Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	Sept. 8, 2021, 9:27 a.m.	Sept. 8, 2021, 9:29 a.m.

Size	874.2KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`8884881ff19c34d3974a042004249d5f`
SHA256	`4e591ca9530450eca3c227d9292c3496d54d022c83d8b9c5372d91b97fed3203`
CRC32	`10FCD4EB`
ssdeep	`24576:J2G/nvxW3Whv6+OgbjAN2BJKC2XOIJiX+/OzB:JbA3gtLb/CC2eIkuK`
PDB Path	D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb
Yara	PE_Header_Zero - PE File Signature Malicious_Library_Zero - Malicious_Library Generic_Malware_Zero - Generic Malware IsPE32 - (no description) Win32_Trojan_Gen_2_0904B0_Zero - Win32 Trojan Gen OS_Processor_Check_Zero - OS Processor Check Malicious_Packer_Zero - Malicious Packer Win32_Trojan_Gen_1_0904B0_Zero - Win32 Trojan Emotet Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT

sadexe.exe "C:\Users\test22\AppData\Local\Temp\sadexe.exe"
564
- wscript.exe "C:\Windows\System32\WScript.exe" "C:\FontCrtMonitorDllSvc\vE7Wyr01RvAnAST1giMb.vbe"
  2480
  - cmd.exe cmd /c ""C:\FontCrtMonitorDllSvc\gCY11fLh4bC7HvXSu1m.bat" "
    1260
    - FontCrtMonitorDllSvcreviewNetsvc.exe "C:\FontCrtMonitorDllSvc\FontCrtMonitorDllSvcreviewNetsvc.exe"
      1808
      - smss.exe "C:\Windows\System32\netcorehc\smss.exe"
        2900

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (12 events)

Time & API	Arguments	Status	Return
GetComputerNameW Sept. 8, 2021, 9:27 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 8, 2021, 9:27 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 8, 2021, 9:27 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 8, 2021, 9:27 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 8, 2021, 9:27 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 8, 2021, 9:27 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 8, 2021, 9:27 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 8, 2021, 9:27 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 8, 2021, 9:27 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 8, 2021, 9:27 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 8, 2021, 9:27 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 8, 2021, 9:28 a.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (4 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Sept. 8, 2021, 9:27 a.m.			0	0
IsDebuggerPresent Sept. 8, 2021, 9:27 a.m.			0	0
IsDebuggerPresent Sept. 8, 2021, 9:27 a.m.			0	0
IsDebuggerPresent Sept. 8, 2021, 9:27 a.m.			0	0

Command line console output was observed (2 events)

Time & API	Arguments	Status	Return	Repeated
WriteConsoleW Sept. 8, 2021, 9:27 a.m.	buffer: C:\FontCrtMonitorDllSvc> console_handle: 0x00000007	1	1	0
WriteConsoleW Sept. 8, 2021, 9:27 a.m.	buffer: "C:\FontCrtMonitorDllSvc\FontCrtMonitorDllSvcreviewNetsvc.exe" console_handle: 0x00000007	1	1	0

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

This executable has a PDB path (1 event)

pdb_path

D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Sept. 8, 2021, 9:27 a.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

.didat

The file contains an unknown PE resource name possibly indicative of a packer (1 event)

resource name

PNG

One or more processes crashed (1 event)

Time & API	Arguments	Status	Return	Repeated
__exception__ Sept. 8, 2021, 9:28 a.m.	stacktrace: 0x7fe914983a8 mscorlib+0x4ef8a5 @ 0x7feefa5f8a5 mscorlib+0x4ef609 @ 0x7feefa5f609 mscorlib+0x4ef5c7 @ 0x7feefa5f5c7 mscorlib+0x502d21 @ 0x7feefa72d21 CoUninitializeEE+0x4c56f GetMetaDataInternalInterface-0x2b1ad clr+0x4f713 @ 0x7fef0b3f713 CoUninitializeEE+0x4c09e GetMetaDataInternalInterface-0x2b67e clr+0x4f242 @ 0x7fef0b3f242 CoUninitializeEE+0x4c167 GetMetaDataInternalInterface-0x2b5b5 clr+0x4f30b @ 0x7fef0b3f30b NGenCreateNGenWorker+0x682d _AxlPublicKeyBlobToPublicKeyToken-0x409df clr+0x216291 @ 0x7fef0d06291 DestroyAssemblyConfigCookie+0x157fc PreBindAssembly-0xc054 clr+0xf6d80 @ 0x7fef0be6d80 DestroyAssemblyConfigCookie+0x1578a PreBindAssembly-0xc0c6 clr+0xf6d0e @ 0x7fef0be6d0e DestroyAssemblyConfigCookie+0x15701 PreBindAssembly-0xc14f clr+0xf6c85 @ 0x7fef0be6c85 DestroyAssemblyConfigCookie+0x15837 PreBindAssembly-0xc019 clr+0xf6dbb @ 0x7fef0be6dbb NGenCreateNGenWorker+0x6711 _AxlPublicKeyBlobToPublicKeyToken-0x40afb clr+0x216175 @ 0x7fef0d06175 StrongNameSignatureVerification+0x5a22 GetCLRFunction-0x7712 clr+0x1866ae @ 0x7fef0c766ae BaseThreadInitThunk+0xd CreateThread-0x53 kernel32+0x1652d @ 0x7721652d RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x7792c521 exception.instruction_r: 48 8b 00 48 8b 40 58 48 8b 55 50 ff 50 18 48 89 exception.instruction: mov rax, qword ptr [rax] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x7fe914983a8 registers.r14: 0 registers.r15: 0 registers.rcx: 0 registers.rsi: 0 registers.r10: 1991376769 registers.rbx: 0 registers.rsp: 467860064 registers.r11: 467855920 registers.r8: 4 registers.r9: 8791541636952 registers.rdx: 0 registers.r12: 0 registers.rbp: 0 registers.rdi: 0 registers.rax: 0 registers.r13: 0	1	0	0

Time & API

Arguments

Status

Return

Repeated

__exception__

Sept. 8, 2021, 9:28 a.m.

stacktrace:

0x7fe914983a8
mscorlib+0x4ef8a5 @ 0x7feefa5f8a5
mscorlib+0x4ef609 @ 0x7feefa5f609
mscorlib+0x4ef5c7 @ 0x7feefa5f5c7
mscorlib+0x502d21 @ 0x7feefa72d21
CoUninitializeEE+0x4c56f GetMetaDataInternalInterface-0x2b1ad clr+0x4f713 @ 0x7fef0b3f713
CoUninitializeEE+0x4c09e GetMetaDataInternalInterface-0x2b67e clr+0x4f242 @ 0x7fef0b3f242
CoUninitializeEE+0x4c167 GetMetaDataInternalInterface-0x2b5b5 clr+0x4f30b @ 0x7fef0b3f30b
NGenCreateNGenWorker+0x682d _AxlPublicKeyBlobToPublicKeyToken-0x409df clr+0x216291 @ 0x7fef0d06291
DestroyAssemblyConfigCookie+0x157fc PreBindAssembly-0xc054 clr+0xf6d80 @ 0x7fef0be6d80
DestroyAssemblyConfigCookie+0x1578a PreBindAssembly-0xc0c6 clr+0xf6d0e @ 0x7fef0be6d0e
DestroyAssemblyConfigCookie+0x15701 PreBindAssembly-0xc14f clr+0xf6c85 @ 0x7fef0be6c85
DestroyAssemblyConfigCookie+0x15837 PreBindAssembly-0xc019 clr+0xf6dbb @ 0x7fef0be6dbb
NGenCreateNGenWorker+0x6711 _AxlPublicKeyBlobToPublicKeyToken-0x40afb clr+0x216175 @ 0x7fef0d06175
StrongNameSignatureVerification+0x5a22 GetCLRFunction-0x7712 clr+0x1866ae @ 0x7fef0c766ae
BaseThreadInitThunk+0xd CreateThread-0x53 kernel32+0x1652d @ 0x7721652d
RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x7792c521

exception.instruction_r: 48 8b 00 48 8b 40 58 48 8b 55 50 ff 50 18 48 89
exception.instruction: mov rax, qword ptr [rax]
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x7fe914983a8
registers.r14: 0
registers.r15: 0
registers.rcx: 0
registers.rsi: 0
registers.r10: 1991376769
registers.rbx: 0
registers.rsp: 467860064
registers.r11: 467855920
registers.r8: 4
registers.r9: 8791541636952
registers.rdx: 0
registers.r12: 0
registers.rbp: 0
registers.rdi: 0
registers.rax: 0
registers.r13: 0

Allocates read-write-execute memory (usually to unpack itself) (50 out of 116 events)

Time & API	Arguments	Status
NtProtectVirtualMemory Sept. 8, 2021, 9:27 a.m.	process_identifier: 564 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x734c2000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 8, 2021, 9:27 a.m.	process_identifier: 2480 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f32000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 8, 2021, 9:27 a.m.	process_identifier: 1808 region_size: 2555904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000600000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 8, 2021, 9:27 a.m.	process_identifier: 1808 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000007f0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 8, 2021, 9:27 a.m.	process_identifier: 1808 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1451000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 8, 2021, 9:27 a.m.	process_identifier: 1808 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1aeb000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 8, 2021, 9:27 a.m.	process_identifier: 1808 region_size: 2031616 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001fb0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 8, 2021, 9:27 a.m.	process_identifier: 1808 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002120000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 8, 2021, 9:27 a.m.	process_identifier: 1808 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1452000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 8, 2021, 9:27 a.m.	process_identifier: 1808 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1452000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 8, 2021, 9:27 a.m.	process_identifier: 1808 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1452000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 8, 2021, 9:27 a.m.	process_identifier: 1808 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1452000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 8, 2021, 9:27 a.m.	process_identifier: 1808 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1452000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 8, 2021, 9:27 a.m.	process_identifier: 1808 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1452000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 8, 2021, 9:27 a.m.	process_identifier: 1808 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1452000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 8, 2021, 9:27 a.m.	process_identifier: 1808 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1452000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 8, 2021, 9:27 a.m.	process_identifier: 1808 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1452000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 8, 2021, 9:27 a.m.	process_identifier: 1808 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1452000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 8, 2021, 9:27 a.m.	process_identifier: 1808 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1452000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 8, 2021, 9:27 a.m.	process_identifier: 1808 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1454000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 8, 2021, 9:27 a.m.	process_identifier: 1808 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1454000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 8, 2021, 9:27 a.m.	process_identifier: 1808 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1454000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 8, 2021, 9:27 a.m.	process_identifier: 1808 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1454000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 8, 2021, 9:27 a.m.	process_identifier: 1808 region_size: 655360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 8, 2021, 9:27 a.m.	process_identifier: 1808 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 8, 2021, 9:27 a.m.	process_identifier: 1808 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 8, 2021, 9:27 a.m.	process_identifier: 1808 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 8, 2021, 9:27 a.m.	process_identifier: 1808 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 8, 2021, 9:27 a.m.	process_identifier: 1808 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 8, 2021, 9:27 a.m.	process_identifier: 1808 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91cda000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 8, 2021, 9:27 a.m.	process_identifier: 1808 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91cec000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 8, 2021, 9:27 a.m.	process_identifier: 1808 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91e10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 8, 2021, 9:27 a.m.	process_identifier: 1808 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91d8c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 8, 2021, 9:27 a.m.	process_identifier: 1808 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91db6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 8, 2021, 9:27 a.m.	process_identifier: 1808 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91d90000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 8, 2021, 9:27 a.m.	process_identifier: 1808 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91cdb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 8, 2021, 9:27 a.m.	process_identifier: 1808 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91cfb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 8, 2021, 9:27 a.m.	process_identifier: 1808 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91d2c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 8, 2021, 9:27 a.m.	process_identifier: 1808 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91cfd000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 8, 2021, 9:27 a.m.	process_identifier: 1808 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91e11000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 8, 2021, 9:27 a.m.	process_identifier: 1808 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91cdc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 8, 2021, 9:27 a.m.	process_identifier: 1808 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91ced000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 8, 2021, 9:27 a.m.	process_identifier: 1808 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91cea000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 8, 2021, 9:27 a.m.	process_identifier: 1808 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91cd2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 8, 2021, 9:27 a.m.	process_identifier: 1808 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91e12000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 8, 2021, 9:27 a.m.	process_identifier: 1808 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91e13000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 8, 2021, 9:27 a.m.	process_identifier: 1808 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91e15000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 8, 2021, 9:27 a.m.	process_identifier: 1808 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91e60000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 8, 2021, 9:27 a.m.	process_identifier: 1808 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91e61000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 8, 2021, 9:27 a.m.	process_identifier: 1808 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91d2d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1

Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation (2 events)

Time & API	Arguments	Status	Return	Repeated
GetDiskFreeSpaceExW Sept. 8, 2021, 9:27 a.m.	total_number_of_free_bytes: 10930393088 free_bytes_available: 10930393088 root_path: C:\ total_number_of_bytes: 34252779520	1	1	0
GetDiskFreeSpaceExW Sept. 8, 2021, 9:28 a.m.	total_number_of_free_bytes: 10927337472 free_bytes_available: 10927337472 root_path: C:\ total_number_of_bytes: 34252779520	1	1	0

Creates executable files on the filesystem (3 events)

file	C:\FontCrtMonitorDllSvc\FontCrtMonitorDllSvcreviewNetsvc.exe
file	C:\FontCrtMonitorDllSvc\vE7Wyr01RvAnAST1giMb.vbe
file	C:\FontCrtMonitorDllSvc\gCY11fLh4bC7HvXSu1m.bat

Drops a binary and executes it (2 events)

file	C:\FontCrtMonitorDllSvc\vE7Wyr01RvAnAST1giMb.vbe
file	C:\FontCrtMonitorDllSvc\FontCrtMonitorDllSvcreviewNetsvc.exe

A process created a hidden window (2 events)

Time & API	Arguments	Status	Return	Repeated
ShellExecuteExW Sept. 8, 2021, 9:27 a.m.	show_type: 0 filepath_r: C:/FontCrtMonitorDllSvc/gCY11fLh4bC7HvXSu1m.bat parameters: filepath: C:/FontCrtMonitorDllSvc/gCY11fLh4bC7HvXSu1m.bat	1	1	0
ShellExecuteExW Sept. 8, 2021, 9:27 a.m.	show_type: 0 filepath_r: C:\Windows\System32\netcorehc\smss.exe parameters: filepath: C:\Windows\System32\netcorehc\smss.exe	1	1	0

The binary likely contains encrypted or compressed data indicative of a packer (1 event)

section

{u'size_of_data': u'0x00007a00', u'virtual_address': u'0x00063000', u'entropy': 7.180509434747631, u'name': u'.rsrc', u'virtual_size': u'0x000079b4'}

entropy

7.18050943475

description

A section with a high entropy has been found

Checks for the Locally Unique Identifier on the system for a suspicious privilege (2 events)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW Sept. 8, 2021, 9:27 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0
LookupPrivilegeValueW Sept. 8, 2021, 9:28 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Yara rule detected in process memory (8 events)

description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep

Installs itself for autorun at Windows startup (5 events)

reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Idle	reg_value	"C:\FontCrtMonitorDllSvc\Idle.exe"
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss	reg_value	"C:\Windows\System32\api-ms-win-core-util-l1-1-0\csrss.exe"
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SearchProtocolHost	reg_value	"C:\Windows\System32\aclui\SearchProtocolHost.exe"
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss	reg_value	"C:\Windows\System32\netcorehc\smss.exe"
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\FontCrtMonitorDllSvcreviewNetsvc	reg_value	"C:\Program Files\7-Zip\Lang\FontCrtMonitorDllSvcreviewNetsvc.exe"

One or more non-whitelisted processes were created (2 events)

parent_process	wscript.exe				martian_process	"C:\FontCrtMonitorDllSvc\gCY11fLh4bC7HvXSu1m.bat"
parent_process	wscript.exe				martian_process	C:/FontCrtMonitorDllSvc/gCY11fLh4bC7HvXSu1m.bat

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 564 resumed a thread in remote process 2480
NtResumeThread Sept. 8, 2021, 9:27 a.m.	thread_handle: 0x000002bc suspend_count: 1 process_identifier: 2480	1	0	0

The process wscript.exe wrote an executable file to disk (1 event)

file	C:\Windows\SysWOW64\wscript.exe

File has been identified by 51 AntiVirus engines on VirusTotal as malicious (50 out of 51 events)

Lionic	Trojan.Win32.Makop.trQA
Elastic	malicious (high confidence)
DrWeb	BackDoor.QuasarNET.3
MicroWorld-eScan	Trojan.GenericKD.37405525
FireEye	Generic.mg.8884881ff19c34d3
CAT-QuickHeal	Backdoor.MSIL
ALYac	Trojan.GenericKD.37405525
Malwarebytes	Malware.AI.1658604840
Sangfor	Backdoor.MSIL.LightStone.gen
CrowdStrike	win/malicious_confidence_100% (W)
Alibaba	Backdoor:MSIL/LightStone.fc824a23
K7GW	Spyware ( 004bf6371 )
K7AntiVirus	Spyware ( 004bf6371 )
BitDefenderTheta	Gen:NN.ZemsilF.34088.Km0@aGTwkami
Cyren	W32/Trojan.SKZM-3024
Symantec	Trojan.Gen.MBT
ESET-NOD32	a variant of MSIL/Spy.Agent.AES
APEX	Malicious
Paloalto	generic.ml
ClamAV	Win.Packed.Uztuby-9853721-0
Kaspersky	UDS:Backdoor.MSIL.LightStone.gen
BitDefender	Trojan.GenericKD.37405525
Avast	Win32:KeyloggerX-gen [Trj]
Rising	Backdoor.DCRat!1.D886 (CLASSIC)
Ad-Aware	Trojan.GenericKD.37405525
Emsisoft	Trojan.GenericKD.37405525 (B)
Comodo	Malware@#32k7njteg5ib2
TrendMicro	TROJ_GEN.R002C0PHE21
McAfee-GW-Edition	BehavesLike.Win32.Generic.ch
Sophos	Mal/Generic-R
Ikarus	Trojan.MSIL.Spy
Avira	TR/Spy.Agent.eiavp
MAX	malware (ai score=82)
Antiy-AVL	Trojan/Generic.ASMalwS.3468A45
Kingsoft	Win32.Hack.Undef.(kcloud)
Microsoft	Trojan:Win32/Sabsik.FL.B!ml
Gridinsoft	Trojan.Win32.Agent.oa
GData	Win32.Trojan.BSE.1CL7UZW
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win.Uztuby.C4593142
McAfee	Artemis!8884881FF19C
VBA32	Backdoor.MSIL.LightStone
TrendMicro-HouseCall	TROJ_GEN.R002C0PHE21
Tencent	Msil.Backdoor.Lightstone.Ebqq
SentinelOne	Static AI - Malicious SFX
eGambit	Unsafe.AI_Score_62%
Fortinet	W32/LightStone.A!tr.bdr
AVG	Win32:KeyloggerX-gen [Trj]
Cybereason	malicious.ff19c3
Panda	Trj/CI.A

sadexe.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All