Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	June 25, 2021, 9:30 a.m.	June 25, 2021, 10 a.m.

Size	1.9MB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`9f105a70f86071d39afad31c14c6c9c2`
SHA256	`6aa436d8c7a5205a40ae1a806dec9d00c2161029fcd16aee21575e246e5c474c`
CRC32	`7E1831AE`
ssdeep	`49152:YeAKdvi9IP/UU54GEaCgKB2z0glD0zNZj:YM/UU54GZNrz0aDuPj`
Yara	PE_Header_Zero - PE File Signature IsPE32 - (no description)

moonitor-setup.exe "C:\Users\test22\AppData\Local\Temp\moonitor-setup.exe"
2616
- MAL2=B2.exe "C:\Users\test22\AppData\Local\Temp\MAL2=B2.exe"
  8708
  - cmd.exe "C:\Windows\System32\cmd.exe" /c cmd < Come.adts
    6928
    - cmd.exe cmd
      8728
      - findstr.exe findstr /V /R "^QqLDXfcyKJYyHpHVvlCPncSYWcwwCqrPmVAsmUDNqkdJxkOiNHJrJWOcoNHChzDKGoGMIfvCHOPjtoEKGUgUdZyDuypLjqAGI$" Trasse.adts
        3800
      - Colpo.exe.com Colpo.exe.com U
        5916
        
        Colpo.exe.com C:\Users\test22\AppData\Local\Temp\7ZipSfx.000\Colpo.exe.com U
        3624
        
        RegAsm.exe C:\Users\test22\AppData\Local\Temp\7ZipSfx.000\RegAsm.exe
        5260
      - PING.EXE ping 127.0.0.1 -n 30
        6892

Name	Response	Post-Analysis Lookup
prRGwPXpYAiIFpIlDoAmoaNEmHUgK.prRGwPXpYAiIFpIlDoAmoaNEmHUgK
api.ip.sb	CNAME api.ip.sb.cdn.cloudflare.net A 104.26.13.31 A 104.26.12.31 A 172.67.75.172	172.67.75.172

IP Address	Status	Action
104.26.12.31	Active	Moloch
164.124.101.2	Active	Moloch
172.217.25.14	Active	Moloch
78.46.225.155	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.102:49820 -> 104.26.12.31:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 78.46.225.155:47321 -> 192.168.56.102:49819	2221010	SURICATA HTTP unable to match response to request	Generic Protocol Command Decode

Suricata TLS

Flow	Issuer	Subject	Fingerprint
TLSv1 192.168.56.102:49820 104.26.12.31:443	C=US, O=Cloudflare, Inc., CN=Cloudflare Inc ECC CA-3	C=US, ST=CA, L=San Francisco, O=Cloudflare, Inc., CN=sni.cloudflaressl.com	5e:7d:19:2d:d7:66:0c:63:45:a5:24:8f:b7:db:35:a7:61:6d:89:0e

Queries for the computername (12 events)

Time & API	Arguments	Status	Return
GetComputerNameW June 25, 2021, 9:30 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 25, 2021, 9:30 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 25, 2021, 9:30 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 25, 2021, 9:30 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 25, 2021, 9:30 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 25, 2021, 9:30 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 25, 2021, 9:30 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 25, 2021, 9:30 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 25, 2021, 9:30 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 25, 2021, 9:30 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 25, 2021, 9:30 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 25, 2021, 9:30 a.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (6 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent June 25, 2021, 9:30 a.m.			0	0
IsDebuggerPresent June 25, 2021, 9:30 a.m.			0	0
IsDebuggerPresent June 25, 2021, 9:30 a.m.			0	0
IsDebuggerPresent June 25, 2021, 9:30 a.m.			0	0
IsDebuggerPresent June 25, 2021, 9:30 a.m.			0	0
IsDebuggerPresent June 25, 2021, 9:30 a.m.			0	0

Command line console output was observed (50 out of 141 events)

Time & API	Arguments	Status	Return
WriteConsoleW June 25, 2021, 9:30 a.m.	buffer: Microsoft Windows [Version 6.1.7601] console_handle: 0x00000007	1	1
WriteConsoleW June 25, 2021, 9:30 a.m.	buffer: Copyright (c) 2009 Microsoft Corporation. All rights reserved. console_handle: 0x00000007	1	1
WriteConsoleW June 25, 2021, 9:30 a.m.	buffer: C:\Users\test22\AppData\Local\Temp\7ZipSfx.000> console_handle: 0x00000007	1	1
WriteConsoleW June 25, 2021, 9:30 a.m.	buffer: if %userdomain%==DESKTOP-QO5QU33 exit 1 console_handle: 0x00000007	1	1
WriteConsoleW June 25, 2021, 9:30 a.m.	buffer: C:\Users\test22\AppData\Local\Temp\7ZipSfx.000> console_handle: 0x00000007	1	1
WriteConsoleW June 25, 2021, 9:30 a.m.	buffer: <nul set /p = "MZ" > Colpo.exe.com console_handle: 0x00000007	1	1
WriteConsoleW June 25, 2021, 9:30 a.m.	buffer: C:\Users\test22\AppData\Local\Temp\7ZipSfx.000> console_handle: 0x00000007	1	1
WriteConsoleW June 25, 2021, 9:30 a.m.	buffer: findstr /V /R "^QqLDXfcyKJYyHpHVvlCPncSYWcwwCqrPmVAsmUDNqkdJxkOiNHJrJWOcoNHChzDKGoGMIfvCHOPjtoEKGUgUdZyDuypLjqAGI$" Trasse.adts >> Colpo.exe.com" console_handle: 0x00000007	1	1
WriteConsoleW June 25, 2021, 9:30 a.m.	buffer: C:\Users\test22\AppData\Local\Temp\7ZipSfx.000> console_handle: 0x00000007	1	1
WriteConsoleW June 25, 2021, 9:30 a.m.	buffer: copy Sogni.adts U console_handle: 0x00000007	1	1
WriteConsoleW June 25, 2021, 9:30 a.m.	buffer: 1 file(s) copied. console_handle: 0x00000007	1	1
WriteConsoleW June 25, 2021, 9:30 a.m.	buffer: C:\Users\test22\AppData\Local\Temp\7ZipSfx.000> console_handle: 0x00000007	1	1
WriteConsoleW June 25, 2021, 9:30 a.m.	buffer: start Colpo.exe.com U console_handle: 0x00000007	1	1
WriteConsoleW June 25, 2021, 9:30 a.m.	buffer: C:\Users\test22\AppData\Local\Temp\7ZipSfx.000> console_handle: 0x00000007	1	1
WriteConsoleW June 25, 2021, 9:30 a.m.	buffer: ping 127.0.0.1 -n 30 console_handle: 0x00000007	1	1
WriteConsoleW June 25, 2021, 9:30 a.m.	buffer: C:\Users\test22\AppData\Local\Temp\7ZipSfx.000> console_handle: 0x00000007	1	1
WriteConsoleW June 25, 2021, 9:30 a.m.	buffer: C:\Users\test22\AppData\Local\Temp\7ZipSfx.000> console_handle: 0x00000007	1	1
WriteConsoleA June 25, 2021, 9:30 a.m.	buffer: Pinging 127.0.0.1 console_handle: 0x00000007	1	1
WriteConsoleA June 25, 2021, 9:30 a.m.	buffer: with 32 bytes of data: console_handle: 0x00000007	1	1
WriteConsoleA June 25, 2021, 9:30 a.m.	buffer: Reply from 127.0.0.1: console_handle: 0x00000007	1	1
WriteConsoleA June 25, 2021, 9:30 a.m.	buffer: bytes=32 console_handle: 0x00000007	1	1
WriteConsoleA June 25, 2021, 9:30 a.m.	buffer: time<1ms console_handle: 0x00000007	1	1
WriteConsoleA June 25, 2021, 9:30 a.m.	buffer: TTL=128 console_handle: 0x00000007	1	1
WriteConsoleA June 25, 2021, 9:30 a.m.	buffer: Reply from 127.0.0.1: console_handle: 0x00000007	1	1
WriteConsoleA June 25, 2021, 9:30 a.m.	buffer: bytes=32 console_handle: 0x00000007	1	1
WriteConsoleA June 25, 2021, 9:30 a.m.	buffer: time<1ms console_handle: 0x00000007	1	1
WriteConsoleA June 25, 2021, 9:30 a.m.	buffer: TTL=128 console_handle: 0x00000007	1	1
WriteConsoleA June 25, 2021, 9:30 a.m.	buffer: Reply from 127.0.0.1: console_handle: 0x00000007	1	1
WriteConsoleA June 25, 2021, 9:30 a.m.	buffer: bytes=32 console_handle: 0x00000007	1	1
WriteConsoleA June 25, 2021, 9:30 a.m.	buffer: time<1ms console_handle: 0x00000007	1	1
WriteConsoleA June 25, 2021, 9:30 a.m.	buffer: TTL=128 console_handle: 0x00000007	1	1
WriteConsoleA June 25, 2021, 9:30 a.m.	buffer: Reply from 127.0.0.1: console_handle: 0x00000007	1	1
WriteConsoleA June 25, 2021, 9:30 a.m.	buffer: bytes=32 console_handle: 0x00000007	1	1
WriteConsoleA June 25, 2021, 9:30 a.m.	buffer: time<1ms console_handle: 0x00000007	1	1
WriteConsoleA June 25, 2021, 9:30 a.m.	buffer: TTL=128 console_handle: 0x00000007	1	1
WriteConsoleA June 25, 2021, 9:30 a.m.	buffer: Reply from 127.0.0.1: console_handle: 0x00000007	1	1
WriteConsoleA June 25, 2021, 9:30 a.m.	buffer: bytes=32 console_handle: 0x00000007	1	1
WriteConsoleA June 25, 2021, 9:30 a.m.	buffer: time<1ms console_handle: 0x00000007	1	1
WriteConsoleA June 25, 2021, 9:30 a.m.	buffer: TTL=128 console_handle: 0x00000007	1	1
WriteConsoleA June 25, 2021, 9:30 a.m.	buffer: Reply from 127.0.0.1: console_handle: 0x00000007	1	1
WriteConsoleA June 25, 2021, 9:30 a.m.	buffer: bytes=32 console_handle: 0x00000007	1	1
WriteConsoleA June 25, 2021, 9:30 a.m.	buffer: time<1ms console_handle: 0x00000007	1	1
WriteConsoleA June 25, 2021, 9:30 a.m.	buffer: TTL=128 console_handle: 0x00000007	1	1
WriteConsoleA June 25, 2021, 9:30 a.m.	buffer: Reply from 127.0.0.1: console_handle: 0x00000007	1	1
WriteConsoleA June 25, 2021, 9:30 a.m.	buffer: bytes=32 console_handle: 0x00000007	1	1
WriteConsoleA June 25, 2021, 9:30 a.m.	buffer: time<1ms console_handle: 0x00000007	1	1
WriteConsoleA June 25, 2021, 9:30 a.m.	buffer: TTL=128 console_handle: 0x00000007	1	1
WriteConsoleA June 25, 2021, 9:30 a.m.	buffer: Reply from 127.0.0.1: console_handle: 0x00000007	1	1
WriteConsoleA June 25, 2021, 9:30 a.m.	buffer: bytes=32 console_handle: 0x00000007	1	1
WriteConsoleA June 25, 2021, 9:30 a.m.	buffer: time<1ms console_handle: 0x00000007	1	1

Uses Windows APIs to generate a cryptographic key (6 events)

Time & API	Arguments	Status	Return
CryptExportKey June 25, 2021, 9:30 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005149b0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 25, 2021, 9:30 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005149b0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 25, 2021, 9:30 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005149f0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 25, 2021, 9:30 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x05f523f8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 25, 2021, 9:30 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x05f523f8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 25, 2021, 9:30 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x05f52238 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Tries to locate where the browsers are installed (2 events)

file	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx June 25, 2021, 9:30 a.m.		1	1	0

One or more processes crashed (1 event)

Time & API	Arguments	Status	Return	Repeated
__exception__ June 25, 2021, 9:30 a.m.	stacktrace: 0x81bce2 0x81ba08 0x811462 0x810392 0x8100d8 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x6fba2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x6fbb264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x6fbb2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x6fc674ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x6fc67610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x6fcf1dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x6fcf1e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x6fcf1f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x6fcf416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7387f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74437f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74434de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 8b 01 8b 40 28 ff 10 8b d0 85 c0 75 06 8b 15 2c exception.instruction: mov eax, dword ptr [ecx] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x81bd71 registers.esp: 2814268 registers.edi: 45876668 registers.eax: 0 registers.ebp: 2814292 registers.edx: 5163624 registers.ebx: 44666128 registers.esi: 45885076 registers.ecx: 0	1	0	0

Time & API

Arguments

Status

Return

Repeated

__exception__

June 25, 2021, 9:30 a.m.

stacktrace:

0x81bce2
0x81ba08
0x811462
0x810392
0x8100d8
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x6fba2652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x6fbb264f
DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x6fbb2e95
DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x6fc674ec
DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x6fc67610
CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x6fcf1dc4
CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x6fcf1e67
CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x6fcf1f7a
_CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x6fcf416a
_CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7387f5a3
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74437f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74434de3
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: 8b 01 8b 40 28 ff 10 8b d0 85 c0 75 06 8b 15 2c
exception.instruction: mov eax, dword ptr [ecx]
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x81bd71
registers.esp: 2814268
registers.edi: 45876668
registers.eax: 0
registers.ebp: 2814292
registers.edx: 5163624
registers.ebx: 44666128
registers.esi: 45885076
registers.ecx: 0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

HTTP traffic contains suspicious features which may be indicative of malware related traffic (1 event)

suspicious_features

GET method with no useragent header

suspicious_request

GET https://api.ip.sb/geoip

Performs some HTTP requests (1 event)

request

GET https://api.ip.sb/geoip

Allocates read-write-execute memory (usually to unpack itself) (50 out of 102 events)

Time & API	Arguments	Status
NtProtectVirtualMemory June 25, 2021, 9:30 a.m.	process_identifier: 2616 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73771000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 25, 2021, 9:30 a.m.	process_identifier: 2616 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74441000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 25, 2021, 9:30 a.m.	process_identifier: 2616 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72da4000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 25, 2021, 9:30 a.m.	process_identifier: 2616 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73772000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 25, 2021, 9:30 a.m.	process_identifier: 8708 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73771000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 25, 2021, 9:30 a.m.	process_identifier: 8708 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72da4000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 25, 2021, 9:30 a.m.	process_identifier: 8708 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73772000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 25, 2021, 9:30 a.m.	process_identifier: 8708 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72821000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 25, 2021, 9:30 a.m.	process_identifier: 8708 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73dd1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 25, 2021, 9:30 a.m.	process_identifier: 8708 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74e51000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 25, 2021, 9:30 a.m.	process_identifier: 8708 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x743c1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 25, 2021, 9:30 a.m.	process_identifier: 5916 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73771000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 25, 2021, 9:30 a.m.	process_identifier: 5916 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72da4000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 25, 2021, 9:30 a.m.	process_identifier: 5916 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73772000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 25, 2021, 9:30 a.m.	process_identifier: 6892 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73321000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 25, 2021, 9:30 a.m.	process_identifier: 3624 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73771000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 25, 2021, 9:30 a.m.	process_identifier: 3624 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72da4000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 25, 2021, 9:30 a.m.	process_identifier: 3624 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73772000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 25, 2021, 9:30 a.m.	process_identifier: 3624 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002e0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory June 25, 2021, 9:30 a.m.	process_identifier: 5260 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x738e2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 25, 2021, 9:30 a.m.	process_identifier: 5260 region_size: 917504 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00690000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 25, 2021, 9:30 a.m.	process_identifier: 5260 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00730000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory June 25, 2021, 9:30 a.m.	process_identifier: 5260 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x701e2000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 25, 2021, 9:30 a.m.	process_identifier: 5260 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7208b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 25, 2021, 9:30 a.m.	process_identifier: 5260 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6fba1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 25, 2021, 9:30 a.m.	process_identifier: 5260 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6fba2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 25, 2021, 9:30 a.m.	process_identifier: 5260 region_size: 1048576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00770000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 25, 2021, 9:30 a.m.	process_identifier: 5260 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00830000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 25, 2021, 9:30 a.m.	process_identifier: 5260 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006c2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 25, 2021, 9:30 a.m.	process_identifier: 5260 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006f5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 25, 2021, 9:30 a.m.	process_identifier: 5260 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006fb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 25, 2021, 9:30 a.m.	process_identifier: 5260 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006f7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 25, 2021, 9:30 a.m.	process_identifier: 5260 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006dc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory June 25, 2021, 9:30 a.m.	process_identifier: 5260 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7386a000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 25, 2021, 9:30 a.m.	process_identifier: 5260 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00810000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 25, 2021, 9:30 a.m.	process_identifier: 5260 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006e6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 25, 2021, 9:30 a.m.	process_identifier: 5260 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006ca000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory June 25, 2021, 9:30 a.m.	process_identifier: 5260 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7441f000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 25, 2021, 9:30 a.m.	process_identifier: 5260 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006ea000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 25, 2021, 9:30 a.m.	process_identifier: 5260 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006e7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory June 25, 2021, 9:30 a.m.	process_identifier: 5260 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73db1000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 25, 2021, 9:30 a.m.	process_identifier: 5260 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006eb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 25, 2021, 9:30 a.m.	process_identifier: 5260 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006da000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 25, 2021, 9:30 a.m.	process_identifier: 5260 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006ec000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 25, 2021, 9:30 a.m.	process_identifier: 5260 region_size: 327680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef50000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 25, 2021, 9:30 a.m.	process_identifier: 5260 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 25, 2021, 9:30 a.m.	process_identifier: 5260 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 25, 2021, 9:30 a.m.	process_identifier: 5260 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef58000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 25, 2021, 9:30 a.m.	process_identifier: 5260 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef40000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 25, 2021, 9:30 a.m.	process_identifier: 5260 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation (1 event)

Time & API	Arguments	Status	Return	Repeated
GetDiskFreeSpaceExW June 25, 2021, 9:30 a.m.	total_number_of_free_bytes: 0 free_bytes_available: 13294497792 root_path: C:\Users\test22\AppData\Local\Temp\7ZipSfx.000 total_number_of_bytes: 0	1	1	0

Steals private information from local Internet browsers (4 events)

file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local State
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Web Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Login Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Cookies

Creates executable files on the filesystem (4 events)

file	C:\Users\test22\AppData\Local\Temp\7ZipSfx.000\Colpo.exe.com
file	C:\Users\test22\AppData\Local\Temp\MAL2=B2.exe
file	C:\Users\test22\AppData\Roaming\IwYmHYautH\fGgpEbyayEcQ.js
file	C:\Users\test22\AppData\Roaming\IwYmHYautH\JQeFjQuDBz.exe.com

Creates a suspicious process (1 event)

cmdline

"C:\Windows\System32\cmd.exe" /c cmd < Come.adts

Drops a binary and executes it (2 events)

file	C:\Users\test22\AppData\Local\Temp\MAL2=B2.exe
file	C:\Users\test22\AppData\Local\Temp\7ZipSfx.000\Colpo.exe.com

Drops an executable to the user AppData folder (3 events)

file	C:\Users\test22\AppData\Local\Temp\7ZipSfx.000\Colpo.exe.com
file	C:\Users\test22\AppData\Local\Temp\MAL2=B2.exe
file	C:\Users\test22\AppData\Local\Temp\7ZipSfx.000\RegAsm.exe

A process created a hidden window (1 event)

Time & API	Arguments	Status	Return	Repeated
ShellExecuteExW June 25, 2021, 9:30 a.m.	show_type: 0 filepath_r: cmd parameters: /c cmd < Come.adts filepath: cmd	1	1	0

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses June 25, 2021, 9:30 a.m.	flags: 15 family: 0		111	0

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x001e0400', u'virtual_address': u'0x00011000', u'entropy': 7.997327567127519, u'name': u'.rsrc', u'virtual_size': u'0x001e0220'}

entropy

7.99732756713

description

A section with a high entropy has been found

entropy

0.996627756161

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 event)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW June 25, 2021, 9:30 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Potentially malicious URLs were found in the process memory dump (3 events)

url	http://www.microsoft.com/schemas/ie8tldlistdescription/1.0
url	http://purl.org/rss/1.0/
url	http://www.passport.com

Yara rule detected in process memory (32 events)

description	Communication using DGA	rule	Network_DGA
description	Communications use DNS	rule	Network_DNS
description	Communications over RAW Socket	rule	Network_TCP_Socket
description	Create a windows service	rule	Create_Service
description	Record Audio	rule	Sniff_Audio
description	Communications over HTTP	rule	Network_HTTP
description	Escalate priviledges	rule	Escalate_priviledges
description	Run a KeyLogger	rule	KeyLogger
description	Communications over FTP	rule	Network_FTP
description	Hijack network configuration	rule	Hijack_Network
description	Code injection with CreateRemoteThread in a remote process	rule	Code_injection
description	Match Windows Http API call	rule	Str_Win32_Http_API
description	Match Windows Inet API call	rule	Str_Win32_Internet_API
description	Steal credential	rule	local_credential_Steal
description	Take ScreenShot	rule	ScreenShot
description	File Downloader	rule	Network_Downloader
description	Communications over P2P network	rule	Network_P2P_Win
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerCheck__RemoteAPI
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	DebuggerException__ConsoleCtrl
description	(no description)	rule	DebuggerException__SetConsoleCtrl
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	(no description)	rule	Check_Dlls
description	Checks if being debugged	rule	anti_dbg
description	Anti-Sandbox checks for ThreatExpert	rule	antisb_threatExpert
description	Bypass DEP	rule	disable_dep
description	Affect hook table	rule	win_hook
description	Install itself for autorun at Windows startup	rule	Persistence

Queries for potentially installed applications (41 events)

Time & API	Arguments	Status
RegOpenKeyExW June 25, 2021, 9:30 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall base_handle: 0x80000002 key_handle: 0x000003e8 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall	1
RegOpenKeyExW June 25, 2021, 9:30 a.m.	regkey_r: 7-Zip base_handle: 0x000003e8 key_handle: 0x0000069c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\7-Zip	1
RegOpenKeyExW June 25, 2021, 9:30 a.m.	regkey_r: AddressBook base_handle: 0x000003e8 key_handle: 0x0000069c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook	1
RegOpenKeyExW June 25, 2021, 9:30 a.m.	regkey_r: Connection Manager base_handle: 0x000003e8 key_handle: 0x0000069c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager	1
RegOpenKeyExW June 25, 2021, 9:30 a.m.	regkey_r: DirectDrawEx base_handle: 0x000003e8 key_handle: 0x0000069c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx	1
RegOpenKeyExW June 25, 2021, 9:30 a.m.	regkey_r: EditPlus base_handle: 0x000003e8 key_handle: 0x0000069c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\EditPlus	1
RegOpenKeyExW June 25, 2021, 9:30 a.m.	regkey_r: ENTERPRISE base_handle: 0x000003e8 key_handle: 0x0000069c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\ENTERPRISE	1
RegOpenKeyExW June 25, 2021, 9:30 a.m.	regkey_r: Fontcore base_handle: 0x000003e8 key_handle: 0x0000069c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore	1
RegOpenKeyExW June 25, 2021, 9:30 a.m.	regkey_r: Google Chrome base_handle: 0x000003e8 key_handle: 0x0000069c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome	1
RegOpenKeyExW June 25, 2021, 9:30 a.m.	regkey_r: Haansoft HWord 80 Korean base_handle: 0x000003e8 key_handle: 0x0000069c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Haansoft HWord 80 Korean	1
RegOpenKeyExW June 25, 2021, 9:30 a.m.	regkey_r: IE40 base_handle: 0x000003e8 key_handle: 0x0000069c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE40	1
RegOpenKeyExW June 25, 2021, 9:30 a.m.	regkey_r: IE4Data base_handle: 0x000003e8 key_handle: 0x0000069c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data	1
RegOpenKeyExW June 25, 2021, 9:30 a.m.	regkey_r: IE5BAKEX base_handle: 0x000003e8 key_handle: 0x0000069c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX	1
RegOpenKeyExW June 25, 2021, 9:30 a.m.	regkey_r: IEData base_handle: 0x000003e8 key_handle: 0x0000069c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IEData	1
RegOpenKeyExW June 25, 2021, 9:30 a.m.	regkey_r: MobileOptionPack base_handle: 0x000003e8 key_handle: 0x0000069c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack	1
RegOpenKeyExW June 25, 2021, 9:30 a.m.	regkey_r: Mozilla Thunderbird 78.4.0 (x86 ko) base_handle: 0x000003e8 key_handle: 0x0000069c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Mozilla Thunderbird 78.4.0 (x86 ko)	1
RegOpenKeyExW June 25, 2021, 9:30 a.m.	regkey_r: SchedulingAgent base_handle: 0x000003e8 key_handle: 0x0000069c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent	1
RegOpenKeyExW June 25, 2021, 9:30 a.m.	regkey_r: WIC base_handle: 0x000003e8 key_handle: 0x0000069c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\WIC	1
RegOpenKeyExW June 25, 2021, 9:30 a.m.	regkey_r: {01B845D4-B73E-4CF7-A377-94BC7BB4F77B} base_handle: 0x000003e8 key_handle: 0x0000069c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{01B845D4-B73E-4CF7-A377-94BC7BB4F77B}	1
RegOpenKeyExW June 25, 2021, 9:30 a.m.	regkey_r: {1D91F7DA-F517-4727-9E62-B7EA978BE980} base_handle: 0x000003e8 key_handle: 0x0000069c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D91F7DA-F517-4727-9E62-B7EA978BE980}	1
RegOpenKeyExW June 25, 2021, 9:30 a.m.	regkey_r: {60EC980A-BDA2-4CB6-A427-B07A5498B4CA} base_handle: 0x000003e8 key_handle: 0x0000069c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}	1
RegOpenKeyExW June 25, 2021, 9:30 a.m.	regkey_r: {90120000-0015-0412-0000-0000000FF1CE} base_handle: 0x000003e8 key_handle: 0x0000069c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0015-0412-0000-0000000FF1CE}	1
RegOpenKeyExW June 25, 2021, 9:30 a.m.	regkey_r: {90120000-0016-0412-0000-0000000FF1CE} base_handle: 0x000003e8 key_handle: 0x0000069c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0016-0412-0000-0000000FF1CE}	1
RegOpenKeyExW June 25, 2021, 9:30 a.m.	regkey_r: {90120000-0018-0412-0000-0000000FF1CE} base_handle: 0x000003e8 key_handle: 0x0000069c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0018-0412-0000-0000000FF1CE}	1
RegOpenKeyExW June 25, 2021, 9:30 a.m.	regkey_r: {90120000-0019-0412-0000-0000000FF1CE} base_handle: 0x000003e8 key_handle: 0x0000069c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0019-0412-0000-0000000FF1CE}	1
RegOpenKeyExW June 25, 2021, 9:30 a.m.	regkey_r: {90120000-001A-0412-0000-0000000FF1CE} base_handle: 0x000003e8 key_handle: 0x0000069c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001A-0412-0000-0000000FF1CE}	1
RegOpenKeyExW June 25, 2021, 9:30 a.m.	regkey_r: {90120000-001B-0412-0000-0000000FF1CE} base_handle: 0x000003e8 key_handle: 0x0000069c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001B-0412-0000-0000000FF1CE}	1
RegOpenKeyExW June 25, 2021, 9:30 a.m.	regkey_r: {90120000-001F-0409-0000-0000000FF1CE} base_handle: 0x000003e8 key_handle: 0x0000069c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001F-0409-0000-0000000FF1CE}	1
RegOpenKeyExW June 25, 2021, 9:30 a.m.	regkey_r: {90120000-001F-0412-0000-0000000FF1CE} base_handle: 0x000003e8 key_handle: 0x0000069c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001F-0412-0000-0000000FF1CE}	1
RegOpenKeyExW June 25, 2021, 9:30 a.m.	regkey_r: {90120000-0028-0412-0000-0000000FF1CE} base_handle: 0x000003e8 key_handle: 0x0000069c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0028-0412-0000-0000000FF1CE}	1
RegOpenKeyExW June 25, 2021, 9:30 a.m.	regkey_r: {90120000-002C-0412-0000-0000000FF1CE} base_handle: 0x000003e8 key_handle: 0x0000069c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-002C-0412-0000-0000000FF1CE}	1
RegOpenKeyExW June 25, 2021, 9:30 a.m.	regkey_r: {90120000-0030-0000-0000-0000000FF1CE} base_handle: 0x000003e8 key_handle: 0x0000069c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0030-0000-0000-0000000FF1CE}	1
RegOpenKeyExW June 25, 2021, 9:30 a.m.	regkey_r: {90120000-0044-0412-0000-0000000FF1CE} base_handle: 0x000003e8 key_handle: 0x0000069c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0044-0412-0000-0000000FF1CE}	1
RegOpenKeyExW June 25, 2021, 9:30 a.m.	regkey_r: {90120000-006E-0409-0000-0000000FF1CE} base_handle: 0x000003e8 key_handle: 0x0000069c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-006E-0409-0000-0000000FF1CE}	1
RegOpenKeyExW June 25, 2021, 9:30 a.m.	regkey_r: {90120000-006E-0412-0000-0000000FF1CE} base_handle: 0x000003e8 key_handle: 0x0000069c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-006E-0412-0000-0000000FF1CE}	1
RegOpenKeyExW June 25, 2021, 9:30 a.m.	regkey_r: {90120000-00A1-0412-0000-0000000FF1CE} base_handle: 0x000003e8 key_handle: 0x0000069c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-00A1-0412-0000-0000000FF1CE}	1
RegOpenKeyExW June 25, 2021, 9:30 a.m.	regkey_r: {90120000-00BA-0409-0000-0000000FF1CE} base_handle: 0x000003e8 key_handle: 0x0000069c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-00BA-0409-0000-0000000FF1CE}	1
RegOpenKeyExW June 25, 2021, 9:30 a.m.	regkey_r: {90120000-0114-0412-0000-0000000FF1CE} base_handle: 0x000003e8 key_handle: 0x0000069c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0114-0412-0000-0000000FF1CE}	1
RegOpenKeyExW June 25, 2021, 9:30 a.m.	regkey_r: {939659F3-71D2-461F-B24D-91D05A4389B4} base_handle: 0x000003e8 key_handle: 0x0000069c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{939659F3-71D2-461F-B24D-91D05A4389B4}	1
RegOpenKeyExW June 25, 2021, 9:30 a.m.	regkey_r: {9B84A461-3B4C-40E2-B44F-CE22E215EE40} base_handle: 0x000003e8 key_handle: 0x0000069c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{9B84A461-3B4C-40E2-B44F-CE22E215EE40}	1
RegOpenKeyExW June 25, 2021, 9:30 a.m.	regkey_r: {d992c12e-cab2-426f-bde3-fb8c53950b0d} base_handle: 0x000003e8 key_handle: 0x0000069c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{d992c12e-cab2-426f-bde3-fb8c53950b0d}	1

Uses Windows utilities for basic Windows functionality (1 event)

cmdline

ping 127.0.0.1 -n 30

Executes one or more WMI queries which can be used to identify virtual machines (1 event)

wmi	SELECT * FROM Win32_Processor

One or more of the buffers contains an embedded PE file (2 events)

buffer	Buffer with sha1: bf739cfe26d2918b1012f121a4c6fdcc16161d3b
buffer	Buffer with sha1: 578cb23184c36c59951f300d81e9626d4c85073b

Communicates with host for which no DNS query was performed (2 events)

host	172.217.25.14
host	78.46.225.155

Allocates execute permission to another process indicative of possible code injection (1 event)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory June 25, 2021, 9:30 a.m.	process_identifier: 5260 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 122880 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000234	1	0	0

Installs itself for autorun at Windows startup (1 event)

file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\JQeFjQuDBz.url

Harvests credentials from local FTP client softwares (2 events)

file	C:\Users\test22\AppData\Roaming\FileZilla\sitemanager.xml
file	C:\Users\test22\AppData\Roaming\FileZilla\recentservers.xml

Executes one or more WMI queries (8 events)

wmi	SELECT * FROM AntivirusProduct
wmi	SELECT * FROM Win32_VideoController
wmi	SELECT * FROM Win32_OperatingSystem
wmi	SELECT * FROM Win32_Process Where SessionId='1'
wmi	SELECT * FROM AntiSpyWareProduct
wmi	SELECT * FROM FirewallProduct
wmi	SELECT * FROM Win32_DiskDrive
wmi	SELECT * FROM Win32_Processor

Potential code injection by writing to the memory of another process (1 event)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory June 25, 2021, 9:30 a.m.	buffer: ÿÿÿÿû~(ü~Pý~mèÿÿ jHâý~± base_address: 0x7efde000 process_identifier: 5260 process_handle: 0x00000234	1	1	0

Collects information about installed applications (29 events)

Time & API	Arguments	Status
RegQueryValueExW June 25, 2021, 9:30 a.m.	key_handle: 0x0000069c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: 7-Zip 20.02 alpha regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\7-Zip\DisplayName	1
RegQueryValueExW June 25, 2021, 9:30 a.m.	key_handle: 0x0000069c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: EditPlus regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\EditPlus\DisplayName	1
RegQueryValueExW June 25, 2021, 9:30 a.m.	key_handle: 0x0000069c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Enterprise 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\ENTERPRISE\DisplayName	1
RegQueryValueExW June 25, 2021, 9:30 a.m.	key_handle: 0x0000069c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Chrome regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome\DisplayName	1
RegQueryValueExW June 25, 2021, 9:30 a.m.	key_handle: 0x0000069c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: 한컴오피스 한글 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Haansoft HWord 80 Korean\DisplayName	1
RegQueryValueExW June 25, 2021, 9:30 a.m.	key_handle: 0x0000069c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Mozilla Thunderbird 78.4.0 (x86 ko) regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Mozilla Thunderbird 78.4.0 (x86 ko)\DisplayName	1
RegQueryValueExW June 25, 2021, 9:30 a.m.	key_handle: 0x0000069c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: HttpWatch Professional 9.3.39 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{01B845D4-B73E-4CF7-A377-94BC7BB4F77B}\DisplayName	1
RegQueryValueExW June 25, 2021, 9:30 a.m.	key_handle: 0x0000069c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: 한컴오피스 한글 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D91F7DA-F517-4727-9E62-B7EA978BE980}\DisplayName	1
RegQueryValueExW June 25, 2021, 9:30 a.m.	key_handle: 0x0000069c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Google Update Helper regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}\DisplayName	1
RegQueryValueExW June 25, 2021, 9:30 a.m.	key_handle: 0x0000069c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Access MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0015-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW June 25, 2021, 9:30 a.m.	key_handle: 0x0000069c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Excel MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0016-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW June 25, 2021, 9:30 a.m.	key_handle: 0x0000069c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office PowerPoint MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0018-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW June 25, 2021, 9:30 a.m.	key_handle: 0x0000069c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Publisher MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0019-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW June 25, 2021, 9:30 a.m.	key_handle: 0x0000069c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Outlook MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001A-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW June 25, 2021, 9:30 a.m.	key_handle: 0x0000069c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Word MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001B-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW June 25, 2021, 9:30 a.m.	key_handle: 0x0000069c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Proof (English) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001F-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW June 25, 2021, 9:30 a.m.	key_handle: 0x0000069c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Proof (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001F-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW June 25, 2021, 9:30 a.m.	key_handle: 0x0000069c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office IME (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0028-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW June 25, 2021, 9:30 a.m.	key_handle: 0x0000069c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Proofing (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-002C-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW June 25, 2021, 9:30 a.m.	key_handle: 0x0000069c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Enterprise 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0030-0000-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW June 25, 2021, 9:30 a.m.	key_handle: 0x0000069c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office InfoPath MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0044-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW June 25, 2021, 9:30 a.m.	key_handle: 0x0000069c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Shared MUI (English) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-006E-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW June 25, 2021, 9:30 a.m.	key_handle: 0x0000069c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Shared MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-006E-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW June 25, 2021, 9:30 a.m.	key_handle: 0x0000069c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office OneNote MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-00A1-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW June 25, 2021, 9:30 a.m.	key_handle: 0x0000069c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Groove MUI (English) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-00BA-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW June 25, 2021, 9:30 a.m.	key_handle: 0x0000069c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Groove Setup Metadata MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0114-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW June 25, 2021, 9:30 a.m.	key_handle: 0x0000069c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Adobe Flash Player 13 ActiveX regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{939659F3-71D2-461F-B24D-91D05A4389B4}\DisplayName	1
RegQueryValueExW June 25, 2021, 9:30 a.m.	key_handle: 0x0000069c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Adobe Flash Player 13 NPAPI regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{9B84A461-3B4C-40E2-B44F-CE22E215EE40}\DisplayName	1
RegQueryValueExW June 25, 2021, 9:30 a.m.	key_handle: 0x0000069c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Visual C++ 2015 Redistributable (x64) - 14.0.24215 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{d992c12e-cab2-426f-bde3-fb8c53950b0d}\DisplayName	1

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 3624 called NtSetContextThread to modify thread in remote process 5260
NtSetContextThread June 25, 2021, 9:30 a.m.	registers.eip: 2000355780 registers.esp: 2817556 registers.edi: 0 registers.eax: 1146662 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000228 process_identifier: 5260	1	0	0

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 8728 resumed a thread in remote process 5916
NtResumeThread June 25, 2021, 9:30 a.m.	thread_handle: 0x00000134 suspend_count: 0 process_identifier: 5916	1	0	0

Executed a process and injected code into it, probably while unpacking (25 events)

Time & API	Arguments	Status	Return
CreateProcessInternalW June 25, 2021, 9:30 a.m.	thread_identifier: 7688 thread_handle: 0x00000294 process_identifier: 8708 current_directory: C:\Users\test22\AppData\Local\Temp\ filepath: C:\Users\test22\AppData\Local\Temp\MAL2=B2.exe track: 1 command_line: "C:\Users\test22\AppData\Local\Temp\MAL2=B2.exe" filepath_r: C:\Users\test22\AppData\Local\Temp\MAL2=B2.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x000002a4	1	1
NtResumeThread June 25, 2021, 9:30 a.m.	thread_handle: 0x00000294 suspend_count: 1 process_identifier: 8708	1	0
CreateProcessInternalW June 25, 2021, 9:30 a.m.	thread_identifier: 7636 thread_handle: 0x000002b8 process_identifier: 6928 current_directory: C:\Users\test22\AppData\Local\Temp\7ZipSfx.000 filepath: C:\Windows\System32\cmd.exe track: 1 command_line: "C:\Windows\System32\cmd.exe" /c cmd < Come.adts filepath_r: C:\Windows\System32\cmd.exe stack_pivoted: 0 creation_flags: 67634176 (CREATE_DEFAULT_ERROR_MODE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x000002c0	1	1
CreateProcessInternalW June 25, 2021, 9:30 a.m.	thread_identifier: 8324 thread_handle: 0x0000012c process_identifier: 8728 current_directory: C:\Users\test22\AppData\Local\Temp\7ZipSfx.000 filepath: C:\Windows\System32\cmd.exe track: 1 command_line: cmd filepath_r: C:\Windows\system32\cmd.exe stack_pivoted: 0 creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x00000130	1	1
CreateProcessInternalW June 25, 2021, 9:30 a.m.	thread_identifier: 6952 thread_handle: 0x00000130 process_identifier: 3800 current_directory: C:\Users\test22\AppData\Local\Temp\7ZipSfx.000 filepath: C:\Windows\System32\findstr.exe track: 1 command_line: findstr /V /R "^QqLDXfcyKJYyHpHVvlCPncSYWcwwCqrPmVAsmUDNqkdJxkOiNHJrJWOcoNHChzDKGoGMIfvCHOPjtoEKGUgUdZyDuypLjqAGI$" Trasse.adts filepath_r: C:\Windows\system32\findstr.exe stack_pivoted: 0 creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x00000138	1	1
CreateProcessInternalW June 25, 2021, 9:30 a.m.	thread_identifier: 3700 thread_handle: 0x00000134 process_identifier: 5916 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\7ZipSfx.000\Colpo.exe.com track: 1 command_line: Colpo.exe.com U filepath_r: C:\Users\test22\AppData\Local\Temp\7ZipSfx.000\Colpo.exe.com stack_pivoted: 0 creation_flags: 525328 (CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x00000138	1	1
NtResumeThread June 25, 2021, 9:30 a.m.	thread_handle: 0x00000134 suspend_count: 0 process_identifier: 5916	1	0
CreateProcessInternalW June 25, 2021, 9:30 a.m.	thread_identifier: 5888 thread_handle: 0x00000138 process_identifier: 6892 current_directory: C:\Users\test22\AppData\Local\Temp\7ZipSfx.000 filepath: C:\Windows\System32\PING.EXE track: 1 command_line: ping 127.0.0.1 -n 30 filepath_r: C:\Windows\system32\PING.EXE stack_pivoted: 0 creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x00000134	1	1
CreateProcessInternalW June 25, 2021, 9:30 a.m.	thread_identifier: 4792 thread_handle: 0x0000014c process_identifier: 3624 current_directory: C:\Users\test22\AppData\Local\Temp\7ZipSfx.000 filepath: track: 1 command_line: C:\Users\test22\AppData\Local\Temp\7ZipSfx.000\Colpo.exe.com U filepath_r: stack_pivoted: 0 creation_flags: 0 () inherit_handles: 0 process_handle: 0x00000150	1	1
NtResumeThread June 25, 2021, 9:30 a.m.	thread_handle: 0x00000180 suspend_count: 1 process_identifier: 6892	1	0
CreateProcessInternalW June 25, 2021, 9:30 a.m.	thread_identifier: 4608 thread_handle: 0x00000228 process_identifier: 5260 current_directory: filepath: track: 1 command_line: C:\Users\test22\AppData\Local\Temp\7ZipSfx.000\RegAsm.exe filepath_r: stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000234	1	1
NtGetContextThread June 25, 2021, 9:30 a.m.	thread_handle: 0x00000228	1	0
NtAllocateVirtualMemory June 25, 2021, 9:30 a.m.	process_identifier: 5260 region_size: 122880 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 4 (PAGE_READWRITE) base_address: 0x00100000 allocation_type: 12289 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000234	1	0
WriteProcessMemory June 25, 2021, 9:30 a.m.	buffer: base_address: 0x00100000 process_identifier: 5260 process_handle: 0x00000234	1	1
WriteProcessMemory June 25, 2021, 9:30 a.m.	buffer: ÿÿÿÿû~(ü~Pý~mèÿÿ jHâý~± base_address: 0x7efde000 process_identifier: 5260 process_handle: 0x00000234	1	1
NtSetContextThread June 25, 2021, 9:30 a.m.	registers.eip: 2000355780 registers.esp: 2817556 registers.edi: 0 registers.eax: 1146662 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000228 process_identifier: 5260	1	0
NtResumeThread June 25, 2021, 9:30 a.m.	thread_handle: 0x00000178 suspend_count: 1 process_identifier: 5260	1	0
NtResumeThread June 25, 2021, 9:30 a.m.	thread_handle: 0x000001f0 suspend_count: 1 process_identifier: 5260	1	0
NtResumeThread June 25, 2021, 9:30 a.m.	thread_handle: 0x00000230 suspend_count: 1 process_identifier: 5260	1	0
NtResumeThread June 25, 2021, 9:30 a.m.	thread_handle: 0x000003c8 suspend_count: 1 process_identifier: 5260	1	0
NtResumeThread June 25, 2021, 9:30 a.m.	thread_handle: 0x000003a0 suspend_count: 1 process_identifier: 5260	1	0
NtResumeThread June 25, 2021, 9:30 a.m.	thread_handle: 0x00000280 suspend_count: 1 process_identifier: 5260	1	0
NtGetContextThread June 25, 2021, 9:30 a.m.	thread_handle: 0x0000017c	1	0
NtGetContextThread June 25, 2021, 9:30 a.m.	thread_handle: 0x0000017c	1	0
NtResumeThread June 25, 2021, 9:30 a.m.	thread_handle: 0x0000017c suspend_count: 1 process_identifier: 5260	1	0

File has been identified by 58 AntiVirus engines on VirusTotal as malicious (50 out of 58 events)

Bkav	W32.AIDetect.malware2
Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.MSIL.Injector.MF
FireEye	Generic.mg.9f105a70f86071d3
CAT-QuickHeal	TrojanDropper.Small.PQ4
McAfee	GenericRXAC-LG!9F105A70F860
Cylance	Unsafe
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Backdoor ( 0040f6fb1 )
Alibaba	Backdoor:Win32/Poison.49588cdb
K7GW	Trojan ( 0047fb211 )
CrowdStrike	win/malicious_confidence_100% (W)
Baidu	Win32.Trojan-Dropper.Small.o
Cyren	W32/GenTroj.S.gen!Eldorado
Symantec	Trojan.Dropper!g1
ESET-NOD32	Win32/TrojanDropper.Small.NMM
APEX	Malicious
Avast	Win32:GenMalicious-NUS [Trj]
ClamAV	Win.Trojan.Poison-8692
Kaspersky	Backdoor.Win32.Poison.ggrf
BitDefender	Trojan.MSIL.Injector.MF
NANO-Antivirus	Trojan.Win32.Poison.cbeljp
Paloalto	generic.ml
ViRobot	Backdoor.Win32.Agent.67584.L
Tencent	Malware.Win32.Gencirc.10b3e7f9
Ad-Aware	Trojan.MSIL.Injector.MF
Emsisoft	Trojan.MSIL.Injector.MF (B)
Comodo	TrojWare.Win32.Ransom.Xorist.ET@4mg4hg
DrWeb	Trojan.MulDrop8.22787
VIPRE	Detect.Trojan.Win32.Small.nmm (v)
TrendMicro	TROJ_VBINDER.SM
McAfee-GW-Edition	GenericRXAC-LG!9F105A70F860
Sophos	ML/PE-A + Troj/Vbinder-D
SentinelOne	Static AI - Suspicious PE
Jiangmin	Backdoor/Poison.abtg
eGambit	Unsafe.AI_Score_94%
Avira	HEUR/AGEN.1140785
Microsoft	VirTool:Win32/Vbinder
Gridinsoft	Backdoor.Win32.Dropper.bot!s1
Arcabit	Trojan.MSIL.Injector.MF
AegisLab	Trojan.Win32.Poison.tnhw
GData	Win32.Trojan-Dropper.Agent.AMY
Cynet	Malicious (score: 100)
AhnLab-V3	Backdoor/Win32.Poison.R72119
Acronis	suspicious
BitDefenderTheta	AI:Packer.9B9580F51F
MAX	malware (ai score=100)
VBA32	Backdoor.Poison
Malwarebytes	Bladabindi.Backdoor.Njrat.DDS
TrendMicro-HouseCall	TROJ_VBINDER.SM

moonitor-setup.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All