Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	June 8, 2021, 12:19 p.m.	June 8, 2021, 12:26 p.m.

Size	2.3MB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`623c88cc55a2df1115600910bbe14457`
SHA256	`47bb97567ec946832d0bf77a9f2c4300032d4d7b2293f64fcd25d9b83e7c1178`
CRC32	`2B1A4391`
ssdeep	`49152:pAI+kzdauN9Z8SIZf3YgMcUZyU6fL/6vwTyMWaCMPfvyi:pAI+cdauN9sZf3YgRUQTIwTyMWaJfvyi`
Yara	PE_Header_Zero - PE File Signature IsPE32 - (no description)

Setup2.exe "C:\Users\test22\AppData\Local\Temp\Setup2.exe"
2444
- file4.exe "C:\Program Files (x86)\Company\NewProduct\file4.exe"
  2228
- jooyu.exe "C:\Program Files (x86)\Company\NewProduct\jooyu.exe"
  2256
  - jfiag3g_gg.exe C:\Users\test22\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\test22\AppData\Local\Temp\fj4ghga23_fsa.txt
    2540
  - jfiag3g_gg.exe C:\Users\test22\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\test22\AppData\Local\Temp\fj4ghga23_fsa.txt
    540
- jingzhang.exe "C:\Program Files (x86)\Company\NewProduct\jingzhang.exe"
  2888
  - rundll32.exe "C:\Windows\system32\rUNdlL32.eXe" "C:\Users\test22\AppData\Local\Temp\install.dll",shl
    1884
- md8_8eus.exe "C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"
  1976
explorer.exe C:\Windows\Explorer.EXE
1848

Name	Response	Post-Analysis Lookup
iplogger.org	A 88.99.66.31	88.99.66.31
email.yg9.me		198.13.62.186
www.facebook.com	A 157.240.215.35 CNAME star-mini.c10r.facebook.com	157.240.215.35
ol.gamegame.info	A 172.67.200.215 A 104.21.21.221	172.67.200.215
uyg5wye.2ihsfa.com	A 88.218.92.148	88.218.92.148
iw.gamegame.info	A 172.67.200.215 A 104.21.21.221	104.21.21.221
email.yg9.me	A 198.13.62.186	198.13.62.186
ip-api.com	A 208.95.112.1	208.95.112.1

IP Address	Status	Action
157.240.215.35	Active	Moloch
164.124.101.2	Active	Moloch
172.67.200.215	Active	Moloch
198.13.62.186	Active	Moloch
208.95.112.1	Active	Moloch
88.218.92.148	Active	Moloch
88.99.66.31	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.101:49204 -> 208.95.112.1:80	2022082	ET POLICY External IP Lookup ip-api.com	Device Retrieving External IP Address Detected
TCP 192.168.56.101:49211 -> 157.240.215.35:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49218 -> 208.95.112.1:80	2022082	ET POLICY External IP Lookup ip-api.com	Device Retrieving External IP Address Detected
TCP 192.168.56.101:49221 -> 88.99.66.31:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49218 -> 208.95.112.1:80	2022082	ET POLICY External IP Lookup ip-api.com	Device Retrieving External IP Address Detected
TCP 192.168.56.101:49218 -> 208.95.112.1:80	2022082	ET POLICY External IP Lookup ip-api.com	Device Retrieving External IP Address Detected
TCP 192.168.56.101:49218 -> 208.95.112.1:80	2022082	ET POLICY External IP Lookup ip-api.com	Device Retrieving External IP Address Detected

Suricata TLS

Flow	Issuer	Subject	Fingerprint
TLSv1 192.168.56.101:49211 157.240.215.35:443	C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert SHA2 High Assurance Server CA	C=US, ST=California, L=Menlo Park, O=Facebook, Inc., CN=*.facebook.com	64:6a:5b:69:8b:12:93:b5:d8:b2:20:d5:3f:4e:74:04:ca:ba:95:5e
TLSv1 192.168.56.101:49221 88.99.66.31:443	C=GB, ST=Greater Manchester, L=Salford, O=Sectigo Limited, CN=Sectigo RSA Domain Validation Secure Server CA	CN=*.iplogger.org	55:1e:13:99:46:1c:67:40:a3:48:7f:38:0d:16:e7:51:f4:c4:43:cb

Queries for the computername (2 events)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameW June 8, 2021, 12:19 p.m.	computer_name: TEST22-PC	1	1	0
GetComputerNameW June 8, 2021, 12:19 p.m.	computer_name: TEST22-PC	1	1	0

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent June 8, 2021, 12:19 p.m.			0	0
IsDebuggerPresent June 8, 2021, 12:19 p.m.			0	0

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

Tries to locate where the browsers are installed (1 event)

file	c:\program files (x86)\Google\Chrome\application\chrome.exe

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx June 8, 2021, 12:19 p.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 events)

section	CODE
section	DATA
section	BSS

The executable uses a known packer (1 event)

packer

BobSoft Mini Delphi -> BoB / BobSoft

One or more processes crashed (1 event)

Time & API	Arguments	Status	Return	Repeated
__exception__ June 8, 2021, 12:19 p.m.	stacktrace: md8_8eus+0xbc3dc @ 0x4bc3dc md8_8eus+0x776a8 @ 0x4776a8 md8_8eus+0x82a20 @ 0x482a20 md8_8eus+0x1270 @ 0x401270 md8_8eus+0xa9d62 @ 0x4a9d62 md8_8eus+0x90944 @ 0x490944 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 8b 30 8b ce ff 15 a8 93 4d 00 8d 4b 04 ff d6 e9 exception.symbol: md8_8eus+0xbc1e1 exception.instruction: mov esi, dword ptr [eax] exception.module: md8_8eus.exe exception.exception_code: 0xc0000005 exception.offset: 770529 exception.address: 0x4bc1e1 registers.esp: 1638064 registers.edi: 1638187 registers.eax: 0 registers.ebp: 1638100 registers.edx: 2755488 registers.ebx: 5309116 registers.esi: 0 registers.ecx: 1638187	1	0	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

HTTP traffic contains suspicious features which may be indicative of malware related traffic (3 events)

suspicious_features	POST method with no referer header	suspicious_request	POST http://iw.gamegame.info/report7.4.php
suspicious_features	POST method with no referer header	suspicious_request	POST http://uyg5wye.2ihsfa.com/api/?sid=244033&key=14a21546c007e98b00ef413b26924f80
suspicious_features	POST method with no referer header	suspicious_request	POST http://ol.gamegame.info/report7.4.php

Performs some HTTP requests (8 events)

request	GET http://ip-api.com/json/
request	GET http://ip-api.com/json/?fields=8198
request	POST http://iw.gamegame.info/report7.4.php
request	GET http://uyg5wye.2ihsfa.com/api/fbtime
request	POST http://uyg5wye.2ihsfa.com/api/?sid=244033&key=14a21546c007e98b00ef413b26924f80
request	POST http://ol.gamegame.info/report7.4.php
request	GET https://www.facebook.com/
request	GET https://iplogger.org/18hh57

Sends data using the HTTP POST Method (3 events)

request	POST http://iw.gamegame.info/report7.4.php
request	POST http://uyg5wye.2ihsfa.com/api/?sid=244033&key=14a21546c007e98b00ef413b26924f80
request	POST http://ol.gamegame.info/report7.4.php

Allocates read-write-execute memory (usually to unpack itself) (22 events)

Time & API	Arguments	Status
NtProtectVirtualMemory June 8, 2021, 12:19 p.m.	process_identifier: 2444 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73702000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 8, 2021, 12:19 p.m.	process_identifier: 2228 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00360000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 8, 2021, 12:19 p.m.	process_identifier: 2228 region_size: 61440 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00370000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 8, 2021, 12:19 p.m.	process_identifier: 2228 region_size: 73728 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00380000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory June 8, 2021, 12:19 p.m.	process_identifier: 1884 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x10002000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 8, 2021, 12:19 p.m.	process_identifier: 1884 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72b60000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 8, 2021, 12:19 p.m.	process_identifier: 1884 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72a31000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 8, 2021, 12:19 p.m.	process_identifier: 1884 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x729a1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 8, 2021, 12:19 p.m.	process_identifier: 1884 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72964000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 8, 2021, 12:19 p.m.	process_identifier: 1884 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72a32000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 8, 2021, 12:19 p.m.	process_identifier: 1884 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72af1000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 8, 2021, 12:19 p.m.	process_identifier: 1884 region_size: 1114112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00cc0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 8, 2021, 12:19 p.m.	process_identifier: 1884 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00d90000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 8, 2021, 12:19 p.m.	process_identifier: 1884 region_size: 1052672 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02250000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 8, 2021, 12:19 p.m.	process_identifier: 1884 region_size: 376832 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00bc0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtProtectVirtualMemory June 8, 2021, 12:19 p.m.	process_identifier: 1884 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72ab1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 8, 2021, 12:19 p.m.	process_identifier: 1884 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76891000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 8, 2021, 12:19 p.m.	process_identifier: 1884 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x743b1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 8, 2021, 12:19 p.m.	process_identifier: 1884 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75111000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 8, 2021, 12:19 p.m.	process_identifier: 1884 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75241000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 8, 2021, 12:19 p.m.	process_identifier: 1884 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74f41000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 8, 2021, 12:19 p.m.	process_identifier: 1884 region_size: 307200 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00380000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

A process attempted to delay the analysis task. (1 event)

description

explorer.exe tried to sleep 130 seconds, actually delayed analysis time by 130 seconds

Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation (1 event)

Time & API	Arguments	Status	Return	Repeated
GetDiskFreeSpaceExW June 8, 2021, 12:20 p.m.	total_number_of_free_bytes: 13719707648 free_bytes_available: 13719707648 root_path: C:\ total_number_of_bytes: 34252779520	1	1	0

Steals private information from local Internet browsers (3 events)

file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local State
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Cookies
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Cookies-journal

Looks up the external IP address (1 event)

domain

ip-api.com

Creates executable files on the filesystem (9 events)

file	C:\Program Files (x86)\Company\NewProduct\Uninstall.exe
file	C:\Program Files (x86)\Company\NewProduct\file4.exe
file	C:\Users\test22\AppData\Local\Temp\install.dll
file	C:\Program Files (x86)\Company\NewProduct\jooyu.exe
file	C:\Program Files (x86)\Company\NewProduct\jingzhang.exe
file	C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe
file	C:\Users\test22\AppData\Local\Temp\install.dll.lnk
file	C:\Users\test22\AppData\Local\Temp\jfiag3g_gg.exe
file	C:\Users\test22\AppData\Local\Temp\Newtonsoft.Json.dll

Creates a shortcut to an executable file (12 events)

file	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Welcome Center.lnk
file	C:\Users\test22\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Windows Explorer.lnk
file	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration.lnk
file	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Snipping Tool.lnk
file	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Fax and Scan.lnk
file	C:\Users\test22\AppData\Local\Temp\install.dll.lnk
file	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Calculator.lnk
file	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Paint.lnk
file	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\displayswitch.lnk
file	C:\Users\test22\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Internet Explorer.lnk
file	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Sticky Notes.lnk
file	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\XPS Viewer.lnk

Drops a binary and executes it (5 events)

file	C:\Program Files (x86)\Company\NewProduct\file4.exe
file	C:\Program Files (x86)\Company\NewProduct\jooyu.exe
file	C:\Program Files (x86)\Company\NewProduct\jingzhang.exe
file	C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe
file	C:\Users\test22\AppData\Local\Temp\install.dll.lnk

Drops an executable to the user AppData folder (3 events)

file	C:\Users\test22\AppData\Local\Temp\jfiag3g_gg.exe
file	C:\Users\test22\AppData\Local\Temp\install.dll
file	C:\Users\test22\AppData\Local\Temp\Newtonsoft.Json.dll

A process created a hidden window (4 events)

Time & API	Arguments	Status	Return
ShellExecuteExW June 8, 2021, 12:19 p.m.	show_type: 0 filepath_r: C:\Program Files (x86)\Company\NewProduct\file4.exe parameters: filepath: C:\Program Files (x86)\Company\NewProduct\file4.exe	1	1
ShellExecuteExW June 8, 2021, 12:19 p.m.	show_type: 0 filepath_r: C:\Program Files (x86)\Company\NewProduct\jooyu.exe parameters: filepath: C:\Program Files (x86)\Company\NewProduct\jooyu.exe	1	1
ShellExecuteExW June 8, 2021, 12:19 p.m.	show_type: 0 filepath_r: C:\Program Files (x86)\Company\NewProduct\jingzhang.exe parameters: filepath: C:\Program Files (x86)\Company\NewProduct\jingzhang.exe	1	1
ShellExecuteExW June 8, 2021, 12:19 p.m.	show_type: 0 filepath_r: C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe parameters: filepath: C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe	1	1

Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (40 events)

Time & API	Arguments	Status	Return
Process32FirstW June 8, 2021, 12:19 p.m.	snapshot_handle: 0x00000120 process_name: [System Process] process_identifier: 0	1	1
Process32NextW June 8, 2021, 12:19 p.m.	snapshot_handle: 0x00000120 process_name: System process_identifier: 4	1	1
Process32NextW June 8, 2021, 12:19 p.m.	snapshot_handle: 0x00000120 process_name: smss.exe process_identifier: 224	1	1
Process32NextW June 8, 2021, 12:19 p.m.	snapshot_handle: 0x00000120 process_name: csrss.exe process_identifier: 300	1	1
Process32NextW June 8, 2021, 12:19 p.m.	snapshot_handle: 0x00000120 process_name: wininit.exe process_identifier: 348	1	1
Process32NextW June 8, 2021, 12:19 p.m.	snapshot_handle: 0x00000120 process_name: csrss.exe process_identifier: 364	1	1
Process32NextW June 8, 2021, 12:19 p.m.	snapshot_handle: 0x00000120 process_name: winlogon.exe process_identifier: 396	1	1
Process32NextW June 8, 2021, 12:19 p.m.	snapshot_handle: 0x00000120 process_name: services.exe process_identifier: 440	1	1
Process32NextW June 8, 2021, 12:19 p.m.	snapshot_handle: 0x00000120 process_name: lsass.exe process_identifier: 456	1	1
Process32NextW June 8, 2021, 12:19 p.m.	snapshot_handle: 0x00000120 process_name: lsm.exe process_identifier: 464	1	1
Process32NextW June 8, 2021, 12:19 p.m.	snapshot_handle: 0x00000120 process_name: svchost.exe process_identifier: 568	1	1
Process32NextW June 8, 2021, 12:19 p.m.	snapshot_handle: 0x00000120 process_name: svchost.exe process_identifier: 640	1	1
Process32NextW June 8, 2021, 12:19 p.m.	snapshot_handle: 0x00000120 process_name: svchost.exe process_identifier: 700	1	1
Process32NextW June 8, 2021, 12:19 p.m.	snapshot_handle: 0x00000120 process_name: svchost.exe process_identifier: 776	1	1
Process32NextW June 8, 2021, 12:19 p.m.	snapshot_handle: 0x00000120 process_name: svchost.exe process_identifier: 824	1	1
Process32NextW June 8, 2021, 12:19 p.m.	snapshot_handle: 0x00000120 process_name: audiodg.exe process_identifier: 892	1	1
Process32NextW June 8, 2021, 12:19 p.m.	snapshot_handle: 0x00000120 process_name: svchost.exe process_identifier: 968	1	1
Process32NextW June 8, 2021, 12:19 p.m.	snapshot_handle: 0x00000120 process_name: svchost.exe process_identifier: 264	1	1
Process32NextW June 8, 2021, 12:19 p.m.	snapshot_handle: 0x00000120 process_name: spoolsv.exe process_identifier: 820	1	1
Process32NextW June 8, 2021, 12:19 p.m.	snapshot_handle: 0x00000120 process_name: svchost.exe process_identifier: 292	1	1
Process32NextW June 8, 2021, 12:19 p.m.	snapshot_handle: 0x00000120 process_name: svchost.exe process_identifier: 1192	1	1
Process32NextW June 8, 2021, 12:19 p.m.	snapshot_handle: 0x00000120 process_name: srvany.exe process_identifier: 1244	1	1
Process32NextW June 8, 2021, 12:19 p.m.	snapshot_handle: 0x00000120 process_name: taskhost.exe process_identifier: 1284	1	1
Process32NextW June 8, 2021, 12:19 p.m.	snapshot_handle: 0x00000120 process_name: KMService.exe process_identifier: 1324	1	1
Process32NextW June 8, 2021, 12:19 p.m.	snapshot_handle: 0x00000120 process_name: conhost.exe process_identifier: 1376	1	1
Process32NextW June 8, 2021, 12:19 p.m.	snapshot_handle: 0x00000120 process_name: sppsvc.exe process_identifier: 1800	1	1
Process32NextW June 8, 2021, 12:19 p.m.	snapshot_handle: 0x00000120 process_name: svchost.exe process_identifier: 1876	1	1
Process32NextW June 8, 2021, 12:19 p.m.	snapshot_handle: 0x00000120 process_name: dwm.exe process_identifier: 1496	1	1
Process32NextW June 8, 2021, 12:19 p.m.	snapshot_handle: 0x00000120 process_name: explorer.exe process_identifier: 1848	1	1
Process32NextW June 8, 2021, 12:19 p.m.	snapshot_handle: 0x00000120 process_name: WmiPrvSE.exe process_identifier: 1916	1	1
Process32NextW June 8, 2021, 12:19 p.m.	snapshot_handle: 0x00000120 process_name: pw.exe process_identifier: 2816	1	1
Process32NextW June 8, 2021, 12:19 p.m.	snapshot_handle: 0x00000120 process_name: SearchIndexer.exe process_identifier: 2940	1	1
Process32NextW June 8, 2021, 12:19 p.m.	snapshot_handle: 0x00000120 process_name: SearchProtocolHost.exe process_identifier: 1480	1	1
Process32NextW June 8, 2021, 12:19 p.m.	snapshot_handle: 0x00000120 process_name: SearchFilterHost.exe process_identifier: 3040	1	1
Process32NextW June 8, 2021, 12:19 p.m.	snapshot_handle: 0x00000120 process_name: SearchProtocolHost.exe process_identifier: 2120	1	1
Process32NextW June 8, 2021, 12:19 p.m.	snapshot_handle: 0x00000120 process_name: mobsync.exe process_identifier: 2060	1	1
Process32NextW June 8, 2021, 12:19 p.m.	snapshot_handle: 0x00000120 process_name: pw.exe process_identifier: 2684	1	1
Process32NextW June 8, 2021, 12:19 p.m.	snapshot_handle: 0x00000120 process_name: taskhost.exe process_identifier: 2944	1	1
Process32NextW June 8, 2021, 12:19 p.m.	snapshot_handle: 0x00000120 process_name: jooyu.exe process_identifier: 2256	1	1
Process32NextW June 8, 2021, 12:19 p.m.	snapshot_handle: 0x00000120 process_name: rundll32.exe process_identifier: 1884	1	1

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses June 8, 2021, 12:19 p.m.	flags: 15 family: 0		111	0

Checks for the Locally Unique Identifier on the system for a suspicious privilege (8 events)

Time & API	Arguments	Status	Return
LookupPrivilegeValueW June 8, 2021, 12:19 p.m.	system_name: privilege_name: SeShutdownPrivilege	1	1
LookupPrivilegeValueW June 8, 2021, 12:19 p.m.	system_name: privilege_name: SeShutdownPrivilege	1	1
LookupPrivilegeValueW June 8, 2021, 12:19 p.m.	system_name: privilege_name: SeShutdownPrivilege	1	1
LookupPrivilegeValueW June 8, 2021, 12:19 p.m.	system_name: privilege_name: SeShutdownPrivilege	1	1
LookupPrivilegeValueW June 8, 2021, 12:19 p.m.	system_name: privilege_name: SeShutdownPrivilege	1	1
LookupPrivilegeValueW June 8, 2021, 12:19 p.m.	system_name: privilege_name: SeShutdownPrivilege	1	1
LookupPrivilegeValueW June 8, 2021, 12:19 p.m.	system_name: privilege_name: SeShutdownPrivilege	1	1
LookupPrivilegeValueW June 8, 2021, 12:19 p.m.	system_name: privilege_name: SeShutdownPrivilege	1	1

Expresses interest in specific running processes (1 event)

process

rundll32.exe

Creates or sets a registry key to a long series of bytes, possibly to store a binary or malware config (1 event)

Time & API	Arguments	Status	Return	Repeated
RegSetValueExW June 8, 2021, 12:19 p.m.	key_handle: 0x00000124 regkey_r: 1 reg_type: 3 (REG_BINARY) value: ÁÕx4XÁåH<PÁýPwËoÜØ_µHÅµ¾HÅ¼«HcáA@Å±4^¯fZÅÊC@K°h·?ËjètM=ãK£¹áü÷¶Ãc~¹²$ ?xÃ{aLÇs°Íh$ÏüsEø½ç@tPAÊ]ù¸003ú6)Ã{¸ÍE´H±Æ·¹ÎMÅÉ`tÃ]ÁÍ`dÁÂGÅh»ÿ^ßptÃE&÷3áù¸HÃE¾(Ã×x\|ÃçHD(ÃÿPL ËGôqÃ çÁÕx<Åh,]ÅáHñÉm,Àe-Ã!E`3èâ.DDHîçLLLHÃÛHTÇÙB]ÆÉr}ÈEÏû~I#\|·@NRÆPÉ7¼BÉÌüp:ò2z½ÃÎòÿ)øTK¸ÀL½ThÃÞêúÎRÖ±¼ÃÄº[B!ãË·=ÊhêtªÀ4³pºÊúQiJó±x`AnóÁÏXNÛÅûrEN±½J¶<ÇÓyc¤c1~"yò8zBaj ;»¾ÊÊe©3vJÃÏ¸£@ÊÂUUJËCØJÓrêÞ7µÎ&JÂsëß!¦Aø.@\|2~oNÇH<>Î±~¦$ËÍÏJKP{û´®ÉÌ@p·OÁN±¾I¶?Âû¹y`§eXXJ>==>§"ÍÅ K¸ûòÁ#ÀL¼eIOfïÕBE´kWÅÀL[ß±¿À Æ¹X@#ãÛ·>Ëiët^õ;¡Ñï§±·ÅÀ8/]÷©¿ìOÃI)é1óÃ¸ÔðHÉEÀ_ËoÄÀûí·ËkáAËGìëÁÕx,]ËoÜxÃrrQcõ;Q!ïFáü÷¶ÁÍ`À6#F²$ ?xÃc9,F;ÂÁ ¬LÇkTAFð¾õz4ÇsGRFR¹Á ¤èu`·ÁÍ`lÇckx»3t4ó)¼V¸õZf_>s~²½ f_>r+KtÅ Hsâ«§T½nEt}½<u¶{¸ fãÁz(bÃA²z(vÄHðf_}zaÑàK¸óz8JÁ¹ úBZÉÜPLÈE´VkÄÊE:øÌþ¶JÑËBéarë¬ÔúÏÇr}~ñÅß¢»Ïßjjgá¾5FÒÊI¶µoù´'zó»OqÀAÊJxrCIÊÈGENHC;áÑÂÀÖsiÌÄ¶üËCJ¶ÚáêNLÏZÊkét¾ojn_¾øù@Aù¸00AÊYáú6ÃSÍEÏ_%»ÏÏzjÃ\ÃC¾(vúN¸^"wr8u:Èäh¸rÅÁÊJÚE´VgÎJÖEÀE´aTÊZÒHÅKKÔ¾(vú¯'Bî]WR8t²ÇçHõZf_:wweïK+GèEHKøÂ>sv7°EÏ D}¶;´HÅOÇPgto»NÏÉFEBË¼ý½AÊKËkà@9¤/³UE¾EwÁÇBMJ¸¶¸¹ððAN¸w¦Eâx¹ f]ú´dKÀaðJÇOMHÊBÃOfÿ¡¹vúBÉFLKÓ[NÏÉFEBË½ÖïÇ/¬EÏHÅ¹7EÏÅBHÏå~XKÈÏ{¼Oè§Oð«pmvúÇk¨ÍEÏü¾Êb¤t7z3ÂEÎr±ÃXÂGÍW«\| ¸e9ìOËAÀJKÐ,k°¤EvúÍEÏÄ½´Â+g·:Çv´&äHÆ;{u0\|Ê÷ËEÒEµôÍÇ/¬LÇçHdÏ' EÀE´S¬#¤E´iCðâ¿«ÇOÇH+éB¾ÁÖouvóKôW`Ã@KøºÌýq])(REµhXvóóáÃ@4(äáù¸HÃ@¾+=OZtMÃ×xT8ËGôq `¥X´²%qÍ 66 !6ÛI×pñâÖE¯ËåÜ©ð"+¤àF 3 ËN ÊDLZ`` ¸Fû @Aåæà!@¤èNðö ðÀMx805Nv ðíFDÆÌ;G/îççÿçõtL) Æø%ÆS'çÔVÁJLCNíÁ1àÖ:úÁÚÁ:¾ ÉÇÀúøú:NãíDPÇÏÕÏÝ ÜÇº<ÜÿuÞËÒåÃsÞTRÀTû{¦hÇ\ÃäÿoeeXËoì(Àò3úÉEvóóáÁ]ItkÀÀÚÀèèíñHÅ{29yDBúL#ÄìÁÌç)âå ÍíÎh¥_ Àè¥®ä±Uä¨¤"âæ¹Xá4óÁ ú²l/NHZ\ÃÉ¬¦âáôàûSkÀòñê àé)Ãë+Àöïé,ÀÃ.åñûCu8(xÅáì¤hÃóè3öÁÌE,À7cË¨HÙp«»»#AµêïséA¬/A#ZìpHÃÆMH{#Ý%aèuËYþàiôyè !Áé¦Æmèx}ãæñ=Éô/ÙècxT°ê9Øã·ÇüöÚóÖSçácÅå6áái6ê>®ÇV¢èÍE´d°äôðJJúä }¹¼@@hµ/r&êiÈÃR <yçê¼ô@±ôELwvHÕx,@ÁåH$XÁýP<PÁ©\Xav((hhêÃ)-ôÄR©ê´aKØPÕá²íb1sKàëXÑCÅö#Áo;0`8µøwdn"+À&öØ+óÛCàÇ¯§ÐáÈÁÎÿP5§:T%!=+Ë +Æ'!D'}bw@Ëmît´ÃçH9a,ÇÿPdÃ÷<dlÁ KÁHD Ëe!@!`ÇD2 åWpE51ÇGæbB_ ! 'ÛÌÄÃ×x0)ypa!Ãv¶þËÃrÄ¥ó¶Âuy·"¸!IØD'ëLAÑ.æGiEH<9xß^:¦KI9IÃkô`P2¿L£&!ÃÂy oê 6ÀÛ ³~ú³;Vù°àó÷ó(ýÄó«z3@p0ÀKPÓI5êaö¢$;:1º t¶øÊñyêä`²ÂùÄW~çïü´±¬³ùü9 1øÈ0Fj ,Ä_¨Pi µ³xyà¨ÂO 4ÖsbRÑéå t¼YG¿êÊÃóE·êÀFPEDB+y]\±çI·Ã+ !ÞäQj¨98#®MÊ{¸ÃaZ£elñ"ÆDµs»¯gXÌÿs8ÇÈKµ!PutÃÕ/£ÃÇÛ0ÈÄÐ\¬o0o=GSm0Ãß»ëöó<¥+hS,µÊ$ûÃ«nÍ÷vÀkÏx£Uh)_!¾8éêEµgMß¤HHDpXÅÉ`DPt`\|Á1?/v`Á5ÇDgokg<G^2Ìã/h\|Á ¶uâE¯z³@3;pµÂàâÂÄ¤Ã¬ê§´rf³µtRòÒ^®øG¶u[xtX@ÅÒ?gsP@G)_@öæÈI² º½uÃGOÈI@ÃápJRTÃ[ÃÄ¯ÈþUYôó+4o\|\Ëv°QCÄ§ûÄ¯êãeCÛH@j[3ÁÇT@#/ÌCÌA¶,Q\¨EáõãJ)s÷ç#Áâ±þ\|³ÒáªÐêØBÛ~ôKù\/$Oh(ÃãðjusF¾âv\pPS+ÈókH{d¢#Rgêê ¢²Ôt$6ò+º¡âz^7[ôû´îççUÍ×.qr`ÒònTLë±rOíAfË+Y"$HØ)KjÞWWoo}µ¡@ËæÌ2Ë ÙAÅÁhrÓ~ê üôEè'Õ\|§»ýà#u71F¢é%(F'-µ ëa1ôïõÉ~³YÊC+JkI¨QÆ»?pS´ùê°EE¤¢¹» LD·!AHþûû¿ÔGû»K7@ÇÜÀâsQÀúCwÆñ³à¥-óÂz¸£c{¼ÇiªÃbi >8¹-MÍzðAAÊkk/rA¶¯ÀÒSEMòkUÈõtÍªìBGù»±¦T´.9ÃÎE0\|Ç@Ä¸úe(EÎMÁÍ`øÂ_Å vô÷ñ,÷Æ23³÷Õýªg"`xòÑÎu`ZÁõáBÈ@#tèvñ4xD,Ü®Vi4EzB¨ÔL(^N¤¦¢ÚÜIÄ·ÌHPò¸~tE"1÷mH¡}ðY¨8!TÿÛÍlÀiM<n>àÉb¹êGðóKéà OÁ1+Ãº¶æÿ$sèîS<$IîÞ¶+ºÀ8Ø´6óãÅÌeõÍÍpyÏÜWÂZ8ã WF$=JÁÅh,ÄÐHÁPØ"&êÇ M`¥í(¸¹A"{Iµ¤T´Å²¸; ¶\\By({òHÐp4K¹ó0J;æàEE2ß¥ÃJÌ$®&FöL½pLËÐÂ»ðøµsþàU2zùuU$7ó+î´µÅú+ÖÉÏ-aØC8mv×Æ)O4x<«@¢_eX,l$bDoêû³{QÊK% regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{LJU50KX1-5I52-VT6Q-WSWM-U2Z9XL21ZV61}\1	1	0	0

Generates some ICMP traffic

File has been identified by 48 AntiVirus engines on VirusTotal as malicious (48 events)

Bkav	W32.AIDetect.malware1
MicroWorld-eScan	Gen:Variant.Zusy.380087
FireEye	Generic.mg.623c88cc55a2df11
CAT-QuickHeal	Trojandownloader.Badoffer
ALYac	Trojan.GenericKD.36976216
Cylance	Unsafe
AegisLab	Trojan.Win32.BadOffer.a!c
Sangfor	Trojan.Win32.BadOffer.gen
CrowdStrike	win/malicious_confidence_80% (W)
BitDefender	Gen:Variant.Zusy.380087
K7GW	Trojan ( 005723511 )
K7AntiVirus	Trojan ( 005723511 )
BitDefenderTheta	Gen:NN.ZexaF.34722.ku0@aqwOMkki
Cyren	W32/Trojan.THRM-0029
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	multiple detections
APEX	Malicious
Avast	Win32:MalOb-FE [Cryp]
Kaspersky	HEUR:Trojan-Downloader.Win32.BadOffer.gen
Alibaba	TrojanPSW:Win32/CookiesStealer.253a059b
NANO-Antivirus	Riskware.Win32.PSWTool.hqsnsl
ViRobot	Trojan.Win32.Z.Zusy.2431039
DrWeb	Trojan.MulDrop16.31196
Emsisoft	Gen:Variant.Zusy.380087 (B)
Ikarus	Trojan.Win32.Crypt
GData	Win32.Trojan-Stealer.Predator.CI1IGG
MaxSecure	Trojan-Ransom.Win32.Crypmod.zfq
Avira	TR/Crypt.XPACK.Gen
Antiy-AVL	Trojan/Generic.ASMalwS.2FFCE3E
Gridinsoft	Trojan.Win32.CoinMiner.vb!s8
SUPERAntiSpyware	Trojan.Agent/Gen-Reconyc
ZoneAlarm	HEUR:Trojan-Downloader.Win32.BadOffer.gen
Microsoft	Trojan:Win32/CookiesStealer.OE!MTB
Cynet	Malicious (score: 100)
McAfee	Artemis!623C88CC55A2
MAX	malware (ai score=86)
Malwarebytes	Generic.Trojan.Malicious.DDS
Panda	Trj/CI.A
TrendMicro-HouseCall	TROJ_GEN.R002H0CF321
Tencent	Win32.Trojan-downloader.Badoffer.Wlpk
Yandex	Trojan.Blocker!OH3Aj8L7MuI
SentinelOne	Static AI - Suspicious PE
eGambit	Unsafe.AI_Score_100%
Fortinet	W32/multiple_detections
Webroot	W32.Trojan.Gen
AVG	Win32:MalOb-FE [Cryp]
Cybereason	malicious.c55a2d
Paloalto	generic.ml

Setup2.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All