Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	July 4, 2021, 6:16 p.m.	July 4, 2021, 6:24 p.m.

Size	1.2MB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`932957d14a082c94d068b5d810e98aae`
SHA256	`c739936172e49a599f88374f7555839c4ad5a11c8dcecc4a0287eb88c633aa3b`
CRC32	`FD01E23C`
ssdeep	`24576:+VTisMEMS/bM9jnNkO6J6Wu5AwzS3gB1/VdiX8wQcQrVvjhOP:+1VZzu5AaS30VVdiScQrRW`
Yara	PE_Header_Zero - PE File Signature anti_vm_detect - Possibly employs anti-virtualization techniques Is_DotNET_EXE - (no description) IsPE32 - (no description) themida_packer - themida packer

file7.exe "C:\Users\test22\AppData\Local\Temp\file7.exe"
2088

Name	Response	Post-Analysis Lookup
zedaumalev.xyz	A 77.246.145.4	77.246.145.4

IP Address	Status	Action
164.124.101.2	Active	Moloch
77.246.145.4	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent July 4, 2021, 6:16 p.m.			0	0
IsDebuggerPresent July 4, 2021, 6:16 p.m.			0	0

Uses Windows APIs to generate a cryptographic key (3 events)

Time & API	Arguments	Status	Return
CryptExportKey July 4, 2021, 6:16 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0038c3e0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 4, 2021, 6:16 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0038c3e0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 4, 2021, 6:16 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0038c460 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx July 4, 2021, 6:16 p.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (4 events)

section
section	eer1* Ca
section	.themida
section	.boot

One or more processes crashed (3 events)

Time & API	Arguments	Status
__exception__ July 4, 2021, 6:16 p.m.	stacktrace: file7+0x416135 @ 0xf86135 file7+0x4161d2 @ 0xf861d2 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc e9 69 ab 3a 8a 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008e exception.offset: 46887 exception.address: 0x76a7b727 registers.esp: 3276360 registers.edi: 14000128 registers.eax: 3276360 registers.ebp: 3276440 registers.edx: 2130566132 registers.ebx: 32 registers.esi: 2000778283 registers.ecx: 4040163328	1
__exception__ July 4, 2021, 6:16 p.m.	stacktrace: exception.instruction_r: ed 64 8f 05 00 00 00 00 83 c4 04 e9 2e e0 e6 ff exception.symbol: file7+0x447011 exception.instruction: in eax, dx exception.module: file7.exe exception.exception_code: 0xc0000096 exception.offset: 4485137 exception.address: 0xfb7011 registers.esp: 3276480 registers.edi: 14844601 registers.eax: 1750617430 registers.ebp: 14000128 registers.edx: 3430486 registers.ebx: 0 registers.esi: 14856270 registers.ecx: 20	1
__exception__ July 4, 2021, 6:16 p.m.	stacktrace: exception.instruction_r: ed 64 8f 05 00 00 00 00 83 c4 04 81 fb 68 58 4d exception.symbol: file7+0x447085 exception.instruction: in eax, dx exception.module: file7.exe exception.exception_code: 0xc0000096 exception.offset: 4485253 exception.address: 0xfb7085 registers.esp: 3276480 registers.edi: 14844601 registers.eax: 1447909480 registers.ebp: 14000128 registers.edx: 22104 registers.ebx: 2256917605 registers.esi: 14856270 registers.ecx: 10	1

Allocates read-write-execute memory (usually to unpack itself) (50 out of 124 events)

Time & API	Arguments	Status
NtProtectVirtualMemory July 4, 2021, 6:16 p.m.	process_identifier: 2088 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7574c000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 4, 2021, 6:16 p.m.	process_identifier: 2088 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a84000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 4, 2021, 6:16 p.m.	process_identifier: 2088 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7574a000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 4, 2021, 6:16 p.m.	process_identifier: 2088 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75735000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 4, 2021, 6:16 p.m.	process_identifier: 2088 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a7b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 4, 2021, 6:16 p.m.	process_identifier: 2088 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75731000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 4, 2021, 6:16 p.m.	process_identifier: 2088 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a7b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 4, 2021, 6:16 p.m.	process_identifier: 2088 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75737000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 4, 2021, 6:16 p.m.	process_identifier: 2088 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a7e000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 4, 2021, 6:16 p.m.	process_identifier: 2088 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75731000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 4, 2021, 6:16 p.m.	process_identifier: 2088 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a7d000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 4, 2021, 6:16 p.m.	process_identifier: 2088 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75734000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 4, 2021, 6:16 p.m.	process_identifier: 2088 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7575c000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 4, 2021, 6:16 p.m.	process_identifier: 2088 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a7b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 4, 2021, 6:16 p.m.	process_identifier: 2088 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7575d000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 4, 2021, 6:16 p.m.	process_identifier: 2088 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a7c000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 4, 2021, 6:16 p.m.	process_identifier: 2088 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75733000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 4, 2021, 6:16 p.m.	process_identifier: 2088 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a81000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 4, 2021, 6:16 p.m.	process_identifier: 2088 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7574a000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 4, 2021, 6:16 p.m.	process_identifier: 2088 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7574c000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 4, 2021, 6:16 p.m.	process_identifier: 2088 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75734000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 4, 2021, 6:16 p.m.	process_identifier: 2088 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a7b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 4, 2021, 6:16 p.m.	process_identifier: 2088 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75731000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 4, 2021, 6:16 p.m.	process_identifier: 2088 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a7d000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 4, 2021, 6:16 p.m.	process_identifier: 2088 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75735000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 4, 2021, 6:16 p.m.	process_identifier: 2088 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75734000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 4, 2021, 6:16 p.m.	process_identifier: 2088 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a7d000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 4, 2021, 6:16 p.m.	process_identifier: 2088 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75731000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 4, 2021, 6:16 p.m.	process_identifier: 2088 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a7d000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 4, 2021, 6:16 p.m.	process_identifier: 2088 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75735000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 4, 2021, 6:16 p.m.	process_identifier: 2088 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75731000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 4, 2021, 6:16 p.m.	process_identifier: 2088 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a7b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 4, 2021, 6:16 p.m.	process_identifier: 2088 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x755bf000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 4, 2021, 6:16 p.m.	process_identifier: 2088 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x755c8000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 4, 2021, 6:16 p.m.	process_identifier: 2088 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75734000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 4, 2021, 6:16 p.m.	process_identifier: 2088 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a81000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 4, 2021, 6:16 p.m.	process_identifier: 2088 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7574c000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 4, 2021, 6:16 p.m.	process_identifier: 2088 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a81000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 4, 2021, 6:16 p.m.	process_identifier: 2088 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75733000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 4, 2021, 6:16 p.m.	process_identifier: 2088 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a81000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 4, 2021, 6:16 p.m.	process_identifier: 2088 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75731000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 4, 2021, 6:16 p.m.	process_identifier: 2088 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a81000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 4, 2021, 6:16 p.m.	process_identifier: 2088 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75734000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 4, 2021, 6:16 p.m.	process_identifier: 2088 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a88000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 4, 2021, 6:16 p.m.	process_identifier: 2088 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75731000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 4, 2021, 6:16 p.m.	process_identifier: 2088 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a88000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 4, 2021, 6:16 p.m.	process_identifier: 2088 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7575c000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 4, 2021, 6:16 p.m.	process_identifier: 2088 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a88000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 4, 2021, 6:16 p.m.	process_identifier: 2088 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75735000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 4, 2021, 6:16 p.m.	process_identifier: 2088 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a88000 process_handle: 0xffffffff	1

A process attempted to delay the analysis task. (1 event)

description

file7.exe tried to sleep 185 seconds, actually delayed analysis time by 185 seconds

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses July 4, 2021, 6:16 p.m.	flags: 15 family: 0		111	0

The binary likely contains encrypted or compressed data indicative of a packer (5 events)

section

{u'size_of_data': u'0x00014e00', u'virtual_address': u'0x00002000', u'entropy': 7.997141345380042, u'name': u' ', u'virtual_size': u'0x00034000'}

entropy

7.99714134538

description

A section with a high entropy has been found

section

{u'size_of_data': u'0x00022400', u'virtual_address': u'0x00036000', u'entropy': 7.998748522883235, u'name': u' ', u'virtual_size': u'0x00194d4c'}

entropy

7.99874852288

description

A section with a high entropy has been found

section

{u'size_of_data': u'0x00019800', u'virtual_address': u'0x001d0000', u'entropy': 7.997195529274346, u'name': u'eer1* Ca', u'virtual_size': u'0x00019800'}

entropy

7.99719552927

description

A section with a high entropy has been found

section

{u'size_of_data': u'0x000d0000', u'virtual_address': u'0x00474000', u'entropy': 7.961992552888943, u'name': u'.boot', u'virtual_size': u'0x000d0000'}

entropy

7.96199255289

description

A section with a high entropy has been found

entropy

0.918091451292

description

Overall entropy of this PE file is high

Checks for the presence of known windows from debuggers and forensic tools (50 out of 159 events)

Time & API	Arguments	Status	Return	Repeated
FindWindowA July 4, 2021, 6:16 p.m.	class_name: RegmonClass window_name:		0	0
FindWindowA July 4, 2021, 6:16 p.m.	class_name: RegmonClass window_name:		0	0
FindWindowA July 4, 2021, 6:16 p.m.	class_name: Registry Monitor - Sysinternals: www.sysinternals.com window_name:		0	0
FindWindowA July 4, 2021, 6:16 p.m.	class_name: 18467-41 window_name:		0	0
FindWindowA July 4, 2021, 6:16 p.m.	class_name: FilemonClass window_name:		0	0
FindWindowA July 4, 2021, 6:16 p.m.	class_name: FilemonClass window_name:		0	0
FindWindowA July 4, 2021, 6:16 p.m.	class_name: File Monitor - Sysinternals: www.sysinternals.com window_name:		0	0
FindWindowA July 4, 2021, 6:16 p.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA July 4, 2021, 6:16 p.m.	class_name: Process Monitor - Sysinternals: www.sysinternals.com window_name:		0	0
FindWindowA July 4, 2021, 6:16 p.m.	class_name: Regmonclass window_name:		0	0
FindWindowA July 4, 2021, 6:16 p.m.	class_name: Regmonclass window_name:		0	0
FindWindowA July 4, 2021, 6:16 p.m.	class_name: 18467-41 window_name:		0	0
FindWindowA July 4, 2021, 6:16 p.m.	class_name: Filemonclass window_name:		0	0
FindWindowA July 4, 2021, 6:16 p.m.	class_name: Filemonclass window_name:		0	0
FindWindowA July 4, 2021, 6:16 p.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA July 4, 2021, 6:16 p.m.	class_name: Regmonclass window_name:		0	0
FindWindowA July 4, 2021, 6:16 p.m.	class_name: Regmonclass window_name:		0	0
FindWindowA July 4, 2021, 6:16 p.m.	class_name: 18467-41 window_name:		0	0
FindWindowA July 4, 2021, 6:16 p.m.	class_name: Filemonclass window_name:		0	0
FindWindowA July 4, 2021, 6:16 p.m.	class_name: Filemonclass window_name:		0	0
FindWindowA July 4, 2021, 6:16 p.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA July 4, 2021, 6:16 p.m.	class_name: Regmonclass window_name:		0	0
FindWindowA July 4, 2021, 6:16 p.m.	class_name: Regmonclass window_name:		0	0
FindWindowA July 4, 2021, 6:16 p.m.	class_name: 18467-41 window_name:		0	0
FindWindowA July 4, 2021, 6:16 p.m.	class_name: Filemonclass window_name:		0	0
FindWindowA July 4, 2021, 6:16 p.m.	class_name: Filemonclass window_name:		0	0
FindWindowA July 4, 2021, 6:16 p.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA July 4, 2021, 6:16 p.m.	class_name: Regmonclass window_name:		0	0
FindWindowA July 4, 2021, 6:16 p.m.	class_name: Regmonclass window_name:		0	0
FindWindowA July 4, 2021, 6:16 p.m.	class_name: 18467-41 window_name:		0	0
FindWindowA July 4, 2021, 6:16 p.m.	class_name: Filemonclass window_name:		0	0
FindWindowA July 4, 2021, 6:16 p.m.	class_name: Filemonclass window_name:		0	0
FindWindowA July 4, 2021, 6:16 p.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA July 4, 2021, 6:16 p.m.	class_name: Regmonclass window_name:		0	0
FindWindowA July 4, 2021, 6:16 p.m.	class_name: Regmonclass window_name:		0	0
FindWindowA July 4, 2021, 6:16 p.m.	class_name: 18467-41 window_name:		0	0
FindWindowA July 4, 2021, 6:16 p.m.	class_name: Filemonclass window_name:		0	0
FindWindowA July 4, 2021, 6:16 p.m.	class_name: Filemonclass window_name:		0	0
FindWindowA July 4, 2021, 6:16 p.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA July 4, 2021, 6:16 p.m.	class_name: Regmonclass window_name:		0	0
FindWindowA July 4, 2021, 6:16 p.m.	class_name: Regmonclass window_name:		0	0
FindWindowA July 4, 2021, 6:16 p.m.	class_name: 18467-41 window_name:		0	0
FindWindowA July 4, 2021, 6:16 p.m.	class_name: Filemonclass window_name:		0	0
FindWindowA July 4, 2021, 6:16 p.m.	class_name: Filemonclass window_name:		0	0
FindWindowA July 4, 2021, 6:16 p.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA July 4, 2021, 6:16 p.m.	class_name: Regmonclass window_name:		0	0
FindWindowA July 4, 2021, 6:16 p.m.	class_name: Regmonclass window_name:		0	0
FindWindowA July 4, 2021, 6:16 p.m.	class_name: 18467-41 window_name:		0	0
FindWindowA July 4, 2021, 6:16 p.m.	class_name: Filemonclass window_name:		0	0
FindWindowA July 4, 2021, 6:16 p.m.	class_name: Filemonclass window_name:		0	0

Checks the version of Bios, possibly for anti-virtualization (2 events)

registry	HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion
registry	HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion

Detects Virtual Machines through their custom firmware (1 event)

Time & API	Arguments	Status	Return	Repeated
NtQuerySystemInformation July 4, 2021, 6:16 p.m.	information_class: 76 (SystemFirmwareTableInformation)		3221225507	0

Detects VMWare through the in instruction feature (1 event)

Time & API	Arguments	Status	Return	Repeated
__exception__ July 4, 2021, 6:16 p.m.	stacktrace: exception.instruction_r: ed 64 8f 05 00 00 00 00 83 c4 04 81 fb 68 58 4d exception.symbol: file7+0x447085 exception.instruction: in eax, dx exception.module: file7.exe exception.exception_code: 0xc0000096 exception.offset: 4485253 exception.address: 0xfb7085 registers.esp: 3276480 registers.edi: 14844601 registers.eax: 1447909480 registers.ebp: 14000128 registers.edx: 22104 registers.ebx: 2256917605 registers.esi: 14856270 registers.ecx: 10	1	0	0

Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) (1 event)

dead_host

77.246.145.4:80

File has been identified by 31 AntiVirus engines on VirusTotal as malicious (31 events)

Bkav	W32.AIDetect.malware2
Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.Razy.886764
FireEye	Generic.mg.932957d14a082c94
Cylance	Unsafe
Sangfor	Trojan.Win32.Save.a
Cybereason	malicious.c4641a
Arcabit	Trojan.Jaik.D9AC1
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Avast	FileRepMetagen [Malware]
Kaspersky	UDS:Trojan-Spy.Win32.Stealer
BitDefender	Gen:Variant.Razy.886764
NANO-Antivirus	Virus.Win32.Gen-Crypt.ccnc
Rising	Trojan.Generic@ML.100 (RDML:f0sGMY/aqWoPsjYJEGbqsg)
Ad-Aware	Gen:Variant.Razy.886764
Sophos	ML/PE-A
Emsisoft	Gen:Variant.Razy.886764 (B)
Ikarus	Trojan.Win32.Themida
eGambit	Unsafe.AI_Score_99%
Gridinsoft	Trojan.Heur!.012100A1
Microsoft	Trojan:Win32/Emotet!ml
GData	Gen:Variant.Razy.886764
Cynet	Malicious (score: 100)
BitDefenderTheta	Gen:NN.ZexaF.34790.pH1@a4X2hlgO
MAX	malware (ai score=87)
VBA32	BScope.Trojan.Tasker
SentinelOne	Static AI - Suspicious PE
MaxSecure	Trojan.Malware.300983.susgen
AVG	FileRepMetagen [Malware]
Qihoo-360	HEUR/QVM19.1.577F.Malware.Gen

file7.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All