Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Aug. 2, 2021, 5:46 p.m.	Aug. 2, 2021, 5:48 p.m.

Size	3.3MB
Type	PE32 executable (console) Intel 80386, for MS Windows
MD5	`8bad491fd5bd7142871b1815c24305bc`
SHA256	`2d8bb40147c17dc2e09c971c1db50a5377db9e599d0a57bd931c9efcbe75189f`
CRC32	`BDC5372D`
ssdeep	`49152:aKqTSVgAkmiQDi6+kgby6esnazu+yIpOUcdzjILI108ht9FgHSK/aJNd17:DqvWWkDdE38LYAIvh/vYuNd17`
Yara	PE_Header_Zero - PE File Signature Generic_Malware_Zero - Generic Malware anti_vm_detect - Possibly employs anti-virtualization techniques Is_DotNET_EXE - (no description) IsPE32 - (no description) Admin_Tool_IN_Zero - Admin Tool Sysinternals themida_packer - themida packer

SYNAPSE X.exe "C:\Users\test22\AppData\Local\Temp\SYNAPSE X.exe"
1728

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Aug. 2, 2021, 5:46 p.m.			0	0
IsDebuggerPresent Aug. 2, 2021, 5:46 p.m.			0	0

Uses Windows APIs to generate a cryptographic key (3 events)

Time & API	Arguments	Status	Return
CryptExportKey Aug. 2, 2021, 5:46 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00e1efb8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 2, 2021, 5:46 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00e1f038 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 2, 2021, 5:46 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00e1f038 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Aug. 2, 2021, 5:46 p.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (4 events)

section
section	.imports
section	.themida
section	.boot

One or more processes crashed (3 events)

Time & API	Arguments	Status
__exception__ Aug. 2, 2021, 5:46 p.m.	stacktrace: synapse x+0x4dfa42 @ 0x53fa42 synapse x+0x554308 @ 0x5b4308 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc e9 b2 d2 d7 8a 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008e exception.offset: 46887 exception.address: 0x754fb727 registers.esp: 13892188 registers.edi: 1122304 registers.eax: 13892188 registers.ebp: 13892268 registers.edx: 2130566132 registers.ebx: 2908885 registers.esi: 2006610987 registers.ecx: 2224816128	1
__exception__ Aug. 2, 2021, 5:46 p.m.	stacktrace: exception.instruction_r: ed e9 e6 ee 23 00 31 00 0f 59 aa 00 16 00 5a 00 exception.symbol: synapse x+0x351a7d exception.instruction: in eax, dx exception.module: SYNAPSE X.exe exception.exception_code: 0xc0000096 exception.offset: 3480189 exception.address: 0x3b1a7d registers.esp: 13892308 registers.edi: 3061824 registers.eax: 1750617430 registers.ebp: 1122304 registers.edx: 14506070 registers.ebx: 393216 registers.esi: 1748101 registers.ecx: 20	1
__exception__ Aug. 2, 2021, 5:46 p.m.	stacktrace: exception.instruction_r: ed e9 4d b5 01 00 c3 e9 89 e0 02 00 3d 58 aa 00 exception.symbol: synapse x+0x547e2d exception.instruction: in eax, dx exception.module: SYNAPSE X.exe exception.exception_code: 0xc0000096 exception.offset: 5537325 exception.address: 0x5a7e2d registers.esp: 13892308 registers.edi: 3061824 registers.eax: 1447909480 registers.ebp: 1122304 registers.edx: 22104 registers.ebx: 2256917605 registers.esi: 1748101 registers.ecx: 10	1

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (50 out of 116 events)

Time & API	Arguments	Status
NtProtectVirtualMemory Aug. 2, 2021, 5:46 p.m.	process_identifier: 1728 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76e5c000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 2, 2021, 5:46 p.m.	process_identifier: 1728 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x754fb000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 2, 2021, 5:46 p.m.	process_identifier: 1728 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76e5d000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 2, 2021, 5:46 p.m.	process_identifier: 1728 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x754fc000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 2, 2021, 5:46 p.m.	process_identifier: 1728 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76e34000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 2, 2021, 5:46 p.m.	process_identifier: 1728 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75508000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 2, 2021, 5:46 p.m.	process_identifier: 1728 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76e31000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 2, 2021, 5:46 p.m.	process_identifier: 1728 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75508000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 2, 2021, 5:46 p.m.	process_identifier: 1728 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76e5c000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 2, 2021, 5:46 p.m.	process_identifier: 1728 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75508000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 2, 2021, 5:46 p.m.	process_identifier: 1728 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76e35000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 2, 2021, 5:46 p.m.	process_identifier: 1728 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75508000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 2, 2021, 5:46 p.m.	process_identifier: 1728 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76703000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 2, 2021, 5:46 p.m.	process_identifier: 1728 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76e37000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 2, 2021, 5:46 p.m.	process_identifier: 1728 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x754fe000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 2, 2021, 5:46 p.m.	process_identifier: 1728 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76e33000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 2, 2021, 5:46 p.m.	process_identifier: 1728 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x754fc000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 2, 2021, 5:46 p.m.	process_identifier: 1728 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76e35000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 2, 2021, 5:46 p.m.	process_identifier: 1728 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x754fb000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 2, 2021, 5:46 p.m.	process_identifier: 1728 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76e33000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 2, 2021, 5:46 p.m.	process_identifier: 1728 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x754fc000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 2, 2021, 5:46 p.m.	process_identifier: 1728 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76e53000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 2, 2021, 5:46 p.m.	process_identifier: 1728 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76e58000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 2, 2021, 5:46 p.m.	process_identifier: 1728 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76eae000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 2, 2021, 5:46 p.m.	process_identifier: 1728 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76e55000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 2, 2021, 5:46 p.m.	process_identifier: 1728 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x769ef000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 2, 2021, 5:46 p.m.	process_identifier: 1728 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x769f8000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 2, 2021, 5:46 p.m.	process_identifier: 1728 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76e31000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 2, 2021, 5:46 p.m.	process_identifier: 1728 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x754fd000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 2, 2021, 5:46 p.m.	process_identifier: 1728 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76e34000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 2, 2021, 5:46 p.m.	process_identifier: 1728 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76e34000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 2, 2021, 5:46 p.m.	process_identifier: 1728 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x754fb000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 2, 2021, 5:46 p.m.	process_identifier: 1728 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76e31000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 2, 2021, 5:46 p.m.	process_identifier: 1728 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75501000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 2, 2021, 5:46 p.m.	process_identifier: 1728 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76e33000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 2, 2021, 5:46 p.m.	process_identifier: 1728 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75501000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 2, 2021, 5:46 p.m.	process_identifier: 1728 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76e35000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 2, 2021, 5:46 p.m.	process_identifier: 1728 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76e31000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 2, 2021, 5:46 p.m.	process_identifier: 1728 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x754fd000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 2, 2021, 5:46 p.m.	process_identifier: 1728 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76e35000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 2, 2021, 5:46 p.m.	process_identifier: 1728 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76e33000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 2, 2021, 5:46 p.m.	process_identifier: 1728 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7550b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 2, 2021, 5:46 p.m.	process_identifier: 1728 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76e35000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 2, 2021, 5:46 p.m.	process_identifier: 1728 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7550b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 2, 2021, 5:46 p.m.	process_identifier: 1728 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76e34000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 2, 2021, 5:46 p.m.	process_identifier: 1728 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75501000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 2, 2021, 5:46 p.m.	process_identifier: 1728 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76e34000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 2, 2021, 5:46 p.m.	process_identifier: 1728 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76e34000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 2, 2021, 5:46 p.m.	process_identifier: 1728 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75501000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 2, 2021, 5:46 p.m.	process_identifier: 1728 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76e34000 process_handle: 0xffffffff	1

The binary likely contains encrypted or compressed data indicative of a packer (4 events)

section

{u'size_of_data': u'0x00042584', u'virtual_address': u'0x00002000', u'entropy': 7.9238811062874595, u'name': u' ', u'virtual_size': u'0x000a8000'}

entropy

7.92388110629

description

A section with a high entropy has been found

section

{u'size_of_data': u'0x00000121', u'virtual_address': u'0x000aa000', u'entropy': 7.160925381651735, u'name': u' ', u'virtual_size': u'0x000002a8'}

entropy

7.16092538165

description

A section with a high entropy has been found

section

{u'size_of_data': u'0x002fcc30', u'virtual_address': u'0x005c6000', u'entropy': 7.9604474403571075, u'name': u'.boot', u'virtual_size': u'0x002fd000'}

entropy

7.96044744036

description

A section with a high entropy has been found

entropy

0.99939440445

description

Overall entropy of this PE file is high

Yara rule detected in process memory (8 events)

description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep

Allocates execute permission to another process indicative of possible code injection (1 event)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory Aug. 2, 2021, 5:46 p.m.	process_identifier: 1652 region_size: 204800 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000022c	1	0	0

Checks for the presence of known windows from debuggers and forensic tools (9 events)

Time & API	Arguments	Status	Return	Repeated
FindWindowA Aug. 2, 2021, 5:46 p.m.	class_name: FilemonClass window_name:		0	0
FindWindowA Aug. 2, 2021, 5:46 p.m.	class_name: FilemonClass window_name:		0	0
FindWindowA Aug. 2, 2021, 5:46 p.m.	class_name: File Monitor - Sysinternals: www.sysinternals.com window_name:		0	0
FindWindowA Aug. 2, 2021, 5:46 p.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA Aug. 2, 2021, 5:46 p.m.	class_name: Process Monitor - Sysinternals: www.sysinternals.com window_name:		0	0
FindWindowA Aug. 2, 2021, 5:46 p.m.	class_name: RegmonClass window_name:		0	0
FindWindowA Aug. 2, 2021, 5:46 p.m.	class_name: RegmonClass window_name:		0	0
FindWindowA Aug. 2, 2021, 5:46 p.m.	class_name: Registry Monitor - Sysinternals: www.sysinternals.com window_name:		0	0
FindWindowA Aug. 2, 2021, 5:46 p.m.	class_name: 18467-41 window_name:		0	0

Checks the version of Bios, possibly for anti-virtualization (2 events)

registry	HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion
registry	HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion

Manipulates memory of a non-child process indicative of process injection (3 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1728 manipulating memory of non-child process 1652
NtUnmapViewOfSection Aug. 2, 2021, 5:46 p.m.	base_address: 0x00400000 region_size: 2252800 process_identifier: 1652 process_handle: 0x0000022c	1	0	0
NtAllocateVirtualMemory Aug. 2, 2021, 5:46 p.m.	process_identifier: 1652 region_size: 204800 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000022c	1	0	0

Potential code injection by writing to the memory of another process (3 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1728 injected into non-child 1652
WriteProcessMemory Aug. 2, 2021, 5:46 p.m.	buffer: MZÿÿ¸@àº´ Í!¸LÍ!This program cannot be run in DOS mode. $h-,qê~,qê~,qê~2#~?qê~·~+qê~,që~\qê~2#n~qê~2#i~¢qê~2#{~-qê~Rich,qê~.CØPELt¥Pà# </Í°@ û;´P`·À± @°.text `.rdata´m°n@@.dataÀ0 @À.rsrc·`¸ @@ base_address: 0x00400000 process_identifier: 1652 process_handle: 0x0000022c	1	1	0
WriteProcessMemory Aug. 2, 2021, 5:46 p.m.	buffer: @ base_address: 0x7efde008 process_identifier: 1652 process_handle: 0x0000022c	1	1	0

Code injection by writing an executable or DLL to the memory of another process (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1728 injected into non-child 1652
WriteProcessMemory Aug. 2, 2021, 5:46 p.m.	buffer: MZÿÿ¸@àº´ Í!¸LÍ!This program cannot be run in DOS mode. $h-,qê~,qê~,qê~2#~?qê~·~+qê~,që~\qê~2#n~qê~2#i~¢qê~2#{~-qê~Rich,qê~.CØPELt¥Pà# </Í°@ û;´P`·À± @°.text `.rdata´m°n@@.dataÀ0 @À.rsrc·`¸ @@ base_address: 0x00400000 process_identifier: 1652 process_handle: 0x0000022c	1	1	0

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1728 called NtSetContextThread to modify thread in remote process 1652
NtSetContextThread Aug. 2, 2021, 5:46 p.m.	registers.eip: 2006188484 registers.esp: 13893152 registers.edi: 0 registers.eax: 4246831 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000228 process_identifier: 1652	1	0	0

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1728 resumed a thread in remote process 1652
NtResumeThread Aug. 2, 2021, 5:46 p.m.	thread_handle: 0x00000228 suspend_count: 1 process_identifier: 1652	1	0	0

Detects Virtual Machines through their custom firmware (1 event)

Time & API	Arguments	Status	Return	Repeated
NtQuerySystemInformation Aug. 2, 2021, 5:46 p.m.	information_class: 76 (SystemFirmwareTableInformation)		3221225507	0

Detects VMWare through the in instruction feature (1 event)

Time & API	Arguments	Status	Return	Repeated
__exception__ Aug. 2, 2021, 5:46 p.m.	stacktrace: exception.instruction_r: ed e9 4d b5 01 00 c3 e9 89 e0 02 00 3d 58 aa 00 exception.symbol: synapse x+0x547e2d exception.instruction: in eax, dx exception.module: SYNAPSE X.exe exception.exception_code: 0xc0000096 exception.offset: 5537325 exception.address: 0x5a7e2d registers.esp: 13892308 registers.edi: 3061824 registers.eax: 1447909480 registers.ebp: 1122304 registers.edx: 22104 registers.ebx: 2256917605 registers.esi: 1748101 registers.ecx: 10	1	0	0

Executed a process and injected code into it, probably while unpacking (16 events)

Time & API	Arguments	Status	Return
NtGetContextThread Aug. 2, 2021, 5:46 p.m.	thread_handle: 0xfffffffe	1	0
NtResumeThread Aug. 2, 2021, 5:46 p.m.	thread_handle: 0x00000108 suspend_count: 1 process_identifier: 1728	1	0
NtResumeThread Aug. 2, 2021, 5:46 p.m.	thread_handle: 0x00000178 suspend_count: 1 process_identifier: 1728	1	0
NtResumeThread Aug. 2, 2021, 5:46 p.m.	thread_handle: 0x000001b4 suspend_count: 1 process_identifier: 1728	1	0
CreateProcessInternalW Aug. 2, 2021, 5:46 p.m.	thread_identifier: 1648 thread_handle: 0x00000228 process_identifier: 1652 current_directory: filepath: track: 1 command_line: C:\Users\test22\AppData\Local\Temp\SYNAPSE X.exe filepath_r: stack_pivoted: 0 creation_flags: 134217740 (CREATE_NO_WINDOW\|CREATE_SUSPENDED\|DETACHED_PROCESS) inherit_handles: 0 process_handle: 0x0000022c	1	1
NtUnmapViewOfSection Aug. 2, 2021, 5:46 p.m.	base_address: 0x00400000 region_size: 2252800 process_identifier: 1652 process_handle: 0x0000022c	1	0
NtAllocateVirtualMemory Aug. 2, 2021, 5:46 p.m.	process_identifier: 1652 region_size: 204800 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000022c	1	0
WriteProcessMemory Aug. 2, 2021, 5:46 p.m.	buffer: MZÿÿ¸@àº´ Í!¸LÍ!This program cannot be run in DOS mode. $h-,qê~,qê~,qê~2#~?qê~·~+qê~,që~\qê~2#n~qê~2#i~¢qê~2#{~-qê~Rich,qê~.CØPELt¥Pà# </Í°@ û;´P`·À± @°.text `.rdata´m°n@@.dataÀ0 @À.rsrc·`¸ @@ base_address: 0x00400000 process_identifier: 1652 process_handle: 0x0000022c	1	1
WriteProcessMemory Aug. 2, 2021, 5:46 p.m.	buffer: base_address: 0x00401000 process_identifier: 1652 process_handle: 0x0000022c	1	1
WriteProcessMemory Aug. 2, 2021, 5:46 p.m.	buffer: base_address: 0x0041b000 process_identifier: 1652 process_handle: 0x0000022c	1	1
WriteProcessMemory Aug. 2, 2021, 5:46 p.m.	buffer: base_address: 0x00422000 process_identifier: 1652 process_handle: 0x0000022c	1	1
WriteProcessMemory Aug. 2, 2021, 5:46 p.m.	buffer: base_address: 0x00426000 process_identifier: 1652 process_handle: 0x0000022c	1	1
NtGetContextThread Aug. 2, 2021, 5:46 p.m.	thread_handle: 0x00000228	1	0
WriteProcessMemory Aug. 2, 2021, 5:46 p.m.	buffer: @ base_address: 0x7efde008 process_identifier: 1652 process_handle: 0x0000022c	1	1
NtSetContextThread Aug. 2, 2021, 5:46 p.m.	registers.eip: 2006188484 registers.esp: 13893152 registers.edi: 0 registers.eax: 4246831 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000228 process_identifier: 1652	1	0
NtResumeThread Aug. 2, 2021, 5:46 p.m.	thread_handle: 0x00000228 suspend_count: 1 process_identifier: 1652	1	0

File has been identified by 45 AntiVirus engines on VirusTotal as malicious (45 events)

Bkav	W32.AIDetect.malware1
Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.GenericKD.46671947
FireEye	Generic.mg.8bad491fd5bd7142
McAfee	Artemis!8BAD491FD5BD
Cylance	Unsafe
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Trojan ( 0057ef301 )
Alibaba	Trojan:Win32/Kryptik.ali2000016
K7GW	Trojan ( 0057ef301 )
Cybereason	malicious.426de2
BitDefenderTheta	Gen:NN.ZexaF.34050.qF0@aW@!ZIo
Cyren	W32/Trojan.EFYR-8637
ESET-NOD32	a variant of Win32/GenKryptik.FHEB
APEX	Malicious
Paloalto	generic.ml
Kaspersky	Trojan-PSW.MSIL.Reline.eec
BitDefender	Trojan.GenericKD.46671947
NANO-Antivirus	Virus.Win32.Gen-Crypt.ccnc
Avast	Win32:Trojan-gen
Rising	Trojan.Generic@ML.100 (RDMK:p3lTT+mo6CEP7je0pxsT4w)
Ad-Aware	Trojan.GenericKD.46671947
Sophos	Generic ML PUA (PUA)
TrendMicro	TROJ_GEN.R002C0WGQ21
Emsisoft	Trojan.GenericKD.46671947 (B)
Ikarus	Trojan.SuspectCRC
Avira	TR/Crypt.XPACK.Gen
Microsoft	Trojan:Win32/Mamson.A!ac
Gridinsoft	Trojan.Heur!.032100A1
Arcabit	Trojan.Generic.D2C8284B
GData	Trojan.GenericKD.46671947
Cynet	Malicious (score: 100)
AhnLab-V3	Malware/Gen.RL_Reputation.R365609
Acronis	suspicious
VBA32	TScope.Malware-Cryptor.SB
ALYac	Spyware.Infostealer.RedLine
MAX	malware (ai score=80)
TrendMicro-HouseCall	TROJ_GEN.R002C0WGQ21
Yandex	Trojan.PWS.Reline!6bPgepba/CU
SentinelOne	Static AI - Malicious PE
Fortinet	W32/GenKryptik.FHEB!tr
AVG	Win32:Trojan-gen
Panda	Trj/CI.A
CrowdStrike	win/malicious_confidence_100% (W)
Qihoo-360	Win32/TrojanPSW.Generic.HxMBztsA

SYNAPSE X.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All