Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	Aug. 9, 2021, 9:26 a.m.	Aug. 9, 2021, 9:30 a.m.

Size	3.7MB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`9619ad1fdc2d4b6ce19567be0a47b6f9`
SHA256	`88b21d6bda07db2097615a88062328006f0c10d199d4fc5e50483d6fd6abe622`
CRC32	`50C7BDF8`
ssdeep	`98304:3qEZBIcirqFrcnT5pq2u4iE8+JoBp+PTNOAoP:5kciacXqFx+kkPo`
Yara	Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature IsPE32 - (no description)

lv.exe "C:\Users\test22\AppData\Local\Temp\lv.exe"
2100
- file.exe "C:\Users\test22\AppData\Local\Temp\folder\file.exe"
  2236
  - dllhost.exe dllhost.exe
    2344
  - cmd.exe cmd /c cmd < Confronto.vsd
    2480
    - cmd.exe cmd
      2588
      - findstr.exe findstr /V /R "^pbfZHNwzsXALugVPsbikcLGmlTQMSJGkUUtRoHQkZmHLQyLLuVpnCdInRQPNWfBIsgQkprGKGWkWrUJtiyFXm$" Che.vsd
        2644
      - Ore.exe.com Ore.exe.com S
        2688
        
        Ore.exe.com C:\Users\test22\AppData\Local\Temp\IXP000.TMP\Ore.exe.com S
        2772
        
        Ore.exe.com C:\Users\test22\AppData\Local\Temp\IXP000.TMP\Ore.exe.com S
        2864
      - PING.EXE ping localhost -n 30
        2832
- setup.exe "C:\Users\test22\AppData\Local\Temp\folder\setup.exe"
  2280
  - IntelRapid.exe "C:\Users\test22\AppData\Roaming\Intel Rapid\IntelRapid.exe"
    2516
explorer.exe C:\Windows\Explorer.EXE
1248

Name	Response	Post-Analysis Lookup
BgABegmSFyMxWuKGR.BgABegmSFyMxWuKGR

IP Address	Status	Action
164.124.101.2	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (3 events)

Time & API	Arguments	Status	Return
GetComputerNameW Aug. 9, 2021, 9:26 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 9, 2021, 9:26 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 9, 2021, 9:26 a.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (5 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Aug. 9, 2021, 9:26 a.m.			0	0
IsDebuggerPresent Aug. 9, 2021, 9:26 a.m.			0	0
IsDebuggerPresent Aug. 9, 2021, 9:26 a.m.			0	0
IsDebuggerPresent Aug. 9, 2021, 9:26 a.m.			0	0
IsDebuggerPresent Aug. 9, 2021, 9:26 a.m.			0	0

Command line console output was observed (50 out of 89 events)

Time & API	Arguments	Status	Return
WriteConsoleW Aug. 9, 2021, 9:26 a.m.	buffer: Microsoft Windows [Version 6.1.7601] console_handle: 0x00000007	1	1
WriteConsoleW Aug. 9, 2021, 9:26 a.m.	buffer: Copyright (c) 2009 Microsoft Corporation. All rights reserved. console_handle: 0x00000007	1	1
WriteConsoleW Aug. 9, 2021, 9:26 a.m.	buffer: C:\Users\test22\AppData\Local\Temp\IXP000.TMP> console_handle: 0x00000007	1	1
WriteConsoleW Aug. 9, 2021, 9:26 a.m.	buffer: Set xPvxUrwsWBxNAok=DESKTOP- console_handle: 0x00000007	1	1
WriteConsoleW Aug. 9, 2021, 9:26 a.m.	buffer: C:\Users\test22\AppData\Local\Temp\IXP000.TMP> console_handle: 0x00000007	1	1
WriteConsoleW Aug. 9, 2021, 9:26 a.m.	buffer: Set kKkFoRGpeMZubaALkBKwjFbyaUWjkcvDMHY=QO5QU33 console_handle: 0x00000007	1	1
WriteConsoleW Aug. 9, 2021, 9:26 a.m.	buffer: C:\Users\test22\AppData\Local\Temp\IXP000.TMP> console_handle: 0x00000007	1	1
WriteConsoleW Aug. 9, 2021, 9:26 a.m.	buffer: Set qalCTnyCqanKyTHPgKTH=ping localhost -n console_handle: 0x00000007	1	1
WriteConsoleW Aug. 9, 2021, 9:26 a.m.	buffer: C:\Users\test22\AppData\Local\Temp\IXP000.TMP> console_handle: 0x00000007	1	1
WriteConsoleW Aug. 9, 2021, 9:26 a.m.	buffer: if %computername%==%xPvxUrwsWBxNAok% qalCTnyCqanKyTHPgKTH 300 console_handle: 0x00000007	1	1
WriteConsoleW Aug. 9, 2021, 9:26 a.m.	buffer: C:\Users\test22\AppData\Local\Temp\IXP000.TMP> console_handle: 0x00000007	1	1
WriteConsoleW Aug. 9, 2021, 9:26 a.m.	buffer: Set dyYpMubUfsbZxcRtOAmhSNmNGVozBWxGznMWNX=MZ console_handle: 0x00000007	1	1
WriteConsoleW Aug. 9, 2021, 9:26 a.m.	buffer: C:\Users\test22\AppData\Local\Temp\IXP000.TMP> console_handle: 0x00000007	1	1
WriteConsoleW Aug. 9, 2021, 9:26 a.m.	buffer: <nul set /p = "%dyYpMubUfsbZxcRtOAmhSNmNGVozBWxGznMWNX%" > Ore.exe.com console_handle: 0x00000007	1	1
WriteConsoleW Aug. 9, 2021, 9:26 a.m.	buffer: C:\Users\test22\AppData\Local\Temp\IXP000.TMP> console_handle: 0x00000007	1	1
WriteConsoleW Aug. 9, 2021, 9:26 a.m.	buffer: findstr /V /R "^pbfZHNwzsXALugVPsbikcLGmlTQMSJGkUUtRoHQkZmHLQyLLuVpnCdInRQPNWfBIsgQkprGKGWkWrUJtiyFXm$" Che.vsd >> Ore.exe.com" console_handle: 0x00000007	1	1
WriteConsoleW Aug. 9, 2021, 9:26 a.m.	buffer: C:\Users\test22\AppData\Local\Temp\IXP000.TMP> console_handle: 0x00000007	1	1
WriteConsoleW Aug. 9, 2021, 9:26 a.m.	buffer: copy Avremo.vsd S console_handle: 0x00000007	1	1
WriteConsoleW Aug. 9, 2021, 9:26 a.m.	buffer: 1 file(s) copied. console_handle: 0x00000007	1	1
WriteConsoleW Aug. 9, 2021, 9:26 a.m.	buffer: C:\Users\test22\AppData\Local\Temp\IXP000.TMP> console_handle: 0x00000007	1	1
WriteConsoleW Aug. 9, 2021, 9:26 a.m.	buffer: start Ore.exe.com S console_handle: 0x00000007	1	1
WriteConsoleW Aug. 9, 2021, 9:26 a.m.	buffer: C:\Users\test22\AppData\Local\Temp\IXP000.TMP> console_handle: 0x00000007	1	1
WriteConsoleW Aug. 9, 2021, 9:26 a.m.	buffer: %qalCTnyCqanKyTHPgKTH% 30 console_handle: 0x00000007	1	1
WriteConsoleW Aug. 9, 2021, 9:27 a.m.	buffer: C:\Users\test22\AppData\Local\Temp\IXP000.TMP> console_handle: 0x00000007	1	1
WriteConsoleW Aug. 9, 2021, 9:27 a.m.	buffer: C:\Users\test22\AppData\Local\Temp\IXP000.TMP> console_handle: 0x00000007	1	1
WriteConsoleA Aug. 9, 2021, 9:26 a.m.	buffer: Pinging test22-PC [::1] console_handle: 0x00000007	1	1
WriteConsoleA Aug. 9, 2021, 9:26 a.m.	buffer: with 32 bytes of data: console_handle: 0x00000007	1	1
WriteConsoleA Aug. 9, 2021, 9:26 a.m.	buffer: Reply from ::1: console_handle: 0x00000007	1	1
WriteConsoleA Aug. 9, 2021, 9:26 a.m.	buffer: time<1ms console_handle: 0x00000007	1	1
WriteConsoleA Aug. 9, 2021, 9:26 a.m.	buffer: Reply from ::1: console_handle: 0x00000007	1	1
WriteConsoleA Aug. 9, 2021, 9:26 a.m.	buffer: time<1ms console_handle: 0x00000007	1	1
WriteConsoleA Aug. 9, 2021, 9:26 a.m.	buffer: Reply from ::1: console_handle: 0x00000007	1	1
WriteConsoleA Aug. 9, 2021, 9:26 a.m.	buffer: time<1ms console_handle: 0x00000007	1	1
WriteConsoleA Aug. 9, 2021, 9:26 a.m.	buffer: Reply from ::1: console_handle: 0x00000007	1	1
WriteConsoleA Aug. 9, 2021, 9:26 a.m.	buffer: time<1ms console_handle: 0x00000007	1	1
WriteConsoleA Aug. 9, 2021, 9:26 a.m.	buffer: Reply from ::1: console_handle: 0x00000007	1	1
WriteConsoleA Aug. 9, 2021, 9:26 a.m.	buffer: time<1ms console_handle: 0x00000007	1	1
WriteConsoleA Aug. 9, 2021, 9:26 a.m.	buffer: Reply from ::1: console_handle: 0x00000007	1	1
WriteConsoleA Aug. 9, 2021, 9:26 a.m.	buffer: time<1ms console_handle: 0x00000007	1	1
WriteConsoleA Aug. 9, 2021, 9:26 a.m.	buffer: Reply from ::1: console_handle: 0x00000007	1	1
WriteConsoleA Aug. 9, 2021, 9:26 a.m.	buffer: time<1ms console_handle: 0x00000007	1	1
WriteConsoleA Aug. 9, 2021, 9:26 a.m.	buffer: Reply from ::1: console_handle: 0x00000007	1	1
WriteConsoleA Aug. 9, 2021, 9:26 a.m.	buffer: time<1ms console_handle: 0x00000007	1	1
WriteConsoleA Aug. 9, 2021, 9:26 a.m.	buffer: Reply from ::1: console_handle: 0x00000007	1	1
WriteConsoleA Aug. 9, 2021, 9:26 a.m.	buffer: time<1ms console_handle: 0x00000007	1	1
WriteConsoleA Aug. 9, 2021, 9:26 a.m.	buffer: Reply from ::1: console_handle: 0x00000007	1	1
WriteConsoleA Aug. 9, 2021, 9:26 a.m.	buffer: time<1ms console_handle: 0x00000007	1	1
WriteConsoleA Aug. 9, 2021, 9:26 a.m.	buffer: Reply from ::1: console_handle: 0x00000007	1	1
WriteConsoleA Aug. 9, 2021, 9:26 a.m.	buffer: time<1ms console_handle: 0x00000007	1	1
WriteConsoleA Aug. 9, 2021, 9:26 a.m.	buffer: Reply from ::1: console_handle: 0x00000007	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Aug. 9, 2021, 9:26 a.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

.ndata

One or more processes crashed (6 events)

Time & API	Arguments	Status
__exception__ Aug. 9, 2021, 9:26 a.m.	stacktrace: setup+0x390e36 @ 0xc40e36 setup+0x385404 @ 0xc35404 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008e exception.offset: 46887 exception.address: 0x748ab727 registers.esp: 4061856 registers.edi: 9265152 registers.eax: 4061856 registers.ebp: 4061936 registers.edx: 2130566132 registers.ebx: 0 registers.esi: 1998418987 registers.ecx: 3339321344	1
__exception__ Aug. 9, 2021, 9:26 a.m.	stacktrace: exception.instruction_r: ed e9 4e 82 00 00 dd b8 10 9e 00 4b 00 01 e5 fc exception.symbol: setup+0x3cd5ec exception.instruction: in eax, dx exception.module: setup.exe exception.exception_code: 0xc0000096 exception.offset: 3986924 exception.address: 0xc7d5ec registers.esp: 4061976 registers.edi: 4730493 registers.eax: 1750617430 registers.ebp: 9265152 registers.edx: 4741206 registers.ebx: 2147483650 registers.esi: 10338076 registers.ecx: 20	1
__exception__ Aug. 9, 2021, 9:26 a.m.	stacktrace: exception.instruction_r: ed e9 af 40 04 00 c3 e9 c6 c7 fe ff c0 4c f5 68 exception.symbol: setup+0x39296c exception.instruction: in eax, dx exception.module: setup.exe exception.exception_code: 0xc0000096 exception.offset: 3746156 exception.address: 0xc4296c registers.esp: 4061976 registers.edi: 4730493 registers.eax: 1447909480 registers.ebp: 9265152 registers.edx: 22104 registers.ebx: 2256917605 registers.esi: 10338076 registers.ecx: 10	1
__exception__ Aug. 9, 2021, 9:26 a.m.	stacktrace: intelrapid+0x390e36 @ 0x16e0e36 intelrapid+0x385404 @ 0x16d5404 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008e exception.offset: 46887 exception.address: 0x748ab727 registers.esp: 3931672 registers.edi: 20406272 registers.eax: 3931672 registers.ebp: 3931752 registers.edx: 2130566132 registers.ebx: 0 registers.esi: 1998418987 registers.ecx: 3408986112	1
__exception__ Aug. 9, 2021, 9:26 a.m.	stacktrace: exception.instruction_r: ed e9 4e 82 00 00 dd b8 10 9e 00 4b 00 01 e5 fc exception.symbol: intelrapid+0x3cd5ec exception.instruction: in eax, dx exception.module: IntelRapid.exe exception.exception_code: 0xc0000096 exception.offset: 3986924 exception.address: 0x171d5ec registers.esp: 3931792 registers.edi: 4075468 registers.eax: 1750617430 registers.ebp: 20406272 registers.edx: 4085846 registers.ebx: 2147483650 registers.esi: 21479196 registers.ecx: 20	1
__exception__ Aug. 9, 2021, 9:26 a.m.	stacktrace: exception.instruction_r: ed e9 af 40 04 00 c3 e9 c6 c7 fe ff c0 4c f5 68 exception.symbol: intelrapid+0x39296c exception.instruction: in eax, dx exception.module: IntelRapid.exe exception.exception_code: 0xc0000096 exception.offset: 3746156 exception.address: 0x16e296c registers.esp: 3931792 registers.edi: 4075468 registers.eax: 1447909480 registers.ebp: 20406272 registers.edx: 22104 registers.ebx: 2256917605 registers.esi: 21479196 registers.ecx: 10	1

Allocates read-write-execute memory (usually to unpack itself) (50 out of 52 events)

Time & API	Arguments	Status
NtProtectVirtualMemory Aug. 9, 2021, 9:26 a.m.	process_identifier: 2100 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73b41000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 9, 2021, 9:26 a.m.	process_identifier: 2100 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x767a1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 9, 2021, 9:26 a.m.	process_identifier: 2100 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x10001000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 9, 2021, 9:26 a.m.	process_identifier: 2100 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73b31000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 9, 2021, 9:26 a.m.	process_identifier: 2100 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73a01000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 9, 2021, 9:26 a.m.	process_identifier: 2100 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73951000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 9, 2021, 9:26 a.m.	process_identifier: 2100 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73a02000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 9, 2021, 9:26 a.m.	process_identifier: 2236 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73b21000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 9, 2021, 9:26 a.m.	process_identifier: 2236 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73c11000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 9, 2021, 9:26 a.m.	process_identifier: 2236 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73b61000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 9, 2021, 9:26 a.m.	process_identifier: 2236 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73c12000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 9, 2021, 9:26 a.m.	process_identifier: 2236 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73911000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 9, 2021, 9:26 a.m.	process_identifier: 2236 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73913000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 9, 2021, 9:26 a.m.	process_identifier: 2236 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73a61000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 9, 2021, 9:26 a.m.	process_identifier: 2280 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x771ff000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 9, 2021, 9:26 a.m.	process_identifier: 2280 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x77170000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 9, 2021, 9:26 a.m.	process_identifier: 2280 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x008cc000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 9, 2021, 9:26 a.m.	process_identifier: 2280 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x008c4000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 9, 2021, 9:26 a.m.	process_identifier: 2280 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x008c4000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 9, 2021, 9:26 a.m.	process_identifier: 2280 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 40960 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x008c4000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 9, 2021, 9:26 a.m.	process_identifier: 2280 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73981000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 9, 2021, 9:26 a.m.	process_identifier: 2280 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74251000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 9, 2021, 9:26 a.m.	process_identifier: 2280 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73951000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 9, 2021, 9:26 a.m.	process_identifier: 2280 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x767a1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 9, 2021, 9:26 a.m.	process_identifier: 2280 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73941000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 9, 2021, 9:26 a.m.	process_identifier: 2280 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73841000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 9, 2021, 9:26 a.m.	process_identifier: 2280 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x738f1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 9, 2021, 9:26 a.m.	process_identifier: 2280 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73831000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 9, 2021, 9:26 a.m.	process_identifier: 2280 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73811000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 9, 2021, 9:26 a.m.	process_identifier: 2280 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x737c1000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 9, 2021, 9:27 a.m.	process_identifier: 1248 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000007140000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 9, 2021, 9:26 a.m.	process_identifier: 2516 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x771ff000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 9, 2021, 9:26 a.m.	process_identifier: 2516 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x77170000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 9, 2021, 9:26 a.m.	process_identifier: 2516 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0136c000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 9, 2021, 9:26 a.m.	process_identifier: 2516 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01364000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 9, 2021, 9:26 a.m.	process_identifier: 2516 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01364000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 9, 2021, 9:26 a.m.	process_identifier: 2516 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 40960 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01364000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 9, 2021, 9:26 a.m.	process_identifier: 2688 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73c11000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 9, 2021, 9:26 a.m.	process_identifier: 2688 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73b61000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 9, 2021, 9:26 a.m.	process_identifier: 2688 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73c12000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 9, 2021, 9:26 a.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73c11000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 9, 2021, 9:26 a.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73b61000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 9, 2021, 9:26 a.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73c12000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 9, 2021, 9:26 a.m.	process_identifier: 2864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73c11000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 9, 2021, 9:26 a.m.	process_identifier: 2864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73b61000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 9, 2021, 9:26 a.m.	process_identifier: 2864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73c12000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 9, 2021, 9:27 a.m.	process_identifier: 2864 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x008e0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 9, 2021, 9:27 a.m.	process_identifier: 2864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 102400 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04411000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 9, 2021, 9:27 a.m.	process_identifier: 2864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 32768 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0442a000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 9, 2021, 9:27 a.m.	process_identifier: 2864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04432000 process_handle: 0xffffffff	1

Checks whether any human activity is being performed by constantly checking whether the foreground window changed

Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation (2 events)

Time & API	Arguments	Status	Return	Repeated
GetDiskFreeSpaceW Aug. 9, 2021, 9:26 a.m.	number_of_free_clusters: 3004125 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: \ total_number_of_clusters: 8362495	1	1	0
GetDiskFreeSpaceW Aug. 9, 2021, 9:26 a.m.	number_of_free_clusters: 3004125 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: \ total_number_of_clusters: 8362495	1	1	0

Creates executable files on the filesystem (9 events)

file	C:\Program Files (x86)\foler\olader\acppage.dll
file	C:\Users\test22\AppData\Local\Temp\IXP000.TMP\Ore.exe.com
file	C:\Users\test22\AppData\Local\Temp\nsv5484.tmp\UAC.dll
file	C:\Users\test22\AppData\Local\Temp\folder\setup.exe
file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IntelRapid.lnk
file	C:\Program Files (x86)\foler\olader\acledit.dll
file	C:\Users\test22\AppData\Local\Temp\folder\file.exe
file	C:\Program Files (x86)\foler\olader\adprovider.dll
file	C:\Users\test22\AppData\Roaming\Intel Rapid\IntelRapid.exe

Creates a shortcut to an executable file (1 event)

file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IntelRapid.lnk

Drops an executable to the user AppData folder (3 events)

file	C:\Users\test22\AppData\Local\Temp\nsv5484.tmp\UAC.dll
file	C:\Users\test22\AppData\Local\Temp\folder\file.exe
file	C:\Users\test22\AppData\Local\Temp\folder\setup.exe

The binary likely contains encrypted or compressed data indicative of a packer (3 events)

section

{u'size_of_data': u'0x00011a00', u'virtual_address': u'0x00160000', u'entropy': 7.320572961406258, u'name': u'.rsrc', u'virtual_size': u'0x00011858'}

entropy

7.32057296141

description

A section with a high entropy has been found

section

{u'size_of_data': u'0x00001000', u'virtual_address': u'0x00172000', u'entropy': 7.920210947259952, u'name': u'.reloc', u'virtual_size': u'0x00000fd6'}

entropy

7.92021094726

description

A section with a high entropy has been found

entropy

0.647826086957

description

Overall entropy of this PE file is high

Uses Windows utilities for basic Windows functionality (1 event)

cmdline

ping localhost -n 30

Attempts to identify installed AV products by installation directory (2 events)

file	C:\ProgramData\AVAST Software
file	C:\ProgramData\AVG

Checks for the presence of known windows from debuggers and forensic tools (50 out of 168 events)

Time & API	Arguments	Status	Return	Repeated
FindWindowA Aug. 9, 2021, 9:26 a.m.	class_name: FilemonClass window_name:		0	0
FindWindowA Aug. 9, 2021, 9:26 a.m.	class_name: FilemonClass window_name:		0	0
FindWindowA Aug. 9, 2021, 9:26 a.m.	class_name: File Monitor - Sysinternals: www.sysinternals.com window_name:		0	0
FindWindowA Aug. 9, 2021, 9:26 a.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA Aug. 9, 2021, 9:26 a.m.	class_name: Process Monitor - Sysinternals: www.sysinternals.com window_name:		0	0
FindWindowA Aug. 9, 2021, 9:26 a.m.	class_name: RegmonClass window_name:		0	0
FindWindowA Aug. 9, 2021, 9:26 a.m.	class_name: RegmonClass window_name:		0	0
FindWindowA Aug. 9, 2021, 9:26 a.m.	class_name: Registry Monitor - Sysinternals: www.sysinternals.com window_name:		0	0
FindWindowA Aug. 9, 2021, 9:26 a.m.	class_name: 18467-41 window_name:		0	0
FindWindowA Aug. 9, 2021, 9:26 a.m.	class_name: FilemonClass window_name:		0	0
FindWindowA Aug. 9, 2021, 9:26 a.m.	class_name: FilemonClass window_name:		0	0
FindWindowA Aug. 9, 2021, 9:26 a.m.	class_name: File Monitor - Sysinternals: www.sysinternals.com window_name:		0	0
FindWindowA Aug. 9, 2021, 9:26 a.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA Aug. 9, 2021, 9:26 a.m.	class_name: Process Monitor - Sysinternals: www.sysinternals.com window_name:		0	0
FindWindowA Aug. 9, 2021, 9:26 a.m.	class_name: RegmonClass window_name:		0	0
FindWindowA Aug. 9, 2021, 9:26 a.m.	class_name: RegmonClass window_name:		0	0
FindWindowA Aug. 9, 2021, 9:26 a.m.	class_name: Registry Monitor - Sysinternals: www.sysinternals.com window_name:		0	0
FindWindowA Aug. 9, 2021, 9:26 a.m.	class_name: 18467-41 window_name:		0	0
FindWindowA Aug. 9, 2021, 9:26 a.m.	class_name: Regmonclass window_name:		0	0
FindWindowA Aug. 9, 2021, 9:26 a.m.	class_name: Regmonclass window_name:		0	0
FindWindowA Aug. 9, 2021, 9:26 a.m.	class_name: 18467-41 window_name:		0	0
FindWindowA Aug. 9, 2021, 9:26 a.m.	class_name: Filemonclass window_name:		0	0
FindWindowA Aug. 9, 2021, 9:26 a.m.	class_name: Filemonclass window_name:		0	0
FindWindowA Aug. 9, 2021, 9:26 a.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA Aug. 9, 2021, 9:26 a.m.	class_name: Regmonclass window_name:		0	0
FindWindowA Aug. 9, 2021, 9:26 a.m.	class_name: Regmonclass window_name:		0	0
FindWindowA Aug. 9, 2021, 9:26 a.m.	class_name: 18467-41 window_name:		0	0
FindWindowA Aug. 9, 2021, 9:26 a.m.	class_name: Filemonclass window_name:		0	0
FindWindowA Aug. 9, 2021, 9:26 a.m.	class_name: Filemonclass window_name:		0	0
FindWindowA Aug. 9, 2021, 9:26 a.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA Aug. 9, 2021, 9:26 a.m.	class_name: Regmonclass window_name:		0	0
FindWindowA Aug. 9, 2021, 9:26 a.m.	class_name: Regmonclass window_name:		0	0
FindWindowA Aug. 9, 2021, 9:26 a.m.	class_name: 18467-41 window_name:		0	0
FindWindowA Aug. 9, 2021, 9:26 a.m.	class_name: Filemonclass window_name:		0	0
FindWindowA Aug. 9, 2021, 9:26 a.m.	class_name: Filemonclass window_name:		0	0
FindWindowA Aug. 9, 2021, 9:26 a.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA Aug. 9, 2021, 9:26 a.m.	class_name: Regmonclass window_name:		0	0
FindWindowA Aug. 9, 2021, 9:26 a.m.	class_name: Regmonclass window_name:		0	0
FindWindowA Aug. 9, 2021, 9:26 a.m.	class_name: 18467-41 window_name:		0	0
FindWindowA Aug. 9, 2021, 9:26 a.m.	class_name: Filemonclass window_name:		0	0
FindWindowA Aug. 9, 2021, 9:26 a.m.	class_name: Filemonclass window_name:		0	0
FindWindowA Aug. 9, 2021, 9:26 a.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA Aug. 9, 2021, 9:27 a.m.	class_name: Regmonclass window_name:		0	0
FindWindowA Aug. 9, 2021, 9:27 a.m.	class_name: Regmonclass window_name:		0	0
FindWindowA Aug. 9, 2021, 9:27 a.m.	class_name: 18467-41 window_name:		0	0
FindWindowA Aug. 9, 2021, 9:27 a.m.	class_name: Filemonclass window_name:		0	0
FindWindowA Aug. 9, 2021, 9:27 a.m.	class_name: Filemonclass window_name:		0	0
FindWindowA Aug. 9, 2021, 9:27 a.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA Aug. 9, 2021, 9:27 a.m.	class_name: Regmonclass window_name:		0	0
FindWindowA Aug. 9, 2021, 9:27 a.m.	class_name: Regmonclass window_name:		0	0

Checks the version of Bios, possibly for anti-virtualization (2 events)

registry	HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion
registry	HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion

Installs itself for autorun at Windows startup (2 events)

reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0				reg_value	rundll32.exe C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\test22\AppData\Local\Temp\IXP000.TMP\"
file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IntelRapid.lnk

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2588 resumed a thread in remote process 2688
NtResumeThread Aug. 9, 2021, 9:26 a.m.	thread_handle: 0x00000134 suspend_count: 0 process_identifier: 2688	1	0	0

Detects Virtual Machines through their custom firmware (1 event)

Time & API	Arguments	Status	Return	Repeated
NtQuerySystemInformation Aug. 9, 2021, 9:26 a.m.	information_class: 76 (SystemFirmwareTableInformation)		3221225507	0

Detects VMWare through the in instruction feature (1 event)

Time & API	Arguments	Status	Return	Repeated
__exception__ Aug. 9, 2021, 9:26 a.m.	stacktrace: exception.instruction_r: ed e9 af 40 04 00 c3 e9 c6 c7 fe ff c0 4c f5 68 exception.symbol: setup+0x39296c exception.instruction: in eax, dx exception.module: setup.exe exception.exception_code: 0xc0000096 exception.offset: 3746156 exception.address: 0xc4296c registers.esp: 4061976 registers.edi: 4730493 registers.eax: 1447909480 registers.ebp: 9265152 registers.edx: 22104 registers.ebx: 2256917605 registers.esi: 10338076 registers.ecx: 10	1	0	0

File has been identified by 32 AntiVirus engines on VirusTotal as malicious (32 events)

Bkav	W32.AIDetect.malware2
Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Trojan.Heur.GM.0000430180
FireEye	Gen:Trojan.Heur.GM.0000430180
Qihoo-360	Win32/Backdoor.Generic.HgIASZ0A
ALYac	Gen:Trojan.Heur.GM.0000430180
Sangfor	Trojan.Win32.Save.a
CrowdStrike	win/malicious_confidence_60% (W)
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/Packed.Themida.HXZ
APEX	Malicious
Paloalto	generic.ml
ClamAV	Win.Packed.Filerepmalware-9864117-0
Kaspersky	UDS:Backdoor.Win32.Agent
BitDefender	Gen:Trojan.Heur.GM.0000430180
NANO-Antivirus	Virus.Win32.Gen-Crypt.ccnc
Avast	Win32:TrojanX-gen [Trj]
Rising	Trojan.Generic@ML.100 (RDML:xZnzFMwNhZi19+y8bPvrgw)
Emsisoft	Gen:Trojan.Heur.GM.0000430180 (B)
McAfee-GW-Edition	BehavesLike.Win32.Generic.wc
Sophos	ML/PE-A
Microsoft	Trojan:Win32/Caynamer.A!ml
GData	Win32.Trojan.BSE.HLJWVB
McAfee	Artemis!9619AD1FDC2D
MAX	malware (ai score=88)
VBA32	BScope.Trojan.Scar
Malwarebytes	Malware.AI.1294164741
eGambit	Unsafe.AI_Score_100%
BitDefenderTheta	AI:Packer.F8FAFA691D
AVG	Win32:TrojanX-gen [Trj]
Cybereason	malicious.fdc2d4
Panda	Trj/CI.A

lv.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All