Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	June 11, 2021, 12:07 p.m.	June 11, 2021, 12:27 p.m.

Size	1.6MB
Type	PE32 executable (GUI) Intel 80386, for MS Windows, InstallShield self-extracting archive
MD5	`6b2715b3c6ce4879c41ea44a261bbdd0`
SHA256	`cdb8a35b197e7f1a6133e029ee861c525d915ffb60cef5af1ec52ee9628686b8`
CRC32	`CD4B343D`
ssdeep	`24576:y9btxEOMPVJ1BppR9q4aObWX5KK/p/mEncYT5ZllnoD+OgD0Idg/CNG6/HRP:yNNMNrBpZTNaJ/p/VncYT5Htoix0agw`
Yara	PE_Header_Zero - PE File Signature IsPE32 - (no description) Malicious_Library_Zero - Malicious_Library

Vlcplayer.exe "C:\Users\test22\AppData\Local\Temp\Vlcplayer.exe"
7032
- cmd.exe "C:\Windows\system32\cmd.exe" /c C:\Windows\system32\cmd < Starne.vssm
  7960
  - cmd.exe C:\Windows\system32\cmd
    8752
    - findstr.exe findstr /V /R "^xOPnRHccwLlqXLcXNbyVTewvYBNUOQNrBSTCQBDisCMXHQdfMnqcbQQsNaAfTAGlYuntRSikUYDddrOilnofQsGKeCObwhhQVBYBaknTsPBmhmwJEzycasxGmNeftJpG$" Cercando.vssm
      5640
    - Distinte.exe.com Distinte.exe.com q
      7236
      - Distinte.exe.com C:\Users\test22\AppData\Local\Temp\7ZipSfx.000\Distinte.exe.com q
        1660
        
        schtasks.exe schtasks.exe /create /tn "EAvqxQkjJG" /tr "C:\\Users\\test22\\AppData\\Roaming\\AfHWXwPlgT\\EAvqxQkjJG.exe.com C:\\Users\\test22\\AppData\\Roaming\\AfHWXwPlgT\\p" /sc onstart /F /RU SYSTEM
        6696
    - PING.EXE ping 127.0.0.1 -n 30
      6472
- cmd.exe cmd /c ""C:\Users\test22\AppData\Local\Temp\7ZSfx000.cmd" "
  5352

Name	Response	Post-Analysis Lookup
edgedl.me.gvt1.com	A 34.104.35.123	34.104.35.123
jhGStadDFeXWZzqBmhvvvUESkDWy.jhGStadDFeXWZzqBmhvvvUESkDWy

IP Address	Status	Action
142.250.204.67	Active	Moloch
164.124.101.2	Active	Moloch
172.217.25.14	Active	Moloch
34.104.35.123	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.102:49826 -> 142.250.204.67:443	906200022	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 34.104.35.123:80 -> 192.168.56.102:49827	2018959	ET POLICY PE EXE or DLL Windows file download HTTP	Potential Corporate Privacy Violation
TCP 34.104.35.123:80 -> 192.168.56.102:49827	2014520	ET INFO EXE - Served Attached HTTP	Misc activity

Suricata TLS

Flow	Issuer	Subject	Fingerprint
TLS 1.2 192.168.56.102:49826 142.250.204.67:443	C=US, O=Google Trust Services, CN=GTS CA 1O1	C=US, ST=California, L=Mountain View, O=Google LLC, CN=upload.video.google.com	0c:b8:82:34:93:46:2b:86:b2:28:eb:7c:42:37:d1:9c:24:93:05:62

Queries for the computername (1 event)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameW June 11, 2021, 12:07 p.m.	computer_name: TEST22-PC	1	1	0

Checks if process is being debugged by a debugger (3 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent June 11, 2021, 12:07 p.m.			0	0
IsDebuggerPresent June 11, 2021, 12:07 p.m.			0	0
IsDebuggerPresent June 11, 2021, 12:07 p.m.			0	0

Command line console output was observed (50 out of 158 events)

Time & API	Arguments	Status	Return
WriteConsoleW June 11, 2021, 12:07 p.m.	buffer: Microsoft Windows [Version 6.1.7601] console_handle: 0x00000007	1	1
WriteConsoleW June 11, 2021, 12:07 p.m.	buffer: Copyright (c) 2009 Microsoft Corporation. All rights reserved. console_handle: 0x00000007	1	1
WriteConsoleW June 11, 2021, 12:07 p.m.	buffer: C:\Users\test22\AppData\Local\Temp\7ZipSfx.000> console_handle: 0x00000007	1	1
WriteConsoleW June 11, 2021, 12:07 p.m.	buffer: Set mftT=%userdomain% console_handle: 0x00000007	1	1
WriteConsoleW June 11, 2021, 12:07 p.m.	buffer: C:\Users\test22\AppData\Local\Temp\7ZipSfx.000> console_handle: 0x00000007	1	1
WriteConsoleW June 11, 2021, 12:07 p.m.	buffer: Set JoopP=DESKTOP-QO5QU33 console_handle: 0x00000007	1	1
WriteConsoleW June 11, 2021, 12:07 p.m.	buffer: C:\Users\test22\AppData\Local\Temp\7ZipSfx.000> console_handle: 0x00000007	1	1
WriteConsoleW June 11, 2021, 12:07 p.m.	buffer: if %mftT%==%JoopP% exit console_handle: 0x00000007	1	1
WriteConsoleW June 11, 2021, 12:07 p.m.	buffer: C:\Users\test22\AppData\Local\Temp\7ZipSfx.000> console_handle: 0x00000007	1	1
WriteConsoleW June 11, 2021, 12:07 p.m.	buffer: <nul set /p = "MZ" > Distinte.exe.com console_handle: 0x00000007	1	1
WriteConsoleW June 11, 2021, 12:07 p.m.	buffer: C:\Users\test22\AppData\Local\Temp\7ZipSfx.000> console_handle: 0x00000007	1	1
WriteConsoleW June 11, 2021, 12:07 p.m.	buffer: findstr /V /R "^xOPnRHccwLlqXLcXNbyVTewvYBNUOQNrBSTCQBDisCMXHQdfMnqcbQQsNaAfTAGlYuntRSikUYDddrOilnofQsGKeCObwhhQVBYBaknTsPBmhmwJEzycasxGmNeftJpG$" Cercando.vssm >> Distinte.exe.com" console_handle: 0x00000007	1	1
WriteConsoleW June 11, 2021, 12:07 p.m.	buffer: C:\Users\test22\AppData\Local\Temp\7ZipSfx.000> console_handle: 0x00000007	1	1
WriteConsoleW June 11, 2021, 12:07 p.m.	buffer: copy Tenerezza.vssm q console_handle: 0x00000007	1	1
WriteConsoleW June 11, 2021, 12:07 p.m.	buffer: 1 file(s) copied. console_handle: 0x00000007	1	1
WriteConsoleW June 11, 2021, 12:07 p.m.	buffer: C:\Users\test22\AppData\Local\Temp\7ZipSfx.000> console_handle: 0x00000007	1	1
WriteConsoleW June 11, 2021, 12:07 p.m.	buffer: start Distinte.exe.com q console_handle: 0x00000007	1	1
WriteConsoleW June 11, 2021, 12:07 p.m.	buffer: C:\Users\test22\AppData\Local\Temp\7ZipSfx.000> console_handle: 0x00000007	1	1
WriteConsoleW June 11, 2021, 12:07 p.m.	buffer: ping 127.0.0.1 -n 30 console_handle: 0x00000007	1	1
WriteConsoleW June 11, 2021, 12:07 p.m.	buffer: C:\Users\test22\AppData\Local\Temp\7ZipSfx.000> console_handle: 0x00000007	1	1
WriteConsoleW June 11, 2021, 12:07 p.m.	buffer: C:\Users\test22\AppData\Local\Temp\7ZipSfx.000> console_handle: 0x00000007	1	1
WriteConsoleA June 11, 2021, 12:07 p.m.	buffer: Pinging 127.0.0.1 console_handle: 0x00000007	1	1
WriteConsoleA June 11, 2021, 12:07 p.m.	buffer: with 32 bytes of data: console_handle: 0x00000007	1	1
WriteConsoleA June 11, 2021, 12:07 p.m.	buffer: Reply from 127.0.0.1: console_handle: 0x00000007	1	1
WriteConsoleA June 11, 2021, 12:07 p.m.	buffer: bytes=32 console_handle: 0x00000007	1	1
WriteConsoleA June 11, 2021, 12:07 p.m.	buffer: time<1ms console_handle: 0x00000007	1	1
WriteConsoleA June 11, 2021, 12:07 p.m.	buffer: TTL=128 console_handle: 0x00000007	1	1
WriteConsoleA June 11, 2021, 12:07 p.m.	buffer: Reply from 127.0.0.1: console_handle: 0x00000007	1	1
WriteConsoleA June 11, 2021, 12:07 p.m.	buffer: bytes=32 console_handle: 0x00000007	1	1
WriteConsoleA June 11, 2021, 12:07 p.m.	buffer: time<1ms console_handle: 0x00000007	1	1
WriteConsoleA June 11, 2021, 12:07 p.m.	buffer: TTL=128 console_handle: 0x00000007	1	1
WriteConsoleA June 11, 2021, 12:07 p.m.	buffer: Reply from 127.0.0.1: console_handle: 0x00000007	1	1
WriteConsoleA June 11, 2021, 12:07 p.m.	buffer: bytes=32 console_handle: 0x00000007	1	1
WriteConsoleA June 11, 2021, 12:07 p.m.	buffer: time<1ms console_handle: 0x00000007	1	1
WriteConsoleA June 11, 2021, 12:07 p.m.	buffer: TTL=128 console_handle: 0x00000007	1	1
WriteConsoleA June 11, 2021, 12:07 p.m.	buffer: Reply from 127.0.0.1: console_handle: 0x00000007	1	1
WriteConsoleA June 11, 2021, 12:07 p.m.	buffer: bytes=32 console_handle: 0x00000007	1	1
WriteConsoleA June 11, 2021, 12:07 p.m.	buffer: time<1ms console_handle: 0x00000007	1	1
WriteConsoleA June 11, 2021, 12:07 p.m.	buffer: TTL=128 console_handle: 0x00000007	1	1
WriteConsoleA June 11, 2021, 12:07 p.m.	buffer: Reply from 127.0.0.1: console_handle: 0x00000007	1	1
WriteConsoleA June 11, 2021, 12:07 p.m.	buffer: bytes=32 console_handle: 0x00000007	1	1
WriteConsoleA June 11, 2021, 12:07 p.m.	buffer: time<1ms console_handle: 0x00000007	1	1
WriteConsoleA June 11, 2021, 12:07 p.m.	buffer: TTL=128 console_handle: 0x00000007	1	1
WriteConsoleA June 11, 2021, 12:07 p.m.	buffer: Reply from 127.0.0.1: console_handle: 0x00000007	1	1
WriteConsoleA June 11, 2021, 12:07 p.m.	buffer: bytes=32 console_handle: 0x00000007	1	1
WriteConsoleA June 11, 2021, 12:07 p.m.	buffer: time<1ms console_handle: 0x00000007	1	1
WriteConsoleA June 11, 2021, 12:07 p.m.	buffer: TTL=128 console_handle: 0x00000007	1	1
WriteConsoleA June 11, 2021, 12:07 p.m.	buffer: Reply from 127.0.0.1: console_handle: 0x00000007	1	1
WriteConsoleA June 11, 2021, 12:07 p.m.	buffer: bytes=32 console_handle: 0x00000007	1	1
WriteConsoleA June 11, 2021, 12:07 p.m.	buffer: time<1ms console_handle: 0x00000007	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx June 11, 2021, 12:07 p.m.		1	1	0

The executable uses a known packer (1 event)

packer

Armadillo v1.71

One or more processes crashed (1 event)

Time & API	Arguments	Status	Return	Repeated
__exception__ June 11, 2021, 12:07 p.m.	stacktrace: RtlpNtEnumerateSubKey+0x2a2b isupper-0x4e2b ntdll+0xcf559 @ 0x7746f559 RtlpNtEnumerateSubKey+0x2b0b isupper-0x4d4b ntdll+0xcf639 @ 0x7746f639 RtlUlonglongByteSwap+0xba5 RtlFreeOemString-0x20d35 ntdll+0x7df95 @ 0x7741df95 HeapFree+0x14 GetProcessHeap-0xc kernel32+0x114dd @ 0x757314dd distinte+0x22f9f @ 0xd02f9f distinte+0x667ec @ 0xd467ec distinte+0x3b4d @ 0xce3b4d distinte+0x3b4d @ 0xce3b4d distinte+0x3b4d @ 0xce3b4d distinte+0x3a7d @ 0xce3a7d distinte+0xb483 @ 0xceb483 distinte+0xc1e0 @ 0xcec1e0 distinte+0xb311 @ 0xceb311 distinte+0x3e518 @ 0xd1e518 distinte+0x89ad @ 0xce89ad distinte+0x9b99 @ 0xce9b99 distinte+0xbee2 @ 0xcebee2 distinte+0x15348 @ 0xcf5348 distinte+0x1601f @ 0xcf601f distinte+0x27f80 @ 0xd07f80 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: eb 12 8b 45 ec 8b 08 8b 09 50 51 e8 6f ff ff ff exception.symbol: RtlpNtEnumerateSubKey+0x1b25 isupper-0x5d31 ntdll+0xce653 exception.instruction: jmp 0x7746e667 exception.module: ntdll.dll exception.exception_code: 0xc0000374 exception.offset: 845395 exception.address: 0x7746e653 registers.esp: 6812052 registers.edi: 56276376 registers.eax: 6812068 registers.ebp: 6812172 registers.edx: 0 registers.ebx: 0 registers.esi: 7471104 registers.ecx: 2147483647	1	0	0

Time & API

Arguments

Status

Return

Repeated

__exception__

June 11, 2021, 12:07 p.m.

stacktrace:

RtlpNtEnumerateSubKey+0x2a2b isupper-0x4e2b ntdll+0xcf559 @ 0x7746f559
RtlpNtEnumerateSubKey+0x2b0b isupper-0x4d4b ntdll+0xcf639 @ 0x7746f639
RtlUlonglongByteSwap+0xba5 RtlFreeOemString-0x20d35 ntdll+0x7df95 @ 0x7741df95
HeapFree+0x14 GetProcessHeap-0xc kernel32+0x114dd @ 0x757314dd
distinte+0x22f9f @ 0xd02f9f
distinte+0x667ec @ 0xd467ec
distinte+0x3b4d @ 0xce3b4d
distinte+0x3b4d @ 0xce3b4d
distinte+0x3b4d @ 0xce3b4d
distinte+0x3a7d @ 0xce3a7d
distinte+0xb483 @ 0xceb483
distinte+0xc1e0 @ 0xcec1e0
distinte+0xb311 @ 0xceb311
distinte+0x3e518 @ 0xd1e518
distinte+0x89ad @ 0xce89ad
distinte+0x9b99 @ 0xce9b99
distinte+0xbee2 @ 0xcebee2
distinte+0x15348 @ 0xcf5348
distinte+0x1601f @ 0xcf601f
distinte+0x27f80 @ 0xd07f80
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: eb 12 8b 45 ec 8b 08 8b 09 50 51 e8 6f ff ff ff
exception.symbol: RtlpNtEnumerateSubKey+0x1b25 isupper-0x5d31 ntdll+0xce653
exception.instruction: jmp 0x7746e667
exception.module: ntdll.dll
exception.exception_code: 0xc0000374
exception.offset: 845395
exception.address: 0x7746e653
registers.esp: 6812052
registers.edi: 56276376
registers.eax: 6812068
registers.ebp: 6812172
registers.edx: 0
registers.ebx: 0
registers.esi: 7471104
registers.ecx: 2147483647

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

HTTP traffic contains suspicious features which may be indicative of malware related traffic (1 event)

suspicious_features

POST method with no referer header

suspicious_request

POST https://update.googleapis.com/service/update2?cup2key=10:3122773252&cup2hreq=d65fe03203611d900d495030da7afb81ea941212d698a6445b2076fc504e44c5

Performs some HTTP requests (3 events)

request	HEAD http://edgedl.me.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe
request	GET http://edgedl.me.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe
request	POST https://update.googleapis.com/service/update2?cup2key=10:3122773252&cup2hreq=d65fe03203611d900d495030da7afb81ea941212d698a6445b2076fc504e44c5

Sends data using the HTTP POST Method (1 event)

request

POST https://update.googleapis.com/service/update2?cup2key=10:3122773252&cup2hreq=d65fe03203611d900d495030da7afb81ea941212d698a6445b2076fc504e44c5

Allocates read-write-execute memory (usually to unpack itself) (4 events)

Time & API	Arguments	Status
NtProtectVirtualMemory June 11, 2021, 12:07 p.m.	process_identifier: 7032 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73772000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 11, 2021, 12:07 p.m.	process_identifier: 7236 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73772000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 11, 2021, 12:07 p.m.	process_identifier: 1660 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73772000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 11, 2021, 12:07 p.m.	process_identifier: 1660 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03ae0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation (1 event)

Time & API	Arguments	Status	Return	Repeated
GetDiskFreeSpaceExW June 11, 2021, 12:07 p.m.	total_number_of_free_bytes: 0 free_bytes_available: 13295296512 root_path: C:\Users\test22\AppData\Local\Temp\7ZipSfx.000 total_number_of_bytes: 0	1	1	0

Creates executable files on the filesystem (4 events)

file	C:\Users\test22\AppData\Roaming\AfHWXwPlgT\thFdDuctaz.js
file	C:\Users\test22\AppData\Local\Temp\7ZipSfx.000\Distinte.exe.com
file	C:\Users\test22\AppData\Local\Temp\7ZSfx000.cmd
file	C:\Users\test22\AppData\Roaming\AfHWXwPlgT\EAvqxQkjJG.exe.com

Creates a suspicious process (2 events)

cmdline	schtasks.exe /create /tn "EAvqxQkjJG" /tr "C:\\Users\\test22\\AppData\\Roaming\\AfHWXwPlgT\\EAvqxQkjJG.exe.com C:\\Users\\test22\\AppData\\Roaming\\AfHWXwPlgT\\p" /sc onstart /F /RU SYSTEM
cmdline	"C:\Windows\system32\cmd.exe" /c C:\Windows\system32\cmd < Starne.vssm

Drops a binary and executes it (1 event)

file	C:\Users\test22\AppData\Local\Temp\7ZSfx000.cmd

Drops an executable to the user AppData folder (2 events)

file	C:\Users\test22\AppData\Local\Temp\Vlcplayer.exe
file	C:\Users\test22\AppData\Roaming\AfHWXwPlgT\EAvqxQkjJG.exe.com

A process created a hidden window (2 events)

Time & API	Arguments	Status	Return	Repeated
ShellExecuteExW June 11, 2021, 12:07 p.m.	show_type: 0 filepath_r: C:\Windows\system32\cmd parameters: /c C:\Windows\system32\cmd < Starne.vssm filepath: C:\Windows\System32\cmd	1	1	0
ShellExecuteExW June 11, 2021, 12:07 p.m.	show_type: 0 filepath_r: C:\Users\test22\AppData\Local\Temp\7ZSfx000.cmd parameters: filepath: C:\Users\test22\AppData\Local\Temp\7ZSfx000.cmd	1	1	0

Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (12 events)

Time & API	Arguments	Status	Return
Process32NextW June 11, 2021, 12:07 p.m.	snapshot_handle: 0x0000012c process_name: mobsync.exe process_identifier: 3400	1	1
Process32NextW June 11, 2021, 12:07 p.m.	snapshot_handle: 0x0000012c process_name: pw.exe process_identifier: 6060	1	1
Process32NextW June 11, 2021, 12:07 p.m.	snapshot_handle: 0x0000012c process_name: cmd.exe process_identifier: 2352	1	1
Process32NextW June 11, 2021, 12:07 p.m.	snapshot_handle: 0x0000012c process_name: conhost.exe process_identifier: 812	1	1
Process32NextW June 11, 2021, 12:07 p.m.	snapshot_handle: 0x0000012c process_name: pw.exe process_identifier: 7528	1	1
Process32NextW June 11, 2021, 12:07 p.m.	snapshot_handle: 0x0000012c process_name: Vlcplayer.exe process_identifier: 7032	1	1
Process32NextW June 11, 2021, 12:07 p.m.	snapshot_handle: 0x0000012c process_name: cmd.exe process_identifier: 7960	1	1
Process32NextW June 11, 2021, 12:07 p.m.	snapshot_handle: 0x0000012c process_name: conhost.exe process_identifier: 5980	1	1
Process32NextW June 11, 2021, 12:07 p.m.	snapshot_handle: 0x0000012c process_name: cmd.exe process_identifier: 8752	1	1
Process32NextW June 11, 2021, 12:07 p.m.	snapshot_handle: 0x0000012c process_name: Distinte.exe.com process_identifier: 7236	1	1
Process32NextW June 11, 2021, 12:07 p.m.	snapshot_handle: 0x0000012c process_name: Distinte.exe.com process_identifier: 1660	1	1
Process32NextW June 11, 2021, 12:07 p.m.	snapshot_handle: 0x0000012c process_name: PING.EXE process_identifier: 6472	1	1

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x00016c00', u'virtual_address': u'0x00023000', u'entropy': 6.857621448418033, u'name': u'.rsrc', u'virtual_size': u'0x00016bc6'}

entropy

6.85762144842

description

A section with a high entropy has been found

entropy

0.443902439024

description

Overall entropy of this PE file is high

Expresses interest in specific running processes (2 events)

process	distinte.exe.com
process	cmd.exe

Potentially malicious URLs were found in the process memory dump (3 events)

url	http://www.microsoft.com/schemas/ie8tldlistdescription/1.0
url	http://purl.org/rss/1.0/
url	http://www.passport.com

Yara rule detected in process memory (33 events)

description	Communication using DGA	rule	Network_DGA
description	Communications use DNS	rule	Network_DNS
description	Communications over RAW Socket	rule	Network_TCP_Socket
description	Create a windows service	rule	Create_Service
description	Record Audio	rule	Sniff_Audio
description	Communications over HTTP	rule	Network_HTTP
description	Escalate priviledges	rule	Escalate_priviledges
description	Run a KeyLogger	rule	KeyLogger
description	Communications over FTP	rule	Network_FTP
description	Win.Trojan.agentTesla	rule	Win_Trojan_agentTesla_Zero
description	Hijack network configuration	rule	Hijack_Network
description	Code injection with CreateRemoteThread in a remote process	rule	Code_injection
description	Match Windows Http API call	rule	Str_Win32_Http_API
description	Match Windows Inet API call	rule	Str_Win32_Internet_API
description	Steal credential	rule	local_credential_Steal
description	Take ScreenShot	rule	ScreenShot
description	File Downloader	rule	Network_Downloader
description	Communications over P2P network	rule	Network_P2P_Win
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerCheck__RemoteAPI
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	DebuggerException__ConsoleCtrl
description	(no description)	rule	DebuggerException__SetConsoleCtrl
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	(no description)	rule	Check_Dlls
description	Checks if being debugged	rule	anti_dbg
description	Anti-Sandbox checks for ThreatExpert	rule	antisb_threatExpert
description	Bypass DEP	rule	disable_dep
description	Affect hook table	rule	win_hook
description	Install itself for autorun at Windows startup	rule	Persistence

Uses Windows utilities for basic Windows functionality (3 events)

cmdline	schtasks.exe /create /tn "EAvqxQkjJG" /tr "C:\\Users\\test22\\AppData\\Roaming\\AfHWXwPlgT\\EAvqxQkjJG.exe.com C:\\Users\\test22\\AppData\\Roaming\\AfHWXwPlgT\\p" /sc onstart /F /RU SYSTEM
cmdline	C:\Windows\SysWOW64\nslookup.exe
cmdline	ping 127.0.0.1 -n 30

One or more of the buffers contains an embedded PE file (1 event)

buffer

Buffer with sha1: f3cc6e5ef86d5675dd693c2a55eff22d8c79dee2

Communicates with host for which no DNS query was performed (2 events)

host	142.250.204.67
host	172.217.25.14

Allocates execute permission to another process indicative of possible code injection (1 event)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory June 11, 2021, 12:07 p.m.	process_identifier: 7184 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 634880 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 process_handle: 0x0000016c	1	0	0

Installs itself for autorun at Windows startup (1 event)

cmdline

schtasks.exe /create /tn "EAvqxQkjJG" /tr "C:\\Users\\test22\\AppData\\Roaming\\AfHWXwPlgT\\EAvqxQkjJG.exe.com C:\\Users\\test22\\AppData\\Roaming\\AfHWXwPlgT\\p" /sc onstart /F /RU SYSTEM

Manipulates memory of a non-child process indicative of process injection (4 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1660 manipulating memory of non-child process 7184
NtAllocateVirtualMemory June 11, 2021, 12:07 p.m.	process_identifier: 7184 region_size: 634880 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 4 (PAGE_READWRITE) base_address: 0x00400000 allocation_type: 4097 (MEM_COMMIT) process_handle: 0x0000016c		3221225496	0
NtAllocateVirtualMemory June 11, 2021, 12:07 p.m.	process_identifier: 7184 region_size: 634880 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 4 (PAGE_READWRITE) base_address: 0x00400000 allocation_type: 12289 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000016c	1	0	0
NtProtectVirtualMemory June 11, 2021, 12:07 p.m.	process_identifier: 7184 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 634880 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 process_handle: 0x0000016c	1	0	0

Potential code injection by writing to the memory of another process (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1660 injected into non-child 7184
WriteProcessMemory June 11, 2021, 12:07 p.m.	buffer: ÿÿÿÿ@û~(ü~Pý~mèÿÿ jHâý~± base_address: 0x7efde000 process_identifier: 7184 process_handle: 0x0000016c	1	1	0

File has been identified by 16 AntiVirus engines on VirusTotal as malicious (16 events)

Bkav	W32.AIDetect.malware2
Zillya	Backdoor.Agent.Win32.80093
BitDefenderTheta	Gen:NN.ZexaF.34738.Mr3@ay7kxhgk
Avast	Win32:MdeClass
Tencent	Malware.Win32.Gencirc.10ce5a6c
APEX	Malicious
Jiangmin	Trojan.Generic.dmbkj
Gridinsoft	Trojan.Win32.Packed.oa!s1
Microsoft	Trojan:Win32/Wacatac.B!ml
GData	Win32.Trojan.BSE.AKETJC
Cynet	Malicious (score: 100)
Malwarebytes	Trojan.Dropper.Generic
Ikarus	Trojan-Spy.RedLineStealer
eGambit	Unsafe.AI_Score_99%
Fortinet	W32/Agent.SFX!tr
AVG	Win32:MdeClass

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1660 called NtSetContextThread to modify thread in remote process 7184
NtSetContextThread June 11, 2021, 12:07 p.m.	registers.eip: 2000355780 registers.esp: 851244 registers.edi: 0 registers.eax: 4620461 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000134 process_identifier: 7184	1	0	0

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 8752 resumed a thread in remote process 7236
NtResumeThread June 11, 2021, 12:07 p.m.	thread_handle: 0x00000090 suspend_count: 0 process_identifier: 7236	1	0	0

Uses Sysinternals tools in order to add additional command line functionality (1 event)

cmdline

schtasks.exe /create /tn "EAvqxQkjJG" /tr "C:\\Users\\test22\\AppData\\Roaming\\AfHWXwPlgT\\EAvqxQkjJG.exe.com C:\\Users\\test22\\AppData\\Roaming\\AfHWXwPlgT\\p" /sc onstart /F /RU SYSTEM

Executed a process and injected code into it, probably while unpacking (19 events)

Time & API	Arguments	Status	Return
NtResumeThread June 11, 2021, 12:07 p.m.	thread_handle: 0x00000224 suspend_count: 1 process_identifier: 7032	1	0
CreateProcessInternalW June 11, 2021, 12:07 p.m.	thread_identifier: 8780 thread_handle: 0x00000248 process_identifier: 7960 current_directory: C:\Users\test22\AppData\Local\Temp\7ZipSfx.000 filepath: C:\Windows\System32\cmd.exe track: 1 command_line: "C:\Windows\system32\cmd.exe" /c C:\Windows\system32\cmd < Starne.vssm filepath_r: C:\Windows\system32\cmd.exe stack_pivoted: 0 creation_flags: 67634176 (CREATE_DEFAULT_ERROR_MODE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x00000250	1	1
CreateProcessInternalW June 11, 2021, 12:07 p.m.	thread_identifier: 7908 thread_handle: 0x00000250 process_identifier: 5352 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: "C:\Users\test22\AppData\Local\Temp\7ZSfx000.cmd" filepath_r: stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x00000284	1	1
CreateProcessInternalW June 11, 2021, 12:07 p.m.	thread_identifier: 3800 thread_handle: 0x00000088 process_identifier: 8752 current_directory: C:\Users\test22\AppData\Local\Temp\7ZipSfx.000 filepath: C:\Windows\System32\cmd.exe track: 1 command_line: C:\Windows\system32\cmd filepath_r: C:\Windows\system32\cmd.exe stack_pivoted: 0 creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x0000008c	1	1
CreateProcessInternalW June 11, 2021, 12:07 p.m.	thread_identifier: 5916 thread_handle: 0x0000008c process_identifier: 5640 current_directory: C:\Users\test22\AppData\Local\Temp\7ZipSfx.000 filepath: C:\Windows\System32\findstr.exe track: 1 command_line: findstr /V /R "^xOPnRHccwLlqXLcXNbyVTewvYBNUOQNrBSTCQBDisCMXHQdfMnqcbQQsNaAfTAGlYuntRSikUYDddrOilnofQsGKeCObwhhQVBYBaknTsPBmhmwJEzycasxGmNeftJpG$" Cercando.vssm filepath_r: C:\Windows\system32\findstr.exe stack_pivoted: 0 creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x00000094	1	1
CreateProcessInternalW June 11, 2021, 12:07 p.m.	thread_identifier: 4836 thread_handle: 0x00000090 process_identifier: 7236 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\7ZipSfx.000\Distinte.exe.com track: 1 command_line: Distinte.exe.com q filepath_r: C:\Users\test22\AppData\Local\Temp\7ZipSfx.000\Distinte.exe.com stack_pivoted: 0 creation_flags: 525328 (CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x00000094	1	1
NtResumeThread June 11, 2021, 12:07 p.m.	thread_handle: 0x00000090 suspend_count: 0 process_identifier: 7236	1	0
CreateProcessInternalW June 11, 2021, 12:07 p.m.	thread_identifier: 4672 thread_handle: 0x00000094 process_identifier: 6472 current_directory: C:\Users\test22\AppData\Local\Temp\7ZipSfx.000 filepath: C:\Windows\System32\PING.EXE track: 1 command_line: ping 127.0.0.1 -n 30 filepath_r: C:\Windows\system32\PING.EXE stack_pivoted: 0 creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x00000090	1	1
CreateProcessInternalW June 11, 2021, 12:07 p.m.	thread_identifier: 1888 thread_handle: 0x0000012c process_identifier: 1660 current_directory: C:\Users\test22\AppData\Local\Temp\7ZipSfx.000 filepath: track: 1 command_line: C:\Users\test22\AppData\Local\Temp\7ZipSfx.000\Distinte.exe.com q filepath_r: stack_pivoted: 0 creation_flags: 0 () inherit_handles: 0 process_handle: 0x00000130	1	1
NtResumeThread June 11, 2021, 12:07 p.m.	thread_handle: 0x00000190 suspend_count: 1 process_identifier: 1660	1	0
CreateProcessInternalW June 11, 2021, 12:07 p.m.	thread_identifier: 3916 thread_handle: 0x0000026c process_identifier: 6696 current_directory: C:\Users\test22\AppData\Local\Temp\7ZipSfx.000 filepath: track: 1 command_line: schtasks.exe /create /tn "EAvqxQkjJG" /tr "C:\\Users\\test22\\AppData\\Roaming\\AfHWXwPlgT\\EAvqxQkjJG.exe.com C:\\Users\\test22\\AppData\\Roaming\\AfHWXwPlgT\\p" /sc onstart /F /RU SYSTEM filepath_r: stack_pivoted: 0 creation_flags: 0 () inherit_handles: 0 process_handle: 0x00000274	1	1
CreateProcessInternalW June 11, 2021, 12:07 p.m.	thread_identifier: 2224 thread_handle: 0x00000134 process_identifier: 7184 current_directory: filepath: track: 1 command_line: C:\Windows\SysWOW64\nslookup.exe filepath_r: stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x0000016c	1	1
NtGetContextThread June 11, 2021, 12:07 p.m.	thread_handle: 0x00000134	1	0
NtAllocateVirtualMemory June 11, 2021, 12:07 p.m.	process_identifier: 7184 region_size: 634880 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 4 (PAGE_READWRITE) base_address: 0x00400000 allocation_type: 4097 (MEM_COMMIT) process_handle: 0x0000016c		3221225496
NtAllocateVirtualMemory June 11, 2021, 12:07 p.m.	process_identifier: 7184 region_size: 634880 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 4 (PAGE_READWRITE) base_address: 0x00400000 allocation_type: 12289 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000016c	1	0
WriteProcessMemory June 11, 2021, 12:07 p.m.	buffer: base_address: 0x00400000 process_identifier: 7184 process_handle: 0x0000016c	1	1
WriteProcessMemory June 11, 2021, 12:07 p.m.	buffer: ÿÿÿÿ@û~(ü~Pý~mèÿÿ jHâý~± base_address: 0x7efde000 process_identifier: 7184 process_handle: 0x0000016c	1	1
NtSetContextThread June 11, 2021, 12:07 p.m.	registers.eip: 2000355780 registers.esp: 851244 registers.edi: 0 registers.eax: 4620461 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000134 process_identifier: 7184	1	0
NtResumeThread June 11, 2021, 12:07 p.m.	thread_handle: 0x000000dc suspend_count: 1 process_identifier: 6472	1	0

Vlcplayer.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All