Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Nov. 8, 2021, 1:10 p.m.	Nov. 8, 2021, 1:13 p.m.

Size	715.1KB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`ce81eed854cece7bf84332694f26943f`
SHA256	`2fc5d385b3ec6a3d5fe5c90bbc26105d8f9387597bb1705bf042451b25da4fbb`
CRC32	`7DCE7049`
ssdeep	`12288:q1f8uiEWyovxISvjAAr9w1000100001ZqOV8Ww/uQRqekzTIHNafnAr9w100010S:qx8uiEWdeSvBX8JqekzTUNa8/F`
PDB Path	D:\APP\APP-ManagerLauncher-CS\ManagerLauncher\UpdateModule\bin\x86\SJPTManagerLauncher.pdb
Yara	Antivirus - Contains references to security software PE_Header_Zero - PE File Signature Generic_Malware_Zero - Generic Malware IsPE32 - (no description) Is_DotNET_EXE - (no description)

server.asp "C:\Users\test22\AppData\Local\Temp\server.asp"
2788
- SJPTMANAGERLauncher.exe "C:\Users\test22\AppData\Local\YTS\SJPT\MANAGER\SJPTMANAGERLauncher.exe"
  2896
  - SJPTMANAGER.exe "C:\Users\test22\AppData\Local\YTS\SJPT\MANAGER\SJPTMANAGER.exe"
    2188
explorer.exe C:\Windows\Explorer.EXE
1156

Name	Response	Post-Analysis Lookup
server.toeicswt.co.kr	A 210.116.108.238	210.116.108.238

IP Address	Status	Action
164.124.101.2	Active	Moloch
210.116.108.238	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.101:49166 -> 210.116.108.238:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49164 -> 210.116.108.238:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49174 -> 210.116.108.238:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49178 -> 210.116.108.238:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49175 -> 210.116.108.238:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49179 -> 210.116.108.238:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49176 -> 210.116.108.238:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49171 -> 210.116.108.238:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49181 -> 210.116.108.238:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49186 -> 210.116.108.238:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49183 -> 210.116.108.238:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined

Suricata TLS

Flow	Issuer	Subject	Fingerprint
TLSv1 192.168.56.101:49166 210.116.108.238:443	None	None	None
TLSv1 192.168.56.101:49164 210.116.108.238:443	C=BE, O=GlobalSign nv-sa, CN=GlobalSign RSA OV SSL CA 2018	C=KR, ST=Gyeonggi-do, L=Seongnam-si, O=YBM NET, Inc., CN=*.ybmnet.co.kr	37:1d:7f:0b:90:fc:61:e4:4b:1d:c5:14:a0:48:2e:8d:cb:04:8f:51
TLSv1 192.168.56.101:49174 210.116.108.238:443	None	None	None
TLSv1 192.168.56.101:49178 210.116.108.238:443	None	None	None
TLSv1 192.168.56.101:49175 210.116.108.238:443	None	None	None
TLSv1 192.168.56.101:49179 210.116.108.238:443	None	None	None
TLSv1 192.168.56.101:49176 210.116.108.238:443	None	None	None
TLSv1 192.168.56.101:49171 210.116.108.238:443	None	None	None
TLSv1 192.168.56.101:49181 210.116.108.238:443	None	None	None
TLSv1 192.168.56.101:49186 210.116.108.238:443	C=BE, O=GlobalSign nv-sa, CN=GlobalSign RSA OV SSL CA 2018	C=KR, ST=Gyeonggi-do, L=Seongnam-si, O=YBM NET, Inc., CN=*.ybmnet.co.kr	37:1d:7f:0b:90:fc:61:e4:4b:1d:c5:14:a0:48:2e:8d:cb:04:8f:51
TLSv1 192.168.56.101:49183 210.116.108.238:443	None	None	None

Queries for the computername (12 events)

Time & API	Arguments	Status	Return
GetComputerNameW Nov. 8, 2021, 1:10 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 8, 2021, 1:10 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 8, 2021, 1:10 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 8, 2021, 1:10 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 8, 2021, 1:10 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 8, 2021, 1:11 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 8, 2021, 1:11 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 8, 2021, 1:11 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 8, 2021, 1:11 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 8, 2021, 1:11 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 8, 2021, 1:11 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 8, 2021, 1:11 p.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (3 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Nov. 8, 2021, 1:10 p.m.			0	0
IsDebuggerPresent Nov. 8, 2021, 1:10 p.m.			0	0
IsDebuggerPresent Nov. 8, 2021, 1:11 p.m.			0	0

This executable has a PDB path (1 event)

pdb_path

D:\APP\APP-ManagerLauncher-CS\ManagerLauncher\UpdateModule\bin\x86\SJPTManagerLauncher.pdb

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Nov. 8, 2021, 1:11 p.m.		1	1	0

One or more processes crashed (1 event)

Time & API	Arguments	Status	Return	Repeated
__exception__ Nov. 8, 2021, 1:11 p.m.	stacktrace: 0x29931ca CoUninitializeEE-0x29870 mscorwks+0x1b4c @ 0x72f21b4c CoUninitializeEE-0x125de mscorwks+0x18dde @ 0x72f38dde CoUninitializeEE-0x11ff1 mscorwks+0x193cb @ 0x72f393cb CoUninitializeEE-0x11fb0 mscorwks+0x1940c @ 0x72f3940c CoUninitializeEE-0x11f43 mscorwks+0x19479 @ 0x72f39479 CoUninitializeEE-0x8c99 mscorwks+0x22723 @ 0x72f42723 CoUninitializeEE-0x8db6 mscorwks+0x22606 @ 0x72f42606 DllRegisterServerInternal+0x2560d GetPrivateContextsPerfCounters-0x3208c mscorwks+0x7b873 @ 0x72f9b873 getJit+0x10040 mscorjit+0x55176 @ 0x74095176 getJit-0x42f41 mscorjit+0x21f5 @ 0x740421f5 getJit-0x40d85 mscorjit+0x43b1 @ 0x740443b1 getJit-0x40c50 mscorjit+0x44e6 @ 0x740444e6 getJit-0x40aca mscorjit+0x466c @ 0x7404466c getJit-0x3fc12 mscorjit+0x5524 @ 0x74045524 getJit-0x3fa6b mscorjit+0x56cb @ 0x740456cb getJit-0x3f356 mscorjit+0x5de0 @ 0x74045de0 CoUninitializeEE+0x8a14 CreateAssemblyNameObject-0x12373 mscorwks+0x33dd0 @ 0x72f53dd0 CoUninitializeEE+0x8aa9 CreateAssemblyNameObject-0x122de mscorwks+0x33e65 @ 0x72f53e65 CoUninitializeEE+0x8b1c CreateAssemblyNameObject-0x1226b mscorwks+0x33ed8 @ 0x72f53ed8 CoUninitializeEE+0x8895 CreateAssemblyNameObject-0x124f2 mscorwks+0x33c51 @ 0x72f53c51 CoUninitializeEE+0x8657 CreateAssemblyNameObject-0x12730 mscorwks+0x33a13 @ 0x72f53a13 CoUninitializeEE-0x1b547 mscorwks+0xfe75 @ 0x72f2fe75 CoUninitializeEE-0x1b389 mscorwks+0x10033 @ 0x72f30033 0xa0083e 0x2993121 0x2992f72 system+0x2046a5 @ 0x712a46a5 system+0x204145 @ 0x712a4145 system+0x1f6d71 @ 0x71296d71 system+0x1f6b74 @ 0x71296b74 system+0x203008 @ 0x712a3008 system+0x1f8966 @ 0x71298966 system+0x201daa @ 0x712a1daa system+0x201d60 @ 0x712a1d60 system+0x202f51 @ 0x712a2f51 system+0x201b34 @ 0x712a1b34 system+0x1f86a0 @ 0x712986a0 system+0x1f8621 @ 0x71298621 system+0x1f84fa @ 0x712984fa 0xa00a64 gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x76be62fa GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x76be6d3a GetThreadDesktop+0x185 GetWindowLongW-0x216 user32+0x16de8 @ 0x76be6de8 GetThreadDesktop+0x1e1 GetWindowLongW-0x1ba user32+0x16e44 @ 0x76be6e44 KiUserCallbackDispatcher+0x2e KiUserExceptionDispatcher-0x1a ntdll+0x1011a @ 0x7765011a system+0x1f5ee3 @ 0x71295ee3 system+0x2013d7 @ 0x712a13d7 system+0x1f4451 @ 0x71294451 system+0x2089a1 @ 0x712a89a1 system+0x2087a1 @ 0x712a87a1 system+0x71de2b @ 0x717bde2b system+0x752608 @ 0x717f2608 system+0x75281f @ 0x717f281f system+0x2046a5 @ 0x712a46a5 system+0x204145 @ 0x712a4145 system+0x1f6d71 @ 0x71296d71 system+0x1f6b74 @ 0x71296b74 system+0x203008 @ 0x712a3008 system+0x1f8966 @ 0x71298966 system+0x201daa @ 0x712a1daa system+0x201d60 @ 0x712a1d60 system+0x202f51 @ 0x712a2f51 system+0x201b34 @ 0x712a1b34 exception.instruction_r: 39 09 e8 64 5e c9 6f 89 45 b4 8b 45 b4 89 45 cc exception.instruction: cmp dword ptr [ecx], ecx exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x2994905 registers.esp: 3198364 registers.edi: 3198424 registers.eax: 0 registers.ebp: 3198440 registers.edx: 8 registers.ebx: 3198536 registers.esi: 6604680 registers.ecx: 0	1	0	0

Time & API

Arguments

Status

Return

Repeated

__exception__

Nov. 8, 2021, 1:11 p.m.

stacktrace:

0x29931ca
CoUninitializeEE-0x29870 mscorwks+0x1b4c @ 0x72f21b4c
CoUninitializeEE-0x125de mscorwks+0x18dde @ 0x72f38dde
CoUninitializeEE-0x11ff1 mscorwks+0x193cb @ 0x72f393cb
CoUninitializeEE-0x11fb0 mscorwks+0x1940c @ 0x72f3940c
CoUninitializeEE-0x11f43 mscorwks+0x19479 @ 0x72f39479
CoUninitializeEE-0x8c99 mscorwks+0x22723 @ 0x72f42723
CoUninitializeEE-0x8db6 mscorwks+0x22606 @ 0x72f42606
DllRegisterServerInternal+0x2560d GetPrivateContextsPerfCounters-0x3208c mscorwks+0x7b873 @ 0x72f9b873
getJit+0x10040 mscorjit+0x55176 @ 0x74095176
getJit-0x42f41 mscorjit+0x21f5 @ 0x740421f5
getJit-0x40d85 mscorjit+0x43b1 @ 0x740443b1
getJit-0x40c50 mscorjit+0x44e6 @ 0x740444e6
getJit-0x40aca mscorjit+0x466c @ 0x7404466c
getJit-0x3fc12 mscorjit+0x5524 @ 0x74045524
getJit-0x3fa6b mscorjit+0x56cb @ 0x740456cb
getJit-0x3f356 mscorjit+0x5de0 @ 0x74045de0
CoUninitializeEE+0x8a14 CreateAssemblyNameObject-0x12373 mscorwks+0x33dd0 @ 0x72f53dd0
CoUninitializeEE+0x8aa9 CreateAssemblyNameObject-0x122de mscorwks+0x33e65 @ 0x72f53e65
CoUninitializeEE+0x8b1c CreateAssemblyNameObject-0x1226b mscorwks+0x33ed8 @ 0x72f53ed8
CoUninitializeEE+0x8895 CreateAssemblyNameObject-0x124f2 mscorwks+0x33c51 @ 0x72f53c51
CoUninitializeEE+0x8657 CreateAssemblyNameObject-0x12730 mscorwks+0x33a13 @ 0x72f53a13
CoUninitializeEE-0x1b547 mscorwks+0xfe75 @ 0x72f2fe75
CoUninitializeEE-0x1b389 mscorwks+0x10033 @ 0x72f30033
0xa0083e
0x2993121
0x2992f72
system+0x2046a5 @ 0x712a46a5
system+0x204145 @ 0x712a4145
system+0x1f6d71 @ 0x71296d71
system+0x1f6b74 @ 0x71296b74
system+0x203008 @ 0x712a3008
system+0x1f8966 @ 0x71298966
system+0x201daa @ 0x712a1daa
system+0x201d60 @ 0x712a1d60
system+0x202f51 @ 0x712a2f51
system+0x201b34 @ 0x712a1b34
system+0x1f86a0 @ 0x712986a0
system+0x1f8621 @ 0x71298621
system+0x1f84fa @ 0x712984fa
0xa00a64
gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x76be62fa
GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x76be6d3a
GetThreadDesktop+0x185 GetWindowLongW-0x216 user32+0x16de8 @ 0x76be6de8
GetThreadDesktop+0x1e1 GetWindowLongW-0x1ba user32+0x16e44 @ 0x76be6e44
KiUserCallbackDispatcher+0x2e KiUserExceptionDispatcher-0x1a ntdll+0x1011a @ 0x7765011a
system+0x1f5ee3 @ 0x71295ee3
system+0x2013d7 @ 0x712a13d7
system+0x1f4451 @ 0x71294451
system+0x2089a1 @ 0x712a89a1
system+0x2087a1 @ 0x712a87a1
system+0x71de2b @ 0x717bde2b
system+0x752608 @ 0x717f2608
system+0x75281f @ 0x717f281f
system+0x2046a5 @ 0x712a46a5
system+0x204145 @ 0x712a4145
system+0x1f6d71 @ 0x71296d71
system+0x1f6b74 @ 0x71296b74
system+0x203008 @ 0x712a3008
system+0x1f8966 @ 0x71298966
system+0x201daa @ 0x712a1daa
system+0x201d60 @ 0x712a1d60
system+0x202f51 @ 0x712a2f51
system+0x201b34 @ 0x712a1b34

exception.instruction_r: 39 09 e8 64 5e c9 6f 89 45 b4 8b 45 b4 89 45 cc
exception.instruction: cmp dword ptr [ecx], ecx
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x2994905
registers.esp: 3198364
registers.edi: 3198424
registers.eax: 0
registers.ebp: 3198440
registers.edx: 8
registers.ebx: 3198536
registers.esi: 6604680
registers.ecx: 0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

HTTP traffic contains suspicious features which may be indicative of malware related traffic (3 events)

suspicious_features	POST method with no referer header, POST method with no useragent header	suspicious_request	POST https://server.toeicswt.co.kr/update/update_global.asp
suspicious_features	POST method with no referer header, POST method with no useragent header	suspicious_request	POST https://server.toeicswt.co.kr/update/download_file_global.asp
suspicious_features	POST method with no referer header, POST method with no useragent header	suspicious_request	POST https://server.toeicswt.co.kr/svr_sjpt/server.asp

Performs some HTTP requests (3 events)

request	POST https://server.toeicswt.co.kr/update/update_global.asp
request	POST https://server.toeicswt.co.kr/update/download_file_global.asp
request	POST https://server.toeicswt.co.kr/svr_sjpt/server.asp

Sends data using the HTTP POST Method (3 events)

request	POST https://server.toeicswt.co.kr/update/update_global.asp
request	POST https://server.toeicswt.co.kr/update/download_file_global.asp
request	POST https://server.toeicswt.co.kr/svr_sjpt/server.asp

Allocates read-write-execute memory (usually to unpack itself) (50 out of 216 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Nov. 8, 2021, 1:10 p.m.	process_identifier: 2788 region_size: 1966080 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00610000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 8, 2021, 1:10 p.m.	process_identifier: 2788 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007b0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 8, 2021, 1:10 p.m.	process_identifier: 2788 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72f21000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 8, 2021, 1:10 p.m.	process_identifier: 2788 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0057a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 8, 2021, 1:10 p.m.	process_identifier: 2788 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72f22000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 8, 2021, 1:10 p.m.	process_identifier: 2788 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00572000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 8, 2021, 1:10 p.m.	process_identifier: 2788 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00582000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 8, 2021, 1:10 p.m.	process_identifier: 2788 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00583000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 8, 2021, 1:10 p.m.	process_identifier: 2788 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005bb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 8, 2021, 1:10 p.m.	process_identifier: 2788 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005b7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 8, 2021, 1:10 p.m.	process_identifier: 2788 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0058c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 8, 2021, 1:10 p.m.	process_identifier: 2788 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00584000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 8, 2021, 1:10 p.m.	process_identifier: 2788 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00586000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 8, 2021, 1:10 p.m.	process_identifier: 2788 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x010f0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 8, 2021, 1:10 p.m.	process_identifier: 2788 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005aa000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 8, 2021, 1:10 p.m.	process_identifier: 2788 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0058a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 8, 2021, 1:10 p.m.	process_identifier: 2896 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74352000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 8, 2021, 1:10 p.m.	process_identifier: 2896 region_size: 2031616 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005f0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 8, 2021, 1:10 p.m.	process_identifier: 2896 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007a0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 8, 2021, 1:10 p.m.	process_identifier: 2896 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72971000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 8, 2021, 1:10 p.m.	process_identifier: 2896 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74064000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 8, 2021, 1:10 p.m.	process_identifier: 2896 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72971000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 8, 2021, 1:10 p.m.	process_identifier: 2896 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0048a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 8, 2021, 1:10 p.m.	process_identifier: 2896 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72972000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 8, 2021, 1:10 p.m.	process_identifier: 2896 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00482000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 8, 2021, 1:10 p.m.	process_identifier: 2896 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00492000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 8, 2021, 1:10 p.m.	process_identifier: 2896 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x64021000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 8, 2021, 1:10 p.m.	process_identifier: 2896 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74d61000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 8, 2021, 1:10 p.m.	process_identifier: 2896 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76941000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 8, 2021, 1:10 p.m.	process_identifier: 2896 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f71000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 8, 2021, 1:10 p.m.	process_identifier: 2896 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x748e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 8, 2021, 1:10 p.m.	process_identifier: 2896 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76371000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 8, 2021, 1:10 p.m.	process_identifier: 2896 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x746d1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 8, 2021, 1:10 p.m.	process_identifier: 2896 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74881000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 8, 2021, 1:10 p.m.	process_identifier: 2896 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f31000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 8, 2021, 1:10 p.m.	process_identifier: 2896 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00493000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 8, 2021, 1:10 p.m.	process_identifier: 2896 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004cb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 8, 2021, 1:10 p.m.	process_identifier: 2896 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004c7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 8, 2021, 1:10 p.m.	process_identifier: 2896 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0049c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 8, 2021, 1:10 p.m.	process_identifier: 2896 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00494000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 8, 2021, 1:10 p.m.	process_identifier: 2896 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00496000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 8, 2021, 1:10 p.m.	process_identifier: 2896 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b80000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 8, 2021, 1:10 p.m.	process_identifier: 2896 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004ba000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 8, 2021, 1:10 p.m.	process_identifier: 2896 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73df1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 8, 2021, 1:10 p.m.	process_identifier: 2896 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a81000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 8, 2021, 1:10 p.m.	process_identifier: 2896 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0049a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 8, 2021, 1:10 p.m.	process_identifier: 2896 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004b2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 8, 2021, 1:10 p.m.	process_identifier: 2896 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76451000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 8, 2021, 1:10 p.m.	process_identifier: 2896 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x750c1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 8, 2021, 1:10 p.m.	process_identifier: 2896 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75291000 process_handle: 0xffffffff	1

Checks whether any human activity is being performed by constantly checking whether the foreground window changed

Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation (1 event)

Time & API	Arguments	Status	Return	Repeated
GetDiskFreeSpaceExW Nov. 8, 2021, 1:03 p.m.	total_number_of_free_bytes: 0 free_bytes_available: 13717311488 root_path: C:\Users\test22\AppData\Local\Microsoft\Windows\Explorer total_number_of_bytes: 0	1	1	0

Creates executable files on the filesystem (6 events)

file	C:\Users\test22\Desktop\New SJPT Manager.lnk
file	C:\Users\test22\AppData\Local\YTS\SJPT\MANAGER\setup\yspt\YSPT.exe
file	C:\Users\test22\AppData\Local\YTS\SJPT\MANAGER\setup\yspt\YSPTLauncher.exe
file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\New SJPT Manager.lnk
file	C:\Users\test22\AppData\Local\YTS\SJPT\MANAGER\SJPTManager.exe
file	C:\Users\test22\AppData\Local\YTS\SJPT\MANAGER\setup\sjpt\client\sjpt_cbt.exe

Creates a shortcut to an executable file (2 events)

file	C:\Users\test22\Desktop\New SJPT Manager.lnk
file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\New SJPT Manager.lnk

Drops an executable to the user AppData folder (4 events)

file	C:\Users\test22\AppData\Local\YTS\SJPT\MANAGER\setup\sjpt\client\sjpt_cbt.exe
file	C:\Users\test22\AppData\Local\YTS\SJPT\MANAGER\setup\yspt\YSPTLauncher.exe
file	C:\Users\test22\AppData\Local\YTS\SJPT\MANAGER\SJPTManager.exe
file	C:\Users\test22\AppData\Local\YTS\SJPT\MANAGER\setup\yspt\YSPT.exe

Executes one or more WMI queries (7 events)

wmi	select * from Win32_LogicalDisk where DriveType = 3
wmi	associators of {\\TEST22-PC\root\cimv2:Win32_LogicalDisk.DeviceID="C:"} where resultclass = Win32_DiskPartition
wmi	select * from Win32_NetworkAdapterConfiguration where IPEnabled = TRUE
wmi	select * from Win32_DiskDrive where Index = 0
wmi	select * from Win32_NetworkAdapterConfiguration
wmi	select * from Win32_Processor
wmi	select * from Win32_BaseBoard

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses Nov. 8, 2021, 1:10 p.m.	flags: 15 family: 0		111	0

The binary likely contains encrypted or compressed data indicative of a packer (3 events)

section

{u'size_of_data': u'0x000a1800', u'virtual_address': u'0x00002000', u'entropy': 6.910602748595147, u'name': u'.text', u'virtual_size': u'0x000a16ab'}

entropy

6.9106027486

description

A section with a high entropy has been found

section

{u'size_of_data': u'0x0000fa00', u'virtual_address': u'0x000a4000', u'entropy': 6.961920669736105, u'name': u'.rsrc', u'virtual_size': u'0x0000f9f4'}

entropy

6.96192066974

description

A section with a high entropy has been found

entropy

0.999294781382

description

Overall entropy of this PE file is high

Executes one or more WMI queries which can be used to identify virtual machines (5 events)

wmi	select * from Win32_Processor
wmi	select * from Win32_LogicalDisk where DriveType = 3
wmi	associators of {\\TEST22-PC\root\cimv2:Win32_LogicalDisk.DeviceID="C:"} where resultclass = Win32_DiskPartition
wmi	select * from Win32_NetworkAdapterConfiguration where IPEnabled = TRUE
wmi	select * from Win32_NetworkAdapterConfiguration

One or more of the buffers contains an embedded PE file (4 events)

buffer	Buffer with sha1: 68c95bf918cfb3763b9ea4d1c488c0edb6bbfcee
buffer	Buffer with sha1: c9e67a5ebab7a3df914894c6884dd7be7e1590a1
buffer	Buffer with sha1: beaae2b063a162015e923c92130b04998fdad6c2
buffer	Buffer with sha1: 3f738d613ecfc686c908bac0e836b51668b19afb

Looks for the Windows Idle Time to determine the uptime (1 event)

Time & API	Arguments	Status	Return	Repeated
NtQuerySystemInformation Nov. 8, 2021, 1:11 p.m.	information_class: 8 (SystemProcessorPerformanceInformation)	1	0	0

File has been identified by 12 AntiVirus engines on VirusTotal as malicious (12 events)

MicroWorld-eScan	Gen:Variant.Bulz.809522
McAfee	Artemis!CE81EED854CE
APEX	Malicious
Kaspersky	HEUR:Trojan.MSIL.Agent.gen
BitDefender	Gen:Variant.Bulz.809522
Tencent	Msil.Trojan.Agent.Tbsb
McAfee-GW-Edition	Artemis!Trojan
Emsisoft	Gen:Variant.Bulz.809522 (B)
MAX	malware (ai score=84)
Kingsoft	Win32.Troj.Undef.(kcloud)
GData	Gen:Variant.Bulz.809522
Panda	Trj/CI.A

Attempts to create or modify system certificates (2 events)

registry	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\91C6D6EE3E8AC86384E548C299295C756C817B81\Blob
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob

server.asp

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All