Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	June 25, 2021, 9:34 a.m.	June 25, 2021, 9:38 a.m.

Size	2.3MB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`c6f1fd934179d264115dd784f2e680b2`
SHA256	`687d7db5cef9442101d2ac4877e877dff168f1912b88eb20482aab67472a224e`
CRC32	`33CCA224`
ssdeep	`49152:p5+hF+xpTrg+j8wJpsIbYbEZR9TrHFT56SI0xiz8lVHTIioOFZQ+x:p5aF+xZzj8w/1Ys3I0xiqZ7x`
Yara	PE_Header_Zero - PE File Signature IsPE32 - (no description)

vpn_windows.exe "C:\Users\test22\AppData\Local\Temp\vpn_windows.exe"
5580
- cmd.exe cmd /c ""C:\Users\test22\AppData\Local\Temp\7ZipSfx.000\svchost.cmd" /S"
  4456
  - mode.com mode 65,10
    7232
  - 7z.exe 7z.exe e file.zip -p___________27812pwd19965pwd29127___________ -oextracted
    4232
  - 7z.exe 7z.exe e extracted/file_9.zip -oextracted
    8064
  - 7z.exe 7z.exe e extracted/file_8.zip -oextracted
    4960
  - 7z.exe 7z.exe e extracted/file_7.zip -oextracted
    2848
  - 7z.exe 7z.exe e extracted/file_6.zip -oextracted
    6200
  - 7z.exe 7z.exe e extracted/file_5.zip -oextracted
    7664
  - 7z.exe 7z.exe e extracted/file_4.zip -oextracted
    6764
  - 7z.exe 7z.exe e extracted/file_3.zip -oextracted
    4120
  - 7z.exe 7z.exe e extracted/file_2.zip -oextracted
    5260
  - 7z.exe 7z.exe e extracted/file_1.zip -oextracted
    8408
  - attrib.exe attrib +H "Downloader.exe"
    1036
  - Downloader.exe "Downloader.exe"
    4788
    - powershell.exe "powershell" Get-MpPreference -verbose
      4764

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
172.67.200.215	Active	Moloch
172.217.25.14	Active	Moloch
178.47.141.153	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (8 events)

Time & API	Arguments	Status	Return
GetComputerNameA June 25, 2021, 9:35 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 25, 2021, 9:35 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 25, 2021, 9:34 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 25, 2021, 9:34 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 25, 2021, 9:34 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 25, 2021, 9:34 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA June 25, 2021, 9:34 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 25, 2021, 9:34 a.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (5 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent June 25, 2021, 9:34 a.m.			0	0
IsDebuggerPresent June 25, 2021, 9:34 a.m.			0	0
IsDebuggerPresent June 25, 2021, 9:35 a.m.			0	0
IsDebuggerPresent June 25, 2021, 9:35 a.m.			0	0
IsDebuggerPresent June 25, 2021, 9:34 a.m.			0	0

Command line console output was observed (6 events)

Time & API	Arguments	Status	Return
WriteConsoleW June 25, 2021, 9:27 a.m.	buffer: C:\Users\test22\AppData\Local\Temp\7ZipSfx.000> console_handle: 0x0000000000000007	1	1
WriteConsoleW June 25, 2021, 9:27 a.m.	buffer: cls console_handle: 0x0000000000000007	1	1
WriteConsoleW June 25, 2021, 9:27 a.m.	buffer: '■' is not recognized as an internal or external command, operable program or batch file. console_handle: 0x000000000000000b	1	1
WriteConsoleW June 25, 2021, 9:27 a.m.	buffer: 1 file(s) moved. console_handle: 0x0000000000000007	1	1
WriteConsoleW June 25, 2021, 9:27 a.m.	buffer: Launched 'Downloader.exe'. console_handle: 0x0000000000000007	1	1
WriteConsoleW June 25, 2021, 9:27 a.m.	buffer: Press any key to continue . . . console_handle: 0x0000000000000007	1	1

Uses Windows APIs to generate a cryptographic key (46 events)

Time & API	Arguments	Status	Return
CryptExportKey June 25, 2021, 9:34 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00665678 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 25, 2021, 9:34 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00665eb8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 25, 2021, 9:34 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00665eb8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 25, 2021, 9:34 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00665eb8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 25, 2021, 9:34 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006661f8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 25, 2021, 9:34 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006661f8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 25, 2021, 9:34 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006661f8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 25, 2021, 9:34 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006661f8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 25, 2021, 9:34 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006661f8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 25, 2021, 9:34 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006661f8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 25, 2021, 9:34 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00665d78 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 25, 2021, 9:34 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00665d78 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 25, 2021, 9:34 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00665d78 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 25, 2021, 9:34 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00665eb8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 25, 2021, 9:34 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00665eb8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 25, 2021, 9:34 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00665eb8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 25, 2021, 9:34 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006659b8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 25, 2021, 9:34 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00665eb8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 25, 2021, 9:34 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00665eb8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 25, 2021, 9:34 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00665eb8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 25, 2021, 9:34 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00665eb8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 25, 2021, 9:34 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00665eb8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 25, 2021, 9:34 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00665eb8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 25, 2021, 9:34 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00665eb8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 25, 2021, 9:34 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00665578 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 25, 2021, 9:34 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00665578 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 25, 2021, 9:34 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00665578 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 25, 2021, 9:34 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00665578 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 25, 2021, 9:34 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00665578 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 25, 2021, 9:34 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00665578 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 25, 2021, 9:34 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00665578 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 25, 2021, 9:34 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00665578 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 25, 2021, 9:34 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00665578 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 25, 2021, 9:34 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00665578 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 25, 2021, 9:34 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00665578 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 25, 2021, 9:34 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00665578 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 25, 2021, 9:34 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00665578 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 25, 2021, 9:34 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00665578 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 25, 2021, 9:34 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00665a78 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 25, 2021, 9:34 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00665a78 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 25, 2021, 9:34 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00665a78 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 25, 2021, 9:34 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00665a78 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 25, 2021, 9:34 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00665a78 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 25, 2021, 9:34 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00665a78 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 25, 2021, 9:34 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00665a78 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 25, 2021, 9:34 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00665a78 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx June 25, 2021, 9:34 a.m.		1	1	0

The executable uses a known packer (1 event)

packer

Armadillo v1.71

Allocates read-write-execute memory (usually to unpack itself) (50 out of 154 events)

Time & API	Arguments	Status
NtProtectVirtualMemory June 25, 2021, 9:34 a.m.	process_identifier: 5580 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73772000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 25, 2021, 9:34 a.m.	process_identifier: 4788 region_size: 458752 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004c0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 25, 2021, 9:34 a.m.	process_identifier: 4788 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004f0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory June 25, 2021, 9:34 a.m.	process_identifier: 4788 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6fba1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 25, 2021, 9:34 a.m.	process_identifier: 4788 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6fba2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 25, 2021, 9:34 a.m.	process_identifier: 4788 region_size: 1638400 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f40000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 25, 2021, 9:34 a.m.	process_identifier: 4788 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02090000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 25, 2021, 9:34 a.m.	process_identifier: 4788 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00672000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 25, 2021, 9:34 a.m.	process_identifier: 4788 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006a5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 25, 2021, 9:34 a.m.	process_identifier: 4788 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006ab000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 25, 2021, 9:34 a.m.	process_identifier: 4788 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006a7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 25, 2021, 9:34 a.m.	process_identifier: 4788 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0068c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 25, 2021, 9:34 a.m.	process_identifier: 4788 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01ef0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 25, 2021, 9:34 a.m.	process_identifier: 4788 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0067a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 25, 2021, 9:34 a.m.	process_identifier: 4788 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00696000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 25, 2021, 9:34 a.m.	process_identifier: 4788 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0069a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 25, 2021, 9:34 a.m.	process_identifier: 4788 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00697000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 25, 2021, 9:34 a.m.	process_identifier: 4764 region_size: 2162688 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a90000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 25, 2021, 9:34 a.m.	process_identifier: 4764 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02c60000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory June 25, 2021, 9:34 a.m.	process_identifier: 4764 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6e9f1000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 25, 2021, 9:34 a.m.	process_identifier: 4764 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0281a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory June 25, 2021, 9:34 a.m.	process_identifier: 4764 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6e9f2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 25, 2021, 9:34 a.m.	process_identifier: 4764 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02812000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 25, 2021, 9:34 a.m.	process_identifier: 4764 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02822000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 25, 2021, 9:34 a.m.	process_identifier: 4764 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02c61000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 25, 2021, 9:34 a.m.	process_identifier: 4764 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02c62000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 25, 2021, 9:34 a.m.	process_identifier: 4764 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0284a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 25, 2021, 9:34 a.m.	process_identifier: 4764 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02823000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 25, 2021, 9:34 a.m.	process_identifier: 4764 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02824000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 25, 2021, 9:34 a.m.	process_identifier: 4764 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0285b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 25, 2021, 9:34 a.m.	process_identifier: 4764 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02857000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 25, 2021, 9:34 a.m.	process_identifier: 4764 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0281b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 25, 2021, 9:34 a.m.	process_identifier: 4764 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02842000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 25, 2021, 9:34 a.m.	process_identifier: 4764 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02855000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 25, 2021, 9:34 a.m.	process_identifier: 4764 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02825000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 25, 2021, 9:34 a.m.	process_identifier: 4764 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0284c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 25, 2021, 9:34 a.m.	process_identifier: 4764 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02c30000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 25, 2021, 9:34 a.m.	process_identifier: 4764 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02826000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 25, 2021, 9:34 a.m.	process_identifier: 4764 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0285c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 25, 2021, 9:34 a.m.	process_identifier: 4764 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02843000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 25, 2021, 9:34 a.m.	process_identifier: 4764 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02844000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 25, 2021, 9:34 a.m.	process_identifier: 4764 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02845000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 25, 2021, 9:34 a.m.	process_identifier: 4764 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02846000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 25, 2021, 9:34 a.m.	process_identifier: 4764 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02847000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 25, 2021, 9:34 a.m.	process_identifier: 4764 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02848000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 25, 2021, 9:34 a.m.	process_identifier: 4764 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02849000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 25, 2021, 9:34 a.m.	process_identifier: 4764 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02d60000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 25, 2021, 9:34 a.m.	process_identifier: 4764 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02d61000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 25, 2021, 9:34 a.m.	process_identifier: 4764 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02d62000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 25, 2021, 9:34 a.m.	process_identifier: 4764 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02d63000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation (1 event)

Time & API	Arguments	Status	Return	Repeated
GetDiskFreeSpaceExW June 25, 2021, 9:34 a.m.	total_number_of_free_bytes: 0 free_bytes_available: 13293383680 root_path: C:\Users\test22\AppData\Local\Temp\7ZipSfx.000 total_number_of_bytes: 0	1	1	0

Creates executable files on the filesystem (4 events)

file	C:\Users\test22\AppData\Local\Temp\7ZipSfx.000\svchost.cmd
file	C:\Users\test22\AppData\Local\Temp\7ZipSfx.000\extracted\Downloader.exe
file	C:\Users\test22\AppData\Local\Temp\7ZipSfx.000\7z.dll
file	C:\Users\test22\AppData\Local\Temp\7ZipSfx.000\7z.exe

Creates a shortcut to an executable file (1 event)

file	C:\Users\test22\AppData\Local\Temp\7ZipSfx.000\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk

Creates a suspicious process (3 events)

cmdline	svchost.cmd /S
cmdline	"powershell" Get-MpPreference -verbose
cmdline	"C:\Users\test22\AppData\Local\Temp\7ZipSfx.000\svchost.cmd" /S

Drops a binary and executes it (1 event)

file	C:\Users\test22\AppData\Local\Temp\7ZipSfx.000\7z.exe

A process created a hidden window (2 events)

Time & API	Arguments	Status	Return	Repeated
ShellExecuteExW June 25, 2021, 9:34 a.m.	show_type: 0 filepath_r: svchost.cmd parameters: /S filepath: svchost.cmd	1	1	0
CreateProcessInternalW June 25, 2021, 9:34 a.m.	thread_identifier: 6324 thread_handle: 0x00000214 process_identifier: 4764 current_directory: C:\Users\test22\AppData\Local\Temp\7ZipSfx.000 filepath: track: 1 command_line: "powershell" Get-MpPreference -verbose filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 1 process_handle: 0x00000220	1	1	0

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses June 25, 2021, 9:34 a.m.	flags: 15 family: 0		111	0

Checks for the Locally Unique Identifier on the system for a suspicious privilege (31 events)

Time & API	Arguments	Status	Return
LookupPrivilegeValueW June 25, 2021, 9:27 a.m.	system_name: privilege_name: SeRestorePrivilege	1	1
LookupPrivilegeValueW June 25, 2021, 9:27 a.m.	system_name: privilege_name: SeSecurityPrivilege	1	1
LookupPrivilegeValueW June 25, 2021, 9:27 a.m.	system_name: privilege_name: SeSecurityPrivilege	1	1
LookupPrivilegeValueW June 25, 2021, 9:27 a.m.	system_name: privilege_name: SeRestorePrivilege	1	1
LookupPrivilegeValueW June 25, 2021, 9:27 a.m.	system_name: privilege_name: SeSecurityPrivilege	1	1
LookupPrivilegeValueW June 25, 2021, 9:27 a.m.	system_name: privilege_name: SeSecurityPrivilege	1	1
LookupPrivilegeValueW June 25, 2021, 9:27 a.m.	system_name: privilege_name: SeRestorePrivilege	1	1
LookupPrivilegeValueW June 25, 2021, 9:27 a.m.	system_name: privilege_name: SeSecurityPrivilege	1	1
LookupPrivilegeValueW June 25, 2021, 9:27 a.m.	system_name: privilege_name: SeSecurityPrivilege	1	1
LookupPrivilegeValueW June 25, 2021, 9:27 a.m.	system_name: privilege_name: SeRestorePrivilege	1	1
LookupPrivilegeValueW June 25, 2021, 9:27 a.m.	system_name: privilege_name: SeSecurityPrivilege	1	1
LookupPrivilegeValueW June 25, 2021, 9:27 a.m.	system_name: privilege_name: SeSecurityPrivilege	1	1
LookupPrivilegeValueW June 25, 2021, 9:27 a.m.	system_name: privilege_name: SeRestorePrivilege	1	1
LookupPrivilegeValueW June 25, 2021, 9:27 a.m.	system_name: privilege_name: SeSecurityPrivilege	1	1
LookupPrivilegeValueW June 25, 2021, 9:27 a.m.	system_name: privilege_name: SeSecurityPrivilege	1	1
LookupPrivilegeValueW June 25, 2021, 9:27 a.m.	system_name: privilege_name: SeRestorePrivilege	1	1
LookupPrivilegeValueW June 25, 2021, 9:27 a.m.	system_name: privilege_name: SeSecurityPrivilege	1	1
LookupPrivilegeValueW June 25, 2021, 9:27 a.m.	system_name: privilege_name: SeSecurityPrivilege	1	1
LookupPrivilegeValueW June 25, 2021, 9:27 a.m.	system_name: privilege_name: SeRestorePrivilege	1	1
LookupPrivilegeValueW June 25, 2021, 9:27 a.m.	system_name: privilege_name: SeSecurityPrivilege	1	1
LookupPrivilegeValueW June 25, 2021, 9:27 a.m.	system_name: privilege_name: SeSecurityPrivilege	1	1
LookupPrivilegeValueW June 25, 2021, 9:27 a.m.	system_name: privilege_name: SeRestorePrivilege	1	1
LookupPrivilegeValueW June 25, 2021, 9:27 a.m.	system_name: privilege_name: SeSecurityPrivilege	1	1
LookupPrivilegeValueW June 25, 2021, 9:27 a.m.	system_name: privilege_name: SeSecurityPrivilege	1	1
LookupPrivilegeValueW June 25, 2021, 9:27 a.m.	system_name: privilege_name: SeRestorePrivilege	1	1
LookupPrivilegeValueW June 25, 2021, 9:27 a.m.	system_name: privilege_name: SeSecurityPrivilege	1	1
LookupPrivilegeValueW June 25, 2021, 9:27 a.m.	system_name: privilege_name: SeSecurityPrivilege	1	1
LookupPrivilegeValueW June 25, 2021, 9:27 a.m.	system_name: privilege_name: SeRestorePrivilege	1	1
LookupPrivilegeValueW June 25, 2021, 9:27 a.m.	system_name: privilege_name: SeSecurityPrivilege	1	1
LookupPrivilegeValueW June 25, 2021, 9:27 a.m.	system_name: privilege_name: SeSecurityPrivilege	1	1
LookupPrivilegeValueW June 25, 2021, 9:34 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1

Yara rule detected in process memory (31 events)

description	Communication using DGA	rule	Network_DGA
description	Communications use DNS	rule	Network_DNS
description	Communications over RAW Socket	rule	Network_TCP_Socket
description	Create a windows service	rule	Create_Service
description	Record Audio	rule	Sniff_Audio
description	Communications over HTTP	rule	Network_HTTP
description	Escalate priviledges	rule	Escalate_priviledges
description	Run a KeyLogger	rule	KeyLogger
description	Communications over FTP	rule	Network_FTP
description	Code injection with CreateRemoteThread in a remote process	rule	Code_injection
description	Match Windows Http API call	rule	Str_Win32_Http_API
description	Match Windows Inet API call	rule	Str_Win32_Internet_API
description	Steal credential	rule	local_credential_Steal
description	Take ScreenShot	rule	ScreenShot
description	File Downloader	rule	Network_Downloader
description	Communications over P2P network	rule	Network_P2P_Win
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerCheck__RemoteAPI
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	DebuggerException__ConsoleCtrl
description	(no description)	rule	DebuggerException__SetConsoleCtrl
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	(no description)	rule	Check_Dlls
description	Checks if being debugged	rule	anti_dbg
description	Anti-Sandbox checks for ThreatExpert	rule	antisb_threatExpert
description	Bypass DEP	rule	disable_dep
description	Affect hook table	rule	win_hook
description	Install itself for autorun at Windows startup	rule	Persistence

Uses Windows utilities for basic Windows functionality (1 event)

cmdline

attrib +H "Downloader.exe"

Communicates with host for which no DNS query was performed (3 events)

host	172.67.200.215
host	172.217.25.14
host	178.47.141.153

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 4456 resumed a thread in remote process 4788
NtResumeThread June 25, 2021, 9:27 a.m.	thread_handle: 0x0000000000000068 suspend_count: 0 process_identifier: 4788	1	0	0

The process powershell.exe wrote an executable file to disk (20 events)

file	C:\Windows\System32\ie4uinit.exe
file	C:\Program Files\Windows Sidebar\sidebar.exe
file	C:\Windows\System32\WindowsAnytimeUpgradeUI.exe
file	C:\Windows\System32\xpsrchvw.exe
file	C:\Windows\System32\displayswitch.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe
file	C:\Windows\System32\mblctr.exe
file	C:\Windows\System32\mstsc.exe
file	C:\Windows\System32\SnippingTool.exe
file	C:\Windows\System32\SoundRecorder.exe
file	C:\Windows\System32\dfrgui.exe
file	C:\Windows\System32\msinfo32.exe
file	C:\Windows\System32\rstrui.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe
file	C:\Program Files\Windows Journal\Journal.exe
file	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
file	C:\Windows\System32\MdSched.exe
file	C:\Windows\System32\msconfig.exe
file	C:\Windows\System32\recdisc.exe
file	C:\Windows\System32\msra.exe

Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) (1 event)

dead_host

178.47.141.153:80

Disables Windows Security features (4 events)

description	attempts to modify windows defender policies	registry	HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection
description	attempts to modify windows defender policies	registry	HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware
description	attempts to modify windows defender policies	registry	HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable
description	attempts to modify windows defender policies	registry	HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring

File has been identified by 45 AntiVirus engines on VirusTotal as malicious (45 events)

Bkav	W32.AIDetect.malware2
DrWeb	Trojan.Starter.8002
MicroWorld-eScan	Trojan.GenericKD.46519428
FireEye	Generic.mg.c6f1fd934179d264
ALYac	Trojan.GenericKD.46519428
Sangfor	Spyware.MSIL.Stealer.ky
K7AntiVirus	Trojan ( 0057d71b1 )
Alibaba	TrojanSpy:MSIL/Stealer.6ecde3e7
K7GW	Trojan ( 0057d71b1 )
Cybereason	malicious.34179d
Arcabit	Trojan.Generic.D2C5D484
Cyren	W32/Trojan.RQVS-3760
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	BAT/TrojanDropper.Agent.NFZ
APEX	Malicious
Avast	Win32:Trojan-gen
ClamAV	Win.Malware.Bulz-9866401-0
Kaspersky	Trojan-Spy.MSIL.Stealer.bnp
BitDefender	Trojan.GenericKD.46519428
Paloalto	generic.ml
AegisLab	Trojan.MSIL.Stealer.l!c
Ad-Aware	Trojan.GenericKD.46519428
Emsisoft	Trojan.GenericKD.46519428 (B)
F-Secure	Trojan.TR/Drop.Agent.uunku
VIPRE	Trojan.Win32.Generic!BT
McAfee-GW-Edition	BehavesLike.Win32.Generic.vc
Sophos	Mal/Generic-S
Ikarus	Trojan-Dropper.BAT.Agent
Jiangmin	Trojan/CoinMiner.ab.a
Avira	TR/Drop.Agent.uunku
Kingsoft	Win32.Troj.Undef.(kcloud)
Microsoft	Trojan:Win32/Tnega!ml
ZoneAlarm	Trojan-Spy.MSIL.Stealer.bnp
GData	Trojan.GenericKD.46519428
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win.Generic.R425592
McAfee	Artemis!C6F1FD934179
VBA32	Trojan.Hesv
Malwarebytes	Trojan.Dropper
TrendMicro-HouseCall	TROJ_GEN.R002H0DFJ21
MAX	malware (ai score=100)
Fortinet	BAT/Reline.BPP!tr
AVG	Win32:Trojan-gen
Panda	Trj/CI.A
CrowdStrike	win/malicious_confidence_70% (W)

vpn_windows.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All