popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

nass.exe

Generic Malware UPX DNS AntiDebug PE File PE32 .NET EXE AntiVM
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 Aug. 20, 2021, 7:50 a.m. Aug. 20, 2021, 7:56 a.m.
Size 1.1MB
Type PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 12cf41794cd41156c4f43c26cff1c740
SHA256 801761f7af7bd86d136b36b7f4b48550e9258cfec68b482210da6561b8e61f68
CRC32 3E8C3DE8
ssdeep 24576:Sx8B0MKe9L/K1DwOqm7KWJas0pcPE6aIAtUSMhn/tGxNlycX9:eelK91rf0SMh61h/UyM
Yara
  • PE_Header_Zero - PE File Signature
  • Generic_Malware_Zero - Generic Malware
  • Is_DotNET_EXE - (no description)
  • UPX_Zero - UPX packed file
  • IsPE32 - (no description)

Name Response Post-Analysis Lookup
newmeforever.3utilities.com
A 79.134.225.25
79.134.225.25
newmeforever12.3utilities.com
IP Address Status Action
164.124.101.2 Active Moloch
79.134.225.25 Active Moloch

Suricata Alerts

Flow SID Signature Category
UDP 192.168.56.101:61479 -> 8.8.8.8:53 2028677 ET POLICY DNS Query to DynDNS Domain *.3utilities .com Potentially Bad Traffic
UDP 192.168.56.101:60751 -> 8.8.8.8:53 2028677 ET POLICY DNS Query to DynDNS Domain *.3utilities .com Potentially Bad Traffic
UDP 192.168.56.101:62902 -> 8.8.4.4:53 2028677 ET POLICY DNS Query to DynDNS Domain *.3utilities .com Potentially Bad Traffic
UDP 192.168.56.101:59369 -> 8.8.8.8:53 2028677 ET POLICY DNS Query to DynDNS Domain *.3utilities .com Potentially Bad Traffic
UDP 192.168.56.101:54056 -> 8.8.8.8:53 2028677 ET POLICY DNS Query to DynDNS Domain *.3utilities .com Potentially Bad Traffic
UDP 192.168.56.101:55450 -> 8.8.8.8:53 2028677 ET POLICY DNS Query to DynDNS Domain *.3utilities .com Potentially Bad Traffic
UDP 192.168.56.101:62430 -> 8.8.8.8:53 2028677 ET POLICY DNS Query to DynDNS Domain *.3utilities .com Potentially Bad Traffic
UDP 192.168.56.101:62362 -> 8.8.4.4:53 2028677 ET POLICY DNS Query to DynDNS Domain *.3utilities .com Potentially Bad Traffic
UDP 192.168.56.101:57460 -> 8.8.8.8:53 2028677 ET POLICY DNS Query to DynDNS Domain *.3utilities .com Potentially Bad Traffic
UDP 192.168.56.101:61673 -> 8.8.8.8:53 2028677 ET POLICY DNS Query to DynDNS Domain *.3utilities .com Potentially Bad Traffic
UDP 192.168.56.101:65329 -> 8.8.4.4:53 2028677 ET POLICY DNS Query to DynDNS Domain *.3utilities .com Potentially Bad Traffic
UDP 192.168.56.101:50851 -> 8.8.8.8:53 2028677 ET POLICY DNS Query to DynDNS Domain *.3utilities .com Potentially Bad Traffic
UDP 192.168.56.101:63983 -> 8.8.8.8:53 2028677 ET POLICY DNS Query to DynDNS Domain *.3utilities .com Potentially Bad Traffic
UDP 192.168.56.101:56887 -> 8.8.4.4:53 2028677 ET POLICY DNS Query to DynDNS Domain *.3utilities .com Potentially Bad Traffic
UDP 192.168.56.101:63951 -> 8.8.8.8:53 2028677 ET POLICY DNS Query to DynDNS Domain *.3utilities .com Potentially Bad Traffic
UDP 192.168.56.101:55667 -> 8.8.8.8:53 2028677 ET POLICY DNS Query to DynDNS Domain *.3utilities .com Potentially Bad Traffic
UDP 192.168.56.101:55629 -> 8.8.8.8:53 2028677 ET POLICY DNS Query to DynDNS Domain *.3utilities .com Potentially Bad Traffic
UDP 192.168.56.101:60820 -> 8.8.8.8:53 2028677 ET POLICY DNS Query to DynDNS Domain *.3utilities .com Potentially Bad Traffic
UDP 192.168.56.101:54657 -> 8.8.4.4:53 2028677 ET POLICY DNS Query to DynDNS Domain *.3utilities .com Potentially Bad Traffic
UDP 192.168.56.101:61794 -> 8.8.8.8:53 2028677 ET POLICY DNS Query to DynDNS Domain *.3utilities .com Potentially Bad Traffic
UDP 192.168.56.101:56977 -> 164.124.101.2:53 2028677 ET POLICY DNS Query to DynDNS Domain *.3utilities .com Potentially Bad Traffic
UDP 192.168.56.101:63194 -> 8.8.4.4:53 2028677 ET POLICY DNS Query to DynDNS Domain *.3utilities .com Potentially Bad Traffic

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

WriteConsoleW

 buffer: SUCCESS: The scheduled task "Updates\JICPwop" has successfully been created.
console_handle: 0x00000007
1 1 0
registry HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
domain newmeforever.3utilities.com
domain newmeforever12.3utilities.com
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2948
region_size: 1703936
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x008d0000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2948
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00a30000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2948
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72831000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2948
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0052a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2948
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 8192
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72832000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2948
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00522000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2948
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00532000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2948
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00533000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2948
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0057b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2948
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00577000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2948
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00534000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2948
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00535000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2948
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00536000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2948
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0053c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2948
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x008f0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2948
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00537000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2948
region_size: 327680
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7ef60000
allocation_type: 1056768 (MEM_RESERVE|MEM_TOP_DOWN)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2948
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7ef60000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2948
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7ef60000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2948
region_size: 65536
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7ef50000
allocation_type: 1056768 (MEM_RESERVE|MEM_TOP_DOWN)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2948
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7ef50000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2948
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0056a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2948
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0054a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2948
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00547000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2948
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x008f1000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2948
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0052b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2948
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x6ef82000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2948
region_size: 1507328
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04c40000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2948
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04d70000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2948
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04d71000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2948
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04d72000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2948
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04d73000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2948
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00546000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2948
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x008f2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2948
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04d74000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2948
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04d75000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2948
region_size: 16384
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04d76000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2948
region_size: 69632
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04d7a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2948
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04d8b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2948
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x008f3000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2948
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00562000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2948
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0056c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2948
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00538000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2948
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00539000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2948
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00c30000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2948
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00c31000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2948
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00c32000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2948
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00c33000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2948
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00c34000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2948
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00575000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
cmdline "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\JICPwop" /XML "C:\Users\test22\AppData\Local\Temp\tmp6DA.tmp"
cmdline schtasks.exe /Create /TN "Updates\JICPwop" /XML "C:\Users\test22\AppData\Local\Temp\tmp6DA.tmp"
Time & API Arguments Status Return Repeated

ShellExecuteExW

 show_type: 0
filepath_r: schtasks.exe
parameters: /Create /TN "Updates\JICPwop" /XML "C:\Users\test22\AppData\Local\Temp\tmp6DA.tmp"
filepath: schtasks.exe
1 1 0
section {u'size_of_data': u'0x00113c00', u'virtual_address': u'0x00002000', u'entropy': 7.96849072495786, u'name': u'.text', u'virtual_size': u'0x00113b84'} entropy 7.96849072496 description A section with a high entropy has been found
entropy 0.998190045249 description Overall entropy of this PE file is high
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0
description Communications use DNS rule Network_DNS
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Checks if being debugged rule anti_dbg
description Bypass DEP rule disable_dep
cmdline "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\JICPwop" /XML "C:\Users\test22\AppData\Local\Temp\tmp6DA.tmp"
cmdline schtasks.exe /Create /TN "Updates\JICPwop" /XML "C:\Users\test22\AppData\Local\Temp\tmp6DA.tmp"
buffer Buffer with sha1: 636b8187f0cb59d43c9ee1eedf144043941b62d9
buffer Buffer with sha1: 4380fb6de89a7776d52214359ce213d24a2239ad
buffer Buffer with sha1: c19d9db351af75fec019fe76506a455eba7fd168
buffer Buffer with sha1: c1ef2ca62189121934d1a7944ef1bdc1aa319877
buffer Buffer with sha1: 063fb8b27c0872c54bff35e2b76d8f522e13f8b4
buffer Buffer with sha1: 925c5236c59dd8f3efea4b3e091ef735b405a880
buffer Buffer with sha1: c54e7c5cac5fac68dc564ce64355d948422bf1ce
buffer Buffer with sha1: dcdec0ea839844e977c1151d2eeedbb0788a34b1
buffer Buffer with sha1: 0c6598a0a37eaf12ce188fa66bc6c5db394af8a4
buffer Buffer with sha1: 874b7c3c97cc5b13b9dd172fec5a54bc1f258005
buffer Buffer with sha1: efa4948abb218e47d809bedd1aff08cfb76d40e1
buffer Buffer with sha1: 1b68e773e3522fa8edc7cb20d7c7f156b08ec73a
buffer Buffer with sha1: 874f3caf663265f7dd18fb565d91b7d915031251
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 1164
region_size: 573440
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000340
1 0 0
Time & API Arguments Status Return Repeated

NtQuerySystemInformation

 information_class: 8 (SystemProcessorPerformanceInformation)
1 0 0
description RegSvcs.exe tried to sleep 5456578 seconds, actually delayed analysis time by 5456578 seconds
file C:\Users\test22\AppData\Local\Temp\tmp6DA.tmp
Time & API Arguments Status Return Repeated

WriteProcessMemory

 buffer: MZÿÿ¸@€º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL¡'éTà Ȉ’ç @ À8çW ø…  H.text˜Ç È `.reloc Ê@B.rsrcø… †Ì@@
base_address: 0x00400000
process_identifier: 1164
process_handle: 0x00000340
1 1 0

WriteProcessMemory

 buffer: à ”7
base_address: 0x00420000
process_identifier: 1164
process_handle: 0x00000340
1 1 0

WriteProcessMemory

 buffer: @
base_address: 0x7efde008
process_identifier: 1164
process_handle: 0x00000340
1 1 0
Time & API Arguments Status Return Repeated

WriteProcessMemory

 buffer: MZÿÿ¸@€º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL¡'éTà Ȉ’ç @ À8çW ø…  H.text˜Ç È `.reloc Ê@B.rsrcø… †Ì@@
base_address: 0x00400000
process_identifier: 1164
process_handle: 0x00000340
1 1 0
Process injection Process 2948 called NtSetContextThread to modify thread in remote process 1164
Time & API Arguments Status Return Repeated

NtSetContextThread

 registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4319122
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x00000398
process_identifier: 1164
1 0 0
file C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe:Zone.Identifier
Process injection Process 2948 resumed a thread in remote process 1164
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x00000398
suspend_count: 1
process_identifier: 1164
1 0 0
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x000000d0
suspend_count: 1
process_identifier: 2948
1 0 0

NtResumeThread

 thread_handle: 0x0000015c
suspend_count: 1
process_identifier: 2948
1 0 0

NtResumeThread

 thread_handle: 0x00000270
suspend_count: 1
process_identifier: 2948
1 0 0

CreateProcessInternalW

 thread_identifier: 2532
thread_handle: 0x00000378
process_identifier: 1808
current_directory: C:\Users\test22\AppData\Local\Temp
filepath: C:\Windows\System32\schtasks.exe
track: 1
command_line: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\JICPwop" /XML "C:\Users\test22\AppData\Local\Temp\tmp6DA.tmp"
filepath_r: C:\Windows\System32\schtasks.exe
stack_pivoted: 0
creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 0
process_handle: 0x00000380
1 1 0

CreateProcessInternalW

 thread_identifier: 2412
thread_handle: 0x00000398
process_identifier: 1164
current_directory:
filepath: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
track: 1
command_line:
filepath_r: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
stack_pivoted: 0
creation_flags: 134217732 (CREATE_NO_WINDOW|CREATE_SUSPENDED)
inherit_handles: 0
process_handle: 0x00000340
1 1 0

NtGetContextThread

 thread_handle: 0x00000398
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1164
region_size: 573440
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000340
1 0 0

WriteProcessMemory

 buffer: MZÿÿ¸@€º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL¡'éTà Ȉ’ç @ À8çW ø…  H.text˜Ç È `.reloc Ê@B.rsrcø… †Ì@@
base_address: 0x00400000
process_identifier: 1164
process_handle: 0x00000340
1 1 0

WriteProcessMemory

 buffer:
base_address: 0x00402000
process_identifier: 1164
process_handle: 0x00000340
1 1 0

WriteProcessMemory

 buffer: à ”7
base_address: 0x00420000
process_identifier: 1164
process_handle: 0x00000340
1 1 0

WriteProcessMemory

 buffer:
base_address: 0x00422000
process_identifier: 1164
process_handle: 0x00000340
1 1 0

WriteProcessMemory

 buffer: @
base_address: 0x7efde008
process_identifier: 1164
process_handle: 0x00000340
1 1 0

NtSetContextThread

 registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4319122
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x00000398
process_identifier: 1164
1 0 0

NtResumeThread

 thread_handle: 0x00000398
suspend_count: 1
process_identifier: 1164
1 0 0

NtResumeThread

 thread_handle: 0x000003ac
suspend_count: 1
process_identifier: 2948
1 0 0

NtGetContextThread

 thread_handle: 0x000003ac
1 0 0

NtGetContextThread

 thread_handle: 0x000003ac
1 0 0

NtResumeThread

 thread_handle: 0x000003ac
suspend_count: 1
process_identifier: 2948
1 0 0

NtResumeThread

 thread_handle: 0x000000d0
suspend_count: 1
process_identifier: 1164
1 0 0

NtResumeThread

 thread_handle: 0x00000160
suspend_count: 1
process_identifier: 1164
1 0 0

NtResumeThread

 thread_handle: 0x00000208
suspend_count: 1
process_identifier: 1164
1 0 0

NtResumeThread

 thread_handle: 0x00000264
suspend_count: 1
process_identifier: 1164
1 0 0

NtResumeThread

 thread_handle: 0x00000268
suspend_count: 1
process_identifier: 1164
1 0 0

NtResumeThread

 thread_handle: 0x00000340
suspend_count: 1
process_identifier: 1164
1 0 0

NtResumeThread

 thread_handle: 0x00000354
suspend_count: 1
process_identifier: 1164
1 0 0

NtResumeThread

 thread_handle: 0x0000036c
suspend_count: 1
process_identifier: 1164
1 0 0
Lionic Trojan.MSIL.Convagent.i!c
Elastic malicious (high confidence)
DrWeb Trojan.PackedNET.964
FireEye Generic.mg.12cf41794cd41156
McAfee Artemis!12CF41794CD4
Cylance Unsafe
Alibaba Trojan:Win32/starter.ali1000139
CrowdStrike win/malicious_confidence_80% (W)
Cyren W32/MSIL_Kryptik.FGW.gen!Eldorado
Symantec Trojan.Gen.MBT
ESET-NOD32 a variant of MSIL/Kryptik.ACMY
APEX Malicious
Paloalto generic.ml
Kaspersky UDS:DangerousObject.Multi.Generic
Avast Win32:PWSX-gen [Trj]
McAfee-GW-Edition BehavesLike.Win32.Generic.tc
Webroot W32.Trojan.Gen
Avira HEUR/AGEN.1142734
Kingsoft Win32.Troj.Generic_a.a.(kcloud)
Microsoft Trojan:Win32/Woreflint.A!cl
Cynet Malicious (score: 100)
Malwarebytes MachineLearning/Anomalous.96%
Yandex Trojan.AvsArher.bTJEKx
SentinelOne Static AI - Malicious PE
eGambit Unsafe.AI_Score_99%
Fortinet MSIL/GenKryptik.FJEE!tr
MaxSecure Trojan.Malware.300983.susgen
AVG Win32:PWSX-gen [Trj]
Cybereason malicious.560abe
Qihoo-360 HEUR/QVM03.0.5F3B.Malware.Gen
dead_host 192.168.56.101:49212
dead_host 79.134.225.25:83
dead_host 192.168.56.101:49211
dead_host 192.168.56.101:49210
dead_host 192.168.56.101:49207
dead_host 192.168.56.101:49209
dead_host 192.168.56.101:49206
dead_host 192.168.56.101:49208
dead_host 192.168.56.101:49205
dead_host 192.168.56.101:49204