Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	July 12, 2021, 9:39 a.m.	July 12, 2021, 9:46 a.m.

Size	1.2MB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`6e23d791b07e987b4329a0f076133cd1`
SHA256	`edd5a3dc519a5feacea84473ade885844e72b8165a93a91871928330bde659e7`
CRC32	`3FFBFB98`
ssdeep	`24576:3fX3E1VT9A34QOX6eCBoRdlPxnhSqbCyppVWcXn1oFBkNYvO2u+QGO8r2b1slrw:3/0TTc4QCAmmqbCKVWmqFJvh7Xamy`
Yara	PE_Header_Zero - PE File Signature IsPE32 - (no description) Is_DotNET_EXE - (no description) themida_packer - themida packer

jop.exe "C:\Users\test22\AppData\Local\Temp\jop.exe"
1116

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
164.124.101.2	Active	Moloch
185.215.113.81	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent July 12, 2021, 9:39 a.m.			0	0
IsDebuggerPresent July 12, 2021, 9:39 a.m.			0	0

Uses Windows APIs to generate a cryptographic key (3 events)

Time & API	Arguments	Status	Return
CryptExportKey July 12, 2021, 9:39 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0055e2b8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 12, 2021, 9:39 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0055e2b8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 12, 2021, 9:39 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0055e338 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx July 12, 2021, 9:39 a.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (4 events)

section
section	eer1* Ca
section	.themida
section	.boot

One or more processes crashed (3 events)

Time & API	Arguments	Status
__exception__ July 12, 2021, 9:39 a.m.	stacktrace: jop+0x40f269 @ 0x176f269 jop+0x40f306 @ 0x176f306 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc e9 e3 b1 b9 8a 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008e exception.offset: 46887 exception.address: 0x76a7b727 registers.esp: 2620568 registers.edi: 22323200 registers.eax: 2620568 registers.ebp: 2620648 registers.edx: 2130566132 registers.ebx: 0 registers.esi: 2000778283 registers.ecx: 4039114752	1
__exception__ July 12, 2021, 9:39 a.m.	stacktrace: exception.instruction_r: ed 64 8f 05 00 00 00 00 83 c4 04 e9 c1 b8 e7 ff exception.symbol: jop+0x43fd9a exception.instruction: in eax, dx exception.module: jop.exe exception.exception_code: 0xc0000096 exception.offset: 4455834 exception.address: 0x179fd9a registers.esp: 2620688 registers.edi: 23169862 registers.eax: 1750617430 registers.ebp: 22323200 registers.edx: 22614 registers.ebx: 20316160 registers.esi: 13 registers.ecx: 20	1
__exception__ July 12, 2021, 9:39 a.m.	stacktrace: exception.instruction_r: ed 64 8f 05 00 00 00 00 83 c4 04 81 fb 68 58 4d exception.symbol: jop+0x43fe0e exception.instruction: in eax, dx exception.module: jop.exe exception.exception_code: 0xc0000096 exception.offset: 4455950 exception.address: 0x179fe0e registers.esp: 2620688 registers.edi: 23169862 registers.eax: 1447909480 registers.ebp: 22323200 registers.edx: 22104 registers.ebx: 2256917605 registers.esi: 13 registers.ecx: 10	1

Allocates read-write-execute memory (usually to unpack itself) (50 out of 124 events)

Time & API	Arguments	Status
NtProtectVirtualMemory July 12, 2021, 9:39 a.m.	process_identifier: 1116 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75731000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 12, 2021, 9:39 a.m.	process_identifier: 1116 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a7d000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 12, 2021, 9:39 a.m.	process_identifier: 1116 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75735000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 12, 2021, 9:39 a.m.	process_identifier: 1116 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a7c000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 12, 2021, 9:39 a.m.	process_identifier: 1116 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75731000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 12, 2021, 9:39 a.m.	process_identifier: 1116 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a81000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 12, 2021, 9:39 a.m.	process_identifier: 1116 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75733000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 12, 2021, 9:39 a.m.	process_identifier: 1116 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a8b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 12, 2021, 9:39 a.m.	process_identifier: 1116 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75735000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 12, 2021, 9:39 a.m.	process_identifier: 1116 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a8b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 12, 2021, 9:39 a.m.	process_identifier: 1116 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75734000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 12, 2021, 9:39 a.m.	process_identifier: 1116 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a81000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 12, 2021, 9:39 a.m.	process_identifier: 1116 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7574c000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 12, 2021, 9:39 a.m.	process_identifier: 1116 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a81000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 12, 2021, 9:39 a.m.	process_identifier: 1116 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75733000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 12, 2021, 9:39 a.m.	process_identifier: 1116 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a81000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 12, 2021, 9:39 a.m.	process_identifier: 1116 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75731000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 12, 2021, 9:39 a.m.	process_identifier: 1116 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a81000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 12, 2021, 9:39 a.m.	process_identifier: 1116 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75733000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 12, 2021, 9:39 a.m.	process_identifier: 1116 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a81000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 12, 2021, 9:39 a.m.	process_identifier: 1116 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75731000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 12, 2021, 9:39 a.m.	process_identifier: 1116 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a7d000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 12, 2021, 9:39 a.m.	process_identifier: 1116 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75734000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 12, 2021, 9:39 a.m.	process_identifier: 1116 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7575c000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 12, 2021, 9:39 a.m.	process_identifier: 1116 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a7b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 12, 2021, 9:39 a.m.	process_identifier: 1116 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7575d000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 12, 2021, 9:39 a.m.	process_identifier: 1116 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a7c000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 12, 2021, 9:39 a.m.	process_identifier: 1116 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75733000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 12, 2021, 9:39 a.m.	process_identifier: 1116 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a7c000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 12, 2021, 9:39 a.m.	process_identifier: 1116 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75733000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 12, 2021, 9:39 a.m.	process_identifier: 1116 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a7c000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 12, 2021, 9:39 a.m.	process_identifier: 1116 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75483000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 12, 2021, 9:39 a.m.	process_identifier: 1116 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75734000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 12, 2021, 9:39 a.m.	process_identifier: 1116 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a81000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 12, 2021, 9:39 a.m.	process_identifier: 1116 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75734000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 12, 2021, 9:39 a.m.	process_identifier: 1116 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75734000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 12, 2021, 9:39 a.m.	process_identifier: 1116 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a81000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 12, 2021, 9:39 a.m.	process_identifier: 1116 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75734000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 12, 2021, 9:39 a.m.	process_identifier: 1116 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75731000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 12, 2021, 9:39 a.m.	process_identifier: 1116 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a7d000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 12, 2021, 9:39 a.m.	process_identifier: 1116 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75734000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 12, 2021, 9:39 a.m.	process_identifier: 1116 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a7d000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 12, 2021, 9:39 a.m.	process_identifier: 1116 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75731000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 12, 2021, 9:39 a.m.	process_identifier: 1116 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a7d000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 12, 2021, 9:39 a.m.	process_identifier: 1116 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75735000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 12, 2021, 9:39 a.m.	process_identifier: 1116 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75731000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 12, 2021, 9:39 a.m.	process_identifier: 1116 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a7b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 12, 2021, 9:39 a.m.	process_identifier: 1116 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7574c000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 12, 2021, 9:39 a.m.	process_identifier: 1116 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a84000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 12, 2021, 9:39 a.m.	process_identifier: 1116 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7574a000 process_handle: 0xffffffff	1

A process attempted to delay the analysis task. (1 event)

description

jop.exe tried to sleep 185 seconds, actually delayed analysis time by 185 seconds

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses July 12, 2021, 9:40 a.m.	flags: 15 family: 0		111	0

The binary likely contains encrypted or compressed data indicative of a packer (5 events)

section

{u'size_of_data': u'0x00014c00', u'virtual_address': u'0x00002000', u'entropy': 7.997055195285321, u'name': u' ', u'virtual_size': u'0x00034000'}

entropy

7.99705519529

description

A section with a high entropy has been found

section

{u'size_of_data': u'0x00025e00', u'virtual_address': u'0x00036000', u'entropy': 7.9983220019674315, u'name': u' ', u'virtual_size': u'0x00194d4c'}

entropy

7.99832200197

description

A section with a high entropy has been found

section

{u'size_of_data': u'0x00019800', u'virtual_address': u'0x001d0000', u'entropy': 7.997548328763551, u'name': u'eer1* Ca', u'virtual_size': u'0x00019800'}

entropy

7.99754832876

description

A section with a high entropy has been found

section

{u'size_of_data': u'0x000c9400', u'virtual_address': u'0x00474000', u'entropy': 7.962546331501634, u'name': u'.boot', u'virtual_size': u'0x000c9400'}

entropy

7.9625463315

description

A section with a high entropy has been found

entropy

0.917235837686

description

Overall entropy of this PE file is high

Communicates with host for which no DNS query was performed (1 event)

host

185.215.113.81

Checks for the presence of known windows from debuggers and forensic tools (50 out of 159 events)

Time & API	Arguments	Status	Return	Repeated
FindWindowA July 12, 2021, 9:39 a.m.	class_name: RegmonClass window_name:		0	0
FindWindowA July 12, 2021, 9:39 a.m.	class_name: RegmonClass window_name:		0	0
FindWindowA July 12, 2021, 9:39 a.m.	class_name: Registry Monitor - Sysinternals: www.sysinternals.com window_name:		0	0
FindWindowA July 12, 2021, 9:39 a.m.	class_name: 18467-41 window_name:		0	0
FindWindowA July 12, 2021, 9:39 a.m.	class_name: FilemonClass window_name:		0	0
FindWindowA July 12, 2021, 9:39 a.m.	class_name: FilemonClass window_name:		0	0
FindWindowA July 12, 2021, 9:39 a.m.	class_name: File Monitor - Sysinternals: www.sysinternals.com window_name:		0	0
FindWindowA July 12, 2021, 9:39 a.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA July 12, 2021, 9:39 a.m.	class_name: Process Monitor - Sysinternals: www.sysinternals.com window_name:		0	0
FindWindowA July 12, 2021, 9:39 a.m.	class_name: Regmonclass window_name:		0	0
FindWindowA July 12, 2021, 9:39 a.m.	class_name: Regmonclass window_name:		0	0
FindWindowA July 12, 2021, 9:39 a.m.	class_name: 18467-41 window_name:		0	0
FindWindowA July 12, 2021, 9:39 a.m.	class_name: Filemonclass window_name:		0	0
FindWindowA July 12, 2021, 9:39 a.m.	class_name: Filemonclass window_name:		0	0
FindWindowA July 12, 2021, 9:39 a.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA July 12, 2021, 9:40 a.m.	class_name: Regmonclass window_name:		0	0
FindWindowA July 12, 2021, 9:40 a.m.	class_name: Regmonclass window_name:		0	0
FindWindowA July 12, 2021, 9:40 a.m.	class_name: 18467-41 window_name:		0	0
FindWindowA July 12, 2021, 9:40 a.m.	class_name: Filemonclass window_name:		0	0
FindWindowA July 12, 2021, 9:40 a.m.	class_name: Filemonclass window_name:		0	0
FindWindowA July 12, 2021, 9:40 a.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA July 12, 2021, 9:40 a.m.	class_name: Regmonclass window_name:		0	0
FindWindowA July 12, 2021, 9:40 a.m.	class_name: Regmonclass window_name:		0	0
FindWindowA July 12, 2021, 9:40 a.m.	class_name: 18467-41 window_name:		0	0
FindWindowA July 12, 2021, 9:40 a.m.	class_name: Filemonclass window_name:		0	0
FindWindowA July 12, 2021, 9:40 a.m.	class_name: Filemonclass window_name:		0	0
FindWindowA July 12, 2021, 9:40 a.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA July 12, 2021, 9:40 a.m.	class_name: Regmonclass window_name:		0	0
FindWindowA July 12, 2021, 9:40 a.m.	class_name: Regmonclass window_name:		0	0
FindWindowA July 12, 2021, 9:40 a.m.	class_name: 18467-41 window_name:		0	0
FindWindowA July 12, 2021, 9:40 a.m.	class_name: Filemonclass window_name:		0	0
FindWindowA July 12, 2021, 9:40 a.m.	class_name: Filemonclass window_name:		0	0
FindWindowA July 12, 2021, 9:40 a.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA July 12, 2021, 9:40 a.m.	class_name: Regmonclass window_name:		0	0
FindWindowA July 12, 2021, 9:40 a.m.	class_name: Regmonclass window_name:		0	0
FindWindowA July 12, 2021, 9:40 a.m.	class_name: 18467-41 window_name:		0	0
FindWindowA July 12, 2021, 9:40 a.m.	class_name: Filemonclass window_name:		0	0
FindWindowA July 12, 2021, 9:40 a.m.	class_name: Filemonclass window_name:		0	0
FindWindowA July 12, 2021, 9:40 a.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA July 12, 2021, 9:40 a.m.	class_name: Regmonclass window_name:		0	0
FindWindowA July 12, 2021, 9:40 a.m.	class_name: Regmonclass window_name:		0	0
FindWindowA July 12, 2021, 9:40 a.m.	class_name: 18467-41 window_name:		0	0
FindWindowA July 12, 2021, 9:40 a.m.	class_name: Filemonclass window_name:		0	0
FindWindowA July 12, 2021, 9:40 a.m.	class_name: Filemonclass window_name:		0	0
FindWindowA July 12, 2021, 9:40 a.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA July 12, 2021, 9:40 a.m.	class_name: Regmonclass window_name:		0	0
FindWindowA July 12, 2021, 9:40 a.m.	class_name: Regmonclass window_name:		0	0
FindWindowA July 12, 2021, 9:40 a.m.	class_name: 18467-41 window_name:		0	0
FindWindowA July 12, 2021, 9:40 a.m.	class_name: Filemonclass window_name:		0	0
FindWindowA July 12, 2021, 9:40 a.m.	class_name: Filemonclass window_name:		0	0

Checks the version of Bios, possibly for anti-virtualization (2 events)

registry	HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion
registry	HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion

Detects Virtual Machines through their custom firmware (1 event)

Time & API	Arguments	Status	Return	Repeated
NtQuerySystemInformation July 12, 2021, 9:39 a.m.	information_class: 76 (SystemFirmwareTableInformation)		3221225507	0

Detects VMWare through the in instruction feature (1 event)

Time & API	Arguments	Status	Return	Repeated
__exception__ July 12, 2021, 9:39 a.m.	stacktrace: exception.instruction_r: ed 64 8f 05 00 00 00 00 83 c4 04 81 fb 68 58 4d exception.symbol: jop+0x43fe0e exception.instruction: in eax, dx exception.module: jop.exe exception.exception_code: 0xc0000096 exception.offset: 4455950 exception.address: 0x179fe0e registers.esp: 2620688 registers.edi: 23169862 registers.eax: 1447909480 registers.ebp: 22323200 registers.edx: 22104 registers.ebx: 2256917605 registers.esi: 13 registers.ecx: 10	1	0	0

Generates some ICMP traffic

Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) (1 event)

dead_host

185.215.113.81:28578

File has been identified by 52 AntiVirus engines on VirusTotal as malicious (50 out of 52 events)

Bkav	W32.AIDetect.malware2
Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.Razy.886764
FireEye	Generic.mg.6e23d791b07e987b
CAT-QuickHeal	Trojanpws.Msil
ALYac	Gen:Variant.Razy.886764
Cylance	Unsafe
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Spyware ( 0057a2d41 )
Alibaba	TrojanPSW:MSIL/Reline.687be8c8
K7GW	Spyware ( 0057a2c81 )
Cybereason	malicious.78c515
Cyren	W32/Trojan.XDWC-0963
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	MSIL/Spy.Agent.DFY
APEX	Malicious
ClamAV	Win.Packed.Razy-9875755-0
Kaspersky	Trojan-PSW.MSIL.Reline.dew
BitDefender	Gen:Variant.Razy.886764
NANO-Antivirus	Virus.Win32.Gen-Crypt.ccnc
Avast	Win32:DangerousSig [Trj]
Ad-Aware	Gen:Variant.Razy.886764
Emsisoft	Trojan.Agent (A)
DrWeb	Trojan.PWS.Stealer.30742
VIPRE	Trojan.Win32.Generic!BT
TrendMicro	TROJ_GEN.R002C0WG821
McAfee-GW-Edition	Artemis!Trojan
Sophos	Mal/Generic-S
SentinelOne	Static AI - Suspicious PE
Webroot	W32.Trojan.Gen
Avira	TR/Spy.Agent.jleny
Kingsoft	Win32.PSWTroj.Undef.(kcloud)
Microsoft	Trojan:Win32/Woreflint.A!cl
Gridinsoft	Trojan.Win32.Packed.oa
Arcabit	Trojan.Razy.DD87EC
GData	Gen:Variant.Razy.886764
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win.Generic.R429260
McAfee	Artemis!6E23D791B07E
MAX	malware (ai score=81)
VBA32	BScope.TrojanPSW.MSIL.Reline
Malwarebytes	Trojan.MalPack.Themida
TrendMicro-HouseCall	TROJ_GEN.R002C0WG821
Rising	Trojan.Generic@ML.98 (RDMK:A8SkpM4T54+t0JmJceJuNg)
Ikarus	Trojan.MSIL.Spy
MaxSecure	Trojan.Malware.119405785.susgen
Fortinet	W32/Reline.DEW!tr.pws
BitDefenderTheta	Gen:NN.ZexaF.34790.oH1@aaLEKjnO
AVG	Win32:DangerousSig [Trj]
Panda	Trj/CI.A

jop.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All