Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	Oct. 2, 2021, 12:52 p.m.	Oct. 2, 2021, 12:54 p.m.

Size	328.0KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`759e5f4dbc7432a87a19bcff1ae50ab7`
SHA256	`680e418e349d611812a6afd357c39fa4fe3baf32cd95012f9b0632a364f2f349`
CRC32	`9E4284A5`
ssdeep	`3072:4bTIIignViP0xBjOhkWJZCpphe70tnIIfP6F2UIHTuDaim722TZ:4bGs9ihkWTIt382rfim722T`
Yara	PE_Header_Zero - PE File Signature Generic_Malware_Zero - Generic Malware IsPE32 - (no description)

hfs.exe "C:\Users\test22\AppData\Local\Temp\hfs.exe"
2488
- hfsSrv.exe C:\Users\test22\AppData\Local\Temp\hfsSrv.exe
  2132
  - DesktopLayer.exe "C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
    572

Name	Response	Post-Analysis Lookup
caiyundf.cn	A 103.45.185.68	103.45.185.68
google.com	A 142.250.204.46	142.250.196.142
fget-career.com	A 72.26.218.70	72.26.218.70

IP Address	Status	Action
103.45.185.68	Active	Moloch
142.250.204.46	Active	Moloch
164.124.101.2	Active	Moloch
72.26.218.70	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Oct. 2, 2021, 12:52 p.m.		1	1	0

The executable uses a known packer (1 event)

packer

Armadillo v1.71

One or more processes crashed (1 event)

Time & API	Arguments	Status	Return	Repeated
__exception__ Oct. 2, 2021, 12:52 p.m.	stacktrace: CheckElevationEnabled+0x4a7 BaseGenerateAppCompatData-0x152 kernel32+0x23605 @ 0x76a53605 CheckElevationEnabled+0x2a3 BaseGenerateAppCompatData-0x356 kernel32+0x23401 @ 0x76a53401 CheckElevationEnabled+0x190 BaseGenerateAppCompatData-0x469 kernel32+0x232ee @ 0x76a532ee CreateProcessInternalW+0xc65 BasepFreeAppCompatData-0x4d9 kernel32+0x24858 @ 0x76a54858 New_kernel32_CreateProcessInternalW@48+0x185 New_kernel32_CreateRemoteThread@28-0x16b @ 0x74997747 CreateProcessInternalA+0x123 SetConsoleMode-0x1a3 kernel32+0x2a5da @ 0x76a5a5da CreateProcessA+0x2c Sleep-0x61 kernel32+0x1109e @ 0x76a4109e desktoplayer+0x13c0 @ 0x4013c0 desktoplayer+0x2cda @ 0x402cda RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77b19ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77b19ea5 exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0xfd5f3d52 registers.esp: 1634936 registers.edi: 1635572 registers.eax: 1635008 registers.ebp: 1634968 registers.edx: 83 registers.ebx: 1636324 registers.esi: 2008022532 registers.ecx: 2470930280	1	0	0

Time & API

Arguments

Status

Return

Repeated

__exception__

Oct. 2, 2021, 12:52 p.m.

stacktrace:

CheckElevationEnabled+0x4a7 BaseGenerateAppCompatData-0x152 kernel32+0x23605 @ 0x76a53605
CheckElevationEnabled+0x2a3 BaseGenerateAppCompatData-0x356 kernel32+0x23401 @ 0x76a53401
CheckElevationEnabled+0x190 BaseGenerateAppCompatData-0x469 kernel32+0x232ee @ 0x76a532ee
CreateProcessInternalW+0xc65 BasepFreeAppCompatData-0x4d9 kernel32+0x24858 @ 0x76a54858
New_kernel32_CreateProcessInternalW@48+0x185 New_kernel32_CreateRemoteThread@28-0x16b @ 0x74997747
CreateProcessInternalA+0x123 SetConsoleMode-0x1a3 kernel32+0x2a5da @ 0x76a5a5da
CreateProcessA+0x2c Sleep-0x61 kernel32+0x1109e @ 0x76a4109e
desktoplayer+0x13c0 @ 0x4013c0
desktoplayer+0x2cda @ 0x402cda
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77b19ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77b19ea5

exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xfd5f3d52
registers.esp: 1634936
registers.edi: 1635572
registers.eax: 1635008
registers.ebp: 1634968
registers.edx: 83
registers.ebx: 1636324
registers.esi: 2008022532
registers.ecx: 2470930280

Allocates read-write-execute memory (usually to unpack itself) (15 events)

Time & API	Arguments	Status	Return
NtProtectVirtualMemory Oct. 2, 2021, 12:52 p.m.	process_identifier: 2488 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 61440 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x10015000 process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Oct. 2, 2021, 12:52 p.m.	process_identifier: 2132 region_size: 61440 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003b0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtProtectVirtualMemory Oct. 2, 2021, 12:52 p.m.	process_identifier: 2132 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 188416 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Oct. 2, 2021, 12:52 p.m.	process_identifier: 2132 region_size: 28672 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003c0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1	0
NtProtectVirtualMemory Oct. 2, 2021, 12:52 p.m.	process_identifier: 2132 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 24576 protection: 3758096448 (PAGE_EXECUTE_READWRITE) base_address: 0x0040c000 process_handle: 0xffffffff		3221225541
NtProtectVirtualMemory Oct. 2, 2021, 12:52 p.m.	process_identifier: 2132 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 3221225536 (PAGE_EXECUTE_READWRITE) base_address: 0x00412000 process_handle: 0xffffffff		3221225541
NtProtectVirtualMemory Oct. 2, 2021, 12:52 p.m.	process_identifier: 2132 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Oct. 2, 2021, 12:52 p.m.	process_identifier: 572 region_size: 61440 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00710000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtProtectVirtualMemory Oct. 2, 2021, 12:52 p.m.	process_identifier: 572 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 188416 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Oct. 2, 2021, 12:52 p.m.	process_identifier: 572 region_size: 28672 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00720000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1	0
NtProtectVirtualMemory Oct. 2, 2021, 12:52 p.m.	process_identifier: 572 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 24576 protection: 3758096448 (PAGE_EXECUTE_READWRITE) base_address: 0x0040c000 process_handle: 0xffffffff		3221225541
NtProtectVirtualMemory Oct. 2, 2021, 12:52 p.m.	process_identifier: 572 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 3221225536 (PAGE_EXECUTE_READWRITE) base_address: 0x00412000 process_handle: 0xffffffff		3221225541
NtProtectVirtualMemory Oct. 2, 2021, 12:52 p.m.	process_identifier: 572 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory Oct. 2, 2021, 12:52 p.m.	process_identifier: 572 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x77aff000 process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Oct. 2, 2021, 12:52 p.m.	process_identifier: 572 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00750000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0

Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation (1 event)

Time & API	Arguments	Status	Return	Repeated
GetDiskFreeSpaceExW Oct. 2, 2021, 12:52 p.m.	total_number_of_free_bytes: 10931912704 free_bytes_available: 10931912704 root_path: C:\ total_number_of_bytes: 34252779520	1	1	0

Foreign language identified in PE resource (5 events)

name

RT_ICON

language

LANG_CHINESE

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x00051be0

size

0x00000568

name

RT_ICON

language

LANG_CHINESE

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x00051be0

size

0x00000568

name

RT_ICON

language

LANG_CHINESE

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x00051be0

size

0x00000568

name

RT_GROUP_ICON

language

LANG_CHINESE

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x00052148

size

0x00000030

name

RT_VERSION

language

LANG_CHINESE

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x00050150

size

0x00000340

Creates executable files on the filesystem (1 event)

file	C:\Users\test22\AppData\Local\Temp\hfsSrv.exe

Creates a service (1 event)

Time & API	Arguments	Status	Return	Repeated
CreateServiceA Oct. 2, 2021, 12:52 p.m.	service_start_name: start_type: 2 password: display_name: Ceaiyq cgkccasu filepath: C:\Program Files (x86)\Mpjshia.exe service_name: Rsvzjj rjhblwvi filepath_r: C:\Program Files (x86)\Mpjshia.exe desired_access: 983551 service_handle: 0x006042e8 error_control: 1 service_type: 272 service_manager_handle: 0x00603fc8	1	6308584	0

Drops an executable to the user AppData folder (1 event)

file	C:\Users\test22\AppData\Local\Temp\hfsSrv.exe

Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (42 events)

Time & API	Arguments	Status	Return
Process32NextW Oct. 2, 2021, 12:52 p.m.	snapshot_handle: 0x000000d8 process_name: smss.exe process_identifier: 228	1	1
Process32NextW Oct. 2, 2021, 12:52 p.m.	snapshot_handle: 0x000000d8 process_name: csrss.exe process_identifier: 308	1	1
Process32NextW Oct. 2, 2021, 12:52 p.m.	snapshot_handle: 0x000000d8 process_name: wininit.exe process_identifier: 348	1	1
Process32NextW Oct. 2, 2021, 12:52 p.m.	snapshot_handle: 0x000000d8 process_name: csrss.exe process_identifier: 368	1	1
Process32NextW Oct. 2, 2021, 12:52 p.m.	snapshot_handle: 0x000000d8 process_name: winlogon.exe process_identifier: 412	1	1
Process32NextW Oct. 2, 2021, 12:52 p.m.	snapshot_handle: 0x000000d8 process_name: services.exe process_identifier: 448	1	1
Process32NextW Oct. 2, 2021, 12:52 p.m.	snapshot_handle: 0x000000d8 process_name: lsass.exe process_identifier: 464	1	1
Process32NextW Oct. 2, 2021, 12:52 p.m.	snapshot_handle: 0x000000d8 process_name: lsm.exe process_identifier: 472	1	1
Process32NextW Oct. 2, 2021, 12:52 p.m.	snapshot_handle: 0x000000d8 process_name: svchost.exe process_identifier: 584	1	1
Process32NextW Oct. 2, 2021, 12:52 p.m.	snapshot_handle: 0x000000d8 process_name: svchost.exe process_identifier: 660	1	1
Process32NextW Oct. 2, 2021, 12:52 p.m.	snapshot_handle: 0x000000d8 process_name: svchost.exe process_identifier: 736	1	1
Process32NextW Oct. 2, 2021, 12:52 p.m.	snapshot_handle: 0x000000d8 process_name: svchost.exe process_identifier: 820	1	1
Process32NextW Oct. 2, 2021, 12:52 p.m.	snapshot_handle: 0x000000d8 process_name: svchost.exe process_identifier: 852	1	1
Process32NextW Oct. 2, 2021, 12:52 p.m.	snapshot_handle: 0x000000d8 process_name: audiodg.exe process_identifier: 912	1	1
Process32NextW Oct. 2, 2021, 12:52 p.m.	snapshot_handle: 0x000000d8 process_name: svchost.exe process_identifier: 1004	1	1
Process32NextW Oct. 2, 2021, 12:52 p.m.	snapshot_handle: 0x000000d8 process_name: svchost.exe process_identifier: 312	1	1
Process32NextW Oct. 2, 2021, 12:52 p.m.	snapshot_handle: 0x000000d8 process_name: spoolsv.exe process_identifier: 1032	1	1
Process32NextW Oct. 2, 2021, 12:52 p.m.	snapshot_handle: 0x000000d8 process_name: svchost.exe process_identifier: 1072	1	1
Process32NextW Oct. 2, 2021, 12:52 p.m.	snapshot_handle: 0x000000d8 process_name: taskhost.exe process_identifier: 1140	1	1
Process32NextW Oct. 2, 2021, 12:52 p.m.	snapshot_handle: 0x000000d8 process_name: dwm.exe process_identifier: 1204	1	1
Process32NextW Oct. 2, 2021, 12:52 p.m.	snapshot_handle: 0x000000d8 process_name: explorer.exe process_identifier: 1236	1	1
Process32NextW Oct. 2, 2021, 12:52 p.m.	snapshot_handle: 0x000000d0 process_name: svchost.exe process_identifier: 1432	1	1
Process32NextW Oct. 2, 2021, 12:52 p.m.	snapshot_handle: 0x000000d0 process_name: IMEDICTUPDATE.EXE process_identifier: 1476	1	1
Process32NextW Oct. 2, 2021, 12:52 p.m.	snapshot_handle: 0x000000d0 process_name: svchost.exe process_identifier: 1844	1	1
Process32NextW Oct. 2, 2021, 12:52 p.m.	snapshot_handle: 0x000000d0 process_name: pw.exe process_identifier: 1996	1	1
Process32NextW Oct. 2, 2021, 12:52 p.m.	snapshot_handle: 0x000000d0 process_name: SearchIndexer.exe process_identifier: 748	1	1
Process32NextW Oct. 2, 2021, 12:52 p.m.	snapshot_handle: 0x000000d0 process_name: taskeng.exe process_identifier: 2932	1	1
Process32NextW Oct. 2, 2021, 12:52 p.m.	snapshot_handle: 0x000000d0 process_name: WmiPrvSE.exe process_identifier: 2160	1	1
Process32NextW Oct. 2, 2021, 12:52 p.m.	snapshot_handle: 0x000000d0 process_name: svchost.exe process_identifier: 2196	1	1
Process32NextW Oct. 2, 2021, 12:52 p.m.	snapshot_handle: 0x000000d0 process_name: mobsync.exe process_identifier: 1384	1	1
Process32NextW Oct. 2, 2021, 12:52 p.m.	snapshot_handle: 0x000000d0 process_name: pw.exe process_identifier: 2672	1	1
Process32NextW Oct. 2, 2021, 12:52 p.m.	snapshot_handle: 0x000000d0 process_name: wsqmcons.exe process_identifier: 2640	1	1
Process32NextW Oct. 2, 2021, 12:52 p.m.	snapshot_handle: 0x000000d0 process_name: taskhost.exe process_identifier: 624	1	1
Process32NextW Oct. 2, 2021, 12:52 p.m.	snapshot_handle: 0x000000d0 process_name: sdclt.exe process_identifier: 1424	1	1
Process32NextW Oct. 2, 2021, 12:52 p.m.	snapshot_handle: 0x000000d0 process_name: sppsvc.exe process_identifier: 2596	1	1
Process32NextW Oct. 2, 2021, 12:52 p.m.	snapshot_handle: 0x000000d0 process_name: cmd.exe process_identifier: 248	1	1
Process32NextW Oct. 2, 2021, 12:52 p.m.	snapshot_handle: 0x000000d0 process_name: conhost.exe process_identifier: 564	1	1
Process32NextW Oct. 2, 2021, 12:52 p.m.	snapshot_handle: 0x000000d0 process_name: SearchProtocolHost.exe process_identifier: 876	1	1
Process32NextW Oct. 2, 2021, 12:52 p.m.	snapshot_handle: 0x000000d0 process_name: SearchFilterHost.exe process_identifier: 544	1	1
Process32NextW Oct. 2, 2021, 12:52 p.m.	snapshot_handle: 0x000000d0 process_name: hfs.exe process_identifier: 2488	1	1
Process32NextW Oct. 2, 2021, 12:52 p.m.	snapshot_handle: 0x00000274 process_name: iexplore.exe process_identifier: 1808	1	1
Process32NextW Oct. 2, 2021, 12:52 p.m.	snapshot_handle: 0x00000274 process_name: iexplore.exe process_identifier: 7340152		0

Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time) (1 event)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory Oct. 2, 2021, 12:52 p.m.	process_identifier: 2488 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 45056 protection: 32 (PAGE_EXECUTE_READ) base_address: 0x10001000 process_handle: 0xffffffff	1	0	0

Repeatedly searches for a not-found process, you may want to run a web browser during analysis (50 out of 80 events)

Time & API	Arguments	Status	Return	Repeated
Process32NextW Oct. 2, 2021, 12:52 p.m.	snapshot_handle: 0x00000274 process_name: iexplore.exe process_identifier: 7340152		0	0
Process32NextW Oct. 2, 2021, 12:52 p.m.	snapshot_handle: 0x00000274 process_name: iexplore.exe process_identifier: 7340152		0	0
Process32NextW Oct. 2, 2021, 12:52 p.m.	snapshot_handle: 0x00000274 process_name: iexplore.exe process_identifier: 7340152		0	0
Process32NextW Oct. 2, 2021, 12:52 p.m.	snapshot_handle: 0x00000274 process_name: iexplore.exe process_identifier: 7340152		0	0
Process32NextW Oct. 2, 2021, 12:52 p.m.	snapshot_handle: 0x00000274 process_name: iexplore.exe process_identifier: 7340152		0	0
Process32NextW Oct. 2, 2021, 12:52 p.m.	snapshot_handle: 0x00000274 process_name: iexplore.exe process_identifier: 7340152		0	0
Process32NextW Oct. 2, 2021, 12:52 p.m.	snapshot_handle: 0x00000274 process_name: iexplore.exe process_identifier: 7340152		0	0
Process32NextW Oct. 2, 2021, 12:52 p.m.	snapshot_handle: 0x00000274 process_name: iexplore.exe process_identifier: 7340152		0	0
Process32NextW Oct. 2, 2021, 12:52 p.m.	snapshot_handle: 0x00000274 process_name: iexplore.exe process_identifier: 7340152		0	0
Process32NextW Oct. 2, 2021, 12:52 p.m.	snapshot_handle: 0x00000274 process_name: iexplore.exe process_identifier: 7340152		0	0
Process32NextW Oct. 2, 2021, 12:52 p.m.	snapshot_handle: 0x00000274 process_name: iexplore.exe process_identifier: 7340152		0	0
Process32NextW Oct. 2, 2021, 12:52 p.m.	snapshot_handle: 0x00000274 process_name: iexplore.exe process_identifier: 7340152		0	0
Process32NextW Oct. 2, 2021, 12:52 p.m.	snapshot_handle: 0x00000274 process_name: iexplore.exe process_identifier: 7340152		0	0
Process32NextW Oct. 2, 2021, 12:52 p.m.	snapshot_handle: 0x00000274 process_name: iexplore.exe process_identifier: 7340152		0	0
Process32NextW Oct. 2, 2021, 12:52 p.m.	snapshot_handle: 0x00000274 process_name: iexplore.exe process_identifier: 7340152		0	0
Process32NextW Oct. 2, 2021, 12:52 p.m.	snapshot_handle: 0x00000274 process_name: iexplore.exe process_identifier: 7340152		0	0
Process32NextW Oct. 2, 2021, 12:52 p.m.	snapshot_handle: 0x00000274 process_name: iexplore.exe process_identifier: 7340152		0	0
Process32NextW Oct. 2, 2021, 12:52 p.m.	snapshot_handle: 0x00000274 process_name: iexplore.exe process_identifier: 7340152		0	0
Process32NextW Oct. 2, 2021, 12:52 p.m.	snapshot_handle: 0x00000274 process_name: iexplore.exe process_identifier: 7340152		0	0
Process32NextW Oct. 2, 2021, 12:52 p.m.	snapshot_handle: 0x00000274 process_name: iexplore.exe process_identifier: 7340152		0	0
Process32NextW Oct. 2, 2021, 12:52 p.m.	snapshot_handle: 0x00000274 process_name: iexplore.exe process_identifier: 7340152		0	0
Process32NextW Oct. 2, 2021, 12:52 p.m.	snapshot_handle: 0x00000274 process_name: iexplore.exe process_identifier: 7340152		0	0
Process32NextW Oct. 2, 2021, 12:52 p.m.	snapshot_handle: 0x00000274 process_name: iexplore.exe process_identifier: 7340152		0	0
Process32NextW Oct. 2, 2021, 12:52 p.m.	snapshot_handle: 0x00000274 process_name: iexplore.exe process_identifier: 7340152		0	0
Process32NextW Oct. 2, 2021, 12:52 p.m.	snapshot_handle: 0x00000274 process_name: iexplore.exe process_identifier: 7340152		0	0
Process32NextW Oct. 2, 2021, 12:52 p.m.	snapshot_handle: 0x00000274 process_name: iexplore.exe process_identifier: 7340152		0	0
Process32NextW Oct. 2, 2021, 12:52 p.m.	snapshot_handle: 0x00000274 process_name: iexplore.exe process_identifier: 7340152		0	0
Process32NextW Oct. 2, 2021, 12:52 p.m.	snapshot_handle: 0x00000274 process_name: iexplore.exe process_identifier: 7340152		0	0
Process32NextW Oct. 2, 2021, 12:52 p.m.	snapshot_handle: 0x00000274 process_name: iexplore.exe process_identifier: 7340152		0	0
Process32NextW Oct. 2, 2021, 12:52 p.m.	snapshot_handle: 0x00000274 process_name: iexplore.exe process_identifier: 7340152		0	0
Process32NextW Oct. 2, 2021, 12:52 p.m.	snapshot_handle: 0x00000274 process_name: iexplore.exe process_identifier: 7340152		0	0
Process32NextW Oct. 2, 2021, 12:52 p.m.	snapshot_handle: 0x00000274 process_name: iexplore.exe process_identifier: 7340152		0	0
Process32NextW Oct. 2, 2021, 12:52 p.m.	snapshot_handle: 0x00000274 process_name: iexplore.exe process_identifier: 7340152		0	0
Process32NextW Oct. 2, 2021, 12:52 p.m.	snapshot_handle: 0x00000274 process_name: iexplore.exe process_identifier: 7340152		0	0
Process32NextW Oct. 2, 2021, 12:52 p.m.	snapshot_handle: 0x00000274 process_name: iexplore.exe process_identifier: 7340152		0	0
Process32NextW Oct. 2, 2021, 12:52 p.m.	snapshot_handle: 0x00000274 process_name: iexplore.exe process_identifier: 7340152		0	0
Process32NextW Oct. 2, 2021, 12:52 p.m.	snapshot_handle: 0x00000274 process_name: iexplore.exe process_identifier: 7340152		0	0
Process32NextW Oct. 2, 2021, 12:52 p.m.	snapshot_handle: 0x00000274 process_name: iexplore.exe process_identifier: 7340152		0	0
Process32NextW Oct. 2, 2021, 12:52 p.m.	snapshot_handle: 0x00000274 process_name: iexplore.exe process_identifier: 7340152		0	0
Process32NextW Oct. 2, 2021, 12:52 p.m.	snapshot_handle: 0x00000274 process_name: iexplore.exe process_identifier: 7340152		0	0
Process32NextW Oct. 2, 2021, 12:52 p.m.	snapshot_handle: 0x00000274 process_name: iexplore.exe process_identifier: 7340152		0	0
Process32NextW Oct. 2, 2021, 12:52 p.m.	snapshot_handle: 0x00000274 process_name: iexplore.exe process_identifier: 7340152		0	0
Process32NextW Oct. 2, 2021, 12:52 p.m.	snapshot_handle: 0x00000274 process_name: iexplore.exe process_identifier: 7340152		0	0
Process32NextW Oct. 2, 2021, 12:52 p.m.	snapshot_handle: 0x00000274 process_name: iexplore.exe process_identifier: 7340152		0	0
Process32NextW Oct. 2, 2021, 12:52 p.m.	snapshot_handle: 0x00000274 process_name: iexplore.exe process_identifier: 7340152		0	0
Process32NextW Oct. 2, 2021, 12:52 p.m.	snapshot_handle: 0x00000274 process_name: iexplore.exe process_identifier: 7340152		0	0
Process32NextW Oct. 2, 2021, 12:52 p.m.	snapshot_handle: 0x00000274 process_name: iexplore.exe process_identifier: 7340152		0	0
Process32NextW Oct. 2, 2021, 12:52 p.m.	snapshot_handle: 0x00000274 process_name: iexplore.exe process_identifier: 7340152		0	0
Process32NextW Oct. 2, 2021, 12:52 p.m.	snapshot_handle: 0x00000274 process_name: iexplore.exe process_identifier: 7340152		0	0
Process32NextW Oct. 2, 2021, 12:52 p.m.	snapshot_handle: 0x00000274 process_name: iexplore.exe process_identifier: 7340152		0	0

Installs itself for autorun at Windows startup (1 event)

service_name

Rsvzjj rjhblwvi

service_path

C:\Program Files (x86)\Mpjshia.exe

Expresses interest in specific running processes (2 events)

process	hfs.exe
process: potential process injection target	explorer.exe

Ramnit malware indicators found (1 event)

mutex

KyUffThOkYwRRtgPP

File has been identified by 46 AntiVirus engines on VirusTotal as malicious (46 events)

Bkav	W32.AIDetect.malware1
Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.Zusy.401736
FireEye	Generic.mg.759e5f4dbc7432a8
CAT-QuickHeal	Backdoor.Farfli
McAfee	GenericRXAA-FA!759E5F4DBC74
Cylance	Unsafe
Sangfor	Suspicious.Win32.Save.a
K7AntiVirus	Trojan ( 004d35321 )
Alibaba	Backdoor:Win32/Farfli.3ec251ac
K7GW	Trojan ( 004d35321 )
Cybereason	malicious.dbc743
BitDefenderTheta	Gen:NN.ZexaF.34170.uq0@a0Pur9hb
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/Injector.CJVZ
APEX	Malicious
Paloalto	generic.ml
BitDefender	Gen:Variant.Zusy.401736
NANO-Antivirus	Trojan.Win32.Farfli.jcgarw
Avast	Win32:Trojan-gen
Rising	Trojan.Kryptik!1.D32C (CLASSIC)
Ad-Aware	Gen:Variant.Zusy.401736
Comodo	TrojWare.Win32.Magania.F@7jjkv4
TrendMicro	Backdoor.Win32.ZEGOST.SMAL02
McAfee-GW-Edition	Artemis!Trojan
Emsisoft	Gen:Variant.Zusy.401736 (B)
SentinelOne	Static AI - Malicious PE
Jiangmin	Backdoor.Farfli.ffr
Avira	TR/Injector.xgpce
MAX	malware (ai score=88)
Antiy-AVL	Trojan/Generic.ASMalwS.3483B88
Gridinsoft	Trojan.Win32.Downloader.sa
Microsoft	Trojan:Win32/Farfli.DSK!MTB
GData	Gen:Variant.Zusy.401736
Cynet	Malicious (score: 100)
AhnLab-V3	Backdoor/Win.ZEGOST.C4620367
VBA32	BScope.Backdoor.Zegost
Malwarebytes	Malware.AI.2807775092
TrendMicro-HouseCall	Backdoor.Win32.ZEGOST.SMAL02
Tencent	Malware.Win32.Gencirc.10cf2784
Yandex	Trojan.Injector!01N01P9nhGc
Ikarus	Trojan.Win32.Injector
Fortinet	W32/Farfli.BNZS!tr
AVG	Win32:Trojan-gen
Panda	Trj/GdSda.A
CrowdStrike	win/malicious_confidence_90% (W)

hfs.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All