Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Aug. 15, 2021, 12:29 p.m.	Aug. 15, 2021, 12:32 p.m.

Size	968.2KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`4ff6c915da988f6746263dc2eb000261`
SHA256	`3cb7b7b5baa118be862271eb8c793bf67f6918f6eca53b097cde230059c13e80`
CRC32	`73B192DF`
ssdeep	`24576:1SLXIkuIoE7kxCRdkHonBZVQ5hSBwEPLWzq:24jCLBZVQ5ABwEDWzq`
Yara	PE_Header_Zero - PE File Signature Malicious_Library_Zero - Malicious_Library IsPE32 - (no description)

jushenkotak.exe "C:\Users\test22\AppData\Local\Temp\jushenkotak.exe"
1116
- dllhost.exe "C:\Windows\System32\dllhost.exe"
  2852
- cmd.exe "C:\Windows\System32\cmd.exe" /c cmd < Perisce.jar
  1444
  - cmd.exe cmd
    2988
    - findstr.exe findstr /V /R "^RjxbYtQhXRvMStXsrWjZzMEutIshVobYBYKPlbziZPusCiQZrGYjUBLtHgafMCaOxblTxouFDtZDGjDXRslgl$" Presto.jar
      2324
    - Preme.exe.com Preme.exe.com r
      2772
      - Preme.exe.com C:\Users\test22\AppData\Local\Temp\7ZipSfx.000\Preme.exe.com r
        2040
        
        RegAsm.exe C:\Users\test22\AppData\Local\Temp\7ZipSfx.000\RegAsm.exe ÿÿœîg
        2072
    - PING.EXE ping localhost -n 30
      2748

Name	Response	Post-Analysis Lookup
GtNmHgYRUJvNBAMdDUxmwxiv.GtNmHgYRUJvNBAMdDUxmwxiv
activityhike.com	A 95.142.37.102	95.142.37.102

IP Address	Status	Action
164.124.101.2	Active	Moloch
95.142.37.102	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.101:49212 -> 95.142.37.102:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined

Suricata TLS

Flow	Issuer	Subject	Fingerprint
TLSv1 192.168.56.101:49212 95.142.37.102:443	C=US, O=Let's Encrypt, CN=R3	CN=activityhike.com	d9:01:ff:be:cb:a6:56:e3:39:d0:f7:3c:c7:e7:6f:3f:31:76:43:01

Queries for the computername (4 events)

Time & API	Arguments	Status	Return
GetComputerNameW Aug. 15, 2021, 12:30 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 15, 2021, 12:30 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 15, 2021, 12:30 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 15, 2021, 12:30 p.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (5 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Aug. 15, 2021, 12:29 p.m.			0	0
IsDebuggerPresent Aug. 15, 2021, 12:29 p.m.			0	0
IsDebuggerPresent Aug. 15, 2021, 12:29 p.m.			0	0
IsDebuggerPresent Aug. 15, 2021, 12:30 p.m.			0	0
IsDebuggerPresent Aug. 15, 2021, 12:30 p.m.			0	0

Command line console output was observed (50 out of 89 events)

Time & API	Arguments	Status	Return
WriteConsoleW Aug. 15, 2021, 12:29 p.m.	buffer: Microsoft Windows [Version 6.1.7601] console_handle: 0x00000007	1	1
WriteConsoleW Aug. 15, 2021, 12:29 p.m.	buffer: Copyright (c) 2009 Microsoft Corporation. All rights reserved. console_handle: 0x00000007	1	1
WriteConsoleW Aug. 15, 2021, 12:29 p.m.	buffer: C:\Users\test22\AppData\Local\Temp\7ZipSfx.000> console_handle: 0x00000007	1	1
WriteConsoleW Aug. 15, 2021, 12:29 p.m.	buffer: Set jvxvJNqYfPQNJLqxFjEly=DESKTOP- console_handle: 0x00000007	1	1
WriteConsoleW Aug. 15, 2021, 12:29 p.m.	buffer: C:\Users\test22\AppData\Local\Temp\7ZipSfx.000> console_handle: 0x00000007	1	1
WriteConsoleW Aug. 15, 2021, 12:29 p.m.	buffer: Set GWLqqnyItSovqrDCmxYKmyDrZYKZeoWGzfPbKI=QO5QU33 console_handle: 0x00000007	1	1
WriteConsoleW Aug. 15, 2021, 12:29 p.m.	buffer: C:\Users\test22\AppData\Local\Temp\7ZipSfx.000> console_handle: 0x00000007	1	1
WriteConsoleW Aug. 15, 2021, 12:29 p.m.	buffer: Set UWTLgdgtwpKgs=ping localhost -n console_handle: 0x00000007	1	1
WriteConsoleW Aug. 15, 2021, 12:29 p.m.	buffer: C:\Users\test22\AppData\Local\Temp\7ZipSfx.000> console_handle: 0x00000007	1	1
WriteConsoleW Aug. 15, 2021, 12:29 p.m.	buffer: if %computername%==%jvxvJNqYfPQNJLqxFjEly% UWTLgdgtwpKgs 300 console_handle: 0x00000007	1	1
WriteConsoleW Aug. 15, 2021, 12:29 p.m.	buffer: C:\Users\test22\AppData\Local\Temp\7ZipSfx.000> console_handle: 0x00000007	1	1
WriteConsoleW Aug. 15, 2021, 12:29 p.m.	buffer: Set jjScSESKEpuixtlGGShsWlCEwGiQ=MZ console_handle: 0x00000007	1	1
WriteConsoleW Aug. 15, 2021, 12:29 p.m.	buffer: C:\Users\test22\AppData\Local\Temp\7ZipSfx.000> console_handle: 0x00000007	1	1
WriteConsoleW Aug. 15, 2021, 12:29 p.m.	buffer: <nul set /p = "%jjScSESKEpuixtlGGShsWlCEwGiQ%" > Preme.exe.com console_handle: 0x00000007	1	1
WriteConsoleW Aug. 15, 2021, 12:29 p.m.	buffer: C:\Users\test22\AppData\Local\Temp\7ZipSfx.000> console_handle: 0x00000007	1	1
WriteConsoleW Aug. 15, 2021, 12:29 p.m.	buffer: findstr /V /R "^RjxbYtQhXRvMStXsrWjZzMEutIshVobYBYKPlbziZPusCiQZrGYjUBLtHgafMCaOxblTxouFDtZDGjDXRslgl$" Presto.jar >> Preme.exe.com" console_handle: 0x00000007	1	1
WriteConsoleW Aug. 15, 2021, 12:29 p.m.	buffer: C:\Users\test22\AppData\Local\Temp\7ZipSfx.000> console_handle: 0x00000007	1	1
WriteConsoleW Aug. 15, 2021, 12:29 p.m.	buffer: copy Soffri.jar r console_handle: 0x00000007	1	1
WriteConsoleW Aug. 15, 2021, 12:29 p.m.	buffer: 1 file(s) copied. console_handle: 0x00000007	1	1
WriteConsoleW Aug. 15, 2021, 12:29 p.m.	buffer: C:\Users\test22\AppData\Local\Temp\7ZipSfx.000> console_handle: 0x00000007	1	1
WriteConsoleW Aug. 15, 2021, 12:29 p.m.	buffer: start Preme.exe.com r console_handle: 0x00000007	1	1
WriteConsoleW Aug. 15, 2021, 12:29 p.m.	buffer: C:\Users\test22\AppData\Local\Temp\7ZipSfx.000> console_handle: 0x00000007	1	1
WriteConsoleW Aug. 15, 2021, 12:29 p.m.	buffer: %UWTLgdgtwpKgs% 30 console_handle: 0x00000007	1	1
WriteConsoleW Aug. 15, 2021, 12:30 p.m.	buffer: C:\Users\test22\AppData\Local\Temp\7ZipSfx.000> console_handle: 0x00000007	1	1
WriteConsoleW Aug. 15, 2021, 12:30 p.m.	buffer: C:\Users\test22\AppData\Local\Temp\7ZipSfx.000> console_handle: 0x00000007	1	1
WriteConsoleA Aug. 15, 2021, 12:29 p.m.	buffer: Pinging test22-PC [::1] console_handle: 0x00000007	1	1
WriteConsoleA Aug. 15, 2021, 12:29 p.m.	buffer: with 32 bytes of data: console_handle: 0x00000007	1	1
WriteConsoleA Aug. 15, 2021, 12:29 p.m.	buffer: Reply from ::1: console_handle: 0x00000007	1	1
WriteConsoleA Aug. 15, 2021, 12:29 p.m.	buffer: time<1ms console_handle: 0x00000007	1	1
WriteConsoleA Aug. 15, 2021, 12:29 p.m.	buffer: Reply from ::1: console_handle: 0x00000007	1	1
WriteConsoleA Aug. 15, 2021, 12:29 p.m.	buffer: time<1ms console_handle: 0x00000007	1	1
WriteConsoleA Aug. 15, 2021, 12:29 p.m.	buffer: Reply from ::1: console_handle: 0x00000007	1	1
WriteConsoleA Aug. 15, 2021, 12:29 p.m.	buffer: time<1ms console_handle: 0x00000007	1	1
WriteConsoleA Aug. 15, 2021, 12:29 p.m.	buffer: Reply from ::1: console_handle: 0x00000007	1	1
WriteConsoleA Aug. 15, 2021, 12:29 p.m.	buffer: time<1ms console_handle: 0x00000007	1	1
WriteConsoleA Aug. 15, 2021, 12:29 p.m.	buffer: Reply from ::1: console_handle: 0x00000007	1	1
WriteConsoleA Aug. 15, 2021, 12:29 p.m.	buffer: time<1ms console_handle: 0x00000007	1	1
WriteConsoleA Aug. 15, 2021, 12:30 p.m.	buffer: Reply from ::1: console_handle: 0x00000007	1	1
WriteConsoleA Aug. 15, 2021, 12:30 p.m.	buffer: time<1ms console_handle: 0x00000007	1	1
WriteConsoleA Aug. 15, 2021, 12:30 p.m.	buffer: Reply from ::1: console_handle: 0x00000007	1	1
WriteConsoleA Aug. 15, 2021, 12:30 p.m.	buffer: time<1ms console_handle: 0x00000007	1	1
WriteConsoleA Aug. 15, 2021, 12:30 p.m.	buffer: Reply from ::1: console_handle: 0x00000007	1	1
WriteConsoleA Aug. 15, 2021, 12:30 p.m.	buffer: time<1ms console_handle: 0x00000007	1	1
WriteConsoleA Aug. 15, 2021, 12:30 p.m.	buffer: Reply from ::1: console_handle: 0x00000007	1	1
WriteConsoleA Aug. 15, 2021, 12:30 p.m.	buffer: time<1ms console_handle: 0x00000007	1	1
WriteConsoleA Aug. 15, 2021, 12:30 p.m.	buffer: Reply from ::1: console_handle: 0x00000007	1	1
WriteConsoleA Aug. 15, 2021, 12:30 p.m.	buffer: time<1ms console_handle: 0x00000007	1	1
WriteConsoleA Aug. 15, 2021, 12:30 p.m.	buffer: Reply from ::1: console_handle: 0x00000007	1	1
WriteConsoleA Aug. 15, 2021, 12:30 p.m.	buffer: time<1ms console_handle: 0x00000007	1	1
WriteConsoleA Aug. 15, 2021, 12:30 p.m.	buffer: Reply from ::1: console_handle: 0x00000007	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Aug. 15, 2021, 12:29 p.m.		1	1	0

The executable uses a known packer (1 event)

packer

Armadillo v1.71

HTTP traffic contains suspicious features which may be indicative of malware related traffic (3 events)

suspicious_features	GET method with no useragent header	suspicious_request	GET http://activityhike.com/files/red28.exe
suspicious_features	POST method with no referer header, POST method with no useragent header	suspicious_request	POST https://activityhike.com/core.php
suspicious_features	GET method with no useragent header	suspicious_request	GET https://activityhike.com/files/red28.exe

Performs some HTTP requests (3 events)

request	GET http://activityhike.com/files/red28.exe
request	POST https://activityhike.com/core.php
request	GET https://activityhike.com/files/red28.exe

Sends data using the HTTP POST Method (1 event)

request

POST https://activityhike.com/core.php

Allocates read-write-execute memory (usually to unpack itself) (50 out of 68 events)

Time & API	Arguments	Status
NtProtectVirtualMemory Aug. 15, 2021, 12:29 p.m.	process_identifier: 1116 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73702000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 15, 2021, 12:29 p.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73702000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 15, 2021, 12:29 p.m.	process_identifier: 2040 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73702000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 15, 2021, 12:30 p.m.	process_identifier: 2040 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00810000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 15, 2021, 12:30 p.m.	process_identifier: 2040 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00820000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 15, 2021, 12:30 p.m.	process_identifier: 2072 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72582000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 15, 2021, 12:30 p.m.	process_identifier: 2072 region_size: 1507328 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00960000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 15, 2021, 12:30 p.m.	process_identifier: 2072 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a90000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 15, 2021, 12:30 p.m.	process_identifier: 2072 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x70252000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 15, 2021, 12:30 p.m.	process_identifier: 2072 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x724fb000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 15, 2021, 12:30 p.m.	process_identifier: 2072 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6fc11000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 15, 2021, 12:30 p.m.	process_identifier: 2072 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6fc12000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 15, 2021, 12:30 p.m.	process_identifier: 2072 region_size: 1114112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00ad0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 15, 2021, 12:30 p.m.	process_identifier: 2072 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00ba0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 15, 2021, 12:30 p.m.	process_identifier: 2072 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00972000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 15, 2021, 12:30 p.m.	process_identifier: 2072 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x009a5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 15, 2021, 12:30 p.m.	process_identifier: 2072 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x009ab000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 15, 2021, 12:30 p.m.	process_identifier: 2072 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x009a7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 15, 2021, 12:30 p.m.	process_identifier: 2072 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0098c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 15, 2021, 12:30 p.m.	process_identifier: 2072 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7242a000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 15, 2021, 12:30 p.m.	process_identifier: 2072 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a70000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 15, 2021, 12:30 p.m.	process_identifier: 2072 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0097a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 15, 2021, 12:30 p.m.	process_identifier: 2072 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0099a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 15, 2021, 12:30 p.m.	process_identifier: 2072 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00997000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 15, 2021, 12:30 p.m.	process_identifier: 2072 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00996000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 15, 2021, 12:30 p.m.	process_identifier: 2072 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7292f000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 15, 2021, 12:30 p.m.	process_identifier: 2072 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x736e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 15, 2021, 12:30 p.m.	process_identifier: 2072 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x77371000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 15, 2021, 12:30 p.m.	process_identifier: 2072 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x728b1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 15, 2021, 12:30 p.m.	process_identifier: 2072 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76891000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 15, 2021, 12:30 p.m.	process_identifier: 2072 region_size: 327680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef50000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 15, 2021, 12:30 p.m.	process_identifier: 2072 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 15, 2021, 12:30 p.m.	process_identifier: 2072 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 15, 2021, 12:30 p.m.	process_identifier: 2072 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef58000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 15, 2021, 12:30 p.m.	process_identifier: 2072 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef40000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 15, 2021, 12:30 p.m.	process_identifier: 2072 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 15, 2021, 12:30 p.m.	process_identifier: 2072 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x71f61000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 15, 2021, 12:30 p.m.	process_identifier: 2072 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73361000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 15, 2021, 12:30 p.m.	process_identifier: 2072 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6c726000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 15, 2021, 12:30 p.m.	process_identifier: 2072 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a71000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 15, 2021, 12:30 p.m.	process_identifier: 2072 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a72000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 15, 2021, 12:30 p.m.	process_identifier: 2072 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a73000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 15, 2021, 12:30 p.m.	process_identifier: 2072 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6c6f1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 15, 2021, 12:30 p.m.	process_identifier: 2072 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6c661000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 15, 2021, 12:30 p.m.	process_identifier: 2072 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73d11000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 15, 2021, 12:30 p.m.	process_identifier: 2072 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0098a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 15, 2021, 12:30 p.m.	process_identifier: 2072 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a74000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 15, 2021, 12:30 p.m.	process_identifier: 2072 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73701000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 15, 2021, 12:30 p.m.	process_identifier: 2072 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72b94000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 15, 2021, 12:30 p.m.	process_identifier: 2072 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73702000 process_handle: 0xffffffff	1

Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation (1 event)

Time & API	Arguments	Status	Return	Repeated
GetDiskFreeSpaceExW Aug. 15, 2021, 12:29 p.m.	total_number_of_free_bytes: 0 free_bytes_available: 13726535680 root_path: C:\Users\test22\AppData\Local\Temp\7ZipSfx.000 total_number_of_bytes: 0	1	1	0

Creates executable files on the filesystem (3 events)

file	C:\Users\test22\AppData\Local\Temp\7ZipSfx.000\Preme.exe.com
file	C:\Users\test22\AppData\Roaming\vdOFTyHlVi\YbaOmNXcbb.exe.com
file	C:\Users\test22\AppData\Roaming\vdOFTyHlVi\qlBAJBigfnwU.js

Creates a suspicious process (1 event)

cmdline

"C:\Windows\System32\cmd.exe" /c cmd < Perisce.jar

Drops a binary and executes it (1 event)

file	C:\Users\test22\AppData\Local\Temp\7ZipSfx.000\Preme.exe.com

Drops an executable to the user AppData folder (2 events)

file	C:\Users\test22\AppData\Local\Temp\7ZipSfx.000\RegAsm.exe
file	C:\Users\test22\AppData\Local\Temp\7ZipSfx.000\Preme.exe.com

Executes one or more WMI queries (4 events)

wmi	SELECT * FROM Win32_VideoController
wmi	SELECT * FROM Win32_OperatingSystem
wmi	SELECT * FROM Win32_Processor
wmi	SELECT * FROM Win32_PhysicalMemory

A process created a hidden window (1 event)

Time & API	Arguments	Status	Return	Repeated
ShellExecuteExW Aug. 15, 2021, 12:29 p.m.	show_type: 0 filepath_r: cmd parameters: /c cmd < Perisce.jar filepath: cmd	1	1	0

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses Aug. 15, 2021, 12:30 p.m.	flags: 1158 family: 0	1	0	0

Potentially malicious URLs were found in the process memory dump (3 events)

url	http://www.microsoft.com/schemas/ie8tldlistdescription/1.0
url	http://purl.org/rss/1.0/
url	http://www.passport.com

Yara rule detected in process memory (32 events)

description	Communication using DGA	rule	Network_DGA
description	Communications use DNS	rule	Network_DNS
description	Communications over RAW Socket	rule	Network_TCP_Socket
description	Create a windows service	rule	Create_Service
description	Record Audio	rule	Sniff_Audio
description	Escalate priviledges	rule	Escalate_priviledges
description	Run a KeyLogger	rule	KeyLogger
description	Code injection with CreateRemoteThread in a remote process	rule	Code_injection
description	Communications over HTTP	rule	Network_HTTP
description	Hijack network configuration	rule	Hijack_Network
description	Match Windows Inet API call	rule	Str_Win32_Internet_API
description	Communications over FTP	rule	Network_FTP
description	Take ScreenShot	rule	ScreenShot
description	Match Windows Http API call	rule	Str_Win32_Http_API
description	Steal credential	rule	local_credential_Steal
description	File Downloader	rule	Network_Downloader
description	Communications over P2P network	rule	Network_P2P_Win
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerCheck__RemoteAPI
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	DebuggerException__ConsoleCtrl
description	(no description)	rule	DebuggerException__SetConsoleCtrl
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	(no description)	rule	Check_Dlls
description	Checks if being debugged	rule	anti_dbg
description	Anti-Sandbox checks for ThreatExpert	rule	antisb_threatExpert
description	Bypass DEP	rule	disable_dep
description	Affect hook table	rule	win_hook
description	Install itself for autorun at Windows startup	rule	Persistence

Uses Windows utilities for basic Windows functionality (1 event)

cmdline

ping localhost -n 30

Executes one or more WMI queries which can be used to identify virtual machines (2 events)

wmi	SELECT * FROM Win32_Processor
wmi	SELECT * FROM Win32_PhysicalMemory

Installs itself for autorun at Windows startup (1 event)

file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\YbaOmNXcbb.url

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2988 resumed a thread in remote process 2772
NtResumeThread Aug. 15, 2021, 12:29 p.m.	thread_handle: 0x00000090 suspend_count: 0 process_identifier: 2772	1	0	0

File has been identified by 32 AntiVirus engines on VirusTotal as malicious (32 events)

Lionic	Trojan.Win32.Agent.m!c
Elastic	malicious (high confidence)
Cynet	Malicious (score: 100)
McAfee	RDN/Generic BackDoor
Cylance	Unsafe
Zillya	Backdoor.Agent.Win32.80898
Sangfor	Backdoor.Win32.Agent.myucsq
Alibaba	Backdoor:Win32/Injector.b0d20d81
K7GW	Trojan ( 0056312b1 )
K7AntiVirus	Trojan ( 0056312b1 )
Symantec	Trojan.Gen.MBT
ESET-NOD32	multiple detections
Paloalto	generic.ml
Kaspersky	Backdoor.Win32.Agent.myucsq
Avast	Win32:Trojan-gen
Sophos	Mal/Generic-R
TrendMicro	TROJ_GEN.R011C0PHB21
McAfee-GW-Edition	RDN/Generic BackDoor
Jiangmin	Trojan.Alien.kc
Gridinsoft	Trojan.Win32.Agent.oa!s1
ZoneAlarm	Backdoor.Win32.Agent.myucsq
Microsoft	Trojan:Win32/Sabsik.FL.B!ml
VBA32	Backdoor.Agent
TrendMicro-HouseCall	TROJ_GEN.R011C0PHB21
Tencent	Malware.Win32.Gencirc.11c821d1
Yandex	Backdoor.Agent!UOJWaa2B1WA
MAX	malware (ai score=99)
eGambit	Unsafe.AI_Score_99%
Fortinet	W32/Agent.MYUCSQ!tr.bdr
AVG	Win32:Trojan-gen
Panda	Trj/CI.A
Qihoo-360	Win32/Backdoor.Generic.HyoDNjcA

jushenkotak.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All