Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Sept. 22, 2021, 10:23 p.m.	Sept. 22, 2021, 10:36 p.m.

Size	43.0KB
Type	PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
MD5	`26b9716419a2eac7f4b367e6cc06a946`
SHA256	`5f2bb993e586b280867fe5ca8a86d14f4ac659ce4ca0ce1e63379a5fad668d44`
CRC32	`1D37946B`
ssdeep	`768:9wlIOdRWC4sDUIaO2qvTwbQ1dsI5QY+QN8Aliwt4:9wCOdRWC4sDUfzbQ8VY+QCAliP`
Yara	IsPE64 - (no description) PE_Header_Zero - PE File Signature Generic_Malware_Zero - Generic Malware OS_Processor_Check_Zero - OS Processor Check Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT

buildcpils.exe "C:\Users\test22\AppData\Local\Temp\buildcpils.exe"
1016
- IISExpress.exe "C:\Users\test22\AppData\Local\IIS Express ver2.30\IISExpress.exe"
  1976
  - schtasks.exe "C:\Windows\System32\schtasks.exe" /create /sc MINUTE /mo 1 /tn "LogicNP Software ver4.47" /tr "'C:\Users\test22\AppData\Local\IIS Express ver2.30\IISExpress.exe"'/f
    2540

Name	Response	Post-Analysis Lookup
api.telegram.org	A 149.154.167.220	149.154.167.220

IP Address	Status	Action
104.26.12.31	Active	Moloch
149.154.167.220	Active	Moloch
164.124.101.2	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 149.154.167.220:443 -> 192.168.56.101:49203	2029340	ET INFO TLS Handshake Failure	Potentially Bad Traffic
TCP 192.168.56.101:49203 -> 149.154.167.220:443	906200022	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined

Suricata TLS

No Suricata TLS

Queries for the computername (9 events)

Time & API	Arguments	Status	Return
GetComputerNameW Sept. 22, 2021, 10:16 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 22, 2021, 10:27 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 22, 2021, 10:27 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 22, 2021, 10:27 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 22, 2021, 10:27 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 22, 2021, 10:27 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 22, 2021, 10:27 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 22, 2021, 10:27 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 22, 2021, 10:27 p.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (4 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Sept. 22, 2021, 10:16 p.m.			0	0
IsDebuggerPresent Sept. 22, 2021, 10:16 p.m.			0	0
IsDebuggerPresent Sept. 22, 2021, 10:27 p.m.			0	0
IsDebuggerPresent Sept. 22, 2021, 10:27 p.m.			0	0

Command line console output was observed (1 event)

Time & API	Arguments	Status	Return	Repeated
WriteConsoleW Sept. 22, 2021, 10:27 p.m.	buffer: SUCCESS: The scheduled task "LogicNP Software ver4.47" has successfully been created. console_handle: 0x0000000000000007	1	1	0

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Sept. 22, 2021, 10:16 p.m.		1	1	0

Allocates read-write-execute memory (usually to unpack itself) (50 out of 122 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Sept. 22, 2021, 10:16 p.m.	process_identifier: 1016 region_size: 1376256 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000a50000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 22, 2021, 10:16 p.m.	process_identifier: 1016 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000b20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 22, 2021, 10:16 p.m.	process_identifier: 1016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1271000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 22, 2021, 10:16 p.m.	process_identifier: 1016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef190b000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 22, 2021, 10:16 p.m.	process_identifier: 1016 region_size: 1376256 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002470000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 22, 2021, 10:16 p.m.	process_identifier: 1016 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002540000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 22, 2021, 10:16 p.m.	process_identifier: 1016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1272000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 22, 2021, 10:16 p.m.	process_identifier: 1016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1272000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 22, 2021, 10:16 p.m.	process_identifier: 1016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1272000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 22, 2021, 10:16 p.m.	process_identifier: 1016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1272000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 22, 2021, 10:16 p.m.	process_identifier: 1016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1272000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 22, 2021, 10:16 p.m.	process_identifier: 1016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1272000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 22, 2021, 10:16 p.m.	process_identifier: 1016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1272000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 22, 2021, 10:16 p.m.	process_identifier: 1016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1272000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 22, 2021, 10:16 p.m.	process_identifier: 1016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1272000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 22, 2021, 10:16 p.m.	process_identifier: 1016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1272000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 22, 2021, 10:16 p.m.	process_identifier: 1016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1272000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 22, 2021, 10:16 p.m.	process_identifier: 1016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1274000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 22, 2021, 10:16 p.m.	process_identifier: 1016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1274000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 22, 2021, 10:16 p.m.	process_identifier: 1016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1274000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 22, 2021, 10:16 p.m.	process_identifier: 1016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1274000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 22, 2021, 10:16 p.m.	process_identifier: 1016 region_size: 655360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 22, 2021, 10:16 p.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 22, 2021, 10:16 p.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 22, 2021, 10:16 p.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 22, 2021, 10:16 p.m.	process_identifier: 1016 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 22, 2021, 10:16 p.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 22, 2021, 10:16 p.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91aea000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 22, 2021, 10:16 p.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91afc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 22, 2021, 10:16 p.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91b9c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 22, 2021, 10:16 p.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91bc6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 22, 2021, 10:16 p.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91ba0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 22, 2021, 10:16 p.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91c10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 22, 2021, 10:16 p.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91aeb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 22, 2021, 10:16 p.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91b0b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 22, 2021, 10:16 p.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91c11000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 22, 2021, 10:16 p.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91afa000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 22, 2021, 10:16 p.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91b3c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 22, 2021, 10:16 p.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91b0d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 22, 2021, 10:16 p.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91ae2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 22, 2021, 10:16 p.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91c50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 22, 2021, 10:16 p.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91c12000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 22, 2021, 10:16 p.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91c51000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 22, 2021, 10:16 p.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91afb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 22, 2021, 10:16 p.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91c52000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 22, 2021, 10:27 p.m.	process_identifier: 1976 region_size: 1966080 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000aa0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 22, 2021, 10:27 p.m.	process_identifier: 1976 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000c00000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 22, 2021, 10:27 p.m.	process_identifier: 1976 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1271000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 22, 2021, 10:27 p.m.	process_identifier: 1976 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef190b000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 22, 2021, 10:27 p.m.	process_identifier: 1976 region_size: 1376256 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000023a0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1

Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation (4 events)

Time & API	Arguments	Status	Return
GetDiskFreeSpaceExW Sept. 22, 2021, 10:16 p.m.	total_number_of_free_bytes: 13726449664 free_bytes_available: 13726449664 root_path: C:\ total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceExW Sept. 22, 2021, 10:27 p.m.	total_number_of_free_bytes: 12997599232 free_bytes_available: 12997599232 root_path: C:\ total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceExW Sept. 22, 2021, 10:27 p.m.	total_number_of_free_bytes: 12997533696 free_bytes_available: 12997533696 root_path: C:\ total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceExW Sept. 22, 2021, 10:27 p.m.	total_number_of_free_bytes: 12997193728 free_bytes_available: 12997193728 root_path: C:\ total_number_of_bytes: 34252779520	1	1

Creates executable files on the filesystem (1 event)

file	C:\Users\test22\AppData\Local\IIS Express ver2.30\IISExpress.exe

Creates a suspicious process (2 events)

cmdline	"C:\Windows\System32\schtasks.exe" /create /sc MINUTE /mo 1 /tn "LogicNP Software ver4.47" /tr "'C:\Users\test22\AppData\Local\IIS Express ver2.30\IISExpress.exe"'/f
cmdline	schtasks.exe /create /sc MINUTE /mo 1 /tn "LogicNP Software ver4.47" /tr "'C:\Users\test22\AppData\Local\IIS Express ver2.30\IISExpress.exe"'/f

A process created a hidden window (1 event)

Time & API	Arguments	Status	Return	Repeated
ShellExecuteExW Sept. 22, 2021, 10:27 p.m.	show_type: 0 filepath_r: schtasks.exe parameters: /create /sc MINUTE /mo 1 /tn "LogicNP Software ver4.47" /tr "'C:\Users\test22\AppData\Local\IIS Express ver2.30\IISExpress.exe"'/f filepath: schtasks.exe	1	1	0

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses Sept. 22, 2021, 10:27 p.m.	flags: 15 family: 0		111	0

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 event)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW Sept. 22, 2021, 10:16 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Uses Windows utilities for basic Windows functionality (2 events)

cmdline	"C:\Windows\System32\schtasks.exe" /create /sc MINUTE /mo 1 /tn "LogicNP Software ver4.47" /tr "'C:\Users\test22\AppData\Local\IIS Express ver2.30\IISExpress.exe"'/f
cmdline	schtasks.exe /create /sc MINUTE /mo 1 /tn "LogicNP Software ver4.47" /tr "'C:\Users\test22\AppData\Local\IIS Express ver2.30\IISExpress.exe"'/f

Communicates with host for which no DNS query was performed (1 event)

host

104.26.12.31

Installs itself for autorun at Windows startup (2 events)

cmdline	"C:\Windows\System32\schtasks.exe" /create /sc MINUTE /mo 1 /tn "LogicNP Software ver4.47" /tr "'C:\Users\test22\AppData\Local\IIS Express ver2.30\IISExpress.exe"'/f
cmdline	schtasks.exe /create /sc MINUTE /mo 1 /tn "LogicNP Software ver4.47" /tr "'C:\Users\test22\AppData\Local\IIS Express ver2.30\IISExpress.exe"'/f

Drops a binary and executes it (1 event)

file	C:\Users\test22\AppData\Local\IIS Express ver2.30\IISExpress.exe

File has been identified by 17 AntiVirus engines on VirusTotal as malicious (17 events)

Elastic	malicious (high confidence)
CAT-QuickHeal	Trojan.YakbeexMSIL.ZZ4
CrowdStrike	win/malicious_confidence_100% (W)
APEX	Malicious
Paloalto	generic.ml
Avast	FileRepMalware
McAfee-GW-Edition	BehavesLike.Win64.Generic.pm
FireEye	Generic.mg.26b9716419a2eac7
Sophos	ML/PE-A
Webroot	W32.Malware.Gen
ZoneAlarm	UDS:DangerousObject.Multi.Generic
Microsoft	Trojan:Win32/Sabsik.FL.B!ml
McAfee	Artemis!26B9716419A2
Cylance	Unsafe
SentinelOne	Static AI - Malicious PE
AVG	FileRepMalware
MaxSecure	Trojan.Malware.300983.susgen

A process performed obfuscation on information about the computer or sent it to a remote location indicative of CnC Traffic/Preperations. (14 events)

Time & API	Arguments	Status	Return
CryptHashData Sept. 22, 2021, 10:16 p.m.	buffer: 127631360test22TEST22-PCMicrosoft Windows NT 6.1.7601 Service Pack 134252779520 hash_handle: 0x0000000000102af0 flags: 0	1	1
CryptHashData Sept. 22, 2021, 10:27 p.m.	buffer: 127631360test22TEST22-PCMicrosoft Windows NT 6.1.7601 Service Pack 134252779520 hash_handle: 0x0000000000530b90 flags: 0	1	1
CryptHashData Sept. 22, 2021, 10:27 p.m.	buffer: 127631360test22TEST22-PCMicrosoft Windows NT 6.1.7601 Service Pack 134252779520 hash_handle: 0x0000000000530b90 flags: 0	1	1
CryptHashData Sept. 22, 2021, 10:27 p.m.	buffer: 127631360test221Microsoft Windows NT 6.1.7601 Service Pack 1TEST22-PC34252779520 hash_handle: 0x0000000000589150 flags: 0	1	1
CryptHashData Sept. 22, 2021, 10:27 p.m.	buffer: 127631360test221Microsoft Windows NT 6.1.7601 Service Pack 1TEST22-PC34252779520 hash_handle: 0x0000000000589150 flags: 0	1	1
CryptHashData Sept. 22, 2021, 10:27 p.m.	buffer: 127631360test221Microsoft Windows NT 6.1.7601 Service Pack 1TEST22-PC34252779520 hash_handle: 0x0000000000589150 flags: 0	1	1
CryptHashData Sept. 22, 2021, 10:27 p.m.	buffer: 127631360test221Microsoft Windows NT 6.1.7601 Service Pack 1TEST22-PC34252779520 hash_handle: 0x000000001cc46230 flags: 0	1	1
CryptHashData Sept. 22, 2021, 10:27 p.m.	buffer: 127631360test221Microsoft Windows NT 6.1.7601 Service Pack 1TEST22-PC34252779520 hash_handle: 0x000000001cc46230 flags: 0	1	1
CryptHashData Sept. 22, 2021, 10:27 p.m.	buffer: 127631360test221Microsoft Windows NT 6.1.7601 Service Pack 1TEST22-PC34252779520 hash_handle: 0x000000001cc46230 flags: 0	1	1
CryptHashData Sept. 22, 2021, 10:27 p.m.	buffer: 127631360test221Microsoft Windows NT 6.1.7601 Service Pack 1TEST22-PC34252779520 hash_handle: 0x000000001cc46230 flags: 0	1	1
CryptHashData Sept. 22, 2021, 10:27 p.m.	buffer: 127631360test221Microsoft Windows NT 6.1.7601 Service Pack 1TEST22-PC34252779520 hash_handle: 0x000000001cc46230 flags: 0	1	1
CryptHashData Sept. 22, 2021, 10:27 p.m.	buffer: 127631360test221Microsoft Windows NT 6.1.7601 Service Pack 1TEST22-PC34252779520 hash_handle: 0x000000001cc46230 flags: 0	1	1
CryptHashData Sept. 22, 2021, 10:27 p.m.	buffer: 127631360test221Microsoft Windows NT 6.1.7601 Service Pack 1TEST22-PC34252779520 hash_handle: 0x000000001cc46230 flags: 0	1	1
CryptHashData Sept. 22, 2021, 10:27 p.m.	buffer: 127631360test221Microsoft Windows NT 6.1.7601 Service Pack 1TEST22-PC34252779520 hash_handle: 0x000000001cc46230 flags: 0	1	1

buildcpils.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All