Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	Aug. 13, 2021, 9:42 a.m.	Aug. 13, 2021, 9:44 a.m.

Size	4.7MB
Type	PE32 executable (console) Intel 80386, for MS Windows
MD5	`1d8f32a4bcd066413acbb8c4bf6037c9`
SHA256	`5d682001504dc58701765ca9721e4b4b9eb5b5e73469731fe787d15217cd7435`
CRC32	`33C8F2B6`
ssdeep	`98304:JVzGNV9HkAK+sGxBlPKHj6ePKVpP+JRILRe/FaEZeSoPdVaKU+Ft:PzGNVyAK+txBliAVpPYGRe/FPD8dVaKU`
Yara	Malicious_Packer_Zero - Malicious Packer Win32_Trojan_Gen_2_0904B0_Zero - Win32 Trojan Gen Generic_Malware_Zero - Generic Malware anti_vm_detect - Possibly employs anti-virtualization techniques Is_DotNET_EXE - (no description) UPX_Zero - UPX packed file Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature IsPE32 - (no description)

sw.exe "C:\Users\test22\AppData\Local\Temp\sw.exe"
248

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
46.28.205.147	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Aug. 13, 2021, 9:42 a.m.			0	0
IsDebuggerPresent Aug. 13, 2021, 9:42 a.m.			0	0

Uses Windows APIs to generate a cryptographic key (3 events)

Time & API	Arguments	Status	Return
CryptExportKey Aug. 13, 2021, 9:42 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x008c9728 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 13, 2021, 9:42 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x008c9728 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 13, 2021, 9:42 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x008c9768 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Aug. 13, 2021, 9:42 a.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 events)

section
section	\xe2\x94\x9e Quiz
section	.themida

The file contains an unknown PE resource name possibly indicative of a packer (2 events)

resource name	DIFX64
resource name	DIFX86

One or more processes crashed (3 events)

Time & API	Arguments	Status
__exception__ Aug. 13, 2021, 9:42 a.m.	stacktrace: sw+0x3524ff @ 0x3c24ff sw+0x3643ed @ 0x3d43ed exception.instruction_r: c9 c2 10 00 cc cc cc cc cc e9 64 c3 b7 8a 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008e exception.offset: 46887 exception.address: 0x7566b727 registers.esp: 8715988 registers.edi: 1671168 registers.eax: 8715988 registers.ebp: 8716068 registers.edx: 2130566132 registers.ebx: 32 registers.esi: 2008380459 registers.ecx: 3891134464	1
__exception__ Aug. 13, 2021, 9:42 a.m.	stacktrace: exception.instruction_r: ed e9 28 34 09 00 f7 00 35 ff 0a 00 00 00 10 00 exception.symbol: sw+0x31c82e exception.instruction: in eax, dx exception.module: sw.exe exception.exception_code: 0xc0000096 exception.offset: 3262510 exception.address: 0x38c82e registers.esp: 8716108 registers.edi: 2476093 registers.eax: 1750617430 registers.ebp: 1671168 registers.edx: 22614 registers.ebx: 2147483650 registers.esi: 1919142 registers.ecx: 20	1
__exception__ Aug. 13, 2021, 9:42 a.m.	stacktrace: exception.instruction_r: ed e9 1e 2b 00 00 c3 e9 cc a3 03 00 05 0e 88 ce exception.symbol: sw+0x37015a exception.instruction: in eax, dx exception.module: sw.exe exception.exception_code: 0xc0000096 exception.offset: 3604826 exception.address: 0x3e015a registers.esp: 8716108 registers.edi: 2476093 registers.eax: 1447909480 registers.ebp: 1671168 registers.edx: 22104 registers.ebx: 2256917605 registers.esi: 1919142 registers.ecx: 10	1

Allocates read-write-execute memory (usually to unpack itself) (50 out of 123 events)

Time & API	Arguments	Status
NtProtectVirtualMemory Aug. 13, 2021, 9:42 a.m.	process_identifier: 248 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a43000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 13, 2021, 9:42 a.m.	process_identifier: 248 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75671000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 13, 2021, 9:42 a.m.	process_identifier: 248 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a44000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 13, 2021, 9:42 a.m.	process_identifier: 248 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75670000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 13, 2021, 9:42 a.m.	process_identifier: 248 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a41000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 13, 2021, 9:42 a.m.	process_identifier: 248 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75671000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 13, 2021, 9:42 a.m.	process_identifier: 248 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a43000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 13, 2021, 9:42 a.m.	process_identifier: 248 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7566c000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 13, 2021, 9:42 a.m.	process_identifier: 248 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a44000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 13, 2021, 9:42 a.m.	process_identifier: 248 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75671000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 13, 2021, 9:42 a.m.	process_identifier: 248 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a44000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 13, 2021, 9:42 a.m.	process_identifier: 248 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a44000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 13, 2021, 9:42 a.m.	process_identifier: 248 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75671000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 13, 2021, 9:42 a.m.	process_identifier: 248 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a44000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 13, 2021, 9:42 a.m.	process_identifier: 248 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a5a000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 13, 2021, 9:42 a.m.	process_identifier: 248 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a44000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 13, 2021, 9:42 a.m.	process_identifier: 248 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75678000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 13, 2021, 9:42 a.m.	process_identifier: 248 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a41000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 13, 2021, 9:42 a.m.	process_identifier: 248 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75678000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 13, 2021, 9:42 a.m.	process_identifier: 248 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a6c000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 13, 2021, 9:42 a.m.	process_identifier: 248 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75678000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 13, 2021, 9:42 a.m.	process_identifier: 248 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a45000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 13, 2021, 9:42 a.m.	process_identifier: 248 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75678000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 13, 2021, 9:42 a.m.	process_identifier: 248 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a44000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 13, 2021, 9:42 a.m.	process_identifier: 248 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75671000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 13, 2021, 9:42 a.m.	process_identifier: 248 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a5c000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 13, 2021, 9:42 a.m.	process_identifier: 248 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75671000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 13, 2021, 9:42 a.m.	process_identifier: 248 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a43000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 13, 2021, 9:42 a.m.	process_identifier: 248 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75671000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 13, 2021, 9:42 a.m.	process_identifier: 248 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a41000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 13, 2021, 9:42 a.m.	process_identifier: 248 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75671000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 13, 2021, 9:42 a.m.	process_identifier: 248 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a45000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 13, 2021, 9:42 a.m.	process_identifier: 248 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a6c000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 13, 2021, 9:42 a.m.	process_identifier: 248 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7566b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 13, 2021, 9:42 a.m.	process_identifier: 248 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a6d000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 13, 2021, 9:42 a.m.	process_identifier: 248 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7566c000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 13, 2021, 9:42 a.m.	process_identifier: 248 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a41000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 13, 2021, 9:42 a.m.	process_identifier: 248 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7566b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 13, 2021, 9:42 a.m.	process_identifier: 248 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a44000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 13, 2021, 9:42 a.m.	process_identifier: 248 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7566b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 13, 2021, 9:42 a.m.	process_identifier: 248 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a41000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 13, 2021, 9:42 a.m.	process_identifier: 248 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7566d000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 13, 2021, 9:42 a.m.	process_identifier: 248 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a45000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 13, 2021, 9:42 a.m.	process_identifier: 248 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7566b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 13, 2021, 9:42 a.m.	process_identifier: 248 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a5c000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 13, 2021, 9:42 a.m.	process_identifier: 248 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76abf000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 13, 2021, 9:42 a.m.	process_identifier: 248 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a43000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 13, 2021, 9:42 a.m.	process_identifier: 248 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7567b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 13, 2021, 9:42 a.m.	process_identifier: 248 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a45000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 13, 2021, 9:42 a.m.	process_identifier: 248 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7567b000 process_handle: 0xffffffff	1

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses Aug. 13, 2021, 9:42 a.m.	flags: 15 family: 0		111	0

The binary likely contains encrypted or compressed data indicative of a packer (3 events)

section

{u'size_of_data': u'0x00018400', u'virtual_address': u'0x00002000', u'entropy': 7.968953744646836, u'name': u' ', u'virtual_size': u'0x00030000'}

entropy

7.96895374465

description

A section with a high entropy has been found

section

{u'size_of_data': u'0x000f1200', u'virtual_address': u'0x00032000', u'entropy': 7.999827747403565, u'name': u'\\xe2\\x94\\x9e Quiz', u'virtual_size': u'0x000f115c'}

entropy

7.9998277474

description

A section with a high entropy has been found

entropy

0.219908846074

description

Overall entropy of this PE file is high

Communicates with host for which no DNS query was performed (1 event)

host

46.28.205.147

Checks for the presence of known windows from debuggers and forensic tools (50 out of 159 events)

Time & API	Arguments	Status	Return	Repeated
FindWindowA Aug. 13, 2021, 9:42 a.m.	class_name: RegmonClass window_name:		0	0
FindWindowA Aug. 13, 2021, 9:42 a.m.	class_name: RegmonClass window_name:		0	0
FindWindowA Aug. 13, 2021, 9:42 a.m.	class_name: Registry Monitor - Sysinternals: www.sysinternals.com window_name:		0	0
FindWindowA Aug. 13, 2021, 9:42 a.m.	class_name: 18467-41 window_name:		0	0
FindWindowA Aug. 13, 2021, 9:42 a.m.	class_name: FilemonClass window_name:		0	0
FindWindowA Aug. 13, 2021, 9:42 a.m.	class_name: FilemonClass window_name:		0	0
FindWindowA Aug. 13, 2021, 9:42 a.m.	class_name: File Monitor - Sysinternals: www.sysinternals.com window_name:		0	0
FindWindowA Aug. 13, 2021, 9:42 a.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA Aug. 13, 2021, 9:42 a.m.	class_name: Process Monitor - Sysinternals: www.sysinternals.com window_name:		0	0
FindWindowA Aug. 13, 2021, 9:42 a.m.	class_name: Regmonclass window_name:		0	0
FindWindowA Aug. 13, 2021, 9:42 a.m.	class_name: Regmonclass window_name:		0	0
FindWindowA Aug. 13, 2021, 9:42 a.m.	class_name: 18467-41 window_name:		0	0
FindWindowA Aug. 13, 2021, 9:42 a.m.	class_name: Filemonclass window_name:		0	0
FindWindowA Aug. 13, 2021, 9:42 a.m.	class_name: Filemonclass window_name:		0	0
FindWindowA Aug. 13, 2021, 9:42 a.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA Aug. 13, 2021, 9:42 a.m.	class_name: Regmonclass window_name:		0	0
FindWindowA Aug. 13, 2021, 9:42 a.m.	class_name: Regmonclass window_name:		0	0
FindWindowA Aug. 13, 2021, 9:42 a.m.	class_name: 18467-41 window_name:		0	0
FindWindowA Aug. 13, 2021, 9:42 a.m.	class_name: Filemonclass window_name:		0	0
FindWindowA Aug. 13, 2021, 9:42 a.m.	class_name: Filemonclass window_name:		0	0
FindWindowA Aug. 13, 2021, 9:42 a.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA Aug. 13, 2021, 9:42 a.m.	class_name: Regmonclass window_name:		0	0
FindWindowA Aug. 13, 2021, 9:42 a.m.	class_name: Regmonclass window_name:		0	0
FindWindowA Aug. 13, 2021, 9:42 a.m.	class_name: 18467-41 window_name:		0	0
FindWindowA Aug. 13, 2021, 9:42 a.m.	class_name: Filemonclass window_name:		0	0
FindWindowA Aug. 13, 2021, 9:42 a.m.	class_name: Filemonclass window_name:		0	0
FindWindowA Aug. 13, 2021, 9:42 a.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA Aug. 13, 2021, 9:42 a.m.	class_name: Regmonclass window_name:		0	0
FindWindowA Aug. 13, 2021, 9:42 a.m.	class_name: Regmonclass window_name:		0	0
FindWindowA Aug. 13, 2021, 9:42 a.m.	class_name: 18467-41 window_name:		0	0
FindWindowA Aug. 13, 2021, 9:42 a.m.	class_name: Filemonclass window_name:		0	0
FindWindowA Aug. 13, 2021, 9:42 a.m.	class_name: Filemonclass window_name:		0	0
FindWindowA Aug. 13, 2021, 9:42 a.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA Aug. 13, 2021, 9:42 a.m.	class_name: Regmonclass window_name:		0	0
FindWindowA Aug. 13, 2021, 9:42 a.m.	class_name: Regmonclass window_name:		0	0
FindWindowA Aug. 13, 2021, 9:42 a.m.	class_name: 18467-41 window_name:		0	0
FindWindowA Aug. 13, 2021, 9:42 a.m.	class_name: Filemonclass window_name:		0	0
FindWindowA Aug. 13, 2021, 9:42 a.m.	class_name: Filemonclass window_name:		0	0
FindWindowA Aug. 13, 2021, 9:42 a.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA Aug. 13, 2021, 9:42 a.m.	class_name: Regmonclass window_name:		0	0
FindWindowA Aug. 13, 2021, 9:42 a.m.	class_name: Regmonclass window_name:		0	0
FindWindowA Aug. 13, 2021, 9:42 a.m.	class_name: 18467-41 window_name:		0	0
FindWindowA Aug. 13, 2021, 9:42 a.m.	class_name: Filemonclass window_name:		0	0
FindWindowA Aug. 13, 2021, 9:42 a.m.	class_name: Filemonclass window_name:		0	0
FindWindowA Aug. 13, 2021, 9:42 a.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA Aug. 13, 2021, 9:42 a.m.	class_name: Regmonclass window_name:		0	0
FindWindowA Aug. 13, 2021, 9:42 a.m.	class_name: Regmonclass window_name:		0	0
FindWindowA Aug. 13, 2021, 9:42 a.m.	class_name: 18467-41 window_name:		0	0
FindWindowA Aug. 13, 2021, 9:42 a.m.	class_name: Filemonclass window_name:		0	0
FindWindowA Aug. 13, 2021, 9:42 a.m.	class_name: Filemonclass window_name:		0	0

Checks the version of Bios, possibly for anti-virtualization (2 events)

registry	HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion
registry	HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion

Detects Virtual Machines through their custom firmware (1 event)

Time & API	Arguments	Status	Return	Repeated
NtQuerySystemInformation Aug. 13, 2021, 9:42 a.m.	information_class: 76 (SystemFirmwareTableInformation)		3221225507	0

Detects VMWare through the in instruction feature (1 event)

Time & API	Arguments	Status	Return	Repeated
__exception__ Aug. 13, 2021, 9:42 a.m.	stacktrace: exception.instruction_r: ed e9 1e 2b 00 00 c3 e9 cc a3 03 00 05 0e 88 ce exception.symbol: sw+0x37015a exception.instruction: in eax, dx exception.module: sw.exe exception.exception_code: 0xc0000096 exception.offset: 3604826 exception.address: 0x3e015a registers.esp: 8716108 registers.edi: 2476093 registers.eax: 1447909480 registers.ebp: 1671168 registers.edx: 22104 registers.ebx: 2256917605 registers.esi: 1919142 registers.ecx: 10	1	0	0

File has been identified by 24 AntiVirus engines on VirusTotal as malicious (24 events)

Bkav	W32.AIDetect.malware2
Lionic	Trojan.Win32.Generic.4!c
Elastic	malicious (high confidence)
McAfee	Artemis!1D8F32A4BCD0
Cylance	Unsafe
Sangfor	Trojan.Win32.Save.a
CrowdStrike	win/malicious_confidence_100% (W)
APEX	Malicious
Kaspersky	UDS:Trojan-PSW.MSIL.Reline
NANO-Antivirus	Virus.Win32.Gen.ccmw
Avast	FileRepMalware
Sophos	Mal/Generic-R
FireEye	Generic.mg.1d8f32a4bcd06641
Kingsoft	Win32.Heur.KVMH008.a.(kcloud)
Gridinsoft	Trojan.Win32.Agent.oa
Microsoft	Trojan:Win32/Sabsik.FL.B!ml
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win.Generic.R429793
BitDefenderTheta	Gen:NN.ZexaF.34058.@B0@aePeBMuP
VBA32	BScope.Trojan.Wacatac
Malwarebytes	Malware.Heuristic.1003
MaxSecure	Trojan.Malware.300983.susgen
AVG	FileRepMalware
Qihoo-360	Win32/Trojan.Generic.HxMBueAA

sw.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All