Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Sept. 29, 2021, 10:04 a.m.	Sept. 29, 2021, 10:08 a.m.

Size	994.0KB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`2ed76672668438c5129c82daeac7ef36`
SHA256	`e5f48b4531abf6b553ac264b9deb28736db14a92e6d3afd196a7c8e11f40e11f`
CRC32	`F78D3397`
ssdeep	`24576:Qdla9gYmncCehCF2BEwT/5PrQLeOjQ8WEA48VEfxnv:yQ9R6ehTUPjjrSVEfxn`
Yara	PE_Header_Zero - PE File Signature Generic_Malware_Zero - Generic Malware Is_DotNET_EXE - (no description) Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT IsPE32 - (no description)

ppt_61102126305327.exe "C:\Users\test22\AppData\Local\Temp\ppt_61102126305327.exe"
1868
- ppt_61102126305327.exe "C:\Users\test22\AppData\Local\Temp\ppt_61102126305327.exe"
  3052
- cmd.exe "C:\Windows\System32\cmd.exe" /c schtasks /create /sc minute /mo 1 /tn "Nano" /tr "'C:\Users\test22\AppData\Roaming\snto\snto.exe'" /f
  1912
  - schtasks.exe schtasks /create /sc minute /mo 1 /tn "Nano" /tr "'C:\Users\test22\AppData\Roaming\snto\snto.exe'" /f
    2444
- cmd.exe "C:\Windows\System32\cmd.exe" /c copy "C:\Users\test22\AppData\Local\Temp\ppt_61102126305327.exe" "C:\Users\test22\AppData\Roaming\snto\snto.exe"
  2088

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
152.67.253.163	Active	Moloch
164.124.101.2	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (2 events)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameW Sept. 29, 2021, 10:05 a.m.	computer_name: TEST22-PC	1	1	0
GetComputerNameW Sept. 29, 2021, 10:05 a.m.	computer_name: TEST22-PC	1	1	0

Checks if process is being debugged by a debugger (50 out of 239 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Sept. 29, 2021, 10:04 a.m.			0	0
IsDebuggerPresent Sept. 29, 2021, 10:04 a.m.			0	0
IsDebuggerPresent Sept. 29, 2021, 10:04 a.m.			0	0
IsDebuggerPresent Sept. 29, 2021, 10:04 a.m.			0	0
IsDebuggerPresent Sept. 29, 2021, 10:04 a.m.			0	0
IsDebuggerPresent Sept. 29, 2021, 10:04 a.m.			0	0
IsDebuggerPresent Sept. 29, 2021, 10:04 a.m.			0	0
IsDebuggerPresent Sept. 29, 2021, 10:04 a.m.			0	0
IsDebuggerPresent Sept. 29, 2021, 10:04 a.m.			0	0
IsDebuggerPresent Sept. 29, 2021, 10:04 a.m.			0	0
IsDebuggerPresent Sept. 29, 2021, 10:04 a.m.			0	0
IsDebuggerPresent Sept. 29, 2021, 10:04 a.m.			0	0
IsDebuggerPresent Sept. 29, 2021, 10:04 a.m.			0	0
IsDebuggerPresent Sept. 29, 2021, 10:04 a.m.			0	0
IsDebuggerPresent Sept. 29, 2021, 10:04 a.m.			0	0
IsDebuggerPresent Sept. 29, 2021, 10:04 a.m.			0	0
IsDebuggerPresent Sept. 29, 2021, 10:04 a.m.			0	0
IsDebuggerPresent Sept. 29, 2021, 10:04 a.m.			0	0
IsDebuggerPresent Sept. 29, 2021, 10:04 a.m.			0	0
IsDebuggerPresent Sept. 29, 2021, 10:04 a.m.			0	0
IsDebuggerPresent Sept. 29, 2021, 10:04 a.m.			0	0
IsDebuggerPresent Sept. 29, 2021, 10:04 a.m.			0	0
IsDebuggerPresent Sept. 29, 2021, 10:04 a.m.			0	0
IsDebuggerPresent Sept. 29, 2021, 10:04 a.m.			0	0
IsDebuggerPresent Sept. 29, 2021, 10:04 a.m.			0	0
IsDebuggerPresent Sept. 29, 2021, 10:04 a.m.			0	0
IsDebuggerPresent Sept. 29, 2021, 10:04 a.m.			0	0
IsDebuggerPresent Sept. 29, 2021, 10:04 a.m.			0	0
IsDebuggerPresent Sept. 29, 2021, 10:04 a.m.			0	0
IsDebuggerPresent Sept. 29, 2021, 10:04 a.m.			0	0
IsDebuggerPresent Sept. 29, 2021, 10:04 a.m.			0	0
IsDebuggerPresent Sept. 29, 2021, 10:04 a.m.			0	0
IsDebuggerPresent Sept. 29, 2021, 10:04 a.m.			0	0
IsDebuggerPresent Sept. 29, 2021, 10:04 a.m.			0	0
IsDebuggerPresent Sept. 29, 2021, 10:04 a.m.			0	0
IsDebuggerPresent Sept. 29, 2021, 10:04 a.m.			0	0
IsDebuggerPresent Sept. 29, 2021, 10:04 a.m.			0	0
IsDebuggerPresent Sept. 29, 2021, 10:04 a.m.			0	0
IsDebuggerPresent Sept. 29, 2021, 10:05 a.m.			0	0
IsDebuggerPresent Sept. 29, 2021, 10:05 a.m.			0	0
IsDebuggerPresent Sept. 29, 2021, 10:05 a.m.			0	0
IsDebuggerPresent Sept. 29, 2021, 10:05 a.m.			0	0
IsDebuggerPresent Sept. 29, 2021, 10:05 a.m.			0	0
IsDebuggerPresent Sept. 29, 2021, 10:05 a.m.			0	0
IsDebuggerPresent Sept. 29, 2021, 10:05 a.m.			0	0
IsDebuggerPresent Sept. 29, 2021, 10:05 a.m.			0	0
IsDebuggerPresent Sept. 29, 2021, 10:05 a.m.			0	0
IsDebuggerPresent Sept. 29, 2021, 10:05 a.m.			0	0
IsDebuggerPresent Sept. 29, 2021, 10:05 a.m.			0	0
IsDebuggerPresent Sept. 29, 2021, 10:05 a.m.			0	0

Command line console output was observed (2 events)

Time & API	Arguments	Status	Return	Repeated
WriteConsoleW Sept. 29, 2021, 10:05 a.m.	buffer: 1 file(s) copied. console_handle: 0x00000007	1	1	0
WriteConsoleW Sept. 29, 2021, 10:05 a.m.	buffer: SUCCESS: The scheduled task "Nano" has successfully been created. console_handle: 0x00000007	1	1	0

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Sept. 29, 2021, 10:04 a.m.		1	1	0

One or more processes crashed (1 event)

Time & API	Arguments	Status	Return	Repeated
__exception__ Sept. 29, 2021, 10:05 a.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x76a7b727 registers.esp: 3012308 registers.edi: 12288160 registers.eax: 3012308 registers.ebp: 3012388 registers.edx: 0 registers.ebx: 12288160 registers.esi: 12288160 registers.ecx: 2	1	0	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (50 out of 56 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Sept. 29, 2021, 10:04 a.m.	process_identifier: 1868 region_size: 1572864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x009b0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 29, 2021, 10:04 a.m.	process_identifier: 1868 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00af0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 29, 2021, 10:04 a.m.	process_identifier: 1868 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72741000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 29, 2021, 10:04 a.m.	process_identifier: 1868 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72742000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 29, 2021, 10:04 a.m.	process_identifier: 1868 region_size: 1114112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x009b0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 29, 2021, 10:04 a.m.	process_identifier: 1868 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a80000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 29, 2021, 10:04 a.m.	process_identifier: 1868 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00412000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 29, 2021, 10:04 a.m.	process_identifier: 1868 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0042c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 29, 2021, 10:04 a.m.	process_identifier: 1868 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007d0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 29, 2021, 10:04 a.m.	process_identifier: 1868 region_size: 12288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007d1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 29, 2021, 10:04 a.m.	process_identifier: 1868 region_size: 20480 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007d4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 29, 2021, 10:04 a.m.	process_identifier: 1868 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0044b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 29, 2021, 10:04 a.m.	process_identifier: 1868 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00447000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 29, 2021, 10:04 a.m.	process_identifier: 1868 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00445000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 29, 2021, 10:04 a.m.	process_identifier: 1868 region_size: 24576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007d9000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 29, 2021, 10:04 a.m.	process_identifier: 1868 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x008a0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 29, 2021, 10:04 a.m.	process_identifier: 1868 region_size: 20480 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x008a1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 29, 2021, 10:04 a.m.	process_identifier: 1868 region_size: 20480 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x008a6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 29, 2021, 10:04 a.m.	process_identifier: 1868 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x008ab000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 29, 2021, 10:04 a.m.	process_identifier: 1868 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x009b0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 29, 2021, 10:04 a.m.	process_identifier: 1868 region_size: 20480 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x009b1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 29, 2021, 10:04 a.m.	process_identifier: 1868 region_size: 20480 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x009b6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 29, 2021, 10:04 a.m.	process_identifier: 1868 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x009c0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 29, 2021, 10:04 a.m.	process_identifier: 1868 region_size: 20480 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x009c1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 29, 2021, 10:04 a.m.	process_identifier: 1868 region_size: 20480 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x009c6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 29, 2021, 10:04 a.m.	process_identifier: 1868 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x009d0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 29, 2021, 10:04 a.m.	process_identifier: 1868 region_size: 20480 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x009d1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 29, 2021, 10:04 a.m.	process_identifier: 1868 region_size: 24576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x009d6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 29, 2021, 10:04 a.m.	process_identifier: 1868 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x009e0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 29, 2021, 10:04 a.m.	process_identifier: 1868 region_size: 20480 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x009e1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 29, 2021, 10:04 a.m.	process_identifier: 1868 region_size: 20480 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x009e6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 29, 2021, 10:04 a.m.	process_identifier: 1868 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x009eb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 29, 2021, 10:04 a.m.	process_identifier: 1868 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a30000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 29, 2021, 10:04 a.m.	process_identifier: 1868 region_size: 24576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a31000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 29, 2021, 10:04 a.m.	process_identifier: 1868 region_size: 20480 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a37000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 29, 2021, 10:04 a.m.	process_identifier: 1868 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x009f0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 29, 2021, 10:04 a.m.	process_identifier: 1868 region_size: 20480 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x009f1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 29, 2021, 10:04 a.m.	process_identifier: 1868 region_size: 24576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x009f6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 29, 2021, 10:04 a.m.	process_identifier: 1868 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0042d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 29, 2021, 10:04 a.m.	process_identifier: 1868 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x009fc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 29, 2021, 10:04 a.m.	process_identifier: 1868 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0072f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 29, 2021, 10:04 a.m.	process_identifier: 1868 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00720000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 29, 2021, 10:04 a.m.	process_identifier: 1868 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0041a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 29, 2021, 10:04 a.m.	process_identifier: 1868 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x009fd000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 29, 2021, 10:04 a.m.	process_identifier: 1868 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00436000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 29, 2021, 10:04 a.m.	process_identifier: 1868 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0043a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 29, 2021, 10:04 a.m.	process_identifier: 1868 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00437000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 29, 2021, 10:04 a.m.	process_identifier: 1868 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0042a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 29, 2021, 10:05 a.m.	process_identifier: 1868 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x009fe000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 29, 2021, 10:05 a.m.	process_identifier: 1868 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x009ff000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

A process attempted to delay the analysis task. (1 event)

description

ppt_61102126305327.exe tried to sleep 267 seconds, actually delayed analysis time by 267 seconds

Creates a suspicious process (5 events)

cmdline	schtasks /create /sc minute /mo 1 /tn "Nano" /tr "'C:\Users\test22\AppData\Roaming\snto\snto.exe'" /f
cmdline	"C:\Windows\System32\cmd.exe" /c schtasks /create /sc minute /mo 1 /tn "Nano" /tr "'C:\Users\test22\AppData\Roaming\snto\snto.exe'" /f
cmdline	cmd.exe /c copy "C:\Users\test22\AppData\Local\Temp\ppt_61102126305327.exe" "C:\Users\test22\AppData\Roaming\snto\snto.exe"
cmdline	"C:\Windows\System32\cmd.exe" /c copy "C:\Users\test22\AppData\Local\Temp\ppt_61102126305327.exe" "C:\Users\test22\AppData\Roaming\snto\snto.exe"
cmdline	cmd.exe /c schtasks /create /sc minute /mo 1 /tn "Nano" /tr "'C:\Users\test22\AppData\Roaming\snto\snto.exe'" /f

Executes one or more WMI queries (1 event)

wmi	Select * from Win32_ComputerSystem

A process created a hidden window (2 events)

Time & API	Arguments	Status	Return	Repeated
ShellExecuteExW Sept. 29, 2021, 10:05 a.m.	show_type: 0 filepath_r: cmd.exe parameters: /c schtasks /create /sc minute /mo 1 /tn "Nano" /tr "'C:\Users\test22\AppData\Roaming\snto\snto.exe'" /f filepath: cmd.exe	1	1	0
ShellExecuteExW Sept. 29, 2021, 10:05 a.m.	show_type: 0 filepath_r: cmd.exe parameters: /c copy "C:\Users\test22\AppData\Local\Temp\ppt_61102126305327.exe" "C:\Users\test22\AppData\Roaming\snto\snto.exe" filepath: cmd.exe	1	1	0

Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time) (1 event)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory Sept. 29, 2021, 10:05 a.m.	process_identifier: 3052 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 24576 protection: 32 (PAGE_EXECUTE_READ) base_address: 0x00390000 process_handle: 0xffffffff	1	0	0

The binary likely contains encrypted or compressed data indicative of a packer (3 events)

section

{u'size_of_data': u'0x000e8c00', u'virtual_address': u'0x00002000', u'entropy': 7.54686627406884, u'name': u'.text', u'virtual_size': u'0x000e8b34'}

entropy

7.54686627407

description

A section with a high entropy has been found

section

{u'size_of_data': u'0x0000f800', u'virtual_address': u'0x000ec000', u'entropy': 7.518443767317225, u'name': u'.rsrc', u'virtual_size': u'0x0000f752'}

entropy

7.51844376732

description

A section with a high entropy has been found

entropy

0.999496728737

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 event)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW Sept. 29, 2021, 10:04 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Yara rule detected in process memory (10 events)

description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerCheck__RemoteAPI
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vba
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep

Uses Windows utilities for basic Windows functionality (3 events)

cmdline	schtasks /create /sc minute /mo 1 /tn "Nano" /tr "'C:\Users\test22\AppData\Roaming\snto\snto.exe'" /f
cmdline	"C:\Windows\System32\cmd.exe" /c schtasks /create /sc minute /mo 1 /tn "Nano" /tr "'C:\Users\test22\AppData\Roaming\snto\snto.exe'" /f
cmdline	cmd.exe /c schtasks /create /sc minute /mo 1 /tn "Nano" /tr "'C:\Users\test22\AppData\Roaming\snto\snto.exe'" /f

Executes one or more WMI queries which can be used to identify virtual machines (1 event)

wmi	Select * from Win32_ComputerSystem

One or more of the buffers contains an embedded PE file (1 event)

buffer

Buffer with sha1: 8caebcdac1e7bb8bfdee06444be663418719c6d3

Communicates with host for which no DNS query was performed (1 event)

host

152.67.253.163

Allocates execute permission to another process indicative of possible code injection (1 event)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory Sept. 29, 2021, 10:05 a.m.	process_identifier: 3052 region_size: 688128 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000004ac	1	0	0

Installs itself for autorun at Windows startup (3 events)

cmdline	schtasks /create /sc minute /mo 1 /tn "Nano" /tr "'C:\Users\test22\AppData\Roaming\snto\snto.exe'" /f
cmdline	"C:\Windows\System32\cmd.exe" /c schtasks /create /sc minute /mo 1 /tn "Nano" /tr "'C:\Users\test22\AppData\Roaming\snto\snto.exe'" /f
cmdline	cmd.exe /c schtasks /create /sc minute /mo 1 /tn "Nano" /tr "'C:\Users\test22\AppData\Roaming\snto\snto.exe'" /f

Potential code injection by writing to the memory of another process (1 event)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory Sept. 29, 2021, 10:05 a.m.	buffer: @ base_address: 0x7efde008 process_identifier: 3052 process_handle: 0x000004ac	1	1	0

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1868 called NtSetContextThread to modify thread in remote process 3052
NtSetContextThread Sept. 29, 2021, 10:05 a.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4205532 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x000004a8 process_identifier: 3052	1	0	0

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1868 resumed a thread in remote process 3052
NtResumeThread Sept. 29, 2021, 10:05 a.m.	thread_handle: 0x000004a8 suspend_count: 1 process_identifier: 3052	1	0	0

Executed a process and injected code into it, probably while unpacking (18 events)

Time & API	Arguments	Status	Return
NtResumeThread Sept. 29, 2021, 10:04 a.m.	thread_handle: 0x000000e0 suspend_count: 1 process_identifier: 1868	1	0
NtResumeThread Sept. 29, 2021, 10:04 a.m.	thread_handle: 0x00000154 suspend_count: 1 process_identifier: 1868	1	0
NtResumeThread Sept. 29, 2021, 10:04 a.m.	thread_handle: 0x00000190 suspend_count: 1 process_identifier: 1868	1	0
NtResumeThread Sept. 29, 2021, 10:04 a.m.	thread_handle: 0x00000214 suspend_count: 1 process_identifier: 1868	1	0
NtResumeThread Sept. 29, 2021, 10:04 a.m.	thread_handle: 0x00000228 suspend_count: 1 process_identifier: 1868	1	0
CreateProcessInternalW Sept. 29, 2021, 10:05 a.m.	thread_identifier: 2420 thread_handle: 0x000004a8 process_identifier: 3052 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\ppt_61102126305327.exe track: 1 command_line: "C:\Users\test22\AppData\Local\Temp\ppt_61102126305327.exe" filepath_r: C:\Users\test22\AppData\Local\Temp\ppt_61102126305327.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x000004ac	1	1
NtGetContextThread Sept. 29, 2021, 10:05 a.m.	thread_handle: 0x000004a8	1	0
NtAllocateVirtualMemory Sept. 29, 2021, 10:05 a.m.	process_identifier: 3052 region_size: 688128 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000004ac	1	0
WriteProcessMemory Sept. 29, 2021, 10:05 a.m.	buffer: base_address: 0x00400000 process_identifier: 3052 process_handle: 0x000004ac	1	1
WriteProcessMemory Sept. 29, 2021, 10:05 a.m.	buffer: base_address: 0x00401000 process_identifier: 3052 process_handle: 0x000004ac	1	1
WriteProcessMemory Sept. 29, 2021, 10:05 a.m.	buffer: base_address: 0x0045d000 process_identifier: 3052 process_handle: 0x000004ac	1	1
WriteProcessMemory Sept. 29, 2021, 10:05 a.m.	buffer: base_address: 0x0045e000 process_identifier: 3052 process_handle: 0x000004ac	1	1
WriteProcessMemory Sept. 29, 2021, 10:05 a.m.	buffer: @ base_address: 0x7efde008 process_identifier: 3052 process_handle: 0x000004ac	1	1
NtSetContextThread Sept. 29, 2021, 10:05 a.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4205532 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x000004a8 process_identifier: 3052	1	0
NtResumeThread Sept. 29, 2021, 10:05 a.m.	thread_handle: 0x000004a8 suspend_count: 1 process_identifier: 3052	1	0
CreateProcessInternalW Sept. 29, 2021, 10:05 a.m.	thread_identifier: 2548 thread_handle: 0x000005fc process_identifier: 1912 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\cmd.exe track: 1 command_line: "C:\Windows\System32\cmd.exe" /c schtasks /create /sc minute /mo 1 /tn "Nano" /tr "'C:\Users\test22\AppData\Roaming\snto\snto.exe'" /f filepath_r: C:\Windows\System32\cmd.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x00000604	1	1
CreateProcessInternalW Sept. 29, 2021, 10:05 a.m.	thread_identifier: 1468 thread_handle: 0x000005a8 process_identifier: 2088 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\cmd.exe track: 1 command_line: "C:\Windows\System32\cmd.exe" /c copy "C:\Users\test22\AppData\Local\Temp\ppt_61102126305327.exe" "C:\Users\test22\AppData\Roaming\snto\snto.exe" filepath_r: C:\Windows\System32\cmd.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x00000608	1	1
CreateProcessInternalW Sept. 29, 2021, 10:05 a.m.	thread_identifier: 3056 thread_handle: 0x00000084 process_identifier: 2444 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\schtasks.exe track: 1 command_line: schtasks /create /sc minute /mo 1 /tn "Nano" /tr "'C:\Users\test22\AppData\Roaming\snto\snto.exe'" /f filepath_r: C:\Windows\system32\schtasks.exe stack_pivoted: 0 creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x00000088	1	1

File has been identified by 31 AntiVirus engines on VirusTotal as malicious (31 events)

Lionic	Trojan.Multi.Generic.4!c
Elastic	malicious (high confidence)
Cylance	Unsafe
Sangfor	Suspicious.Win32.Save.a
BitDefender	Trojan.GenericKD.37676170
CrowdStrike	win/malicious_confidence_90% (W)
Cyren	W32/MSIL_Kryptik.FOQ.gen!Eldorado
ESET-NOD32	a variant of MSIL/Injector.VRN
APEX	Malicious
Paloalto	generic.ml
Kaspersky	HEUR:Trojan.MSIL.Tasker.gen
Alibaba	Trojan:Win32/Kryptik.ali2000016
MicroWorld-eScan	Trojan.GenericKD.37676170
Avast	Win32:RATX-gen [Trj]
Sophos	Mal/Generic-S
McAfee-GW-Edition	BehavesLike.Win32.Generic.dc
FireEye	Generic.mg.2ed76672668438c5
Emsisoft	Trojan.GenericKD.37676170 (B)
Ikarus	Trojan.MSIL.Injector
GData	Win32.Trojan.Agent.CKFCNY
Webroot	W32.Trojan.Gen
Kingsoft	Win32.Troj.Undef.(kcloud)
Microsoft	Trojan:Win32/Woreflint.A!cl
AhnLab-V3	Trojan/Win.Mardom.C4656510
McAfee	Artemis!2ED766726684
Malwarebytes	MachineLearning/Anomalous.94%
TrendMicro-HouseCall	TROJ_GEN.R06CH0CIS21
SentinelOne	Static AI - Malicious PE
Fortinet	W32/Tasker!tr
BitDefenderTheta	Gen:NN.ZemsilF.34170.!m0@aiZcNhbG
AVG	Win32:RATX-gen [Trj]

ppt_61102126305327.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All