Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	Sept. 3, 2021, 8:49 a.m.	Sept. 3, 2021, 8:53 a.m.

Size	1.0MB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`ec13b1b95f843a9d05826658350406fc`
SHA256	`8cd18ad8fcef6455042807051884bf67b1eac4e4f77e5c97c5fcf6817c66bd6a`
CRC32	`C9D5719C`
ssdeep	`24576:Hgw1ZddI/r10hjc4bDFGt6yIg/Upp2E6g/4uidJtpPKitSY:Aw1Zd2T101LU0N5lfidJtpPFtSY`
Yara	PE_Header_Zero - PE File Signature Malicious_Library_Zero - Malicious_Library IsPE32 - (no description)

lv.exe "C:\Users\test22\AppData\Local\Temp\lv.exe"
1608
- howkit.exe "C:\Users\test22\AppData\Local\Temp\mystax\howkit.exe"
  2100
  - cmd.exe "cmd" /c cmd < Gettando.flv
    1260
    - cmd.exe cmd
      2272
      - findstr.exe findstr /V /R "^JjEYStoRvryVXGWLuxZiQOWRIRCNExrncpRtaPAEXraioMzOyBDZAABUfNfqCcjeqGANPSasUcpNvOIWnOIrRrXUIWOEAmeCQdiCjFYj$" Vergogna.flv
        2308
      - Finita.exe.com Finita.exe.com B
        1792
        
        Finita.exe.com C:\Users\test22\AppData\Roaming\Finita.exe.com B
        2240
        
        Finita.exe.com C:\Users\test22\AppData\Roaming\Finita.exe.com
        3060
      - PING.EXE ping TEST22-PC
        1632
- fip.exe "C:\Users\test22\AppData\Local\Temp\mystax\fip.exe"
  1040
  - fip.exe "C:\Users\test22\AppData\Local\Temp\mystax\fip.exe"
    1644

Name	Response	Post-Analysis Lookup
kWIFyTtOQxaHW.kWIFyTtOQxaHW

IP Address	Status	Action
164.124.101.2	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (3 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Sept. 3, 2021, 8:49 a.m.			0	0
IsDebuggerPresent Sept. 3, 2021, 8:49 a.m.			0	0
IsDebuggerPresent Sept. 3, 2021, 8:49 a.m.			0	0

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Sept. 3, 2021, 8:49 a.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

.ndata

One or more processes crashed (1 event)

Time & API	Arguments	Status	Return	Repeated
__exception__ Sept. 3, 2021, 8:49 a.m.	stacktrace: fip+0x7c26 @ 0x407c26 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77b19ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77b19ea5 exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.esp: 1638240 registers.edi: 3141592654 registers.eax: 1638264 registers.ebp: 1638276 registers.edx: 4226081 registers.ebx: 2130567168 registers.esi: 4294901760 registers.ecx: 0	1	0	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (22 events)

Time & API	Arguments	Status
NtProtectVirtualMemory Sept. 3, 2021, 8:49 a.m.	process_identifier: 1608 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73fd1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 3, 2021, 8:49 a.m.	process_identifier: 1608 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76ec1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 3, 2021, 8:49 a.m.	process_identifier: 1608 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x10001000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 3, 2021, 8:49 a.m.	process_identifier: 1608 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73fc1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 3, 2021, 8:49 a.m.	process_identifier: 1608 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73e91000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 3, 2021, 8:49 a.m.	process_identifier: 1608 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x732b1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 3, 2021, 8:49 a.m.	process_identifier: 1608 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73e92000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 3, 2021, 8:49 a.m.	process_identifier: 2100 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74c81000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 3, 2021, 8:49 a.m.	process_identifier: 2100 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74c41000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 3, 2021, 8:49 a.m.	process_identifier: 2100 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76811000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 3, 2021, 8:49 a.m.	process_identifier: 2100 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74c11000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 3, 2021, 8:49 a.m.	process_identifier: 2100 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76ec1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 3, 2021, 8:49 a.m.	process_identifier: 2100 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72ff1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 3, 2021, 8:49 a.m.	process_identifier: 2100 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74bf2000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 3, 2021, 8:49 a.m.	process_identifier: 1040 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 69632 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02d11000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 3, 2021, 8:49 a.m.	process_identifier: 1040 region_size: 139264 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02c80000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 3, 2021, 8:49 a.m.	process_identifier: 1792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73fc1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 3, 2021, 8:49 a.m.	process_identifier: 1792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f11000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 3, 2021, 8:49 a.m.	process_identifier: 1792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73fc2000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 3, 2021, 8:49 a.m.	process_identifier: 2240 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73fc1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 3, 2021, 8:49 a.m.	process_identifier: 2240 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f11000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 3, 2021, 8:49 a.m.	process_identifier: 2240 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73fc2000 process_handle: 0xffffffff	1

Creates executable files on the filesystem (8 events)

file	C:\Users\test22\AppData\Local\Temp\nsj7E42.tmp\nsExec.dll
file	C:\Program Files (x86)\foler\olader\acppage.dll
file	C:\Users\test22\AppData\Local\Temp\mystax\fip.exe
file	C:\Program Files (x86)\foler\olader\acledit.dll
file	C:\Users\test22\AppData\Local\Temp\nsr799E.tmp\UAC.dll
file	C:\Users\test22\AppData\Roaming\Finita.exe.com
file	C:\Program Files (x86)\foler\olader\adprovider.dll
file	C:\Users\test22\AppData\Local\Temp\mystax\howkit.exe

Drops a binary and executes it (1 event)

file	C:\Users\test22\AppData\Local\Temp\mystax\fip.exe

Drops an executable to the user AppData folder (3 events)

file	C:\Users\test22\AppData\Local\Temp\nsr799E.tmp\UAC.dll
file	C:\Users\test22\AppData\Local\Temp\mystax\fip.exe
file	C:\Users\test22\AppData\Local\Temp\mystax\howkit.exe

Potentially malicious URLs were found in the process memory dump (3 events)

url	http://www.microsoft.com/schemas/ie8tldlistdescription/1.0
url	http://purl.org/rss/1.0/
url	http://www.passport.com

Yara rule detected in process memory (39 events)

description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Bypass DEP	rule	disable_dep
description	Communication using DGA	rule	Network_DGA
description	Communications use DNS	rule	Network_DNS
description	Communications over RAW Socket	rule	Network_TCP_Socket
description	Create a windows service	rule	Create_Service
description	Record Audio	rule	Sniff_Audio
description	Escalate priviledges	rule	Escalate_priviledges
description	Run a KeyLogger	rule	KeyLogger
description	Code injection with CreateRemoteThread in a remote process	rule	Code_injection
description	Communications over HTTP	rule	Network_HTTP
description	Hijack network configuration	rule	Hijack_Network
description	Match Windows Inet API call	rule	Str_Win32_Internet_API
description	Communications over FTP	rule	Network_FTP
description	Take ScreenShot	rule	ScreenShot
description	Match Windows Http API call	rule	Str_Win32_Http_API
description	Steal credential	rule	local_credential_Steal
description	File Downloader	rule	Network_Downloader
description	Communications over P2P network	rule	Network_P2P_Win
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerCheck__RemoteAPI
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	DebuggerException__ConsoleCtrl
description	(no description)	rule	DebuggerException__SetConsoleCtrl
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	(no description)	rule	Check_Dlls
description	Checks if being debugged	rule	anti_dbg
description	Anti-Sandbox checks for ThreatExpert	rule	antisb_threatExpert
description	Bypass DEP	rule	disable_dep
description	Affect hook table	rule	win_hook
description	Install itself for autorun at Windows startup	rule	Persistence

Uses Windows utilities for basic Windows functionality (1 event)

cmdline

ping TEST22-PC

One or more of the buffers contains an embedded PE file (1 event)

buffer

Buffer with sha1: 085f26a2184e513718d2f544989659fa8243c2a6

Allocates execute permission to another process indicative of possible code injection (2 events)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory Sept. 3, 2021, 8:49 a.m.	process_identifier: 1644 region_size: 147456 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000118	1	0	0
NtProtectVirtualMemory Sept. 3, 2021, 8:49 a.m.	process_identifier: 3060 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 159744 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x0000022c	1	0	0

Attempts to identify installed AV products by installation directory (2 events)

file	C:\ProgramData\AVAST Software
file	C:\ProgramData\AVG

Potential code injection by writing to the memory of another process (2 events)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory Sept. 3, 2021, 8:49 a.m.	buffer: @ base_address: 0x7efde008 process_identifier: 1644 process_handle: 0x00000118	1	1	0
WriteProcessMemory Sept. 3, 2021, 8:49 a.m.	buffer: ÿÿÿÿûÿ(üÿPýÿmèÿÿ jHâýÿ± base_address: 0xfffde000 process_identifier: 3060 process_handle: 0x0000022c	1	1	0

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (4 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1040 called NtSetContextThread to modify thread in remote process 1644
Process injection	Process 2240 called NtSetContextThread to modify thread in remote process 3060
NtSetContextThread Sept. 3, 2021, 8:49 a.m.	registers.eip: 2007957956 registers.esp: 1638384 registers.edi: 0 registers.eax: 4226081 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000114 process_identifier: 1644	1	0	0
NtSetContextThread Sept. 3, 2021, 8:49 a.m.	registers.eip: 2007957956 registers.esp: 7011660 registers.edi: 0 registers.eax: 809246 registers.ebp: 0 registers.edx: 0 registers.ebx: -139264 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000228 process_identifier: 3060	1	0	0

Resumed a suspended thread in a remote process potentially indicative of process injection (4 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1040 resumed a thread in remote process 1644
Process injection	Process 2272 resumed a thread in remote process 1792
NtResumeThread Sept. 3, 2021, 8:49 a.m.	thread_handle: 0x00000114 suspend_count: 1 process_identifier: 1644	1	0	0
NtResumeThread Sept. 3, 2021, 8:49 a.m.	thread_handle: 0x00000138 suspend_count: 0 process_identifier: 1792	1	0	0

File has been identified by 28 AntiVirus engines on VirusTotal as malicious (28 events)

Lionic	Trojan.Win32.Agent.m!c
Elastic	malicious (high confidence)
Cylance	Unsafe
Zillya	Dropper.Scrop.Win32.1344
Alibaba	Backdoor:Win32/Coins.92914f37
BitDefenderTheta	Gen:NN.ZexaF.34126.oqW@aOF6McjG
Cyren	W32/Kryptik.EYC.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Paloalto	generic.ml
ClamAV	Win.Packed.Filerepmalware-9864117-0
Kaspersky	UDS:Backdoor.Win32.Agent
Avast	Win32:Malware-gen
Emsisoft	Trojan.Crypt (A)
McAfee-GW-Edition	BehavesLike.Win32.Dropper.tc
Sophos	Mal/Generic-S
Webroot	W32.Malware.Gen
Avira	HEUR/AGEN.1140896
Microsoft	Trojan:Win32/Sabsik.TE.B!ml
GData	Win32.Trojan.BSE.HLJWVB
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win32.Generic.C4293291
McAfee	Artemis!EC13B1B95F84
VBA32	BScope.Trojan.Chapak
Malwarebytes	Malware.AI.3005362190
Rising	Malware.Obscure/Heur!1.A89F (CLASSIC)
SentinelOne	Static AI - Suspicious PE
AVG	Win32:Malware-gen

Executed a process and injected code into it, probably while unpacking (22 events)

Time & API	Arguments	Status	Return
CreateProcessInternalW Sept. 3, 2021, 8:49 a.m.	thread_identifier: 2096 thread_handle: 0x00000238 process_identifier: 2100 current_directory: filepath: track: 1 command_line: "C:\Users\test22\AppData\Local\Temp\mystax\howkit.exe" filepath_r: stack_pivoted: 0 creation_flags: 0 () inherit_handles: 0 process_handle: 0x00000218	1	1
CreateProcessInternalW Sept. 3, 2021, 8:49 a.m.	thread_identifier: 1196 thread_handle: 0x00000218 process_identifier: 1040 current_directory: filepath: track: 1 command_line: "C:\Users\test22\AppData\Local\Temp\mystax\fip.exe" filepath_r: stack_pivoted: 0 creation_flags: 0 () inherit_handles: 0 process_handle: 0x00000238	1	1
CreateProcessInternalW Sept. 3, 2021, 8:49 a.m.	thread_identifier: 2420 thread_handle: 0x0000021c process_identifier: 1260 current_directory: filepath: track: 1 command_line: "cmd" /c cmd < Gettando.flv filepath_r: stack_pivoted: 0 creation_flags: 16 (CREATE_NEW_CONSOLE) inherit_handles: 1 process_handle: 0x00000220	1	1
CreateProcessInternalW Sept. 3, 2021, 8:49 a.m.	thread_identifier: 2916 thread_handle: 0x00000114 process_identifier: 1644 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\mystax\fip.exe track: 1 command_line: "C:\Users\test22\AppData\Local\Temp\mystax\fip.exe" filepath_r: C:\Users\test22\AppData\Local\Temp\mystax\fip.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000118	1	1
NtGetContextThread Sept. 3, 2021, 8:49 a.m.	thread_handle: 0x00000114	1	0
NtUnmapViewOfSection Sept. 3, 2021, 8:49 a.m.	base_address: 0x00400000 region_size: 4096 process_identifier: 1644 process_handle: 0x00000118	1	0
NtAllocateVirtualMemory Sept. 3, 2021, 8:49 a.m.	process_identifier: 1644 region_size: 147456 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000118	1	0
WriteProcessMemory Sept. 3, 2021, 8:49 a.m.	buffer: @ base_address: 0x7efde008 process_identifier: 1644 process_handle: 0x00000118	1	1
NtSetContextThread Sept. 3, 2021, 8:49 a.m.	registers.eip: 2007957956 registers.esp: 1638384 registers.edi: 0 registers.eax: 4226081 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000114 process_identifier: 1644	1	0
NtResumeThread Sept. 3, 2021, 8:49 a.m.	thread_handle: 0x00000114 suspend_count: 1 process_identifier: 1644	1	0
CreateProcessInternalW Sept. 3, 2021, 8:49 a.m.	thread_identifier: 928 thread_handle: 0x00000130 process_identifier: 2272 current_directory: C:\Users\test22\AppData\Roaming filepath: C:\Windows\System32\cmd.exe track: 1 command_line: cmd filepath_r: C:\Windows\system32\cmd.exe stack_pivoted: 0 creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x00000134	1	1
CreateProcessInternalW Sept. 3, 2021, 8:49 a.m.	thread_identifier: 2252 thread_handle: 0x00000134 process_identifier: 2308 current_directory: C:\Users\test22\AppData\Roaming filepath: C:\Windows\System32\findstr.exe track: 1 command_line: findstr /V /R "^JjEYStoRvryVXGWLuxZiQOWRIRCNExrncpRtaPAEXraioMzOyBDZAABUfNfqCcjeqGANPSasUcpNvOIWnOIrRrXUIWOEAmeCQdiCjFYj$" Vergogna.flv filepath_r: C:\Windows\system32\findstr.exe stack_pivoted: 0 creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x00000140	1	1
CreateProcessInternalW Sept. 3, 2021, 8:49 a.m.	thread_identifier: 508 thread_handle: 0x00000138 process_identifier: 1792 current_directory: filepath: C:\Users\test22\AppData\Roaming\Finita.exe.com track: 1 command_line: Finita.exe.com B filepath_r: C:\Users\test22\AppData\Roaming\Finita.exe.com stack_pivoted: 0 creation_flags: 525328 (CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x00000140	1	1
NtResumeThread Sept. 3, 2021, 8:49 a.m.	thread_handle: 0x00000138 suspend_count: 0 process_identifier: 1792	1	0
CreateProcessInternalW Sept. 3, 2021, 8:49 a.m.	thread_identifier: 3016 thread_handle: 0x00000140 process_identifier: 1632 current_directory: C:\Users\test22\AppData\Roaming filepath: C:\Windows\System32\PING.EXE track: 1 command_line: ping TEST22-PC filepath_r: C:\Windows\system32\PING.EXE stack_pivoted: 0 creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x00000138	1	1
CreateProcessInternalW Sept. 3, 2021, 8:49 a.m.	thread_identifier: 2396 thread_handle: 0x00000164 process_identifier: 2240 current_directory: C:\Users\test22\AppData\Roaming filepath: track: 1 command_line: C:\Users\test22\AppData\Roaming\Finita.exe.com B filepath_r: stack_pivoted: 0 creation_flags: 0 () inherit_handles: 0 process_handle: 0x00000168	1	1
CreateProcessInternalW Sept. 3, 2021, 8:49 a.m.	thread_identifier: 1192 thread_handle: 0x00000228 process_identifier: 3060 current_directory: filepath: track: 1 command_line: C:\Users\test22\AppData\Roaming\Finita.exe.com filepath_r: stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x0000022c	1	1
NtGetContextThread Sept. 3, 2021, 8:49 a.m.	thread_handle: 0x00000228	1	0
NtAllocateVirtualMemory Sept. 3, 2021, 8:49 a.m.	process_identifier: 3060 region_size: 159744 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 4 (PAGE_READWRITE) base_address: 0x000c0000 allocation_type: 12289 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000022c	1	0
WriteProcessMemory Sept. 3, 2021, 8:49 a.m.	buffer: base_address: 0x000c0000 process_identifier: 3060 process_handle: 0x0000022c	1	1
WriteProcessMemory Sept. 3, 2021, 8:49 a.m.	buffer: ÿÿÿÿûÿ(üÿPýÿmèÿÿ jHâýÿ± base_address: 0xfffde000 process_identifier: 3060 process_handle: 0x0000022c	1	1
NtSetContextThread Sept. 3, 2021, 8:49 a.m.	registers.eip: 2007957956 registers.esp: 7011660 registers.edi: 0 registers.eax: 809246 registers.ebp: 0 registers.edx: 0 registers.ebx: -139264 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000228 process_identifier: 3060	1	0

lv.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All