Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	July 8, 2021, 5:06 p.m.	July 8, 2021, 5:10 p.m.

Size	409.5KB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`2117808b6a0ded968c7f8f05c44e928a`
SHA256	`607995b16cd6300fde94e5613d5c708331f0e7b2b91ea6210a0f6b3a5cbdf64f`
CRC32	`7B912EC4`
ssdeep	`12288:40l2MJpjoRafuVY6t9Mawdbi/vI+mvJ2:4utoRzyKVwyvbmR`
Yara	Generic_Malware_Zero - Generic Malware Is_DotNET_EXE - (no description) IsPE32 - (no description) PDF_Format_Z - PDF Format PE_Header_Zero - PE File Signature

ConsoleApp17.exe "C:\Users\test22\AppData\Local\Temp\ConsoleApp17.exe"
2444
- wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\test22\AppData\Local\Temp\_Fcfawtnttqigza.vbs"
  2928
  - powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ExclusionPath C:\,'C:\Users\test22\AppData\Roaming\notapad.exe'
    2140
- ConsoleApp17.exe C:\Users\test22\AppData\Local\Temp\ConsoleApp17.exe
  3008

Name	Response	Post-Analysis Lookup
www.schedule.group		199.59.242.153
www.radiodigitalgroup.com	CNAME radiodigitalgroup.com A 34.102.136.180	34.102.136.180

IP Address	Status	Action
164.124.101.2	Active	Moloch
34.102.136.180	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (6 events)

Time & API	Arguments	Status	Return
GetComputerNameW July 8, 2021, 5:07 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 8, 2021, 5:07 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 8, 2021, 5:07 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 8, 2021, 5:07 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA July 8, 2021, 5:07 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 8, 2021, 5:07 p.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (3 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent July 8, 2021, 5:06 p.m.			0	0
IsDebuggerPresent July 8, 2021, 5:06 p.m.			0	0
IsDebuggerPresent July 8, 2021, 5:07 p.m.			0	0

Command line console output was observed (9 events)

Time & API	Arguments	Status	Return
WriteConsoleW July 8, 2021, 5:07 p.m.	buffer: The term 'Set-MpPreference' is not recognized as the name of a cmdlet, function console_handle: 0x00000023	1	1
WriteConsoleW July 8, 2021, 5:07 p.m.	buffer: , script file, or operable program. Check the spelling of the name, or if a pat console_handle: 0x0000002f	1	1
WriteConsoleW July 8, 2021, 5:07 p.m.	buffer: h was included, verify that the path is correct and try again. console_handle: 0x0000003b	1	1
WriteConsoleW July 8, 2021, 5:07 p.m.	buffer: At line:1 char:17 console_handle: 0x00000047	1	1
WriteConsoleW July 8, 2021, 5:07 p.m.	buffer: + Set-MpPreference <<<< -ExclusionPath C:\,'C:\Users\test22\AppData\Roaming\no console_handle: 0x00000053	1	1
WriteConsoleW July 8, 2021, 5:07 p.m.	buffer: tapad.exe' console_handle: 0x0000005f	1	1
WriteConsoleW July 8, 2021, 5:07 p.m.	buffer: + CategoryInfo : ObjectNotFound: (Set-MpPreference:String) [], Co console_handle: 0x0000006b	1	1
WriteConsoleW July 8, 2021, 5:07 p.m.	buffer: mmandNotFoundException console_handle: 0x00000077	1	1
WriteConsoleW July 8, 2021, 5:07 p.m.	buffer: + FullyQualifiedErrorId : CommandNotFoundException console_handle: 0x00000083	1	1

Uses Windows APIs to generate a cryptographic key (49 events)

Time & API	Arguments	Status	Return
CryptExportKey July 8, 2021, 5:06 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00436458 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 8, 2021, 5:06 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00435e98 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 8, 2021, 5:06 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00435e98 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 8, 2021, 5:07 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0079f878 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 8, 2021, 5:07 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0079fdf8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 8, 2021, 5:07 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0079fdf8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 8, 2021, 5:07 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0079fdf8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 8, 2021, 5:07 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0079f938 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 8, 2021, 5:07 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0079f938 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 8, 2021, 5:07 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0079f938 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 8, 2021, 5:07 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0079f938 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 8, 2021, 5:07 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0079f938 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 8, 2021, 5:07 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0079f938 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 8, 2021, 5:07 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0079fcf8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 8, 2021, 5:07 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0079fcf8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 8, 2021, 5:07 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0079fcf8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 8, 2021, 5:07 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0079fbb8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 8, 2021, 5:07 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0079fbb8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 8, 2021, 5:07 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0079fbb8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 8, 2021, 5:07 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0079fff8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 8, 2021, 5:07 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0079fbb8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 8, 2021, 5:07 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0079fbb8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 8, 2021, 5:07 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0079fbb8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 8, 2021, 5:07 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0079fbb8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 8, 2021, 5:07 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0079fbb8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 8, 2021, 5:07 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0079fbb8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 8, 2021, 5:07 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0079fbb8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 8, 2021, 5:07 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x007a0178 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 8, 2021, 5:07 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x007a0178 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 8, 2021, 5:07 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x007a0178 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 8, 2021, 5:07 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x007a0178 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 8, 2021, 5:07 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x007a0178 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 8, 2021, 5:07 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x007a0178 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 8, 2021, 5:07 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x007a0178 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 8, 2021, 5:07 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x007a0178 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 8, 2021, 5:07 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x007a0178 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 8, 2021, 5:07 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x007a0178 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 8, 2021, 5:07 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x007a0178 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 8, 2021, 5:07 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x007a0178 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 8, 2021, 5:07 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x007a0178 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 8, 2021, 5:07 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x007a0178 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 8, 2021, 5:07 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x007a00b8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 8, 2021, 5:07 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x007a00b8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 8, 2021, 5:07 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x007a00b8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 8, 2021, 5:07 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x007a00b8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 8, 2021, 5:07 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x007a00b8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 8, 2021, 5:07 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x007a00b8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 8, 2021, 5:07 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x007a00b8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 8, 2021, 5:07 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x007a00b8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx July 8, 2021, 5:06 p.m.		1	1	0

One or more processes crashed (4 events)

Time & API	Arguments	Status
__exception__ July 8, 2021, 5:07 p.m.	stacktrace: K32EnumProcessModules+0x18 RegisterApplicationRestart-0x1be kernel32+0x3b37e @ 0x75b5b37e 0x438aba5 0x438ab1a 0x438826d 0x43879b3 0x4380453 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x74082652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7409264f LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x74101838 LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x74101737 mscorlib+0x2d36ad @ 0x727d36ad mscorlib+0x308f2d @ 0x72808f2d mscorlib+0x3135ed @ 0x728135ed 0x9d0c93 0x9d0b86 0x9d08ab system+0x1f9799 @ 0x71159799 system+0x1f92c8 @ 0x711592c8 system+0x1eca74 @ 0x7114ca74 system+0x1ec868 @ 0x7114c868 system+0x1f82b8 @ 0x711582b8 system+0x1ee54d @ 0x7114e54d system+0x1f70ea @ 0x711570ea system+0x1e56c0 @ 0x711456c0 system+0x1f8215 @ 0x71158215 system+0x1f6f75 @ 0x71156f75 system+0x1ee251 @ 0x7114e251 system+0x1ee229 @ 0x7114e229 system+0x1ee170 @ 0x7114e170 0x54a08e gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x75dc62fa GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x75dc6d3a GetThreadDesktop+0x185 GetWindowLongW-0x216 user32+0x16de8 @ 0x75dc6de8 GetThreadDesktop+0x1e1 GetWindowLongW-0x1ba user32+0x16e44 @ 0x75dc6e44 KiUserCallbackDispatcher+0x2e KiUserExceptionDispatcher-0x1a ntdll+0x1011a @ 0x7777011a system+0x1ebc85 @ 0x7114bc85 system+0x1f683b @ 0x7115683b system+0x1a5e44 @ 0x71105e44 system+0x1fd8a0 @ 0x7115d8a0 system+0x1fd792 @ 0x7115d792 system+0x1a14bd @ 0x711014bd 0x9d007a DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x74082652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7409264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x74092e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x741474ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x74147610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x741d1dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x741d1e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x741d1f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x741d416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7472f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x749b7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x749b4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77799ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77799ea5 exception.instruction_r: 89 04 91 c7 45 fc fe ff ff ff ff 45 10 81 7d 10 exception.symbol: K32EnumProcessModules+0x113 RegisterApplicationRestart-0xc3 kernel32+0x3b479 exception.instruction: mov dword ptr [ecx + edx*4], eax exception.module: KERNEL32.dll exception.exception_code: 0xc0000005 exception.offset: 242809 exception.address: 0x75b5b479 registers.esp: 3598012 registers.edi: 1978982344 registers.eax: 12386304 registers.ebp: 3598216 registers.edx: 0 registers.ebx: 0 registers.esi: 1 registers.ecx: 0	1
__exception__ July 8, 2021, 5:07 p.m.	stacktrace: K32EnumProcessModules+0x18 RegisterApplicationRestart-0x1be kernel32+0x3b37e @ 0x75b5b37e 0x438aba5 0x438ab1a 0x438826d 0x43879b3 0x4380453 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x74082652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7409264f LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x74101838 LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x74101737 mscorlib+0x2d36ad @ 0x727d36ad mscorlib+0x308f2d @ 0x72808f2d mscorlib+0x3135ed @ 0x728135ed 0x9d0c93 0x9d0b86 0x9d08ab system+0x1f9799 @ 0x71159799 system+0x1f92c8 @ 0x711592c8 system+0x1eca74 @ 0x7114ca74 system+0x1ec868 @ 0x7114c868 system+0x1f82b8 @ 0x711582b8 system+0x1ee54d @ 0x7114e54d system+0x1f70ea @ 0x711570ea system+0x1e56c0 @ 0x711456c0 system+0x1f8215 @ 0x71158215 system+0x1f6f75 @ 0x71156f75 system+0x1ee251 @ 0x7114e251 system+0x1ee229 @ 0x7114e229 system+0x1ee170 @ 0x7114e170 0x54a08e gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x75dc62fa GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x75dc6d3a GetThreadDesktop+0x185 GetWindowLongW-0x216 user32+0x16de8 @ 0x75dc6de8 GetThreadDesktop+0x1e1 GetWindowLongW-0x1ba user32+0x16e44 @ 0x75dc6e44 KiUserCallbackDispatcher+0x2e KiUserExceptionDispatcher-0x1a ntdll+0x1011a @ 0x7777011a system+0x1ebc85 @ 0x7114bc85 system+0x1f683b @ 0x7115683b system+0x1a5e44 @ 0x71105e44 system+0x1fd8a0 @ 0x7115d8a0 system+0x1fd792 @ 0x7115d792 system+0x1a14bd @ 0x711014bd 0x9d007a DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x74082652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7409264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x74092e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x741474ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x74147610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x741d1dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x741d1e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x741d1f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x741d416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7472f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x749b7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x749b4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77799ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77799ea5 exception.instruction_r: 89 04 91 c7 45 fc fe ff ff ff ff 45 10 81 7d 10 exception.symbol: K32EnumProcessModules+0x113 RegisterApplicationRestart-0xc3 kernel32+0x3b479 exception.instruction: mov dword ptr [ecx + edx*4], eax exception.module: KERNEL32.dll exception.exception_code: 0xc0000005 exception.offset: 242809 exception.address: 0x75b5b479 registers.esp: 3598012 registers.edi: 1978982344 registers.eax: 1245184 registers.ebp: 3598216 registers.edx: 0 registers.ebx: 0 registers.esi: 1 registers.ecx: 0	1
__exception__ July 8, 2021, 5:07 p.m.	stacktrace: K32EnumProcessModules+0x18 RegisterApplicationRestart-0x1be kernel32+0x3b37e @ 0x75b5b37e 0x438aba5 0x438ab1a 0x438826d 0x43879b3 0x4380453 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x74082652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7409264f LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x74101838 LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x74101737 mscorlib+0x2d36ad @ 0x727d36ad mscorlib+0x308f2d @ 0x72808f2d mscorlib+0x3135ed @ 0x728135ed 0x9d0c93 0x9d0b86 0x9d08ab system+0x1f9799 @ 0x71159799 system+0x1f92c8 @ 0x711592c8 system+0x1eca74 @ 0x7114ca74 system+0x1ec868 @ 0x7114c868 system+0x1f82b8 @ 0x711582b8 system+0x1ee54d @ 0x7114e54d system+0x1f70ea @ 0x711570ea system+0x1e56c0 @ 0x711456c0 system+0x1f8215 @ 0x71158215 system+0x1f6f75 @ 0x71156f75 system+0x1ee251 @ 0x7114e251 system+0x1ee229 @ 0x7114e229 system+0x1ee170 @ 0x7114e170 0x54a08e gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x75dc62fa GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x75dc6d3a GetThreadDesktop+0x185 GetWindowLongW-0x216 user32+0x16de8 @ 0x75dc6de8 GetThreadDesktop+0x1e1 GetWindowLongW-0x1ba user32+0x16e44 @ 0x75dc6e44 KiUserCallbackDispatcher+0x2e KiUserExceptionDispatcher-0x1a ntdll+0x1011a @ 0x7777011a system+0x1ebc85 @ 0x7114bc85 system+0x1f683b @ 0x7115683b system+0x1a5e44 @ 0x71105e44 system+0x1fd8a0 @ 0x7115d8a0 system+0x1fd792 @ 0x7115d792 system+0x1a14bd @ 0x711014bd 0x9d007a DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x74082652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7409264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x74092e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x741474ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x74147610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x741d1dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x741d1e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x741d1f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x741d416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7472f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x749b7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x749b4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77799ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77799ea5 exception.instruction_r: 89 04 91 c7 45 fc fe ff ff ff ff 45 10 81 7d 10 exception.symbol: K32EnumProcessModules+0x113 RegisterApplicationRestart-0xc3 kernel32+0x3b479 exception.instruction: mov dword ptr [ecx + edx*4], eax exception.module: KERNEL32.dll exception.exception_code: 0xc0000005 exception.offset: 242809 exception.address: 0x75b5b479 registers.esp: 3598012 registers.edi: 1978982344 registers.eax: 12386304 registers.ebp: 3598216 registers.edx: 0 registers.ebx: 0 registers.esi: 1 registers.ecx: 0	1
__exception__ July 8, 2021, 5:07 p.m.	stacktrace: K32EnumProcessModules+0x18 RegisterApplicationRestart-0x1be kernel32+0x3b37e @ 0x75b5b37e 0x438aba5 0x438ab1a 0x438826d 0x43879b3 0x4380453 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x74082652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7409264f LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x74101838 LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x74101737 mscorlib+0x2d36ad @ 0x727d36ad mscorlib+0x308f2d @ 0x72808f2d mscorlib+0x3135ed @ 0x728135ed 0x9d0c93 0x9d0b86 0x9d08ab system+0x1f9799 @ 0x71159799 system+0x1f92c8 @ 0x711592c8 system+0x1eca74 @ 0x7114ca74 system+0x1ec868 @ 0x7114c868 system+0x1f82b8 @ 0x711582b8 system+0x1ee54d @ 0x7114e54d system+0x1f70ea @ 0x711570ea system+0x1e56c0 @ 0x711456c0 system+0x1f8215 @ 0x71158215 system+0x1f6f75 @ 0x71156f75 system+0x1ee251 @ 0x7114e251 system+0x1ee229 @ 0x7114e229 system+0x1ee170 @ 0x7114e170 0x54a08e gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x75dc62fa GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x75dc6d3a GetThreadDesktop+0x185 GetWindowLongW-0x216 user32+0x16de8 @ 0x75dc6de8 GetThreadDesktop+0x1e1 GetWindowLongW-0x1ba user32+0x16e44 @ 0x75dc6e44 KiUserCallbackDispatcher+0x2e KiUserExceptionDispatcher-0x1a ntdll+0x1011a @ 0x7777011a system+0x1ebc85 @ 0x7114bc85 system+0x1f683b @ 0x7115683b system+0x1a5e44 @ 0x71105e44 system+0x1fd8a0 @ 0x7115d8a0 system+0x1fd792 @ 0x7115d792 system+0x1a14bd @ 0x711014bd 0x9d007a DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x74082652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7409264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x74092e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x741474ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x74147610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x741d1dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x741d1e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x741d1f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x741d416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7472f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x749b7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x749b4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77799ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77799ea5 exception.instruction_r: 89 04 91 c7 45 fc fe ff ff ff ff 45 10 81 7d 10 exception.symbol: K32EnumProcessModules+0x113 RegisterApplicationRestart-0xc3 kernel32+0x3b479 exception.instruction: mov dword ptr [ecx + edx*4], eax exception.module: KERNEL32.dll exception.exception_code: 0xc0000005 exception.offset: 242809 exception.address: 0x75b5b479 registers.esp: 3598012 registers.edi: 1978982344 registers.eax: 1245184 registers.ebp: 3598216 registers.edx: 0 registers.ebx: 0 registers.esi: 1 registers.ecx: 0	1

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

HTTP traffic contains suspicious features which may be indicative of malware related traffic (1 event)

suspicious_features

GET method with no useragent header

suspicious_request

GET http://www.radiodigitalgroup.com/zymg/?EZX0x0=FcPYrthcRRKZFtaZW2MUypHTrhkCCkyPpasybCsDd6Hxuj0aWMOQa8WJObhtFCKIO1ZrpAzv&qL3=gdnLMPoHZ4

Performs some HTTP requests (1 event)

request

GET http://www.radiodigitalgroup.com/zymg/?EZX0x0=FcPYrthcRRKZFtaZW2MUypHTrhkCCkyPpasybCsDd6Hxuj0aWMOQa8WJObhtFCKIO1ZrpAzv&qL3=gdnLMPoHZ4

Allocates read-write-execute memory (usually to unpack itself) (50 out of 187 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory July 8, 2021, 5:06 p.m.	process_identifier: 2444 region_size: 1376256 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004e0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2021, 5:06 p.m.	process_identifier: 2444 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005f0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory July 8, 2021, 5:06 p.m.	process_identifier: 2444 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74081000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 8, 2021, 5:06 p.m.	process_identifier: 2444 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74082000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2021, 5:06 p.m.	process_identifier: 2444 region_size: 655360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00990000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2021, 5:06 p.m.	process_identifier: 2444 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x009f0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2021, 5:06 p.m.	process_identifier: 2444 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00532000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2021, 5:06 p.m.	process_identifier: 2444 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00565000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2021, 5:06 p.m.	process_identifier: 2444 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0056b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2021, 5:06 p.m.	process_identifier: 2444 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00567000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2021, 5:06 p.m.	process_identifier: 2444 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0054c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2021, 5:06 p.m.	process_identifier: 2444 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x009d0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2021, 5:06 p.m.	process_identifier: 2444 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0053a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2021, 5:06 p.m.	process_identifier: 2444 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0055a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2021, 5:06 p.m.	process_identifier: 2444 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00557000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2021, 5:06 p.m.	process_identifier: 2444 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0054a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory July 8, 2021, 5:06 p.m.	process_identifier: 2444 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x70ca2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2021, 5:06 p.m.	process_identifier: 2444 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00556000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2021, 5:06 p.m.	process_identifier: 2444 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0053c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2021, 5:06 p.m.	process_identifier: 2444 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0055b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2021, 5:06 p.m.	process_identifier: 2444 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x021bf000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2021, 5:06 p.m.	process_identifier: 2444 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x021b0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2021, 5:06 p.m.	process_identifier: 2444 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x009d1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2021, 5:06 p.m.	process_identifier: 2444 region_size: 28672 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x009d2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2021, 5:06 p.m.	process_identifier: 2444 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x009d9000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2021, 5:06 p.m.	process_identifier: 2444 region_size: 16384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x009da000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2021, 5:06 p.m.	process_identifier: 2444 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x009de000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2021, 5:06 p.m.	process_identifier: 2444 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0054d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2021, 5:06 p.m.	process_identifier: 2444 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x009df000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2021, 5:06 p.m.	process_identifier: 2444 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x021c0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2021, 5:06 p.m.	process_identifier: 2444 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0054e000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2021, 5:06 p.m.	process_identifier: 2444 region_size: 57344 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x021c1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2021, 5:06 p.m.	process_identifier: 2444 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x021cf000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2021, 5:06 p.m.	process_identifier: 2444 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04380000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2021, 5:06 p.m.	process_identifier: 2444 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04381000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2021, 5:06 p.m.	process_identifier: 2444 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0055c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2021, 5:06 p.m.	process_identifier: 2444 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04382000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2021, 5:06 p.m.	process_identifier: 2444 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04383000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2021, 5:06 p.m.	process_identifier: 2444 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04384000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2021, 5:06 p.m.	process_identifier: 2444 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x021b1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2021, 5:06 p.m.	process_identifier: 2444 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04385000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2021, 5:06 p.m.	process_identifier: 2444 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04386000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2021, 5:07 p.m.	process_identifier: 2444 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04387000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2021, 5:07 p.m.	process_identifier: 2444 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04388000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2021, 5:07 p.m.	process_identifier: 2444 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04389000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2021, 5:07 p.m.	process_identifier: 2444 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0438a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2021, 5:07 p.m.	process_identifier: 2444 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0054f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2021, 5:07 p.m.	process_identifier: 2444 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0438b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory July 8, 2021, 5:07 p.m.	process_identifier: 2928 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x70ca2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2021, 5:07 p.m.	process_identifier: 3008 region_size: 3158016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00c40000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1

Creates executable files on the filesystem (1 event)

file	C:\Users\test22\AppData\Local\Temp\_Fcfawtnttqigza.vbs

Creates a shortcut to an executable file (1 event)

file	C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk

Creates a suspicious process (2 events)

cmdline	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ExclusionPath C:\,'C:\Users\test22\AppData\Roaming\notapad.exe'
cmdline	powershell Set-MpPreference -ExclusionPath C:\,'C:\Users\test22\AppData\Roaming\notapad.exe'

Drops a binary and executes it (1 event)

file	C:\Users\test22\AppData\Local\Temp\_Fcfawtnttqigza.vbs

A process created a hidden window (1 event)

Time & API	Arguments	Status	Return	Repeated
ShellExecuteExW July 8, 2021, 5:07 p.m.	show_type: 0 filepath_r: powershell parameters: Set-MpPreference -ExclusionPath C:\,'C:\Users\test22\AppData\Roaming\notapad.exe' filepath: powershell	1	1	0

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x0005dc00', u'virtual_address': u'0x00002000', u'entropy': 7.98293622585401, u'name': u'.text', u'virtual_size': u'0x0005dbe4'}

entropy

7.98293622585

description

A section with a high entropy has been found

entropy

0.916870415648

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (3 events)

Time & API	Arguments	Status	Return
LookupPrivilegeValueW July 8, 2021, 5:06 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW July 8, 2021, 5:07 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW July 8, 2021, 5:07 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1

Potentially malicious URLs were found in the process memory dump (1 event)

url	http://www.nevrona.com/rave

Yara rule detected in process memory (7 events)

description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Bypass DEP	rule	disable_dep

Terminates another process (2 events)

Time & API	Arguments	Status	Return	Repeated
NtTerminateProcess July 8, 2021, 5:07 p.m.	status_code: 0xffffffff process_identifier: 2968 process_handle: 0x000003cc		0	0
NtTerminateProcess July 8, 2021, 5:07 p.m.	status_code: 0xffffffff process_identifier: 2968 process_handle: 0x000003cc	1	0	0

Allocates execute permission to another process indicative of possible code injection (2 events)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory July 8, 2021, 5:07 p.m.	process_identifier: 2968 region_size: 188416 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000294		3221225496	0
NtAllocateVirtualMemory July 8, 2021, 5:07 p.m.	process_identifier: 3008 region_size: 188416 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000029c	1	0	0

Installs itself for autorun at Windows startup (1 event)

reg_key

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\notapad

reg_value

"C:\Users\test22\AppData\Roaming\notapad.exe"

Manipulates memory of a non-child process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2444 manipulating memory of non-child process 2968
NtAllocateVirtualMemory July 8, 2021, 5:07 p.m.	process_identifier: 2968 region_size: 188416 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000294		3221225496	0

Potential code injection by writing to the memory of another process (2 events)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory July 8, 2021, 5:07 p.m.	buffer: MZERèXè ÈÀ<ÁÀ(ÿáÀº´ Í!¸LÍ!This program cannot be run in DOS mode. $«üêïf¹ïf¹ïf¹ôÍ¹©f¹ôø¹ìf¹ôû¹îf¹Richïf¹PEL*Ý4Hà Äpëà@à@.textÔÃÄ ` base_address: 0x00400000 process_identifier: 3008 process_handle: 0x0000029c	1	1	0
WriteProcessMemory July 8, 2021, 5:07 p.m.	buffer: @ base_address: 0x7efde008 process_identifier: 3008 process_handle: 0x0000029c	1	1	0

Code injection by writing an executable or DLL to the memory of another process (1 event)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory July 8, 2021, 5:07 p.m.	buffer: MZERèXè ÈÀ<ÁÀ(ÿáÀº´ Í!¸LÍ!This program cannot be run in DOS mode. $«üêïf¹ïf¹ïf¹ôÍ¹©f¹ôø¹ìf¹ôû¹îf¹Richïf¹PEL*Ý4Hà Äpëà@à@.textÔÃÄ ` base_address: 0x00400000 process_identifier: 3008 process_handle: 0x0000029c	1	1	0

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2444 called NtSetContextThread to modify thread in remote process 3008
NtSetContextThread July 8, 2021, 5:07 p.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4320112 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x000003cc process_identifier: 3008	1	0	0

One or more non-whitelisted processes were created (2 events)

parent_process	wscript.exe				martian_process	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ExclusionPath C:\,'C:\Users\test22\AppData\Roaming\notapad.exe'
parent_process	wscript.exe				martian_process	powershell Set-MpPreference -ExclusionPath C:\,'C:\Users\test22\AppData\Roaming\notapad.exe'

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2444 resumed a thread in remote process 3008
NtResumeThread July 8, 2021, 5:07 p.m.	thread_handle: 0x000003cc suspend_count: 1 process_identifier: 3008	1	0	0

File has been identified by 23 AntiVirus engines on VirusTotal as malicious (23 events)

Elastic	malicious (high confidence)
FireEye	Generic.mg.2117808b6a0ded96
Alibaba	Trojan:MSIL/GenKryptik.45c8be88
BitDefenderTheta	Gen:NN.ZemsilF.34790.zm0@aOw9ohb
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of MSIL/Kryptik.ABVV
APEX	Malicious
Paloalto	generic.ml
Kaspersky	UDS:DangerousObject.Multi.Generic
Avast	Win32:CrypterX-gen [Trj]
McAfee-GW-Edition	BehavesLike.Win32.Generic.gc
Sophos	ML/PE-A
SentinelOne	Static AI - Malicious PE
Kingsoft	Win32.Troj.Undef.(kcloud)
Microsoft	Trojan:MSIL/AgentTesla.CJ!MTB
Cynet	Malicious (score: 100)
McAfee	Artemis!2117808B6A0D
Malwarebytes	Trojan.MalPack
Ikarus	Win32.Outbreak
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	MSIL/Kryptik.ABRS!tr
AVG	Win32:CrypterX-gen [Trj]
CrowdStrike	win/malicious_confidence_90% (W)

Executed a process and injected code into it, probably while unpacking (20 events)

Time & API	Arguments	Status	Return
NtResumeThread July 8, 2021, 5:06 p.m.	thread_handle: 0x000000dc suspend_count: 1 process_identifier: 2444	1	0
NtResumeThread July 8, 2021, 5:06 p.m.	thread_handle: 0x00000150 suspend_count: 1 process_identifier: 2444	1	0
NtResumeThread July 8, 2021, 5:06 p.m.	thread_handle: 0x0000018c suspend_count: 1 process_identifier: 2444	1	0
CreateProcessInternalW July 8, 2021, 5:07 p.m.	thread_identifier: 2932 thread_handle: 0x000003f4 process_identifier: 2928 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\wscript.exe track: 1 command_line: "C:\Windows\System32\WScript.exe" "C:\Users\test22\AppData\Local\Temp\_Fcfawtnttqigza.vbs" filepath_r: C:\Windows\System32\WScript.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x000003e8	1	1
CreateProcessInternalW July 8, 2021, 5:07 p.m.	thread_identifier: 2972 thread_handle: 0x000003f8 process_identifier: 2968 current_directory: filepath: track: 1 command_line: C:\Users\test22\AppData\Local\Temp\ConsoleApp17.exe filepath_r: stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000294	1	1
NtGetContextThread July 8, 2021, 5:07 p.m.	thread_handle: 0x000003f8	1	0
NtAllocateVirtualMemory July 8, 2021, 5:07 p.m.	process_identifier: 2968 region_size: 188416 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000294		3221225496
CreateProcessInternalW July 8, 2021, 5:07 p.m.	thread_identifier: 3012 thread_handle: 0x000003cc process_identifier: 3008 current_directory: filepath: track: 1 command_line: C:\Users\test22\AppData\Local\Temp\ConsoleApp17.exe filepath_r: stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x0000029c	1	1
NtGetContextThread July 8, 2021, 5:07 p.m.	thread_handle: 0x000003cc	1	0
NtAllocateVirtualMemory July 8, 2021, 5:07 p.m.	process_identifier: 3008 region_size: 188416 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000029c	1	0
WriteProcessMemory July 8, 2021, 5:07 p.m.	buffer: MZERèXè ÈÀ<ÁÀ(ÿáÀº´ Í!¸LÍ!This program cannot be run in DOS mode. $«üêïf¹ïf¹ïf¹ôÍ¹©f¹ôø¹ìf¹ôû¹îf¹Richïf¹PEL*Ý4Hà Äpëà@à@.textÔÃÄ ` base_address: 0x00400000 process_identifier: 3008 process_handle: 0x0000029c	1	1
WriteProcessMemory July 8, 2021, 5:07 p.m.	buffer: base_address: 0x00401000 process_identifier: 3008 process_handle: 0x0000029c	1	1
WriteProcessMemory July 8, 2021, 5:07 p.m.	buffer: @ base_address: 0x7efde008 process_identifier: 3008 process_handle: 0x0000029c	1	1
NtSetContextThread July 8, 2021, 5:07 p.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4320112 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x000003cc process_identifier: 3008	1	0
NtResumeThread July 8, 2021, 5:07 p.m.	thread_handle: 0x000003cc suspend_count: 1 process_identifier: 3008	1	0
CreateProcessInternalW July 8, 2021, 5:07 p.m.	thread_identifier: 196 thread_handle: 0x000002dc process_identifier: 2140 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe track: 1 command_line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ExclusionPath C:\,'C:\Users\test22\AppData\Roaming\notapad.exe' filepath_r: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x000002f0	1	1
NtResumeThread July 8, 2021, 5:07 p.m.	thread_handle: 0x00000294 suspend_count: 1 process_identifier: 2140	1	0
NtResumeThread July 8, 2021, 5:07 p.m.	thread_handle: 0x000002e8 suspend_count: 1 process_identifier: 2140	1	0
NtResumeThread July 8, 2021, 5:07 p.m.	thread_handle: 0x00000434 suspend_count: 1 process_identifier: 2140	1	0
NtResumeThread July 8, 2021, 5:07 p.m.	thread_handle: 0x00000494 suspend_count: 1 process_identifier: 2140	1	0

The processes wscript.exe, powershell.exe wrote an executable file to disk which it then attempted to execute (21 events)

file	C:\Windows\SysWOW64\wscript.exe
file	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
file	C:\Windows\System32\ie4uinit.exe
file	C:\Program Files\Windows Sidebar\sidebar.exe
file	C:\Windows\System32\WindowsAnytimeUpgradeUI.exe
file	C:\Windows\System32\xpsrchvw.exe
file	C:\Windows\System32\displayswitch.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe
file	C:\Windows\System32\mblctr.exe
file	C:\Windows\System32\mstsc.exe
file	C:\Windows\System32\SnippingTool.exe
file	C:\Windows\System32\SoundRecorder.exe
file	C:\Windows\System32\dfrgui.exe
file	C:\Windows\System32\msinfo32.exe
file	C:\Windows\System32\rstrui.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe
file	C:\Program Files\Windows Journal\Journal.exe
file	C:\Windows\System32\MdSched.exe
file	C:\Windows\System32\msconfig.exe
file	C:\Windows\System32\recdisc.exe
file	C:\Windows\System32\msra.exe

ConsoleApp17.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All