Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Jan. 18, 2022, 10:43 a.m.	Jan. 18, 2022, 10:45 a.m.

Size	3.9MB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`ffc7e0b51a3320c3f6d1e76163b974bd`
SHA256	`ace473f7276e62fafda41c68ea85dc99c091a644e74efea748ce5e5f38c9990b`
CRC32	`72E4C733`
ssdeep	`98304:UcNOWsyp7fehEBUKICtxzBcG29i0tkwixKuTS:NwofQsU0txz+G2k+Di0u+`
Yara	PE_Header_Zero - PE File Signature IsPE32 - (no description)

543_1642355418_3816.exe "C:\Users\test22\AppData\Local\Temp\543_1642355418_3816.exe"
2404
- AppLaunch.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2520
explorer.exe C:\Windows\Explorer.EXE
1236

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
164.124.101.2	Active	Moloch
185.163.204.212	Active	Moloch
185.163.204.22	Active	Moloch
52.78.231.108	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (32 events)

Time & API	Arguments	Status	Return
GetComputerNameW Jan. 18, 2022, 10:43 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Jan. 18, 2022, 10:43 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Jan. 18, 2022, 10:43 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Jan. 18, 2022, 10:43 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Jan. 18, 2022, 10:43 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Jan. 18, 2022, 10:43 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Jan. 18, 2022, 10:43 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Jan. 18, 2022, 10:43 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Jan. 18, 2022, 10:43 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Jan. 18, 2022, 10:43 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Jan. 18, 2022, 10:43 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Jan. 18, 2022, 10:43 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Jan. 18, 2022, 10:43 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Jan. 18, 2022, 10:43 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Jan. 18, 2022, 10:43 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Jan. 18, 2022, 10:43 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Jan. 18, 2022, 10:43 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Jan. 18, 2022, 10:43 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Jan. 18, 2022, 10:43 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Jan. 18, 2022, 10:43 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Jan. 18, 2022, 10:43 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Jan. 18, 2022, 10:43 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Jan. 18, 2022, 10:43 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Jan. 18, 2022, 10:43 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Jan. 18, 2022, 10:43 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Jan. 18, 2022, 10:43 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Jan. 18, 2022, 10:43 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Jan. 18, 2022, 10:43 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Jan. 18, 2022, 10:43 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Jan. 18, 2022, 10:43 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Jan. 18, 2022, 10:43 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Jan. 18, 2022, 10:43 a.m.	computer_name: TEST22-PC	1	1

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

Tries to locate where the browsers are installed (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Jan. 18, 2022, 10:43 a.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 events)

section
section	.rQROLSt
section	.adata

The executable uses a known packer (1 event)

packer

ASProtect v1.23 RC1

One or more processes crashed (2 events)

Time & API	Arguments	Status	Return	Repeated
__exception__ Jan. 18, 2022, 10:43 a.m.	stacktrace: GetEnvironmentVariableA+0x18 VerifyConsoleIoHandle-0xc5 kernel32+0x133b8 @ 0x768733b8 exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.esp: 2831552 registers.edi: 4293320004 registers.eax: 0 registers.ebp: 1638276 registers.edx: 2130566132 registers.ebx: 2831552 registers.esi: 4293331468 registers.ecx: 2408	1	0	0
__exception__ Jan. 18, 2022, 10:43 a.m.	stacktrace: exception.instruction_r: e9 14 66 fb ff 48 48 74 2e 83 a5 e4 fc ff ff 00 exception.symbol: RtlUlonglongByteSwap+0x133c6 RtlFreeOemString-0xe514 ntdll+0x907b6 exception.instruction: jmp 0x772f6dcf exception.module: ntdll.dll exception.exception_code: 0xc0000029 exception.offset: 591798 exception.address: 0x773407b6 registers.esp: 2828796 registers.edi: 1 registers.eax: 2828888 registers.ebp: 2829700 registers.edx: 2828780 registers.ebx: 2829800 registers.esi: 2828808 registers.ecx: 2828976	1	0	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

HTTP traffic contains suspicious features which may be indicative of malware related traffic (4 events)

suspicious_features	GET method with no useragent header, Connection to IP address	suspicious_request	GET http://185.163.204.22/bin1axsec
suspicious_features	POST method with no referer header, POST method with no useragent header, Connection to IP address	suspicious_request	POST http://185.163.204.212/
suspicious_features	GET method with no useragent header, Connection to IP address	suspicious_request	GET http://185.163.204.212//l/f/8maa330BZ2GIX1a3k6gn/8eb5643c4817d16920c26a3a936412853a3b10a5
suspicious_features	GET method with no useragent header, Connection to IP address	suspicious_request	GET http://185.163.204.212//l/f/8maa330BZ2GIX1a3k6gn/f4a3f3c357b3c7193f467f617873a1c04ff25519

Performs some HTTP requests (4 events)

request	GET http://185.163.204.22/bin1axsec
request	POST http://185.163.204.212/
request	GET http://185.163.204.212//l/f/8maa330BZ2GIX1a3k6gn/8eb5643c4817d16920c26a3a936412853a3b10a5
request	GET http://185.163.204.212//l/f/8maa330BZ2GIX1a3k6gn/f4a3f3c357b3c7193f467f617873a1c04ff25519

Sends data using the HTTP POST Method (1 event)

request

POST http://185.163.204.212/

Allocates read-write-execute memory (usually to unpack itself) (50 out of 445 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Jan. 18, 2022, 10:43 a.m.	process_identifier: 2404 region_size: 393216 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02190000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 18, 2022, 10:43 a.m.	process_identifier: 2404 region_size: 393216 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x021f0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 18, 2022, 10:43 a.m.	process_identifier: 2404 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x021a0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 18, 2022, 10:43 a.m.	process_identifier: 2404 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02470000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 18, 2022, 10:43 a.m.	process_identifier: 2404 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02480000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 18, 2022, 10:43 a.m.	process_identifier: 2404 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02490000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 18, 2022, 10:43 a.m.	process_identifier: 2404 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024a0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 18, 2022, 10:43 a.m.	process_identifier: 2404 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024b0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 18, 2022, 10:43 a.m.	process_identifier: 2404 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024c0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 18, 2022, 10:43 a.m.	process_identifier: 2404 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024d0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 18, 2022, 10:43 a.m.	process_identifier: 2404 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024e0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 18, 2022, 10:43 a.m.	process_identifier: 2404 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024f0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 18, 2022, 10:43 a.m.	process_identifier: 2404 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02500000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 18, 2022, 10:43 a.m.	process_identifier: 2404 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02510000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 18, 2022, 10:43 a.m.	process_identifier: 2404 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02830000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 18, 2022, 10:43 a.m.	process_identifier: 2404 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02840000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 18, 2022, 10:43 a.m.	process_identifier: 2404 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02850000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 18, 2022, 10:43 a.m.	process_identifier: 2404 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02860000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 18, 2022, 10:43 a.m.	process_identifier: 2404 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02870000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 18, 2022, 10:43 a.m.	process_identifier: 2404 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02880000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 18, 2022, 10:43 a.m.	process_identifier: 2404 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02890000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 18, 2022, 10:43 a.m.	process_identifier: 2404 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x028a0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 18, 2022, 10:43 a.m.	process_identifier: 2404 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x028b0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 18, 2022, 10:43 a.m.	process_identifier: 2404 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x028c0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 18, 2022, 10:43 a.m.	process_identifier: 2404 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x028d0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 18, 2022, 10:43 a.m.	process_identifier: 2404 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x028e0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 18, 2022, 10:43 a.m.	process_identifier: 2404 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x028f0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 18, 2022, 10:43 a.m.	process_identifier: 2404 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02900000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 18, 2022, 10:43 a.m.	process_identifier: 2404 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02910000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 18, 2022, 10:43 a.m.	process_identifier: 2404 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02920000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 18, 2022, 10:43 a.m.	process_identifier: 2404 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02930000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 18, 2022, 10:43 a.m.	process_identifier: 2404 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02940000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 18, 2022, 10:43 a.m.	process_identifier: 2404 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02950000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 18, 2022, 10:43 a.m.	process_identifier: 2404 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02960000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 18, 2022, 10:43 a.m.	process_identifier: 2404 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02970000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 18, 2022, 10:43 a.m.	process_identifier: 2404 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02980000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 18, 2022, 10:43 a.m.	process_identifier: 2404 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02990000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 18, 2022, 10:43 a.m.	process_identifier: 2404 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x029a0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 18, 2022, 10:43 a.m.	process_identifier: 2404 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x029b0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 18, 2022, 10:43 a.m.	process_identifier: 2404 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x029c0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 18, 2022, 10:43 a.m.	process_identifier: 2404 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x029d0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 18, 2022, 10:43 a.m.	process_identifier: 2404 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x029e0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 18, 2022, 10:43 a.m.	process_identifier: 2404 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x029f0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 18, 2022, 10:43 a.m.	process_identifier: 2404 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a00000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 18, 2022, 10:43 a.m.	process_identifier: 2404 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 18, 2022, 10:43 a.m.	process_identifier: 2404 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 18, 2022, 10:43 a.m.	process_identifier: 2404 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a30000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 18, 2022, 10:43 a.m.	process_identifier: 2404 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 18, 2022, 10:43 a.m.	process_identifier: 2404 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 18, 2022, 10:43 a.m.	process_identifier: 2404 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a60000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation (5 events)

Time & API	Arguments	Status	Return
GetDiskFreeSpaceW Jan. 18, 2022, 10:43 a.m.	number_of_free_clusters: 2496872 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: \\?\Volume{c2d901c4-0706-11e8-912e-806e6f6e6963}\ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceW Jan. 18, 2022, 10:43 a.m.	number_of_free_clusters: 2494977 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: \ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceW Jan. 18, 2022, 10:43 a.m.	number_of_free_clusters: 2494977 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: \ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceW Jan. 18, 2022, 10:43 a.m.	number_of_free_clusters: 2494977 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: \ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceExW Jan. 18, 2022, 10:37 a.m.	total_number_of_free_bytes: 0 free_bytes_available: 10212282368 root_path: C:\Users\test22\AppData\Local\Microsoft\Windows\Explorer total_number_of_bytes: 0	1	1

Creates executable files on the filesystem (50 out of 61 events)

file	C:\Users\test22\AppData\LocalLow\sG8rM8v\api-ms-win-core-string-l1-1-0.dll
file	C:\Users\test22\AppData\LocalLow\sG8rM8v\AccessibleMarshal.dll
file	C:\Users\test22\AppData\LocalLow\sG8rM8v\msvcp140.dll
file	C:\Users\test22\AppData\LocalLow\sG8rM8v\api-ms-win-crt-conio-l1-1-0.dll
file	C:\Users\test22\AppData\LocalLow\sG8rM8v\nssckbi.dll
file	C:\Users\test22\AppData\LocalLow\sG8rM8v\ldif60.dll
file	C:\Users\test22\AppData\LocalLow\sG8rM8v\mozMapi32_InUse.dll
file	C:\Users\test22\AppData\LocalLow\sG8rM8v\api-ms-win-crt-math-l1-1-0.dll
file	C:\Users\test22\AppData\LocalLow\sG8rM8v\api-ms-win-crt-heap-l1-1-0.dll
file	C:\Users\test22\AppData\LocalLow\sG8rM8v\api-ms-win-crt-convert-l1-1-0.dll
file	C:\Users\test22\AppData\LocalLow\sG8rM8v\lgpllibs.dll
file	C:\Users\test22\AppData\LocalLow\sG8rM8v\api-ms-win-core-processenvironment-l1-1-0.dll
file	C:\Users\test22\AppData\LocalLow\sG8rM8v\api-ms-win-core-processthreads-l1-1-1.dll
file	C:\Users\test22\AppData\LocalLow\sG8rM8v\prldap60.dll
file	C:\Users\test22\AppData\LocalLow\sG8rM8v\api-ms-win-crt-environment-l1-1-0.dll
file	C:\Users\test22\AppData\LocalLow\sG8rM8v\api-ms-win-core-libraryloader-l1-1-0.dll
file	C:\Users\test22\AppData\LocalLow\sG8rM8v\ucrtbase.dll
file	C:\Users\test22\AppData\LocalLow\sG8rM8v\api-ms-win-crt-private-l1-1-0.dll
file	C:\Users\test22\AppData\LocalLow\sG8rM8v\vcruntime140.dll
file	C:\Users\test22\AppData\LocalLow\sG8rM8v\api-ms-win-core-handle-l1-1-0.dll
file	C:\Users\test22\AppData\LocalLow\sG8rM8v\api-ms-win-core-sysinfo-l1-1-0.dll
file	C:\Users\test22\AppData\LocalLow\sG8rM8v\qipcap.dll
file	C:\Users\test22\AppData\LocalLow\sG8rM8v\MapiProxy.dll
file	C:\Users\test22\AppData\LocalLow\sG8rM8v\libEGL.dll
file	C:\Users\test22\AppData\LocalLow\sG8rM8v\api-ms-win-crt-locale-l1-1-0.dll
file	C:\Users\test22\AppData\LocalLow\sG8rM8v\api-ms-win-core-synch-l1-1-0.dll
file	C:\Users\test22\AppData\LocalLow\sG8rM8v\IA2Marshal.dll
file	C:\Users\test22\AppData\LocalLow\sG8rM8v\mozMapi32.dll
file	C:\Users\test22\AppData\LocalLow\sG8rM8v\api-ms-win-crt-utility-l1-1-0.dll
file	C:\Users\test22\AppData\LocalLow\sG8rM8v\api-ms-win-crt-multibyte-l1-1-0.dll
file	C:\Users\test22\AppData\LocalLow\sG8rM8v\nss3.dll
file	C:\Users\test22\AppData\LocalLow\sG8rM8v\api-ms-win-core-memory-l1-1-0.dll
file	C:\Users\test22\AppData\LocalLow\sG8rM8v\mozglue.dll
file	C:\Users\test22\AppData\LocalLow\sG8rM8v\AccessibleHandler.dll
file	C:\Users\test22\AppData\LocalLow\sG8rM8v\ldap60.dll
file	C:\Users\test22\AppData\LocalLow\sG8rM8v\api-ms-win-core-profile-l1-1-0.dll
file	C:\Users\test22\AppData\LocalLow\sG8rM8v\freebl3.dll
file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\click.pyw.lnk
file	C:\Users\test22\AppData\LocalLow\sG8rM8v\api-ms-win-crt-string-l1-1-0.dll
file	C:\Users\test22\AppData\LocalLow\sG8rM8v\api-ms-win-crt-time-l1-1-0.dll
file	C:\Users\test22\AppData\LocalLow\sG8rM8v\api-ms-win-crt-stdio-l1-1-0.dll
file	C:\Users\test22\AppData\LocalLow\sG8rM8v\api-ms-win-core-localization-l1-2-0.dll
file	C:\Users\test22\AppData\LocalLow\sG8rM8v\api-ms-win-crt-process-l1-1-0.dll
file	C:\Users\test22\AppData\LocalLow\sG8rM8v\api-ms-win-core-heap-l1-1-0.dll
file	C:\Users\test22\AppData\LocalLow\sG8rM8v\nssdbm3.dll
file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\dd81b5e9d99588633b73117e3b1f84f1a6952f9d573057d804047a85abfb8328_1609fbf0d6c26e---38596704027.pdf.lnk
file	C:\Users\test22\AppData\LocalLow\sG8rM8v\api-ms-win-crt-runtime-l1-1-0.dll
file	C:\Users\test22\AppData\LocalLow\sG8rM8v\softokn3.dll
file	C:\Users\test22\AppData\LocalLow\sG8rM8v\api-ms-win-core-interlocked-l1-1-0.dll
file	C:\Users\test22\AppData\LocalLow\sG8rM8v\api-ms-win-core-timezone-l1-1-0.dll

Creates a shortcut to an executable file (50 out of 51 events)

file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\agent.pyw.lnk
file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\click_image.lnk
file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\Database1.accdb.lnk
file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\click.txt.lnk
file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\msi2.png.lnk
file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\test_doc.eml.lnk
file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\office_2007.lnk
file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\exe1.zip.lnk
file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\test.eml.lnk
file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\robot.png.lnk
file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\click.py.lnk
file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\╗τ┐δ╣².txt.lnk
file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\ok2.png.lnk
file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\ok1.png.lnk
file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\msi1.png.lnk
file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\util.lnk
file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\test (1).eml.lnk
file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\Settings.ini.lnk
file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\docx2.png.lnk
file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\KMS Activation.txt.lnk
file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\sn.txt.lnk
file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\한글2010(정품).lnk
file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\Office.2010.Toolkit.and.EZ-Activator.v2.1.5.Final.lnk
file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\robot2.png.lnk
file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\agent.py.lnk
file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\ZeroAI_Click.pyw.lnk
file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\1234.zip.lnk
file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\readme.txt.lnk
file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\시리얼넘버.lnk
file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\ZeroCERT.bmp.lnk
file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\age.pyw.lnk
file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\jsGIrPlHsPM.txt.lnk
file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\click.pyw.lnk
file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\ZeroAI_History.txt.lnk
file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\한글2010(정품) (2).lnk
file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\시작프로그램.lnk
file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\doc.png.lnk
file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\dd81b5e9d99588633b73117e3b1f84f1a6952f9d573057d804047a85abfb8328_1609fbf0d6c26e---38596704027.pdf.lnk
file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\ZeroAI_Click.py.lnk
file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\다운로드.lnk
file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\Python27.lnk
file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\password.txt.lnk
file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\robot3.png.lnk
file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\phishing_file.pdf.lnk
file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\msoffice2010_32bit.lnk
file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\doc2.png.lnk
file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\KMSAuto_Net_2015_v1.4. 2.lnk
file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\air+france+klm+annual+report+2013-RTMD-AMBb5mCGMAAAvhwCAEtSGQASABszRd8A.lnk
file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\test_zip_doc.eml.lnk
file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\click.lnk

Drops an executable to the user AppData folder (50 out of 57 events)

file	C:\Users\test22\AppData\LocalLow\sG8rM8v\api-ms-win-core-synch-l1-1-0.dll
file	C:\Users\test22\AppData\LocalLow\sG8rM8v\api-ms-win-core-file-l2-1-0.dll
file	C:\Users\test22\AppData\LocalLow\sG8rM8v\api-ms-win-crt-locale-l1-1-0.dll
file	C:\Users\test22\AppData\LocalLow\sG8rM8v\breakpadinjector.dll
file	C:\Users\test22\AppData\LocalLow\sG8rM8v\prldap60.dll
file	C:\Users\test22\AppData\LocalLow\sG8rM8v\api-ms-win-crt-private-l1-1-0.dll
file	C:\Users\test22\AppData\LocalLow\sG8rM8v\nss3.dll
file	C:\Users\test22\AppData\LocalLow\sG8rM8v\api-ms-win-core-namedpipe-l1-1-0.dll
file	C:\Users\test22\AppData\LocalLow\sG8rM8v\mozglue.dll
file	C:\Users\test22\AppData\LocalLow\sG8rM8v\api-ms-win-core-libraryloader-l1-1-0.dll
file	C:\Users\test22\AppData\LocalLow\sG8rM8v\softokn3.dll
file	C:\Users\test22\AppData\LocalLow\sG8rM8v\vcruntime140.dll
file	C:\Users\test22\AppData\LocalLow\sG8rM8v\api-ms-win-crt-environment-l1-1-0.dll
file	C:\Users\test22\AppData\LocalLow\sG8rM8v\MapiProxy.dll
file	C:\Users\test22\AppData\LocalLow\sG8rM8v\IA2Marshal.dll
file	C:\Users\test22\AppData\LocalLow\sG8rM8v\api-ms-win-crt-heap-l1-1-0.dll
file	C:\Users\test22\AppData\LocalLow\sG8rM8v\api-ms-win-crt-time-l1-1-0.dll
file	C:\Users\test22\AppData\LocalLow\sG8rM8v\api-ms-win-crt-math-l1-1-0.dll
file	C:\Users\test22\AppData\LocalLow\sG8rM8v\api-ms-win-core-string-l1-1-0.dll
file	C:\Users\test22\AppData\LocalLow\sG8rM8v\api-ms-win-core-memory-l1-1-0.dll
file	C:\Users\test22\AppData\LocalLow\sG8rM8v\api-ms-win-core-sysinfo-l1-1-0.dll
file	C:\Users\test22\AppData\LocalLow\sG8rM8v\api-ms-win-core-util-l1-1-0.dll
file	C:\Users\test22\AppData\LocalLow\sG8rM8v\api-ms-win-core-localization-l1-2-0.dll
file	C:\Users\test22\AppData\LocalLow\sG8rM8v\api-ms-win-core-processthreads-l1-1-0.dll
file	C:\Users\test22\AppData\LocalLow\sG8rM8v\api-ms-win-crt-filesystem-l1-1-0.dll
file	C:\Users\test22\AppData\LocalLow\sG8rM8v\msvcp140.dll
file	C:\Users\test22\AppData\LocalLow\sG8rM8v\api-ms-win-crt-stdio-l1-1-0.dll
file	C:\Users\test22\AppData\LocalLow\sG8rM8v\AccessibleHandler.dll
file	C:\Users\test22\AppData\LocalLow\sG8rM8v\qipcap.dll
file	C:\Users\test22\AppData\LocalLow\sG8rM8v\api-ms-win-crt-utility-l1-1-0.dll
file	C:\Users\test22\AppData\LocalLow\sG8rM8v\api-ms-win-core-processthreads-l1-1-1.dll
file	C:\Users\test22\AppData\LocalLow\sG8rM8v\api-ms-win-core-heap-l1-1-0.dll
file	C:\Users\test22\AppData\LocalLow\sqlite3.dll
file	C:\Users\test22\AppData\LocalLow\sG8rM8v\freebl3.dll
file	C:\Users\test22\AppData\LocalLow\sG8rM8v\ucrtbase.dll
file	C:\Users\test22\AppData\LocalLow\sG8rM8v\libEGL.dll
file	C:\Users\test22\AppData\LocalLow\sG8rM8v\api-ms-win-core-processenvironment-l1-1-0.dll
file	C:\Users\test22\AppData\LocalLow\sG8rM8v\api-ms-win-core-handle-l1-1-0.dll
file	C:\Users\test22\AppData\LocalLow\sG8rM8v\nssckbi.dll
file	C:\Users\test22\AppData\LocalLow\sG8rM8v\api-ms-win-core-timezone-l1-1-0.dll
file	C:\Users\test22\AppData\LocalLow\sG8rM8v\nssdbm3.dll
file	C:\Users\test22\AppData\LocalLow\sG8rM8v\lgpllibs.dll
file	C:\Users\test22\AppData\LocalLow\sG8rM8v\api-ms-win-core-synch-l1-2-0.dll
file	C:\Users\test22\AppData\LocalLow\sG8rM8v\api-ms-win-crt-conio-l1-1-0.dll
file	C:\Users\test22\AppData\LocalLow\sG8rM8v\api-ms-win-core-file-l1-2-0.dll
file	C:\Users\test22\AppData\LocalLow\sG8rM8v\ldap60.dll
file	C:\Users\test22\AppData\LocalLow\sG8rM8v\api-ms-win-core-interlocked-l1-1-0.dll
file	C:\Users\test22\AppData\LocalLow\sG8rM8v\api-ms-win-core-profile-l1-1-0.dll
file	C:\Users\test22\AppData\LocalLow\sG8rM8v\api-ms-win-crt-multibyte-l1-1-0.dll
file	C:\Users\test22\AppData\LocalLow\sG8rM8v\api-ms-win-core-rtlsupport-l1-1-0.dll

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses Jan. 18, 2022, 10:43 a.m.	flags: 15 family: 0		111	0

The binary likely contains encrypted or compressed data indicative of a packer (8 events)

section

{u'size_of_data': u'0x00011000', u'virtual_address': u'0x00001000', u'entropy': 7.997084696827064, u'name': u'', u'virtual_size': u'0x00022000'}

entropy

7.99708469683

description