Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	Aug. 19, 2021, 9:38 a.m.	Aug. 19, 2021, 10:11 a.m.

Size	1019.5KB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`05057af2091a89b9e8493804e4d0551f`
SHA256	`b1c44efc8a0822c7c6949ee3ce9f6629893abf9a59dbfbfbf888a627c4f348e9`
CRC32	`6C9F1A04`
ssdeep	`12288:ykDc9F3nC0Py3gAh3JYhfAGQqWIWqKHNduhbZoDx68xT7M+i2TvG27M:yI6hf1fZWZPouvbi2zG+`
Yara	PE_Header_Zero - PE File Signature Admin_Tool_IN_Zero - Admin Tool Sysinternals Generic_Malware_Zero - Generic Malware Is_DotNET_EXE - (no description) IsPE32 - (no description)

word.exe "C:\Users\test22\AppData\Local\Temp\word.exe"
2484
- schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\DbbOsaGaKPV" /XML "C:\Users\test22\AppData\Local\Temp\tmp229F.tmp"
  2332
- word.exe "C:\Users\test22\AppData\Local\Temp\word.exe"
  2212
explorer.exe C:\Windows\Explorer.EXE
1236

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
164.124.101.2	Active	Moloch
20.150.137.35	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (1 event)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameW Aug. 19, 2021, 10:10 a.m.	computer_name: TEST22-PC	1	1	0

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Aug. 19, 2021, 9:38 a.m.			0	0
IsDebuggerPresent Aug. 19, 2021, 9:38 a.m.			0	0

Command line console output was observed (1 event)

Time & API	Arguments	Status	Return	Repeated
WriteConsoleW Aug. 19, 2021, 10:10 a.m.	buffer: SUCCESS: The scheduled task "Updates\DbbOsaGaKPV" has successfully been created. console_handle: 0x00000007	1	1	0

Uses Windows APIs to generate a cryptographic key (3 events)

Time & API	Arguments	Status	Return
CryptExportKey Aug. 19, 2021, 9:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003c5d08 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 19, 2021, 9:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003c5e08 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 19, 2021, 9:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003c5e08 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Aug. 19, 2021, 9:38 a.m.		1	1	0

One or more processes crashed (1 event)

Time & API	Arguments	Status	Return	Repeated
__exception__ Aug. 19, 2021, 10:10 a.m.	stacktrace: word+0x3626 @ 0x403626 word+0x1145b @ 0x41145b word+0x13649 @ 0x413649 word+0x5d61 @ 0x405d61 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76a433ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77b19ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77b19ea5 exception.instruction_r: 0f b7 01 66 89 02 41 41 42 42 66 85 c0 75 f1 c7 exception.symbol: lstrcpyW+0x16 IsBadStringPtrA-0x5b kernel32+0x33118 exception.instruction: movzx eax, word ptr [ecx] exception.module: kernel32.dll exception.exception_code: 0xc0000005 exception.offset: 209176 exception.address: 0x76a63118 registers.esp: 3272808 registers.edi: 3272948 registers.eax: 3272832 registers.ebp: 3272848 registers.edx: 18219008 registers.ebx: 3273088 registers.esi: 3273104 registers.ecx: 0	1	0	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (44 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Aug. 19, 2021, 9:38 a.m.	process_identifier: 2484 region_size: 983040 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004e0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 19, 2021, 9:38 a.m.	process_identifier: 2484 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00590000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 19, 2021, 9:38 a.m.	process_identifier: 2484 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x731a1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 19, 2021, 9:38 a.m.	process_identifier: 2484 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x731a2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 19, 2021, 9:38 a.m.	process_identifier: 2484 region_size: 2162688 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00c30000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 19, 2021, 9:38 a.m.	process_identifier: 2484 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00e00000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 19, 2021, 9:38 a.m.	process_identifier: 2484 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00512000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 19, 2021, 9:38 a.m.	process_identifier: 2484 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00545000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 19, 2021, 9:38 a.m.	process_identifier: 2484 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0054b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 19, 2021, 9:38 a.m.	process_identifier: 2484 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00547000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 19, 2021, 9:38 a.m.	process_identifier: 2484 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0052c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 19, 2021, 9:38 a.m.	process_identifier: 2484 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00660000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 19, 2021, 9:38 a.m.	process_identifier: 2484 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0051a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 19, 2021, 9:38 a.m.	process_identifier: 2484 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0053a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 19, 2021, 9:38 a.m.	process_identifier: 2484 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00537000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 19, 2021, 9:38 a.m.	process_identifier: 2484 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0052a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 19, 2021, 9:38 a.m.	process_identifier: 2484 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00536000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 19, 2021, 9:38 a.m.	process_identifier: 2484 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00661000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 19, 2021, 9:38 a.m.	process_identifier: 2484 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0051c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 19, 2021, 9:38 a.m.	process_identifier: 2484 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6ff02000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 19, 2021, 9:38 a.m.	process_identifier: 2484 region_size: 327680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef50000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 19, 2021, 9:38 a.m.	process_identifier: 2484 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 19, 2021, 9:38 a.m.	process_identifier: 2484 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 19, 2021, 9:38 a.m.	process_identifier: 2484 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef58000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 19, 2021, 9:38 a.m.	process_identifier: 2484 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef40000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 19, 2021, 9:38 a.m.	process_identifier: 2484 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 19, 2021, 9:38 a.m.	process_identifier: 2484 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00662000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 19, 2021, 9:38 a.m.	process_identifier: 2484 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0052d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 19, 2021, 9:38 a.m.	process_identifier: 2484 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0052e000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 19, 2021, 9:38 a.m.	process_identifier: 2484 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00663000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 19, 2021, 9:38 a.m.	process_identifier: 2484 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00664000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 19, 2021, 9:38 a.m.	process_identifier: 2484 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00665000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 19, 2021, 9:38 a.m.	process_identifier: 2484 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00666000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 19, 2021, 9:38 a.m.	process_identifier: 2484 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00667000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 19, 2021, 9:38 a.m.	process_identifier: 2484 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00668000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 19, 2021, 9:38 a.m.	process_identifier: 2484 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00669000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 19, 2021, 9:38 a.m.	process_identifier: 2484 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0066a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 19, 2021, 9:38 a.m.	process_identifier: 2484 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0066b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 19, 2021, 9:38 a.m.	process_identifier: 2484 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0066c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 19, 2021, 9:38 a.m.	process_identifier: 2484 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0066d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 19, 2021, 9:38 a.m.	process_identifier: 2484 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0066e000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 19, 2021, 9:38 a.m.	process_identifier: 2484 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0066f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 19, 2021, 9:38 a.m.	process_identifier: 2484 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0b7a0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 19, 2021, 9:38 a.m.	process_identifier: 2484 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0b7a1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation (1 event)

Time & API	Arguments	Status	Return	Repeated
GetDiskFreeSpaceExW Aug. 19, 2021, 10:03 a.m.	total_number_of_free_bytes: 10929209344 free_bytes_available: 10929209344 root_path: C:\ total_number_of_bytes: 34252779520	1	1	0

Creates a suspicious process (2 events)

cmdline	schtasks.exe /Create /TN "Updates\DbbOsaGaKPV" /XML "C:\Users\test22\AppData\Local\Temp\tmp229F.tmp"
cmdline	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\DbbOsaGaKPV" /XML "C:\Users\test22\AppData\Local\Temp\tmp229F.tmp"

A process created a hidden window (1 event)

Time & API	Arguments	Status	Return	Repeated
ShellExecuteExW Aug. 19, 2021, 9:38 a.m.	show_type: 0 filepath_r: schtasks.exe parameters: /Create /TN "Updates\DbbOsaGaKPV" /XML "C:\Users\test22\AppData\Local\Temp\tmp229F.tmp" filepath: schtasks.exe	1	1	0

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x000d3a00', u'virtual_address': u'0x00002000', u'entropy': 7.27318547195093, u'name': u'.text', u'virtual_size': u'0x000d3984'}

entropy

7.27318547195

description

A section with a high entropy has been found

entropy

0.830716388616

description

Overall entropy of this PE file is high

Yara rule detected in process memory (17 events)

description	Communications use DNS	rule	Network_DNS
description	Communications over RAW Socket	rule	Network_TCP_Socket
description	Escalate priviledges	rule	Escalate_priviledges
description	Run a KeyLogger	rule	KeyLogger
description	Code injection with CreateRemoteThread in a remote process	rule	Code_injection
description	email clients info stealer	rule	infoStealer_emailClients_Zero
description	File Downloader	rule	Network_Downloader
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep
description	Affect hook table	rule	win_hook
description	Install itself for autorun at Windows startup	rule	Persistence

Uses Windows utilities for basic Windows functionality (2 events)

cmdline	schtasks.exe /Create /TN "Updates\DbbOsaGaKPV" /XML "C:\Users\test22\AppData\Local\Temp\tmp229F.tmp"
cmdline	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\DbbOsaGaKPV" /XML "C:\Users\test22\AppData\Local\Temp\tmp229F.tmp"

Communicates with host for which no DNS query was performed (1 event)

host

20.150.137.35

Allocates execute permission to another process indicative of possible code injection (1 event)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory Aug. 19, 2021, 9:38 a.m.	process_identifier: 2212 region_size: 1392640 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000003f8	1	0	0

Deletes executed files from disk (1 event)

file	C:\Users\test22\AppData\Local\Temp\tmp229F.tmp

Potential code injection by writing to the memory of another process (4 events)

Time & API	Arguments	Status	Return
WriteProcessMemory Aug. 19, 2021, 9:38 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $z]üÕ><><><ý3Í?<7D?<ý3Ï<<úÿ?<úü=<;0?<7D:<7D!<><Ù<UN<Um?<U?<Rich><PELûI_à0Úâ\@@@@wðp, ¨ u@p.text«.0 `.rdataÎI@J4@@.dataØP~@À.rsrcp,ð.@@.reloc¨ ²@B.bss0Â@@ base_address: 0x00400000 process_identifier: 2212 process_handle: 0x000003f8	1	1
WriteProcessMemory Aug. 19, 2021, 9:38 a.m.	buffer: Í@ï@þ@ @@+@:@\@k@@TÍ<¨K¢`Ý;UBÄôK A³ÝJpMÛ(PAPAUìUEÈÒt ÆAêu÷]ÃUìd¡0ì@SVWxé§G03ö_,?EøB<}ôDxEðÀÁë3ÉÛt-}ø¾ÁÎ <aUø\| ÂÀàðëuøA;ËrßUü}ôEðL3ÛD ÂMìÉt<3ÿÊÀMøÑEè ÁÏ ¾ÁøBÉuñUü}øEø}ôÆ;Et EèC;]ìrÄWUüÒKÿÿÿ3À_^[ÉÂuðD$X·DÂëÝUìì¼ESVWXhLw&M ]¸èèþÿÿðÇEÄkern3ÀÇEÈel32EÐEÞEÄPÇEÌ.dllÇEàntdlÇEäl.dlfÇEèlÇEÔuserÇEØ32.dfÇEÜllfÇEø1fÇEü2ÿÖEàPÿÖEÔPÿÖhX¤SåèyþÿÿhyÌ?EèlþÿÿhEVEôè_þÿÿhDð5àEÀèRþÿÿhî¶PE¤èEþÿÿhÆREè8þÿÿh_xTîEðè+þÿÿhÚöÚOEèþÿÿøhÆp}´èþÿÿh_»ðèþÿÿh-W®[E¼èöýÿÿE¬3ÀPhjPPhSE¨ÿ×jEìPÿÖ]ø}°jh0WjÿÓðötîjE¨PW}ìVWÿU¼WÿUð>M]¸tjEøPPjÿUÀÆEhà.ÿU¤3À}«jDj«««DÿÿÿPèTýÿÿÄÿu jhÿÿÿUE¼ÀuOEPDÿÿÿP3ÀPPPPPPPSÿUôÀ¯PPjPPh@SE¸ÿU´øjÿÿtE¸ë^EüPPjÿUÀéeìMìQPÿU}ìtoEPDÿÿÿP3ÀPPPPPPPSÿUôÀuOPPjPPh@SEÿU´øjÿÿt*EPÿu°VWÿU¬WÿUðEPDÿÿÿP3ÀPPPPPPPSÿUôë EüPPjÿUÀÆEÿu¼ÿUð}åþÿÿ_^[ÉÃ,mAd base_address: 0x00419000 process_identifier: 2212 process_handle: 0x000003f8	1	1
WriteProcessMemory Aug. 19, 2021, 9:38 a.m.	buffer: 2AÆ¦+ÃºÍ_¡ä0ÏÂIí%µ[ §+uWÀ`½^¤ö¥8`Ö¹Á8ú*¾!S£«ÑRyè93Çë ÊZÏP=±J3ÔíôÖQ2ÃkyYÚ½åMCØuTA§çýO0ãtiÄ,w¹ÏA Þ¤Q®1rF¨® base_address: 0x00553000 process_identifier: 2212 process_handle: 0x000003f8	1	1
WriteProcessMemory Aug. 19, 2021, 9:38 a.m.	buffer: @ base_address: 0x7efde008 process_identifier: 2212 process_handle: 0x000003f8	1	1

Code injection by writing an executable or DLL to the memory of another process (1 event)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory Aug. 19, 2021, 9:38 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $z]üÕ><><><ý3Í?<7D?<ý3Ï<<úÿ?<úü=<;0?<7D:<7D!<><Ù<UN<Um?<U?<Rich><PELûI_à0Úâ\@@@@wðp, ¨ u@p.text«.0 `.rdataÎI@J4@@.dataØP~@À.rsrcp,ð.@@.reloc¨ ²@B.bss0Â@@ base_address: 0x00400000 process_identifier: 2212 process_handle: 0x000003f8	1	1	0

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2484 called NtSetContextThread to modify thread in remote process 2212
NtSetContextThread Aug. 19, 2021, 9:38 a.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4218082 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000360 process_identifier: 2212	1	0	0

Attempts to remove evidence of file being downloaded from the Internet (1 event)

file	C:\Users\test22\AppData\Local\Temp\:Zone.Identifier

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2484 resumed a thread in remote process 2212
NtResumeThread Aug. 19, 2021, 9:38 a.m.	thread_handle: 0x00000360 suspend_count: 1 process_identifier: 2212	1	0	0

Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) (1 event)

dead_host

20.150.137.35:7400

Executed a process and injected code into it, probably while unpacking (18 events)

Time & API	Arguments	Status	Return
NtResumeThread Aug. 19, 2021, 9:38 a.m.	thread_handle: 0x000000dc suspend_count: 1 process_identifier: 2484	1	0
NtResumeThread Aug. 19, 2021, 9:38 a.m.	thread_handle: 0x0000014c suspend_count: 1 process_identifier: 2484	1	0
NtResumeThread Aug. 19, 2021, 9:38 a.m.	thread_handle: 0x00000188 suspend_count: 1 process_identifier: 2484	1	0
NtResumeThread Aug. 19, 2021, 9:38 a.m.	thread_handle: 0x00000260 suspend_count: 1 process_identifier: 2484	1	0
CreateProcessInternalW Aug. 19, 2021, 9:38 a.m.	thread_identifier: 1792 thread_handle: 0x000003e0 process_identifier: 2332 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\schtasks.exe track: 1 command_line: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\DbbOsaGaKPV" /XML "C:\Users\test22\AppData\Local\Temp\tmp229F.tmp" filepath_r: C:\Windows\System32\schtasks.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x000003e8	1	1
CreateProcessInternalW Aug. 19, 2021, 9:38 a.m.	thread_identifier: 1776 thread_handle: 0x00000360 process_identifier: 2212 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\word.exe track: 1 command_line: filepath_r: C:\Users\test22\AppData\Local\Temp\word.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x000003f8	1	1
NtGetContextThread Aug. 19, 2021, 9:38 a.m.	thread_handle: 0x00000360	1	0
NtAllocateVirtualMemory Aug. 19, 2021, 9:38 a.m.	process_identifier: 2212 region_size: 1392640 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000003f8	1	0
WriteProcessMemory Aug. 19, 2021, 9:38 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $z]üÕ><><><ý3Í?<7D?<ý3Ï<<úÿ?<úü=<;0?<7D:<7D!<><Ù<UN<Um?<U?<Rich><PELûI_à0Úâ\@@@@wðp, ¨ u@p.text«.0 `.rdataÎI@J4@@.dataØP~@À.rsrcp,ð.@@.reloc¨ ²@B.bss0Â@@ base_address: 0x00400000 process_identifier: 2212 process_handle: 0x000003f8	1	1
WriteProcessMemory Aug. 19, 2021, 9:38 a.m.	buffer: base_address: 0x00401000 process_identifier: 2212 process_handle: 0x000003f8	1	1
WriteProcessMemory Aug. 19, 2021, 9:38 a.m.	buffer: base_address: 0x00414000 process_identifier: 2212 process_handle: 0x000003f8	1	1
WriteProcessMemory Aug. 19, 2021, 9:38 a.m.	buffer: Í@ï@þ@ @@+@:@\@k@@TÍ<¨K¢`Ý;UBÄôK A³ÝJpMÛ(PAPAUìUEÈÒt ÆAêu÷]ÃUìd¡0ì@SVWxé§G03ö_,?EøB<}ôDxEðÀÁë3ÉÛt-}ø¾ÁÎ <aUø\| ÂÀàðëuøA;ËrßUü}ôEðL3ÛD ÂMìÉt<3ÿÊÀMøÑEè ÁÏ ¾ÁøBÉuñUü}øEø}ôÆ;Et EèC;]ìrÄWUüÒKÿÿÿ3À_^[ÉÂuðD$X·DÂëÝUìì¼ESVWXhLw&M ]¸èèþÿÿðÇEÄkern3ÀÇEÈel32EÐEÞEÄPÇEÌ.dllÇEàntdlÇEäl.dlfÇEèlÇEÔuserÇEØ32.dfÇEÜllfÇEø1fÇEü2ÿÖEàPÿÖEÔPÿÖhX¤SåèyþÿÿhyÌ?EèlþÿÿhEVEôè_þÿÿhDð5àEÀèRþÿÿhî¶PE¤èEþÿÿhÆREè8þÿÿh_xTîEðè+þÿÿhÚöÚOEèþÿÿøhÆp}´èþÿÿh_»ðèþÿÿh-W®[E¼èöýÿÿE¬3ÀPhjPPhSE¨ÿ×jEìPÿÖ]ø}°jh0WjÿÓðötîjE¨PW}ìVWÿU¼WÿUð>M]¸tjEøPPjÿUÀÆEhà.ÿU¤3À}«jDj«««DÿÿÿPèTýÿÿÄÿu jhÿÿÿUE¼ÀuOEPDÿÿÿP3ÀPPPPPPPSÿUôÀ¯PPjPPh@SE¸ÿU´øjÿÿtE¸ë^EüPPjÿUÀéeìMìQPÿU}ìtoEPDÿÿÿP3ÀPPPPPPPSÿUôÀuOPPjPPh@SEÿU´øjÿÿt*EPÿu°VWÿU¬WÿUðEPDÿÿÿP3ÀPPPPPPPSÿUôë EüPPjÿUÀÆEÿu¼ÿUð}åþÿÿ_^[ÉÃ,mAd base_address: 0x00419000 process_identifier: 2212 process_handle: 0x000003f8	1	1
WriteProcessMemory Aug. 19, 2021, 9:38 a.m.	buffer: base_address: 0x0054f000 process_identifier: 2212 process_handle: 0x000003f8	1	1
WriteProcessMemory Aug. 19, 2021, 9:38 a.m.	buffer: base_address: 0x00552000 process_identifier: 2212 process_handle: 0x000003f8	1	1
WriteProcessMemory Aug. 19, 2021, 9:38 a.m.	buffer: 2AÆ¦+ÃºÍ_¡ä0ÏÂIí%µ[ §+uWÀ`½^¤ö¥8`Ö¹Á8ú*¾!S£«ÑRyè93Çë ÊZÏP=±J3ÔíôÖQ2ÃkyYÚ½åMCØuTA§çýO0ãtiÄ,w¹ÏA Þ¤Q®1rF¨® base_address: 0x00553000 process_identifier: 2212 process_handle: 0x000003f8	1	1
WriteProcessMemory Aug. 19, 2021, 9:38 a.m.	buffer: @ base_address: 0x7efde008 process_identifier: 2212 process_handle: 0x000003f8	1	1
NtSetContextThread Aug. 19, 2021, 9:38 a.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4218082 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000360 process_identifier: 2212	1	0
NtResumeThread Aug. 19, 2021, 9:38 a.m.	thread_handle: 0x00000360 suspend_count: 1 process_identifier: 2212	1	0

File has been identified by 34 AntiVirus engines on VirusTotal as malicious (34 events)

Lionic	Trojan.MSIL.Stealer.i!c
Elastic	malicious (high confidence)
FireEye	Generic.mg.05057af2091a89b9
Qihoo-360	Win32/TrojanSpy.Noon.HwMAWN8A
Cylance	Unsafe
Sangfor	Trojan.Win32.Save.a
CrowdStrike	win/malicious_confidence_100% (W)
Alibaba	Trojan:Win32/starter.ali1000139
Cyren	W32/MSIL_Troj.BJP.gen!Eldorado
Symantec	Trojan.Gen.2
ESET-NOD32	a variant of MSIL/Kryptik.ACMR
APEX	Malicious
Paloalto	generic.ml
Kaspersky	HEUR:Trojan-Spy.MSIL.Noon.gen
Avast	Win32:PWSX-gen [Trj]
Sophos	Mal/Generic-S
DrWeb	Trojan.PackedNET.999
TrendMicro	TROJ_FRS.VSNTHI21
McAfee-GW-Edition	AgentTesla-FCTJ!05057AF2091A
Kingsoft	Win32.Troj.Undef.(kcloud)
Microsoft	Trojan:Win32/AgentTesla!ml
GData	Win32.Backdoor.AMRat.C4900U
Cynet	Malicious (score: 100)
McAfee	AgentTesla-FCTJ!05057AF2091A
VBA32	Malware-Cryptor.MSIL.AgentTesla.Heur
Malwarebytes	Malware.AI.852347596
TrendMicro-HouseCall	TROJ_FRS.VSNTHI21
Tencent	Msil.Trojan-spy.Noon.Bxl
SentinelOne	Static AI - Malicious PE
Fortinet	PossibleThreat.PALLAS.H
BitDefenderTheta	Gen:NN.ZemsilF.34088.@m0@aiF0j2b
AVG	Win32:PWSX-gen [Trj]
Cybereason	malicious.785a06
MaxSecure	Trojan.Malware.300983.susgen

word.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All