Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Sept. 22, 2021, 10:05 p.m.	Sept. 22, 2021, 10:13 p.m.

Size	3.2MB
Type	PE32 executable (console) Intel 80386, for MS Windows
MD5	`e3cbb2e3f1de0e9161429b42fcb12e59`
SHA256	`cfa609ebc5780ab5ea678154e60e6e483076f82c74ec1129a3653b1c35173736`
CRC32	`96DF1826`
ssdeep	`24576:9G/egb2aEdWL/1G4F46L5pGifQYD333BigOrj7oglW0vPuXZigYy0+8OloQI/0i1:9G/egb2sz1xNoY+sVso`
Yara	PE_Header_Zero - PE File Signature Generic_Malware_Zero - Generic Malware anti_vm_detect - Possibly employs anti-virtualization techniques Is_DotNET_EXE - (no description) IsPE32 - (no description)

yes.exe "C:\Users\test22\AppData\Local\Temp\yes.exe"
2416

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
164.124.101.2	Active	Moloch
84.38.189.175	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Sept. 22, 2021, 10:05 p.m.			0	0
IsDebuggerPresent Sept. 22, 2021, 10:05 p.m.			0	0

Uses Windows APIs to generate a cryptographic key (3 events)

Time & API	Arguments	Status	Return
CryptExportKey Sept. 22, 2021, 10:05 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006ba118 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 22, 2021, 10:05 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006ba118 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 22, 2021, 10:05 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006ba198 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Sept. 22, 2021, 10:05 p.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 events)

section
section	.themida
section	15.6" IP

One or more processes crashed (3 events)

Time & API	Arguments	Status
__exception__ Sept. 22, 2021, 10:05 p.m.	stacktrace: yes+0x2f168c @ 0x11f168c yes+0x2f173b @ 0x11f173b exception.instruction_r: c9 c2 10 00 cc cc cc cc cc e9 4d a9 5f 8a 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008e exception.offset: 46887 exception.address: 0x76a7b727 registers.esp: 4455568 registers.edi: 16105472 registers.eax: 4455568 registers.ebp: 4455648 registers.edx: 2130566132 registers.ebx: 0 registers.esi: 2000778283 registers.ecx: 3472556032	1
__exception__ Sept. 22, 2021, 10:05 p.m.	stacktrace: exception.instruction_r: ed 64 8f 05 00 00 00 00 83 c4 04 e9 40 19 e7 ff exception.symbol: yes+0x2fe799 exception.instruction: in eax, dx exception.module: yes.exe exception.exception_code: 0xc0000096 exception.offset: 3139481 exception.address: 0x11fe799 registers.esp: 4455688 registers.edi: 17254037 registers.eax: 1750617430 registers.ebp: 16105472 registers.edx: 2130532438 registers.ebx: 1968963558 registers.esi: 13 registers.ecx: 20	1
__exception__ Sept. 22, 2021, 10:05 p.m.	stacktrace: exception.instruction_r: ed 64 8f 05 00 00 00 00 83 c4 04 81 fb 68 58 4d exception.symbol: yes+0x2fe80d exception.instruction: in eax, dx exception.module: yes.exe exception.exception_code: 0xc0000096 exception.offset: 3139597 exception.address: 0x11fe80d registers.esp: 4455688 registers.edi: 17254037 registers.eax: 1447909480 registers.ebp: 16105472 registers.edx: 22104 registers.ebx: 2256917605 registers.esi: 13 registers.ecx: 10	1

Allocates read-write-execute memory (usually to unpack itself) (50 out of 127 events)

Time & API	Arguments	Status
NtProtectVirtualMemory Sept. 22, 2021, 10:05 p.m.	process_identifier: 2416 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75731000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 22, 2021, 10:05 p.m.	process_identifier: 2416 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a7d000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 22, 2021, 10:05 p.m.	process_identifier: 2416 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75734000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 22, 2021, 10:05 p.m.	process_identifier: 2416 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a81000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 22, 2021, 10:05 p.m.	process_identifier: 2416 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75734000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 22, 2021, 10:05 p.m.	process_identifier: 2416 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75734000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 22, 2021, 10:05 p.m.	process_identifier: 2416 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a81000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 22, 2021, 10:05 p.m.	process_identifier: 2416 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75734000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 22, 2021, 10:05 p.m.	process_identifier: 2416 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75733000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 22, 2021, 10:05 p.m.	process_identifier: 2416 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a7c000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 22, 2021, 10:05 p.m.	process_identifier: 2416 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75733000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 22, 2021, 10:05 p.m.	process_identifier: 2416 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a8b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 22, 2021, 10:05 p.m.	process_identifier: 2416 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75735000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 22, 2021, 10:05 p.m.	process_identifier: 2416 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a8b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 22, 2021, 10:05 p.m.	process_identifier: 2416 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x757af000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 22, 2021, 10:05 p.m.	process_identifier: 2416 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7574c000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 22, 2021, 10:05 p.m.	process_identifier: 2416 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a84000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 22, 2021, 10:05 p.m.	process_identifier: 2416 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7574a000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 22, 2021, 10:05 p.m.	process_identifier: 2416 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75731000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 22, 2021, 10:05 p.m.	process_identifier: 2416 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a81000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 22, 2021, 10:05 p.m.	process_identifier: 2416 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7574c000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 22, 2021, 10:05 p.m.	process_identifier: 2416 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a7b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 22, 2021, 10:05 p.m.	process_identifier: 2416 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75731000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 22, 2021, 10:05 p.m.	process_identifier: 2416 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a7b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 22, 2021, 10:05 p.m.	process_identifier: 2416 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75735000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 22, 2021, 10:05 p.m.	process_identifier: 2416 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a7b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 22, 2021, 10:05 p.m.	process_identifier: 2416 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75483000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 22, 2021, 10:05 p.m.	process_identifier: 2416 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75731000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 22, 2021, 10:05 p.m.	process_identifier: 2416 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a7b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 22, 2021, 10:05 p.m.	process_identifier: 2416 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75737000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 22, 2021, 10:05 p.m.	process_identifier: 2416 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a7e000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 22, 2021, 10:05 p.m.	process_identifier: 2416 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75731000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 22, 2021, 10:05 p.m.	process_identifier: 2416 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a7d000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 22, 2021, 10:05 p.m.	process_identifier: 2416 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75734000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 22, 2021, 10:05 p.m.	process_identifier: 2416 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75734000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 22, 2021, 10:05 p.m.	process_identifier: 2416 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a81000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 22, 2021, 10:05 p.m.	process_identifier: 2416 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7574c000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 22, 2021, 10:05 p.m.	process_identifier: 2416 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a81000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 22, 2021, 10:05 p.m.	process_identifier: 2416 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75733000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 22, 2021, 10:05 p.m.	process_identifier: 2416 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a81000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 22, 2021, 10:05 p.m.	process_identifier: 2416 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75731000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 22, 2021, 10:05 p.m.	process_identifier: 2416 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a81000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 22, 2021, 10:05 p.m.	process_identifier: 2416 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75735000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 22, 2021, 10:05 p.m.	process_identifier: 2416 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x755bf000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 22, 2021, 10:05 p.m.	process_identifier: 2416 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x755c8000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 22, 2021, 10:05 p.m.	process_identifier: 2416 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7574a000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 22, 2021, 10:05 p.m.	process_identifier: 2416 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75731000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 22, 2021, 10:05 p.m.	process_identifier: 2416 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a7b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 22, 2021, 10:05 p.m.	process_identifier: 2416 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7575c000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 22, 2021, 10:05 p.m.	process_identifier: 2416 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a7b000 process_handle: 0xffffffff	1

A process attempted to delay the analysis task. (1 event)

description

yes.exe tried to sleep 175 seconds, actually delayed analysis time by 175 seconds

Foreign language identified in PE resource (2 events)

name

RT_MANIFEST

language

LANG_JAPANESE

filetype

XML 1.0 document, UTF-8 Unicode (with BOM) text

sublanguage

SUBLANG_DEFAULT

offset

0x003587d8

size

0x00000c9b

name

RT_MANIFEST

language

LANG_JAPANESE

filetype

XML 1.0 document, UTF-8 Unicode (with BOM) text

sublanguage

SUBLANG_DEFAULT

offset

0x003587d8

size

0x00000c9b

The binary likely contains encrypted or compressed data indicative of a packer (4 events)

section

{u'size_of_data': u'0x00015a00', u'virtual_address': u'0x00002000', u'entropy': 7.9977951537827865, u'name': u' ', u'virtual_size': u'0x00036000'}

entropy

7.99779515378

description

A section with a high entropy has been found

section

{u'size_of_data': u'0x0001b000', u'virtual_address': u'0x00038000', u'entropy': 7.998312216962186, u'name': u' ', u'virtual_size': u'0x0001ef20'}

entropy

7.99831221696

description

A section with a high entropy has been found

section

{u'size_of_data': u'0x00000a00', u'virtual_address': u'0x0034a000', u'entropy': 7.2794053141338955, u'name': u'15.6" IP', u'virtual_size': u'0x000008d0'}

entropy

7.27940531413

description

A section with a high entropy has been found

section

{u'size_of_data': u'0x00000a00', u'virtual_address': u'0x0034c000', u'entropy': 7.299165449020983, u'name': u'15.6" IP', u'virtual_size': u'0x000008d0'}

entropy

7.29916544902

description

A section with a high entropy has been found

Expresses interest in specific running processes (1 event)

process

system

Communicates with host for which no DNS query was performed (1 event)

host

84.38.189.175

Checks for the presence of known windows from debuggers and forensic tools (50 out of 162 events)

Time & API	Arguments	Status	Return	Repeated
FindWindowA Sept. 22, 2021, 10:05 p.m.	class_name: OLLYDBG window_name:		0	0
FindWindowA Sept. 22, 2021, 10:05 p.m.	class_name: GBDYLLO window_name:		0	0
FindWindowA Sept. 22, 2021, 10:05 p.m.	class_name: pediy06 window_name:		0	0
FindWindowA Sept. 22, 2021, 10:05 p.m.	class_name: FilemonClass window_name:		0	0
FindWindowA Sept. 22, 2021, 10:05 p.m.	class_name: FilemonClass window_name:		0	0
FindWindowA Sept. 22, 2021, 10:05 p.m.	class_name: File Monitor - Sysinternals: www.sysinternals.com window_name:		0	0
FindWindowA Sept. 22, 2021, 10:05 p.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA Sept. 22, 2021, 10:05 p.m.	class_name: Process Monitor - Sysinternals: www.sysinternals.com window_name:		0	0
FindWindowA Sept. 22, 2021, 10:05 p.m.	class_name: RegmonClass window_name:		0	0
FindWindowA Sept. 22, 2021, 10:05 p.m.	class_name: RegmonClass window_name:		0	0
FindWindowA Sept. 22, 2021, 10:05 p.m.	class_name: Registry Monitor - Sysinternals: www.sysinternals.com window_name:		0	0
FindWindowA Sept. 22, 2021, 10:05 p.m.	class_name: 18467-41 window_name:		0	0
FindWindowA Sept. 22, 2021, 10:05 p.m.	class_name: Regmonclass window_name:		0	0
FindWindowA Sept. 22, 2021, 10:05 p.m.	class_name: Regmonclass window_name:		0	0
FindWindowA Sept. 22, 2021, 10:05 p.m.	class_name: 18467-41 window_name:		0	0
FindWindowA Sept. 22, 2021, 10:05 p.m.	class_name: Filemonclass window_name:		0	0
FindWindowA Sept. 22, 2021, 10:05 p.m.	class_name: Filemonclass window_name:		0	0
FindWindowA Sept. 22, 2021, 10:05 p.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA Sept. 22, 2021, 10:05 p.m.	class_name: Regmonclass window_name:		0	0
FindWindowA Sept. 22, 2021, 10:05 p.m.	class_name: Regmonclass window_name:		0	0
FindWindowA Sept. 22, 2021, 10:05 p.m.	class_name: 18467-41 window_name:		0	0
FindWindowA Sept. 22, 2021, 10:05 p.m.	class_name: Filemonclass window_name:		0	0
FindWindowA Sept. 22, 2021, 10:05 p.m.	class_name: Filemonclass window_name:		0	0
FindWindowA Sept. 22, 2021, 10:05 p.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA Sept. 22, 2021, 10:05 p.m.	class_name: Regmonclass window_name:		0	0
FindWindowA Sept. 22, 2021, 10:05 p.m.	class_name: Regmonclass window_name:		0	0
FindWindowA Sept. 22, 2021, 10:05 p.m.	class_name: 18467-41 window_name:		0	0
FindWindowA Sept. 22, 2021, 10:05 p.m.	class_name: Filemonclass window_name:		0	0
FindWindowA Sept. 22, 2021, 10:05 p.m.	class_name: Filemonclass window_name:		0	0
FindWindowA Sept. 22, 2021, 10:05 p.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA Sept. 22, 2021, 10:05 p.m.	class_name: Regmonclass window_name:		0	0
FindWindowA Sept. 22, 2021, 10:05 p.m.	class_name: Regmonclass window_name:		0	0
FindWindowA Sept. 22, 2021, 10:05 p.m.	class_name: 18467-41 window_name:		0	0
FindWindowA Sept. 22, 2021, 10:05 p.m.	class_name: Filemonclass window_name:		0	0
FindWindowA Sept. 22, 2021, 10:05 p.m.	class_name: Filemonclass window_name:		0	0
FindWindowA Sept. 22, 2021, 10:05 p.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA Sept. 22, 2021, 10:06 p.m.	class_name: Regmonclass window_name:		0	0
FindWindowA Sept. 22, 2021, 10:06 p.m.	class_name: Regmonclass window_name:		0	0
FindWindowA Sept. 22, 2021, 10:06 p.m.	class_name: 18467-41 window_name:		0	0
FindWindowA Sept. 22, 2021, 10:06 p.m.	class_name: Filemonclass window_name:		0	0
FindWindowA Sept. 22, 2021, 10:06 p.m.	class_name: Filemonclass window_name:		0	0
FindWindowA Sept. 22, 2021, 10:06 p.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA Sept. 22, 2021, 10:06 p.m.	class_name: Regmonclass window_name:		0	0
FindWindowA Sept. 22, 2021, 10:06 p.m.	class_name: Regmonclass window_name:		0	0
FindWindowA Sept. 22, 2021, 10:06 p.m.	class_name: 18467-41 window_name:		0	0
FindWindowA Sept. 22, 2021, 10:06 p.m.	class_name: Filemonclass window_name:		0	0
FindWindowA Sept. 22, 2021, 10:06 p.m.	class_name: Filemonclass window_name:		0	0
FindWindowA Sept. 22, 2021, 10:06 p.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA Sept. 22, 2021, 10:06 p.m.	class_name: Regmonclass window_name:		0	0
FindWindowA Sept. 22, 2021, 10:06 p.m.	class_name: Regmonclass window_name:		0	0

Checks the version of Bios, possibly for anti-virtualization (2 events)

registry	HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion
registry	HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion

File has been identified by 19 AntiVirus engines on VirusTotal as malicious (19 events)

Bkav	W32.AIDetect.malware1
Elastic	malicious (high confidence)
FireEye	Generic.mg.e3cbb2e3f1de0e91
Cylance	Unsafe
Sangfor	Suspicious.Win32.Save.a
Cybereason	malicious.23ad91
BitDefenderTheta	Gen:NN.ZexaF.34142.kJ0@amE1xjcO
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
NANO-Antivirus	Virus.Win32.Gen.ccmw
Sophos	ML/PE-A
McAfee-GW-Edition	BehavesLike.Win32.Generic.wm
SentinelOne	Static AI - Malicious PE
Gridinsoft	Trojan.Heur!.030100A1
Microsoft	Trojan:Win32/Sabsik.FL.B!ml
Cynet	Malicious (score: 100)
McAfee	Artemis!E3CBB2E3F1DE
VBA32	BScope.TrojanPSW.MSIL.Reline
MaxSecure	Trojan.Malware.300983.susgen

Detects Virtual Machines through their custom firmware (1 event)

Time & API	Arguments	Status	Return	Repeated
NtQuerySystemInformation Sept. 22, 2021, 10:05 p.m.	information_class: 76 (SystemFirmwareTableInformation)		3221225507	0

Detects VMWare through the in instruction feature (1 event)

Time & API	Arguments	Status	Return	Repeated
__exception__ Sept. 22, 2021, 10:05 p.m.	stacktrace: exception.instruction_r: ed 64 8f 05 00 00 00 00 83 c4 04 81 fb 68 58 4d exception.symbol: yes+0x2fe80d exception.instruction: in eax, dx exception.module: yes.exe exception.exception_code: 0xc0000096 exception.offset: 3139597 exception.address: 0x11fe80d registers.esp: 4455688 registers.edi: 17254037 registers.eax: 1447909480 registers.ebp: 16105472 registers.edx: 22104 registers.ebx: 2256917605 registers.esi: 13 registers.ecx: 10	1	0	0

Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) (1 event)

dead_host

84.38.189.175:54144

yes.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All