Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	Sept. 14, 2021, 4:14 p.m.	Sept. 14, 2021, 4:16 p.m.

Size	132.0KB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`9fac6c17290657d895651d3aa3407f9c`
SHA256	`a870fa473e623f80c5664b9731aa61ba293acdb73d0653b97e64d0d82313f998`
CRC32	`251962FA`
ssdeep	`3072:JpMnJx1VxbsgoRTvnAdoBMc4cajbChXkeO2y:J2nJ7fbLSAmBMNhbQ0Y`
PDB Path	C:\Users\Carter\Downloads\All in Desktop\crown-demo-01-07-2019\Windows_Update - Copy-20200625T175054Z-001\Windows_Update - Copy\Windows_Update\obj\Debug\Windows_Update.pdb
Yara	PE_Header_Zero - PE File Signature Generic_Malware_Zero - Generic Malware Is_DotNET_EXE - (no description) Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT IsPE32 - (no description) Win32_Trojan_PWS_Net_1_Zero - Win32 Trojan PWS .NET Azorult

Windows_Update_004.exe "C:\Users\test22\AppData\Local\Temp\Windows_Update_004.exe"
2500
- cmd.exe "C:\Windows\System32\cmd.exe" /Ctaskkill /IM explorer.exe -f
  684
  - taskkill.exe taskkill /IM explorer.exe -f
    2864

Name	Response	Post-Analysis Lookup
wondershares.xyz	A 74.208.236.24	74.208.236.24

IP Address	Status	Action
164.124.101.2	Active	Moloch
74.208.236.24	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (1 event)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameW Sept. 14, 2021, 4:14 p.m.	computer_name: TEST22-PC	1	1	0

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Sept. 14, 2021, 4:14 p.m.			0	0
IsDebuggerPresent Sept. 14, 2021, 4:14 p.m.			0	0

Command line console output was observed (1 event)

Time & API	Arguments	Status	Return	Repeated
WriteConsoleW Sept. 14, 2021, 4:14 p.m.	buffer: SUCCESS: The process "explorer.exe" with PID 1236 has been terminated. console_handle: 0x0000000000000007	1	1	0

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

This executable has a PDB path (1 event)

pdb_path

C:\Users\Carter\Downloads\All in Desktop\crown-demo-01-07-2019\Windows_Update - Copy-20200625T175054Z-001\Windows_Update - Copy\Windows_Update\obj\Debug\Windows_Update.pdb

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Sept. 14, 2021, 4:14 p.m.		1	1	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

HTTP traffic contains suspicious features which may be indicative of malware related traffic (3 events)

suspicious_features	GET method with no useragent header	suspicious_request	GET http://wondershares.xyz/guid.php
suspicious_features	GET method with no useragent header	suspicious_request	GET http://wondershares.xyz/w_update.php?mid=1
suspicious_features	POST method with no referer header, POST method with no useragent header	suspicious_request	POST http://wondershares.xyz/ups.php?mid=1

Performs some HTTP requests (3 events)

request	GET http://wondershares.xyz/guid.php
request	GET http://wondershares.xyz/w_update.php?mid=1
request	POST http://wondershares.xyz/ups.php?mid=1

Sends data using the HTTP POST Method (1 event)

request

POST http://wondershares.xyz/ups.php?mid=1

Allocates read-write-execute memory (usually to unpack itself) (50 out of 68 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Sept. 14, 2021, 4:14 p.m.	process_identifier: 2500 region_size: 2424832 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000600000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 14, 2021, 4:14 p.m.	process_identifier: 2500 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000007d0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 14, 2021, 4:14 p.m.	process_identifier: 2500 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef12e1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 14, 2021, 4:14 p.m.	process_identifier: 2500 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef197b000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 14, 2021, 4:14 p.m.	process_identifier: 2500 region_size: 1703936 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000020b0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 14, 2021, 4:14 p.m.	process_identifier: 2500 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000021d0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 14, 2021, 4:14 p.m.	process_identifier: 2500 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef12e2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 14, 2021, 4:14 p.m.	process_identifier: 2500 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef12e2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 14, 2021, 4:14 p.m.	process_identifier: 2500 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef12e2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 14, 2021, 4:14 p.m.	process_identifier: 2500 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef12e2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 14, 2021, 4:14 p.m.	process_identifier: 2500 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef12e2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 14, 2021, 4:14 p.m.	process_identifier: 2500 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef12e2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 14, 2021, 4:14 p.m.	process_identifier: 2500 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef12e2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 14, 2021, 4:14 p.m.	process_identifier: 2500 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef12e2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 14, 2021, 4:14 p.m.	process_identifier: 2500 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef12e2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 14, 2021, 4:14 p.m.	process_identifier: 2500 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef12e2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 14, 2021, 4:14 p.m.	process_identifier: 2500 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef12e2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 14, 2021, 4:14 p.m.	process_identifier: 2500 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef12e4000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 14, 2021, 4:14 p.m.	process_identifier: 2500 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef12e4000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 14, 2021, 4:14 p.m.	process_identifier: 2500 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef12e4000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 14, 2021, 4:14 p.m.	process_identifier: 2500 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef12e4000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 14, 2021, 4:14 p.m.	process_identifier: 2500 region_size: 655360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 14, 2021, 4:14 p.m.	process_identifier: 2500 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 14, 2021, 4:14 p.m.	process_identifier: 2500 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 14, 2021, 4:14 p.m.	process_identifier: 2500 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 14, 2021, 4:14 p.m.	process_identifier: 2500 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 14, 2021, 4:14 p.m.	process_identifier: 2500 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 14, 2021, 4:14 p.m.	process_identifier: 2500 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91b3a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 14, 2021, 4:14 p.m.	process_identifier: 2500 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91bec000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 14, 2021, 4:14 p.m.	process_identifier: 2500 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91c16000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 14, 2021, 4:14 p.m.	process_identifier: 2500 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91bf0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 14, 2021, 4:14 p.m.	process_identifier: 2500 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91b4c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 14, 2021, 4:14 p.m.	process_identifier: 2500 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91c60000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 14, 2021, 4:14 p.m.	process_identifier: 2500 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefb037000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 14, 2021, 4:14 p.m.	process_identifier: 2500 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91b3b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 14, 2021, 4:14 p.m.	process_identifier: 2500 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91b5b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 14, 2021, 4:14 p.m.	process_identifier: 2500 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91b8c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 14, 2021, 4:14 p.m.	process_identifier: 2500 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91b5d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 14, 2021, 4:14 p.m.	process_identifier: 2500 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91b4a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 14, 2021, 4:14 p.m.	process_identifier: 2500 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91b32000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 14, 2021, 4:14 p.m.	process_identifier: 2500 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91b4b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 14, 2021, 4:14 p.m.	process_identifier: 2500 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91ca0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 14, 2021, 4:14 p.m.	process_identifier: 2500 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91ca1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 14, 2021, 4:14 p.m.	process_identifier: 2500 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91ca2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 14, 2021, 4:14 p.m.	process_identifier: 2500 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91cb0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 14, 2021, 4:14 p.m.	process_identifier: 2500 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91cb1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 14, 2021, 4:14 p.m.	process_identifier: 2500 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91b8d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 14, 2021, 4:14 p.m.	process_identifier: 2500 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91ca3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 14, 2021, 4:14 p.m.	process_identifier: 2500 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91ca4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 14, 2021, 4:14 p.m.	process_identifier: 2500 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91ca5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1

Creates a suspicious process (2 events)

cmdline	cmd.exe /Ctaskkill /IM explorer.exe -f
cmdline	"C:\Windows\System32\cmd.exe" /Ctaskkill /IM explorer.exe -f

Executes one or more WMI queries (1 event)

wmi	SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "explorer.exe")

A process created a hidden window (1 event)

Time & API	Arguments	Status	Return	Repeated
ShellExecuteExW Sept. 14, 2021, 4:14 p.m.	show_type: 0 filepath_r: cmd.exe parameters: /Ctaskkill /IM explorer.exe -f filepath: cmd.exe	1	1	0

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses Sept. 14, 2021, 4:14 p.m.	flags: 15 family: 0		111	0

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x00020800', u'virtual_address': u'0x00002000', u'entropy': 7.279430690107382, u'name': u'.text', u'virtual_size': u'0x00020698'}

entropy

7.27943069011

description

A section with a high entropy has been found

entropy

0.988593155894

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 event)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW Sept. 14, 2021, 4:14 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Queries for potentially installed applications (2 events)

Time & API	Arguments	Status	Return	Repeated
RegOpenKeyExW Sept. 14, 2021, 4:14 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{029EFE5B-7F53-4037-B0B7-EAB20BE5B6D9} base_handle: 0xffffffff80000002 key_handle: 0x0000000000000000 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{029EFE5B-7F53-4037-B0B7-EAB20BE5B6D9}		2	0
RegOpenKeyExW Sept. 14, 2021, 4:14 p.m.	regkey_r: SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{029EFE5B-7F53-4037-B0B7-EAB20BE5B6D9} base_handle: 0xffffffff80000002 key_handle: 0x0000000000000000 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{029EFE5B-7F53-4037-B0B7-EAB20BE5B6D9}		2	0

Terminates another process (2 events)

Time & API	Arguments	Status	Return	Repeated
NtTerminateProcess Sept. 14, 2021, 4:14 p.m.	status_code: 0x00000001 process_identifier: 1236 process_handle: 0x0000000000000188		0	0
NtTerminateProcess Sept. 14, 2021, 4:14 p.m.	status_code: 0x00000001 process_identifier: 1236 process_handle: 0x0000000000000188	1	0	0

Uses Windows utilities for basic Windows functionality (3 events)

cmdline	cmd.exe /Ctaskkill /IM explorer.exe -f
cmdline	taskkill /IM explorer.exe -f
cmdline	"C:\Windows\System32\cmd.exe" /Ctaskkill /IM explorer.exe -f

File has been identified by 34 AntiVirus engines on VirusTotal as malicious (34 events)

Lionic	Trojan.MSIL.Bobik.l!c
Cynet	Malicious (score: 99)
ALYac	Trojan.GenericKD.37568177
Malwarebytes	MachineLearning/Anomalous.97%
Alibaba	TrojanSpy:MSIL/Bobik.bdab2b9b
Arcabit	Trojan.Generic.D23D3EB1
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Kaspersky	HEUR:Trojan-Spy.MSIL.Bobik.gen
BitDefender	Trojan.GenericKD.37568177
MicroWorld-eScan	Trojan.GenericKD.37568177
Avast	Win32:Malware-gen
Tencent	Msil.Trojan-spy.Bobik.Hyae
Ad-Aware	Trojan.GenericKD.37568177
Sophos	Mal/Generic-R
F-Secure	Trojan.TR/Spy.Bobik.bpkxt
McAfee-GW-Edition	RDN/Generic PWS.y
FireEye	Trojan.GenericKD.37568177
Emsisoft	Trojan.GenericKD.37568177 (B)
Jiangmin	TrojanSpy.MSIL.btay
Avira	TR/Spy.Bobik.bpkxt
Kingsoft	Win32.Troj.Undef.(kcloud)
Microsoft	Trojan:Win32/Sabsik.FL.B!ml
ZoneAlarm	HEUR:Trojan-Spy.MSIL.Bobik.gen
GData	Trojan.GenericKD.37568177
AhnLab-V3	Trojan/Win.Generic.C4631417
McAfee	RDN/Generic PWS.y
MAX	malware (ai score=82)
SentinelOne	Static AI - Suspicious PE
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	W32/Bobik!tr
BitDefenderTheta	Gen:NN.ZemsilCO.34142.im0@aezMbUm
AVG	Win32:Malware-gen
Panda	Trj/GdSda.A

Windows_Update_004.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All