic match: "ersoft DVD Creator version "
    Heuristic match: "onverter Ultimate v by zirobyte"
    Heuristic match: "Slideshow Maker v "
    ""
    ""
    ""
    ""
    Heuristic match: "t TotalMedia Theatre "
    Heuristic match: "r "
    Heuristic match: "Deluxe "
    Heuristic match: "dit Magic Version "
    ""
    Heuristic match: "Editor Professional "
    Heuristic match: "cs BoostSpeed "
    ""
    Heuristic match: "nterprise II "
    Heuristic match: "video editor serial"
    Heuristic match: "orkshop Pro "
    Heuristic match: "o Accelerator "
    Heuristic match: "e "
    Heuristic match: "eDVD "
    Heuristic match: "ax v"
    Heuristic match: "lide Max v"
    Heuristic match: "pyToDVD "
    Heuristic match: "AVC "
    Heuristic match: "gital Studio "
    Heuristic match: "hoto Ultimate X3 "
    Heuristic match: "aniusoft video converter ultimate "
    Heuristic match: "octor Bulk SMS "
    Heuristic match: "x converter 8 ()"
    Heuristic match: "Pro v Build "
    ""
    Heuristic match: "Pro vBuild "
    Heuristic match: "Pro Build "
    Heuristic match: "uild "
    Heuristic match: "Build "
    Heuristic match: "hin Safe Software NFL Office Pool v"
    Heuristic match: "hin Safe Software NFL Office Pool v"
    Heuristic match: "iver dedective "
    Heuristic match: "er Detective "
    Heuristic match: "iver detective "
    Heuristic match: "us Professional Edition "
    Heuristic match: "n "
    Heuristic match: "us Professional Edition "
    Heuristic match: "n "
    Heuristic match: "r scanner ()v "
    Heuristic match: "er scanner "
    Heuristic match: "iver Scanner ()"
    Heuristic match: "12 version "
    Heuristic match: "er Pro "
    Heuristic match: "er Whiz-Ausf?hrung: "
    Heuristic match: "ost "
    ""
    Heuristic match: "tive "
    Heuristic match: "canner "
    Heuristic match: "ate File Cleaner "
    Heuristic match: "3D Converter "
    Heuristic match: "verter "
    Heuristic match: "3D Converter "
    ""
    Heuristic match: " Qt"
    Heuristic match: "y "
    Heuristic match: "st-Tec Eraser "
    Heuristic match: "r Pro-Version: "
    Heuristic match: "Anti-Malware "
    ""
    "4. "
    Heuristic match: "ET NOD32 "
    Heuristic match: "irus "
    Heuristic match: "tivirus "
    Heuristic match: "NOD32 Antivirus X86"
    Heuristic match: "t "
    ""
    Heuristic match: "t security + license "
    Heuristic match: "smart security "
    Heuristic match: "y busines edition "
    Heuristic match: "rity"
    Heuristic match: "on Episode II New Wave v"
    Heuristic match: "leaner v"
    Heuristic match: "XE "
    Heuristic match: "pro "
    Heuristic match: "el Quest Mysteries: Curse of the Emerald Tear "
    Heuristic match: "Jack "
    ""
    Heuristic match: "i "
    Heuristic match: "07 versi "
    ""
    Heuristic match: "tem Care Pro "
    Heuristic match: "rsky PURE "
    Heuristic match: "sizer "
    Heuristic match: "esizer "
    Heuristic match: "ress Pro "
    Heuristic match: "io Recorder "
    Heuristic match: "MP3 CD Burner "
    Heuristic match: "Video Converter "
    Heuristic match: " Russian"
    Heuristic match: "ring Cameras v"
    ""
    ""
    Heuristic match: "Builder MP3 "
    ""
    Heuristic match: "o Multimedia Suite "
    Heuristic match: "v"
    Heuristic match: "r 3 Pro "
    Heuristic match: "ter 3 Pro x64"
    ""
    ""
    Heuristic match: "Professional "
    Heuristic match: "ro PDF Professional "
    ""
    Heuristic match: "Serials "
    Heuristic match: " "
    Heuristic match: "on inernet security v "
    Heuristic match: "n Internet Security "
    Heuristic match: "rton Internet Security "
    ""
    Heuristic match: "ools Disk Suite Abc"
    Heuristic match: "JPG Converter (PDF2JPG)"
    Heuristic match: "ninstaller "
    Heuristic match: "Pro "
    Heuristic match: "ar password recovery magic "
    Heuristic match: "sonable NoClone Enterprise "
    Heuristic match: "e "
    ""
    Heuristic match: "gistry Booster "
    Heuristic match: "ry Booster "
    ""
    Heuristic match: " nkc.com.pker-CORE"
    ""
    ""
    Heuristic match: "10 Vers. "
    Heuristic match: "stryBooster "
    Heuristic match: "anitto pro "
    Heuristic match: "oviePlus X5 "
    ""
    ""
    ""
    ""
    ""
    ""
    ""
    ""
    ""
    ""
    Heuristic match: "r "
    ""
    Heuristic match: "ialty "
    Heuristic match: "timizer "
    ""
    Heuristic match: "yPC "
    Heuristic match: "dUpMyPc "
    Heuristic match: "nator "
    Heuristic match: " "
    ""
    Heuristic match: "d "
    Heuristic match: "perEasy SpeedUp "
    Heuristic match: "ck Pro "
    ""
    Heuristic match: "rks "
    Heuristic match: "V "
    ""
    Heuristic match: "r Scanner "
    Heuristic match: ""
    Heuristic match: "r Scanner "
    Heuristic match: " "
    Heuristic match: "rScanner "
    Heuristic match: "erScanner v "
    Heuristic match: "iblue DriverScanner "
    Heuristic match: "e PowerSuite "
    Heuristic match: "Booster "
    ""
    Heuristic match: "ter "
    Heuristic match: "ooster "
    Heuristic match: "blue RegistryBooster "
    Heuristic match: "ue Registy Booster "
    Heuristic match: "yPC "
    Heuristic match: "sk Security "
    Heuristic match: "k SECURITY "
    Heuristic match: "k Security "
    ""
    Heuristic match: "CURITY "
    Heuristic match: "Total Video Converter + Serial - Bidjan"
    Heuristic match: "o accelatorv"
    Heuristic match: "bo Accelerator v"
    ""
    Heuristic match: "ft IP Monitor "
    Heuristic match: "Convert Master "
    Heuristic match: "ster "
    Heuristic match: "gistry Fix Professional "
    Heuristic match: "ite "
    Heuristic match: "imate "
    Heuristic match: "ge Resizer "
    Heuristic match: "photodvd "
    ""
    ""
    Heuristic match: "ammax "
    Heuristic match: "with Spy Sweeper "
    Heuristic match: "_VideoConvert "
    Heuristic match: "se installation studio "
    Heuristic match: "ndershare Flash Gallery Factory Deluxe by Krishnendu"
    Heuristic match: "LiveBoot v "
    Heuristic match: "tiLogger "
    ""
    Heuristic match: "d Recovery Magic "

    source

    String

    relevance

    3/10

• Remote Access Related
• Unusual Characteristics
  • Installs hooks/patches the running process

    details

    "Universal_KeyGen_nkc.com.pk" wrote bytes "a3bab8bffc8cccecdffd26ff01" to virtual address "0x74FE4" (part of module "USERDLL")
    "Universal_KeyGen_nkc.com.pk" wrote bytes "5de5fc44" to virtual address "0xF" (part of module "nkc.com.pk")
    "Universal_KeyGen_nkc.com.pk" wrote bytes "db4da" to virtual address "0xD" (part of module "UNIVERSAL_KEYGEN_nkc.com.pk")

    source

    Hook Detection

    relevance

    10/10

    ATT&CK ID

    T (Show technique in the MITRE ATT&CK™ matrix)

  • Reads information about supported languages

    details

    "Universal_KeyGen_nkc.com.pk" (Path: "HKLM\SYSTEM\CONTROLSET\CONTROL\NLS\LOCALE"; Key: "")

    source

    Registry Access

    relevance

    3/10

    ATT&CK ID

    T (Show technique in the MITRE ATT&CK™ matrix)

• Hiding 2 Suspicious Indicators
  • All indicators are available only in the private webservice or standalone version

• Environment Awareness
• General
  • Contains PDB pathways

    details

    "%USERPROFILE%\Desktop\UnivezalniKeygen - Copy (2)\UnivezalniKeygen\UnivezalniKeygen\obj\x86\Release\Universal KeyGen nkc.com.pk"

    source

    String

    relevance

    1/10

  • Loads the .NET runtime environment

    details

    "Universal_KeyGen_nkc.com.pk" loaded module "%WINDIR%\assembly\NativeImages_v_32\mscorlib\77fdda26b2d34ffc51\nkc.com.pk" at A

    source

    Loaded Module

• Installation/Persistance
  • Connects to LPC ports

    details

    "Universal_KeyGen_nkc.com.pk" connecting to "\ThemeApiPort"

    source

    API Call

    relevance

    1/10

  • Touches files in the Windows directory

    details

    "Universal_KeyGen_nkc.com.pk" touched file "%WINDIR%\nkc.com.pk\Framework\v\nkc.com.pk"
    "Universal_KeyGen_nkc.com.pk" touched file "C:\Windows\nkc.com.pk\Framework\v\nkc.com.pk"
    "Universal_KeyGen_nkc.com.pk" touched file "C:\Windows\nkc.com.pk\Framework\v\nkc.com.pk"
    "Universal_KeyGen_nkc.com.pk" touched file "C:\Windows\nkc.com.pk\Framework\v\nkc.com.pk"
    "Universal_KeyGen_nkc.com.pk" touched file "C:\Windows\nkc.com.pk\Framework\v\nkc.com.pk"
    "Universal_KeyGen_nkc.com.pk" touched file "C:\Windows\nkc.com.pk\Framework\v\nkc.com.pk"
    "Universal_KeyGen_nkc.com.pk" touched file "C:\Windows\nkc.com.pk\Framework\v\nkc.com.pk"
    "Universal_KeyGen_nkc.com.pk" touched file "C:\Windows\nkc.com.pk\Framework\v\Config\nkc.com.pk"
    "Universal_KeyGen_nkc.com.pk" touched file "C:\Windows\Globalization\Sorting\nkc.com.pk"
    "Universal_KeyGen_nkc.com.pk" touched file "C:\Windows\assembly\NativeImages_v_32\mscorlib\77fdda26b2d34ffc51\nkc.com.pk"
    "Universal_KeyGen_nkc.com.pk" touched file "C:\Windows\assembly\pubpoldat"
    "Universal_KeyGen_nkc.com.pk" touched file "C:\Windows\assembly\NativeImages_v_32\nkc.com.pk#\1ccc9edfae91bb0d0a\nkc.com.pk"
    "Universal_KeyGen_nkc.com.pk" touched file "C:\Windows\assembly\NativeImages_v_32\System\0b2f69b43ab9edccabd91\nkc.com.pk"
    "Universal_KeyGen_nkc.com.pk" touched file "C:\Windows\assembly\NativeImages_v_32\nkc.com.pk\7aa0dcace3b5d10bd\nkc.com.pk"
    "Universal_KeyGen_nkc.com.pk" touched file "C:\Windows\assembly\NativeImages_v_32\nkc.com.pk\fba0aaefbc\nkc.com.pk"
    "Universal_KeyGen_nkc.com.pk" touched file "C:\Windows\assembly\NativeImages_v_32\nkc.com.pkg\3c20a6b0cabccbf4b7ad0b4d9\nkc.com.pk"

    source

    API Call

    relevance

    7/10

• Network Related
  • Found potential URL in binary/memory

    details

    Heuristic match: "nkc.com.pk"
    Heuristic match: "Ardamax Keylogger xxx"
    Pattern match: "nkc.com.pk"
    Heuristic match: "Folder Protect v - nkc.com.pk"
    Pattern match: "nkc.com.pk"
    Heuristic match: "Camtasia Studio 7 CD Key nkc.com.pk"
    Heuristic match: "Diablo 2 LOD for nkc.com.pk"
    Heuristic match: "Diablo 2 Lord of Destruction FOR nkc.com.pk"
    Heuristic match: "Diablo 2 Lord of Destruction No nkc.com.pk"
    Heuristic match: "Eset nod 32 vxxx"
    Heuristic match: "FrontFace Advanced Edition by nkc.com.pk"
    Heuristic match: "Nitro PDF Professional nkc.com.pk"
    Heuristic match: "USB Disk Security xxx"
    Heuristic match: "logger xxx"
    Heuristic match: "CD Key nkc.com.pk"
    Heuristic match: "D for nkc.com.pk"
    Heuristic match: "ction FOR nkc.com.pk"
    Heuristic match: "truction No nkc.com.pk"
    Heuristic match: "od 32 vxxx"
    Heuristic match: "ect v - nkc.com.pk"
    Heuristic match: "nkc.com.pk"
    Heuristic match: "PDF Professional nkc.com.pk"
    Heuristic match: "Security xxx"

    source

    String

    relevance

    10/10

• Spyware/Information Retrieval
  • Found a reference to a known community page

    details

    "Alive YouTube Video Converter v" (Indicator: "youtube")
    "Alive YouTube Video Converter v" (Indicator: "youtube")
    "Alive YouTube Video Converter v" (Indicator: "youtube")
    "Alive YouTube Video Converter v" (Indicator: "youtube")
    "Alive YouTube Video Converter v" (Indicator: "youtube")
    "Aneesoft YouTube Converter v" (Indicator: "youtube")
    "Aneesoft YouTube Converter v" (Indicator: "youtube")
    "Aneesoft YouTube Converter v" (Indicator: "youtube")
    "CoolMedia Cool YouTube To nkc.com.pkter v" (Indicator: "youtube")
    "ImTOO YouTube HD Video Converter v" (Indicator: "youtube")
    "ImTOO YouTube to iPod Converter v" (Indicator: "youtube")
    "ImTOO YouTube Video Converter v" (Indicator: "youtube")
    "Litex Media Youtube Video Grabber v" (Indicator: "youtube")
    "Litex Media Youtube Video Grabber v" (Indicator: "youtube")
    "Litex Media Youtube Video Grabber v" (Indicator: "youtube")
    "Litex Media Youtube Video Grabber v" (Indicator: "youtube")
    "Digital Media Group MySpace Friend Bomber v" (Indicator: "myspace")
    "Digital Media Group MySpace Friend Bomber v" (Indicator: "myspace")
    "Digital Media Group YouTube Friend Bomber v" (Indicator: "youtube")
    "Download YouTube Music Pro v" (Indicator: "youtube")

    source

    String

    relevance

    7/10

• System Security
• Unusual Characteristics

File Sections

File Resources

Loading content, please wait

Analysed 1 process in total (System Resource Monitor).

DNS Requests

No relevant DNS requests were made.

HTTP Traffic

No relevant HTTP requests were made.

Memory Forensics