Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Oct. 16, 2021, 1:38 p.m.	Oct. 16, 2021, 1:40 p.m.

Size	608.0KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`9c3259f246b2cd7518816219582660e6`
SHA256	`643cc72707fe55509c2798066f324eff41c95c9a3d0653110c377f4bf453c636`
CRC32	`CB01E24A`
ssdeep	`12288:bi2IQBUizfg6lNxMEjjWQUb46A9jmP/uhu/yMS08CkntxYRs:HXGbWNxME/UMfmP/UDMS08Ckn3p`
Yara	Antivirus - Contains references to security software Admin_Tool_IN_Zero - Admin Tool Sysinternals PE_Header_Zero - PE File Signature IsPE32 - (no description) UPX_Zero - UPX packed file

Tax Payment Challan.exe "C:\Users\test22\AppData\Local\Temp\Tax Payment Challan.exe"
2268
- cmd.exe cmd.exe /c C:\Users\test22\AppData\Local\Temp\
  2536

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (3 events)

Time & API	Arguments	Status	Return
GetComputerNameW Oct. 16, 2021, 1:38 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Oct. 16, 2021, 1:38 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Oct. 16, 2021, 1:38 p.m.	computer_name: TEST22-PC	1	1

Command line console output was observed (1 event)

Time & API	Arguments	Status	Return	Repeated
WriteConsoleW Oct. 16, 2021, 1:38 p.m.	buffer: 'C:\Users\test22\AppData\Local\Temp\' is not recognized as an internal or external command, operable program or batch file. console_handle: 0x0000000b	1	1	0

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Oct. 16, 2021, 1:38 p.m.		1	1	0

The file contains an unknown PE resource name possibly indicative of a packer (2 events)

resource name	CUSTOM
resource name	SHADO

One or more processes crashed (15 events)

Time & API	Arguments	Status
__exception__ Oct. 16, 2021, 1:38 p.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7677b727 registers.esp: 1634848 registers.edi: 1635036 registers.eax: 1634848 registers.ebp: 1634928 registers.edx: 0 registers.ebx: 2917992 registers.esi: 1635036 registers.ecx: 2	1
__exception__ Oct. 16, 2021, 1:38 p.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7677b727 registers.esp: 1634608 registers.edi: 2917992 registers.eax: 1634608 registers.ebp: 1634688 registers.edx: 0 registers.ebx: 2917992 registers.esi: 2917992 registers.ecx: 2	1
__exception__ Oct. 16, 2021, 1:38 p.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7677b727 registers.esp: 1634820 registers.edi: 2917992 registers.eax: 1634820 registers.ebp: 1634900 registers.edx: 0 registers.ebx: 2917992 registers.esi: 2917992 registers.ecx: 2	1
__exception__ Oct. 16, 2021, 1:38 p.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7677b727 registers.esp: 1615044 registers.edi: 2917992 registers.eax: 1615044 registers.ebp: 1615124 registers.edx: 0 registers.ebx: 2917992 registers.esi: 2917992 registers.ecx: 2	1
__exception__ Oct. 16, 2021, 1:38 p.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7677b727 registers.esp: 1615036 registers.edi: 2917992 registers.eax: 1615036 registers.ebp: 1615116 registers.edx: 0 registers.ebx: 2917992 registers.esi: 2917992 registers.ecx: 2	1
__exception__ Oct. 16, 2021, 1:38 p.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7677b727 registers.esp: 1615148 registers.edi: 2917992 registers.eax: 1615148 registers.ebp: 1615228 registers.edx: 0 registers.ebx: 2917992 registers.esi: 2917992 registers.ecx: 2	1
__exception__ Oct. 16, 2021, 1:38 p.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7677b727 registers.esp: 1615040 registers.edi: 2917992 registers.eax: 1615040 registers.ebp: 1615120 registers.edx: 0 registers.ebx: 2917992 registers.esi: 2917992 registers.ecx: 2	1
__exception__ Oct. 16, 2021, 1:38 p.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7677b727 registers.esp: 1614908 registers.edi: 2917992 registers.eax: 1614908 registers.ebp: 1614988 registers.edx: 0 registers.ebx: 2917992 registers.esi: 2917992 registers.ecx: 2	1
__exception__ Oct. 16, 2021, 1:38 p.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7677b727 registers.esp: 1606436 registers.edi: 2917992 registers.eax: 1606436 registers.ebp: 1606516 registers.edx: 0 registers.ebx: 2917992 registers.esi: 2917992 registers.ecx: 2	1
__exception__ Oct. 16, 2021, 1:38 p.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7677b727 registers.esp: 1613156 registers.edi: 2917992 registers.eax: 1613156 registers.ebp: 1613236 registers.edx: 0 registers.ebx: 2917992 registers.esi: 2917992 registers.ecx: 2	1
__exception__ Oct. 16, 2021, 1:38 p.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7677b727 registers.esp: 1613156 registers.edi: 2917992 registers.eax: 1613156 registers.ebp: 1613236 registers.edx: 0 registers.ebx: 2917992 registers.esi: 2917992 registers.ecx: 2	1
__exception__ Oct. 16, 2021, 1:38 p.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7677b727 registers.esp: 1634568 registers.edi: 2917992 registers.eax: 1634568 registers.ebp: 1634648 registers.edx: 0 registers.ebx: 2917992 registers.esi: 2917992 registers.ecx: 2	1
__exception__ Oct. 16, 2021, 1:38 p.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7677b727 registers.esp: 1635040 registers.edi: 2917992 registers.eax: 1635040 registers.ebp: 1635120 registers.edx: 0 registers.ebx: 2917992 registers.esi: 2917992 registers.ecx: 2	1
__exception__ Oct. 16, 2021, 1:38 p.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7677b727 registers.esp: 1635148 registers.edi: 2917992 registers.eax: 1635148 registers.ebp: 1635228 registers.edx: 0 registers.ebx: 2917992 registers.esi: 2917992 registers.ecx: 2	1
__exception__ Oct. 16, 2021, 1:38 p.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7677b727 registers.esp: 1636808 registers.edi: 2917992 registers.eax: 1636808 registers.ebp: 1636888 registers.edx: 0 registers.ebx: 2917992 registers.esi: 2917992 registers.ecx: 2	1

Allocates read-write-execute memory (usually to unpack itself) (50 out of 96 events)

Time & API	Arguments	Status
NtProtectVirtualMemory Oct. 16, 2021, 1:38 p.m.	process_identifier: 2268 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x050e0000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 16, 2021, 1:38 p.m.	process_identifier: 2268 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x050e0000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 16, 2021, 1:38 p.m.	process_identifier: 2268 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x050e0000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 16, 2021, 1:38 p.m.	process_identifier: 2268 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x050e0000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 16, 2021, 1:38 p.m.	process_identifier: 2268 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x050e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 16, 2021, 1:38 p.m.	process_identifier: 2268 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x050e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 16, 2021, 1:38 p.m.	process_identifier: 2268 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x050e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 16, 2021, 1:38 p.m.	process_identifier: 2268 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x050e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 16, 2021, 1:38 p.m.	process_identifier: 2268 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x050e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 16, 2021, 1:38 p.m.	process_identifier: 2268 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x050e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 16, 2021, 1:38 p.m.	process_identifier: 2268 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x050e2000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 16, 2021, 1:38 p.m.	process_identifier: 2268 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x050e2000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 16, 2021, 1:38 p.m.	process_identifier: 2268 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x050e3000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 16, 2021, 1:38 p.m.	process_identifier: 2268 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x050e3000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 16, 2021, 1:38 p.m.	process_identifier: 2268 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x050e3000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 16, 2021, 1:38 p.m.	process_identifier: 2268 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x050e3000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 16, 2021, 1:38 p.m.	process_identifier: 2268 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x050e4000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 16, 2021, 1:38 p.m.	process_identifier: 2268 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x050e4000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 16, 2021, 1:38 p.m.	process_identifier: 2268 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x050e4000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 16, 2021, 1:38 p.m.	process_identifier: 2268 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x050e5000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 16, 2021, 1:38 p.m.	process_identifier: 2268 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x050e5000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 16, 2021, 1:38 p.m.	process_identifier: 2268 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x050e6000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 16, 2021, 1:38 p.m.	process_identifier: 2268 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x050e6000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 16, 2021, 1:38 p.m.	process_identifier: 2268 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05ac0000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 16, 2021, 1:38 p.m.	process_identifier: 2268 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05ac0000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 16, 2021, 1:38 p.m.	process_identifier: 2268 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05ac0000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 16, 2021, 1:38 p.m.	process_identifier: 2268 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05ac0000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 16, 2021, 1:38 p.m.	process_identifier: 2268 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05ac0000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 16, 2021, 1:38 p.m.	process_identifier: 2268 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05ac1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 16, 2021, 1:38 p.m.	process_identifier: 2268 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05ac1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 16, 2021, 1:38 p.m.	process_identifier: 2268 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05ac1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 16, 2021, 1:38 p.m.	process_identifier: 2268 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05ac1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 16, 2021, 1:38 p.m.	process_identifier: 2268 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05ac1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 16, 2021, 1:38 p.m.	process_identifier: 2268 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05ac2000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 16, 2021, 1:38 p.m.	process_identifier: 2268 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05ac2000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 16, 2021, 1:38 p.m.	process_identifier: 2268 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05ac3000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 16, 2021, 1:38 p.m.	process_identifier: 2268 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05ac3000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 16, 2021, 1:38 p.m.	process_identifier: 2268 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05ac3000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 16, 2021, 1:38 p.m.	process_identifier: 2268 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05ac3000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 16, 2021, 1:38 p.m.	process_identifier: 2268 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05ac4000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 16, 2021, 1:38 p.m.	process_identifier: 2268 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05ac4000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 16, 2021, 1:38 p.m.	process_identifier: 2268 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05ac4000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 16, 2021, 1:38 p.m.	process_identifier: 2268 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05ac5000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 16, 2021, 1:38 p.m.	process_identifier: 2268 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05ac5000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 16, 2021, 1:38 p.m.	process_identifier: 2268 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05ac6000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 16, 2021, 1:38 p.m.	process_identifier: 2268 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05ac6000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 16, 2021, 1:38 p.m.	process_identifier: 2268 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05ac6000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 16, 2021, 1:38 p.m.	process_identifier: 2268 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05df0000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 16, 2021, 1:38 p.m.	process_identifier: 2268 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05df0000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 16, 2021, 1:38 p.m.	process_identifier: 2268 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05df0000 process_handle: 0xffffffff	1

Creates a suspicious process (1 event)

cmdline

cmd.exe /c C:\Users\test22\AppData\Local\Temp\

Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time) (1 event)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory Oct. 16, 2021, 1:38 p.m.	process_identifier: 2268 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 24576 protection: 32 (PAGE_EXECUTE_READ) base_address: 0x02390000 process_handle: 0xffffffff	1	0	0

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x00042000', u'virtual_address': u'0x0005a000', u'entropy': 7.993389913346946, u'name': u'.rsrc', u'virtual_size': u'0x0004195c'}

entropy

7.99338991335

description

A section with a high entropy has been found

entropy

0.437086092715

description

Overall entropy of this PE file is high

Disables proxy possibly for traffic interception (1 event)

Time & API	Arguments	Status	Return	Repeated
RegSetValueExA Oct. 16, 2021, 1:38 p.m.	key_handle: 0x000003cc regkey_r: ProxyEnable reg_type: 4 (REG_DWORD) value: 0 regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable	1	0	0

File has been identified by 32 AntiVirus engines on VirusTotal as malicious (32 events)

Bkav	W32.AIDetect.malware2
Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.Bulz.733398
Cylance	Unsafe
Sangfor	Trojan.Win32.Save.a
CrowdStrike	win/malicious_confidence_80% (D)
Arcabit	Trojan.Bulz.DB30D6
Cyren	W32/Kryptik.BZN.gen!Eldorado
ESET-NOD32	a variant of Win32/Spy.KeyLogger.NJK
APEX	Malicious
Kaspersky	VHO:Trojan-Spy.Win32.KeyLogger.gen
BitDefender	Gen:Variant.Bulz.733398
Rising	Spyware.KeyLogger!1.D278 (CLASSIC)
Ad-Aware	Gen:Variant.Bulz.733398
Sophos	ML/PE-A
McAfee-GW-Edition	BehavesLike.Win32.Swisyn.jc
FireEye	Generic.mg.9c3259f246b2cd75
Emsisoft	Gen:Variant.Bulz.733398 (B)
SentinelOne	Static AI - Malicious PE
Avira	HEUR/AGEN.1135698
MAX	malware (ai score=85)
Microsoft	Trojan:Win32/Wacatac.B!ml
GData	Gen:Variant.Bulz.733398
Cynet	Malicious (score: 100)
ALYac	Gen:Variant.Bulz.733398
Malwarebytes	Malware.AI.11071512
Ikarus	Trojan-Spy.Agent
eGambit	Unsafe.AI_Score_63%
Fortinet	W32/Bingoml.BSER!tr
BitDefenderTheta	Gen:NN.ZevbaF.34218.Mm0@a0!jDrdi
Panda	Trj/GdSda.A
MaxSecure	Trojan.Malware.300983.susgen

Tax Payment Challan.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All