Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	Oct. 15, 2021, 9:10 a.m.	Oct. 15, 2021, 9:12 a.m.

Size	2.4MB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`d8f411a8ac121a651e56becbbc6f9722`
SHA256	`86072ecb9b50ffcfe121e8a6848d20c3bab8a3199a3e64b484608853f019487e`
CRC32	`41743C70`
ssdeep	`49152:JvC8531Ms2BPjbZaSZoi9fULabl6Eem+65JCybvGu5ZwFioWU7O8R++X3wbOEO:JvNMBPPZayhEyJCM+u5Zw4oWU7Oi++QF`
Yara	Admin_Tool_IN_Zero - Admin Tool Sysinternals PE_Header_Zero - PE File Signature UPX_Zero - UPX packed file IsPE32 - (no description) Is_DotNET_EXE - (no description) Malicious_Library_Zero - Malicious_Library themida_packer - themida packer

110.exe "C:\Users\test22\AppData\Local\Temp\110.exe"
1660
- taskhost.exe "C:\Windows\System32\NlsLexicons0018\taskhost.exe"
  2748

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
164.124.101.2	Active	Moloch
83.136.233.171	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (18 events)

Time & API	Arguments	Status	Return
GetComputerNameW Oct. 15, 2021, 9:10 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 15, 2021, 9:10 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 15, 2021, 9:10 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 15, 2021, 9:10 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 15, 2021, 9:10 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 15, 2021, 9:10 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 15, 2021, 9:10 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 15, 2021, 9:10 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 15, 2021, 9:10 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 15, 2021, 9:10 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 15, 2021, 9:10 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 15, 2021, 9:10 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 15, 2021, 9:10 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 15, 2021, 9:10 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 15, 2021, 9:10 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 15, 2021, 9:10 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 15, 2021, 9:10 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 15, 2021, 9:10 a.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (4 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Oct. 15, 2021, 9:10 a.m.			0	0
IsDebuggerPresent Oct. 15, 2021, 9:10 a.m.			0	0
IsDebuggerPresent Oct. 15, 2021, 9:10 a.m.			0	0
IsDebuggerPresent Oct. 15, 2021, 9:10 a.m.			0	0

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Oct. 15, 2021, 9:10 a.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 events)

section
section	.themida
section	.boot

One or more processes crashed (6 events)

Time & API	Arguments	Status
__exception__ Oct. 15, 2021, 9:10 a.m.	stacktrace: 110+0x3afaef @ 0x16ffaef 110+0x3b1210 @ 0x1701210 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc e9 64 8f df 8b 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008e exception.offset: 46887 exception.address: 0x7566b727 registers.esp: 4651388 registers.edi: 21364736 registers.eax: 4651388 registers.ebp: 4651468 registers.edx: 4294826996 registers.ebx: 1968701414 registers.esi: 2008380459 registers.ecx: 3934388224	1
__exception__ Oct. 15, 2021, 9:10 a.m.	stacktrace: exception.instruction_r: ed e9 26 a6 02 00 c3 e9 44 5f 01 00 b1 f7 90 62 exception.symbol: 110+0x3c1b18 exception.instruction: in eax, dx exception.module: 110.exe exception.exception_code: 0xc0000096 exception.offset: 3939096 exception.address: 0x1711b18 registers.esp: 4651508 registers.edi: 22512199 registers.eax: 1750617430 registers.ebp: 21364736 registers.edx: 4294793302 registers.ebx: 0 registers.esi: 13 registers.ecx: 20	1
__exception__ Oct. 15, 2021, 9:10 a.m.	stacktrace: exception.instruction_r: ed e9 cd c4 01 00 0c a6 04 3d 00 20 00 2c 00 7e exception.symbol: 110+0x3db429 exception.instruction: in eax, dx exception.module: 110.exe exception.exception_code: 0xc0000096 exception.offset: 4043817 exception.address: 0x172b429 registers.esp: 4651508 registers.edi: 22512199 registers.eax: 1447909480 registers.ebp: 21364736 registers.edx: 22104 registers.ebx: 2256917605 registers.esi: 13 registers.ecx: 10	1
__exception__ Oct. 15, 2021, 9:10 a.m.	stacktrace: taskhost+0x3afaef @ 0x5bfaef taskhost+0x3b1210 @ 0x5c1210 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc e9 64 8f cb 8a 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008e exception.offset: 46887 exception.address: 0x7566b727 registers.esp: 10550008 registers.edi: 3276800 registers.eax: 10550008 registers.ebp: 10550088 registers.edx: 4294826996 registers.ebx: 1968701414 registers.esi: 2008380459 registers.ecx: 182124544	1
__exception__ Oct. 15, 2021, 9:10 a.m.	stacktrace: exception.instruction_r: ed e9 26 a6 02 00 c3 e9 44 5f 01 00 b1 f7 90 62 exception.symbol: taskhost+0x3c1b18 exception.instruction: in eax, dx exception.module: taskhost.exe exception.exception_code: 0xc0000096 exception.offset: 3939096 exception.address: 0x5d1b18 registers.esp: 10550128 registers.edi: 4424263 registers.eax: 1750617430 registers.ebp: 3276800 registers.edx: 4294793302 registers.ebx: 0 registers.esi: 13 registers.ecx: 20	1
__exception__ Oct. 15, 2021, 9:10 a.m.	stacktrace: exception.instruction_r: ed e9 cd c4 01 00 0c a6 04 3d 00 20 00 2c 00 7e exception.symbol: taskhost+0x3db429 exception.instruction: in eax, dx exception.module: taskhost.exe exception.exception_code: 0xc0000096 exception.offset: 4043817 exception.address: 0x5eb429 registers.esp: 10550128 registers.edi: 4424263 registers.eax: 1447909480 registers.ebp: 3276800 registers.edx: 22104 registers.ebx: 2256917605 registers.esi: 13 registers.ecx: 10	1

Allocates read-write-execute memory (usually to unpack itself) (50 out of 456 events)

Time & API	Arguments	Status
NtProtectVirtualMemory Oct. 15, 2021, 9:10 a.m.	process_identifier: 1660 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a44000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 15, 2021, 9:10 a.m.	process_identifier: 1660 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75670000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 15, 2021, 9:10 a.m.	process_identifier: 1660 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a41000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 15, 2021, 9:10 a.m.	process_identifier: 1660 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75671000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 15, 2021, 9:10 a.m.	process_identifier: 1660 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a41000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 15, 2021, 9:10 a.m.	process_identifier: 1660 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7566d000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 15, 2021, 9:10 a.m.	process_identifier: 1660 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a45000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 15, 2021, 9:10 a.m.	process_identifier: 1660 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7566c000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 15, 2021, 9:10 a.m.	process_identifier: 1660 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a43000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 15, 2021, 9:10 a.m.	process_identifier: 1660 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7567b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 15, 2021, 9:10 a.m.	process_identifier: 1660 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a45000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 15, 2021, 9:10 a.m.	process_identifier: 1660 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7567b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 15, 2021, 9:10 a.m.	process_identifier: 1660 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a41000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 15, 2021, 9:10 a.m.	process_identifier: 1660 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75671000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 15, 2021, 9:10 a.m.	process_identifier: 1660 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a45000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 15, 2021, 9:10 a.m.	process_identifier: 1660 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a45000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 15, 2021, 9:10 a.m.	process_identifier: 1660 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7566b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 15, 2021, 9:10 a.m.	process_identifier: 1660 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a43000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 15, 2021, 9:10 a.m.	process_identifier: 1660 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7566c000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 15, 2021, 9:10 a.m.	process_identifier: 1660 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a5c000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 15, 2021, 9:10 a.m.	process_identifier: 1660 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75674000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 15, 2021, 9:10 a.m.	process_identifier: 1660 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a5a000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 15, 2021, 9:10 a.m.	process_identifier: 1660 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a5c000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 15, 2021, 9:10 a.m.	process_identifier: 1660 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7566b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 15, 2021, 9:10 a.m.	process_identifier: 1660 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a41000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 15, 2021, 9:10 a.m.	process_identifier: 1660 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7566b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 15, 2021, 9:10 a.m.	process_identifier: 1660 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a6c000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 15, 2021, 9:10 a.m.	process_identifier: 1660 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7566b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 15, 2021, 9:10 a.m.	process_identifier: 1660 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a6d000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 15, 2021, 9:10 a.m.	process_identifier: 1660 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7566c000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 15, 2021, 9:10 a.m.	process_identifier: 1660 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a41000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 15, 2021, 9:10 a.m.	process_identifier: 1660 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7566d000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 15, 2021, 9:10 a.m.	process_identifier: 1660 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a44000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 15, 2021, 9:10 a.m.	process_identifier: 1660 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7557f000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 15, 2021, 9:10 a.m.	process_identifier: 1660 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75588000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 15, 2021, 9:10 a.m.	process_identifier: 1660 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a5c000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 15, 2021, 9:10 a.m.	process_identifier: 1660 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a44000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 15, 2021, 9:10 a.m.	process_identifier: 1660 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75671000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 15, 2021, 9:10 a.m.	process_identifier: 1660 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a5c000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 15, 2021, 9:10 a.m.	process_identifier: 1660 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75671000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 15, 2021, 9:10 a.m.	process_identifier: 1660 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a43000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 15, 2021, 9:10 a.m.	process_identifier: 1660 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75671000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 15, 2021, 9:10 a.m.	process_identifier: 1660 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a41000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 15, 2021, 9:10 a.m.	process_identifier: 1660 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75671000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 15, 2021, 9:10 a.m.	process_identifier: 1660 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a41000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 15, 2021, 9:10 a.m.	process_identifier: 1660 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7566b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 15, 2021, 9:10 a.m.	process_identifier: 1660 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a44000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 15, 2021, 9:10 a.m.	process_identifier: 1660 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75678000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 15, 2021, 9:10 a.m.	process_identifier: 1660 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a41000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 15, 2021, 9:10 a.m.	process_identifier: 1660 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75678000 process_handle: 0xffffffff	1

Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation (2 events)

Time & API	Arguments	Status	Return	Repeated
GetDiskFreeSpaceExW Oct. 15, 2021, 9:10 a.m.	total_number_of_free_bytes: 10933035008 free_bytes_available: 10933035008 root_path: C:\ total_number_of_bytes: 34252779520	1	1	0
GetDiskFreeSpaceExW Oct. 15, 2021, 9:10 a.m.	total_number_of_free_bytes: 10912256000 free_bytes_available: 10912256000 root_path: C:\ total_number_of_bytes: 34252779520	1	1	0

Creates executable files on the filesystem (8 events)

file	C:\Windows\System32\C_865\spoolsv.exe
file	C:\ProgramData\Adobe\ARM\Reader_20.006.20042\audiodg.exe
file	C:\Windows\System32\colorcpl\services.exe
file	C:\Windows\System32\locale\winlogon.exe
file	C:\Users\Default User\SearchProtocolHost.exe
file	C:\Windows\System32\NlsLexicons0018\taskhost.exe
file	C:\Users\Public\Pictures\Sample Pictures\wininit.exe
file	C:\tmpp6wetf\bin\IMEDICTUPDATE.exe

A process created a hidden window (1 event)

Time & API	Arguments	Status	Return	Repeated
ShellExecuteExW Oct. 15, 2021, 9:10 a.m.	show_type: 0 filepath_r: C:\Windows\System32\NlsLexicons0018\taskhost.exe parameters: filepath: C:\Windows\System32\NlsLexicons0018\taskhost.exe	1	1	0

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses Oct. 15, 2021, 9:10 a.m.	flags: 15 family: 0		111	0

The binary likely contains encrypted or compressed data indicative of a packer (4 events)

section

{u'size_of_data': u'0x0008ae00', u'virtual_address': u'0x00002000', u'entropy': 7.9825575934297985, u'name': u' ', u'virtual_size': u'0x00104000'}

entropy

7.98255759343

description

A section with a high entropy has been found

section

{u'size_of_data': u'0x00001200', u'virtual_address': u'0x00106000', u'entropy': 7.66842287309462, u'name': u' ', u'virtual_size': u'0x000032ac'}

entropy

7.66842287309

description

A section with a high entropy has been found

section

{u'size_of_data': u'0x001d9800', u'virtual_address': u'0x00430000', u'entropy': 7.92054396813173, u'name': u'.boot', u'virtual_size': u'0x001d9800'}

entropy

7.92054396813

description

A section with a high entropy has been found

entropy

0.997763773125

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (2 events)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW Oct. 15, 2021, 9:10 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0
LookupPrivilegeValueW Oct. 15, 2021, 9:10 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Expresses interest in specific running processes (1 event)

process

system

Communicates with host for which no DNS query was performed (1 event)

host

83.136.233.171

Checks for the presence of known windows from debuggers and forensic tools (50 out of 84 events)

Time & API	Arguments	Status	Return	Repeated
FindWindowA Oct. 15, 2021, 9:10 a.m.	class_name: OLLYDBG window_name:		0	0
FindWindowA Oct. 15, 2021, 9:10 a.m.	class_name: GBDYLLO window_name:		0	0
FindWindowA Oct. 15, 2021, 9:10 a.m.	class_name: pediy06 window_name:		0	0
FindWindowA Oct. 15, 2021, 9:10 a.m.	class_name: FilemonClass window_name:		0	0
FindWindowA Oct. 15, 2021, 9:10 a.m.	class_name: FilemonClass window_name:		0	0
FindWindowA Oct. 15, 2021, 9:10 a.m.	class_name: File Monitor - Sysinternals: www.sysinternals.com window_name:		0	0
FindWindowA Oct. 15, 2021, 9:10 a.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA Oct. 15, 2021, 9:10 a.m.	class_name: Process Monitor - Sysinternals: www.sysinternals.com window_name:		0	0
FindWindowA Oct. 15, 2021, 9:10 a.m.	class_name: RegmonClass window_name:		0	0
FindWindowA Oct. 15, 2021, 9:10 a.m.	class_name: RegmonClass window_name:		0	0
FindWindowA Oct. 15, 2021, 9:10 a.m.	class_name: Registry Monitor - Sysinternals: www.sysinternals.com window_name:		0	0
FindWindowA Oct. 15, 2021, 9:10 a.m.	class_name: 18467-41 window_name:		0	0
FindWindowA Oct. 15, 2021, 9:10 a.m.	class_name: Regmonclass window_name:		0	0
FindWindowA Oct. 15, 2021, 9:10 a.m.	class_name: Regmonclass window_name:		0	0
FindWindowA Oct. 15, 2021, 9:10 a.m.	class_name: 18467-41 window_name:		0	0
FindWindowA Oct. 15, 2021, 9:10 a.m.	class_name: Filemonclass window_name:		0	0
FindWindowA Oct. 15, 2021, 9:10 a.m.	class_name: Filemonclass window_name:		0	0
FindWindowA Oct. 15, 2021, 9:10 a.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA Oct. 15, 2021, 9:10 a.m.	class_name: OLLYDBG window_name:		0	0
FindWindowA Oct. 15, 2021, 9:10 a.m.	class_name: GBDYLLO window_name:		0	0
FindWindowA Oct. 15, 2021, 9:10 a.m.	class_name: pediy06 window_name:		0	0
FindWindowA Oct. 15, 2021, 9:10 a.m.	class_name: FilemonClass window_name:		0	0
FindWindowA Oct. 15, 2021, 9:10 a.m.	class_name: FilemonClass window_name:		0	0
FindWindowA Oct. 15, 2021, 9:10 a.m.	class_name: File Monitor - Sysinternals: www.sysinternals.com window_name:		0	0
FindWindowA Oct. 15, 2021, 9:10 a.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA Oct. 15, 2021, 9:10 a.m.	class_name: Process Monitor - Sysinternals: www.sysinternals.com window_name:		0	0
FindWindowA Oct. 15, 2021, 9:10 a.m.	class_name: RegmonClass window_name:		0	0
FindWindowA Oct. 15, 2021, 9:10 a.m.	class_name: RegmonClass window_name:		0	0
FindWindowA Oct. 15, 2021, 9:10 a.m.	class_name: Registry Monitor - Sysinternals: www.sysinternals.com window_name:		0	0
FindWindowA Oct. 15, 2021, 9:10 a.m.	class_name: 18467-41 window_name:		0	0
FindWindowA Oct. 15, 2021, 9:10 a.m.	class_name: Regmonclass window_name:		0	0
FindWindowA Oct. 15, 2021, 9:10 a.m.	class_name: Regmonclass window_name:		0	0
FindWindowA Oct. 15, 2021, 9:10 a.m.	class_name: 18467-41 window_name:		0	0
FindWindowA Oct. 15, 2021, 9:10 a.m.	class_name: Filemonclass window_name:		0	0
FindWindowA Oct. 15, 2021, 9:10 a.m.	class_name: Filemonclass window_name:		0	0
FindWindowA Oct. 15, 2021, 9:10 a.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA Oct. 15, 2021, 9:10 a.m.	class_name: Regmonclass window_name:		0	0
FindWindowA Oct. 15, 2021, 9:10 a.m.	class_name: Regmonclass window_name:		0	0
FindWindowA Oct. 15, 2021, 9:10 a.m.	class_name: 18467-41 window_name:		0	0
FindWindowA Oct. 15, 2021, 9:10 a.m.	class_name: Filemonclass window_name:		0	0
FindWindowA Oct. 15, 2021, 9:10 a.m.	class_name: Filemonclass window_name:		0	0
FindWindowA Oct. 15, 2021, 9:10 a.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA Oct. 15, 2021, 9:10 a.m.	class_name: Regmonclass window_name:		0	0
FindWindowA Oct. 15, 2021, 9:10 a.m.	class_name: Regmonclass window_name:		0	0
FindWindowA Oct. 15, 2021, 9:10 a.m.	class_name: 18467-41 window_name:		0	0
FindWindowA Oct. 15, 2021, 9:10 a.m.	class_name: Filemonclass window_name:		0	0
FindWindowA Oct. 15, 2021, 9:10 a.m.	class_name: Filemonclass window_name:		0	0
FindWindowA Oct. 15, 2021, 9:10 a.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA Oct. 15, 2021, 9:10 a.m.	class_name: Regmonclass window_name:		0	0
FindWindowA Oct. 15, 2021, 9:10 a.m.	class_name: Regmonclass window_name:		0	0

Checks the version of Bios, possibly for anti-virtualization (2 events)

registry	HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion
registry	HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion

Installs itself for autorun at Windows startup (8 events)

reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\winlogon	reg_value	"C:\Windows\System32\locale\winlogon.exe"
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SearchProtocolHost	reg_value	"C:\Users\Default User\SearchProtocolHost.exe"
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\IMEDICTUPDATE	reg_value	"C:\tmpp6wetf\bin\IMEDICTUPDATE.exe"
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\taskhost	reg_value	"C:\Windows\System32\NlsLexicons0018\taskhost.exe"
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\services	reg_value	"C:\Windows\System32\colorcpl\services.exe"
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\spoolsv	reg_value	"C:\Windows\System32\C_865\spoolsv.exe"
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\wininit	reg_value	"C:\Users\Public\Pictures\Sample Pictures\wininit.exe"
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\audiodg	reg_value	"C:\ProgramData\Adobe\ARM\Reader_20.006.20042\audiodg.exe"

Detects Virtual Machines through their custom firmware (1 event)

Time & API	Arguments	Status	Return	Repeated
NtQuerySystemInformation Oct. 15, 2021, 9:10 a.m.	information_class: 76 (SystemFirmwareTableInformation)		3221225507	0

Detects VMWare through the in instruction feature (1 event)

Time & API	Arguments	Status	Return	Repeated
__exception__ Oct. 15, 2021, 9:10 a.m.	stacktrace: exception.instruction_r: ed e9 cd c4 01 00 0c a6 04 3d 00 20 00 2c 00 7e exception.symbol: 110+0x3db429 exception.instruction: in eax, dx exception.module: 110.exe exception.exception_code: 0xc0000096 exception.offset: 4043817 exception.address: 0x172b429 registers.esp: 4651508 registers.edi: 22512199 registers.eax: 1447909480 registers.ebp: 21364736 registers.edx: 22104 registers.ebx: 2256917605 registers.esi: 13 registers.ecx: 10	1	0	0

Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) (1 event)

dead_host

83.136.233.171:80

File has been identified by 30 AntiVirus engines on VirusTotal as malicious (30 events)

Bkav	W32.AIDetect.malware2
Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.Jaik.46999
FireEye	Generic.mg.d8f411a8ac121a65
McAfee	Artemis!D8F411A8AC12
Cylance	Unsafe
Sangfor	Suspicious.Win32.Save.a
Arcabit	Trojan.Jaik.DB797
ESET-NOD32	a variant of Win32/GenKryptik.FLZY
APEX	Malicious
Kaspersky	Backdoor.MSIL.LightStone.egm
BitDefender	Gen:Variant.Jaik.46999
NANO-Antivirus	Virus.Win32.Gen-Crypt.ccnc
Avast	FileRepMalware
Ad-Aware	Gen:Variant.Jaik.46999
Sophos	Generic ML PUA (PUA)
McAfee-GW-Edition	BehavesLike.Win32.Drixed.vc
Emsisoft	Gen:Variant.Jaik.46999 (B)
eGambit	Unsafe.AI_Score_99%
Gridinsoft	Trojan.Heur!.032100A1
Microsoft	Trojan:Win32/Sabsik.FL.B!ml
GData	Win32.Backdoor.DCRat.JLST38
Cynet	Malicious (score: 100)
VBA32	BScope.TrojanRansom.Foreign
ALYac	Gen:Variant.Jaik.46999
MAX	malware (ai score=80)
Rising	Trojan.Generic@ML.100 (RDML:tS8gOcNj6EBcK6MkcQ5DkA)
SentinelOne	Static AI - Malicious PE
MaxSecure	Trojan.Malware.300983.susgen
AVG	FileRepMalware

110.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All