Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Jan. 24, 2022, 9:30 a.m.	Jan. 24, 2022, 9:36 a.m.

Size	174.0KB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`dce983778e604b799e0470fd69e833f2`
SHA256	`2d40f472fa610ec9068b1bb4d057ca2293e2389fe7915acd2237b6df85e9b6b3`
CRC32	`69235BCF`
ssdeep	`768:xTa3zG/zbQAaYPtSHPWcmhVm13jPJXtO5k4ZaDBo+CO8nYjj0/:xTsC/zbX5k4ZaDBo+CO8nWj0/`
Yara	PE_Header_Zero - PE File Signature Generic_Malware_Zero - Generic Malware IsPE32 - (no description) Is_DotNET_EXE - (no description) Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT Win32_Trojan_PWS_Net_1_Zero - Win32 Trojan PWS .NET Azorult

121Oyzuedk.exe "C:\Users\test22\AppData\Local\Temp\121Oyzuedk.exe"
2776
- cmd.exe "C:\Windows\System32\cmd.exe" /C ping google.com
  2900
  - PING.EXE ping google.com
    2972
- wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\test22\AppData\Local\Temp\ldvzwlrhmvi.vbs"
  2464
  - chrome.exe "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" -- "C:\Users\test22\AppData\Local\Temp\Dunyfmjfile.pdf"
    2920
    - chrome.exe "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\test22\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\test22\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\test22\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=65.0.3325.181 --initial-client-data=0x88,0x8c,0x90,0x84,0x94,0x7fef4bdf1e8,0x7fef4bdf1f8,0x7fef4bdf208
      2976
    - chrome.exe "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=watcher --main-thread-id=2932 --on-initialized-event-handle=316 --parent-handle=320 /prefetch:6
      232
- 121Oyzuedk.exe C:\Users\test22\AppData\Local\Temp\121Oyzuedk.exe
  2572
  - FB_C1A5.tmp.exe "C:\Users\test22\AppData\Local\Temp\FB_C1A5.tmp.exe"
    2820
  - FB_C1F4.tmp.exe "C:\Users\test22\AppData\Local\Temp\FB_C1F4.tmp.exe"
    2992

Name	Response	Post-Analysis Lookup
google.com	A 172.217.31.14	216.58.220.110
trietlongvinhvien.info	A 150.95.104.46	150.95.104.46

IP Address	Status	Action
150.95.104.46	Active	Moloch
164.124.101.2	Active	Moloch
172.217.31.14	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (41 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Jan. 24, 2022, 9:30 a.m.			0	0
IsDebuggerPresent Jan. 24, 2022, 9:30 a.m.			0	0
IsDebuggerPresent Jan. 24, 2022, 9:31 a.m.			0	0
IsDebuggerPresent Jan. 24, 2022, 9:31 a.m.			0	0
IsDebuggerPresent Jan. 24, 2022, 9:24 a.m.			0	0
IsDebuggerPresent Jan. 24, 2022, 9:24 a.m.			0	0
IsDebuggerPresent Jan. 24, 2022, 9:24 a.m.			0	0
IsDebuggerPresent Jan. 24, 2022, 9:24 a.m.			0	0
IsDebuggerPresent Jan. 24, 2022, 9:24 a.m.			0	0
IsDebuggerPresent Jan. 24, 2022, 9:24 a.m.			0	0
IsDebuggerPresent Jan. 24, 2022, 9:24 a.m.			0	0
IsDebuggerPresent Jan. 24, 2022, 9:24 a.m.			0	0
IsDebuggerPresent Jan. 24, 2022, 9:24 a.m.			0	0
IsDebuggerPresent Jan. 24, 2022, 9:24 a.m.			0	0
IsDebuggerPresent Jan. 24, 2022, 9:24 a.m.			0	0
IsDebuggerPresent Jan. 24, 2022, 9:24 a.m.			0	0
IsDebuggerPresent Jan. 24, 2022, 9:24 a.m.			0	0
IsDebuggerPresent Jan. 24, 2022, 9:24 a.m.			0	0
IsDebuggerPresent Jan. 24, 2022, 9:24 a.m.			0	0
IsDebuggerPresent Jan. 24, 2022, 9:24 a.m.			0	0
IsDebuggerPresent Jan. 24, 2022, 9:24 a.m.			0	0
IsDebuggerPresent Jan. 24, 2022, 9:24 a.m.			0	0
IsDebuggerPresent Jan. 24, 2022, 9:24 a.m.			0	0
IsDebuggerPresent Jan. 24, 2022, 9:24 a.m.			0	0
IsDebuggerPresent Jan. 24, 2022, 9:24 a.m.			0	0
IsDebuggerPresent Jan. 24, 2022, 9:24 a.m.			0	0
IsDebuggerPresent Jan. 24, 2022, 9:24 a.m.			0	0
IsDebuggerPresent Jan. 24, 2022, 9:24 a.m.			0	0
IsDebuggerPresent Jan. 24, 2022, 9:24 a.m.			0	0
IsDebuggerPresent Jan. 24, 2022, 9:24 a.m.			0	0
IsDebuggerPresent Jan. 24, 2022, 9:24 a.m.			0	0
IsDebuggerPresent Jan. 24, 2022, 9:24 a.m.			0	0
IsDebuggerPresent Jan. 24, 2022, 9:24 a.m.			0	0
IsDebuggerPresent Jan. 24, 2022, 9:24 a.m.			0	0
IsDebuggerPresent Jan. 24, 2022, 9:24 a.m.			0	0
IsDebuggerPresent Jan. 24, 2022, 9:24 a.m.			0	0
IsDebuggerPresent Jan. 24, 2022, 9:24 a.m.			0	0
IsDebuggerPresent Jan. 24, 2022, 9:24 a.m.			0	0
IsDebuggerPresent Jan. 24, 2022, 9:24 a.m.			0	0
IsDebuggerPresent Jan. 24, 2022, 9:24 a.m.			0	0
IsDebuggerPresent Jan. 24, 2022, 9:24 a.m.			0	0

Command line console output was observed (20 events)

Time & API	Arguments	Status	Return
WriteConsoleA Jan. 24, 2022, 9:30 a.m.	buffer: Pinging google.com [172.217.31.14] console_handle: 0x00000007	1	1
WriteConsoleA Jan. 24, 2022, 9:30 a.m.	buffer: with 32 bytes of data: console_handle: 0x00000007	1	1
WriteConsoleA Jan. 24, 2022, 9:30 a.m.	buffer: Reply from 172.217.31.14: console_handle: 0x00000007	1	1
WriteConsoleA Jan. 24, 2022, 9:30 a.m.	buffer: bytes=32 console_handle: 0x00000007	1	1
WriteConsoleA Jan. 24, 2022, 9:30 a.m.	buffer: time=55ms console_handle: 0x00000007	1	1
WriteConsoleA Jan. 24, 2022, 9:30 a.m.	buffer: TTL=114 console_handle: 0x00000007	1	1
WriteConsoleA Jan. 24, 2022, 9:30 a.m.	buffer: Reply from 172.217.31.14: console_handle: 0x00000007	1	1
WriteConsoleA Jan. 24, 2022, 9:30 a.m.	buffer: bytes=32 console_handle: 0x00000007	1	1
WriteConsoleA Jan. 24, 2022, 9:30 a.m.	buffer: time=54ms console_handle: 0x00000007	1	1
WriteConsoleA Jan. 24, 2022, 9:30 a.m.	buffer: TTL=114 console_handle: 0x00000007	1	1
WriteConsoleA Jan. 24, 2022, 9:30 a.m.	buffer: Reply from 172.217.31.14: console_handle: 0x00000007	1	1
WriteConsoleA Jan. 24, 2022, 9:30 a.m.	buffer: bytes=32 console_handle: 0x00000007	1	1
WriteConsoleA Jan. 24, 2022, 9:30 a.m.	buffer: time=55ms console_handle: 0x00000007	1	1
WriteConsoleA Jan. 24, 2022, 9:30 a.m.	buffer: TTL=114 console_handle: 0x00000007	1	1
WriteConsoleA Jan. 24, 2022, 9:30 a.m.	buffer: Reply from 172.217.31.14: console_handle: 0x00000007	1	1
WriteConsoleA Jan. 24, 2022, 9:30 a.m.	buffer: bytes=32 console_handle: 0x00000007	1	1
WriteConsoleA Jan. 24, 2022, 9:30 a.m.	buffer: time=54ms console_handle: 0x00000007	1	1
WriteConsoleA Jan. 24, 2022, 9:30 a.m.	buffer: TTL=114 console_handle: 0x00000007	1	1
WriteConsoleA Jan. 24, 2022, 9:30 a.m.	buffer: Ping statistics for 172.217.31.14: Packets: Sent = 4, Received = 4, Lost = 0 (0% loss), console_handle: 0x00000007	1	1
WriteConsoleA Jan. 24, 2022, 9:30 a.m.	buffer: Approximate round trip times in milli-seconds: Minimum = 54ms, Maximum = 55ms, Average = 54ms console_handle: 0x00000007	1	1

Uses Windows APIs to generate a cryptographic key (6 events)

Time & API	Arguments	Status	Return
CryptExportKey Jan. 24, 2022, 9:30 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x007959a8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 24, 2022, 9:30 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x007959a8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 24, 2022, 9:30 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00795868 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 24, 2022, 9:30 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00795868 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 24, 2022, 9:30 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00795868 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 24, 2022, 9:30 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x007954e8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Tries to locate where the browsers are installed (2 events)

file	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\chrome.exe\PATH

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Jan. 24, 2022, 9:30 a.m.		1	1	0

One or more processes crashed (5 events)

Time & API	Arguments	Status
__exception__ Jan. 24, 2022, 9:31 a.m.	stacktrace: K32EnumProcessModules+0x18 RegisterApplicationRestart-0x1be kernel32+0x3b37e @ 0x7670b37e 0x6155190 0x61536df 0x615153e 0x6151402 0x9d7dc2 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72e32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72e4264f LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x72eb1838 LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x72eb1737 mscorlib+0x2d3711 @ 0x72143711 mscorlib+0x308f2d @ 0x72178f2d mscorlib+0x2cb060 @ 0x7213b060 0x9d0812 0x9d0119 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72e32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72e4264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72e42e95 CopyPDBs+0x4c45 DllCanUnloadNowInternal-0x3c392 clr+0x19a887 @ 0x72fca887 DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72ef7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72f81dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72f81e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72f81f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x72f8416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7488f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74907f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74904de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77679ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77679ea5 exception.instruction_r: 89 04 91 c7 45 fc fe ff ff ff ff 45 10 81 7d 10 exception.symbol: K32EnumProcessModules+0x113 RegisterApplicationRestart-0xc3 kernel32+0x3b479 exception.instruction: mov dword ptr [ecx + edx*4], eax exception.module: KERNEL32.dll exception.exception_code: 0xc0000005 exception.offset: 242809 exception.address: 0x7670b479 registers.esp: 3138376 registers.edi: 1980555208 registers.eax: 16777216 registers.ebp: 3138580 registers.edx: 0 registers.ebx: 0 registers.esi: 1 registers.ecx: 0	1
__exception__ Jan. 24, 2022, 9:31 a.m.	stacktrace: K32EnumProcessModules+0x18 RegisterApplicationRestart-0x1be kernel32+0x3b37e @ 0x7670b37e 0x6155190 0x61536df 0x615153e 0x6151402 0x9d7dc2 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72e32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72e4264f LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x72eb1838 LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x72eb1737 mscorlib+0x2d3711 @ 0x72143711 mscorlib+0x308f2d @ 0x72178f2d mscorlib+0x2cb060 @ 0x7213b060 0x9d0812 0x9d0119 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72e32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72e4264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72e42e95 CopyPDBs+0x4c45 DllCanUnloadNowInternal-0x3c392 clr+0x19a887 @ 0x72fca887 DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72ef7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72f81dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72f81e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72f81f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x72f8416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7488f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74907f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74904de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77679ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77679ea5 exception.instruction_r: 89 04 91 c7 45 fc fe ff ff ff ff 45 10 81 7d 10 exception.symbol: K32EnumProcessModules+0x113 RegisterApplicationRestart-0xc3 kernel32+0x3b479 exception.instruction: mov dword ptr [ecx + edx*4], eax exception.module: KERNEL32.dll exception.exception_code: 0xc0000005 exception.offset: 242809 exception.address: 0x7670b479 registers.esp: 3138376 registers.edi: 1980555208 registers.eax: 4194304 registers.ebp: 3138580 registers.edx: 0 registers.ebx: 0 registers.esi: 1 registers.ecx: 0	1
__exception__ Jan. 24, 2022, 9:31 a.m.	stacktrace: K32EnumProcessModules+0x18 RegisterApplicationRestart-0x1be kernel32+0x3b37e @ 0x7670b37e 0x6155190 0x61536df 0x615153e 0x6151402 0x9d7dc2 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72e32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72e4264f LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x72eb1838 LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x72eb1737 mscorlib+0x2d3711 @ 0x72143711 mscorlib+0x308f2d @ 0x72178f2d mscorlib+0x2cb060 @ 0x7213b060 0x9d0812 0x9d0119 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72e32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72e4264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72e42e95 CopyPDBs+0x4c45 DllCanUnloadNowInternal-0x3c392 clr+0x19a887 @ 0x72fca887 DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72ef7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72f81dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72f81e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72f81f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x72f8416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7488f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74907f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74904de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77679ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77679ea5 exception.instruction_r: 89 04 91 c7 45 fc fe ff ff ff ff 45 10 81 7d 10 exception.symbol: K32EnumProcessModules+0x113 RegisterApplicationRestart-0xc3 kernel32+0x3b479 exception.instruction: mov dword ptr [ecx + edx*4], eax exception.module: KERNEL32.dll exception.exception_code: 0xc0000005 exception.offset: 242809 exception.address: 0x7670b479 registers.esp: 3138376 registers.edi: 1980555208 registers.eax: 18481152 registers.ebp: 3138580 registers.edx: 0 registers.ebx: 0 registers.esi: 1 registers.ecx: 0	1
__exception__ Jan. 24, 2022, 9:31 a.m.	stacktrace: K32EnumProcessModules+0x18 RegisterApplicationRestart-0x1be kernel32+0x3b37e @ 0x7670b37e 0x6155190 0x61536df 0x615153e 0x6151402 0x9d7dc2 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72e32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72e4264f LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x72eb1838 LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x72eb1737 mscorlib+0x2d3711 @ 0x72143711 mscorlib+0x308f2d @ 0x72178f2d mscorlib+0x2cb060 @ 0x7213b060 0x9d0812 0x9d0119 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72e32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72e4264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72e42e95 CopyPDBs+0x4c45 DllCanUnloadNowInternal-0x3c392 clr+0x19a887 @ 0x72fca887 DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72ef7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72f81dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72f81e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72f81f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x72f8416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7488f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74907f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74904de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77679ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77679ea5 exception.instruction_r: 89 04 91 c7 45 fc fe ff ff ff ff 45 10 81 7d 10 exception.symbol: K32EnumProcessModules+0x113 RegisterApplicationRestart-0xc3 kernel32+0x3b479 exception.instruction: mov dword ptr [ecx + edx*4], eax exception.module: KERNEL32.dll exception.exception_code: 0xc0000005 exception.offset: 242809 exception.address: 0x7670b479 registers.esp: 3138376 registers.edi: 1980555208 registers.eax: 11665408 registers.ebp: 3138580 registers.edx: 0 registers.ebx: 0 registers.esi: 1 registers.ecx: 0	1
__exception__ Jan. 24, 2022, 9:24 a.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 180415840 registers.r15: 180416280 registers.rcx: 1416 registers.rsi: 17302540 registers.r10: 0 registers.rbx: 88923792 registers.rsp: 180415000 registers.r11: 180419536 registers.r8: 2002289036 registers.r9: 0 registers.rdx: 1504 registers.r12: 32487696 registers.rbp: 180415152 registers.rdi: 32223936 registers.rax: 7548416 registers.r13: 180415712	1

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

HTTP traffic contains suspicious features which may be indicative of malware related traffic (1 event)

suspicious_features

GET method with no useragent header

suspicious_request

GET http://trietlongvinhvien.info//.tmb/ID4/121Oyzuedk.bin

Performs some HTTP requests (1 event)

request

GET http://trietlongvinhvien.info//.tmb/ID4/121Oyzuedk.bin

Allocates read-write-execute memory (usually to unpack itself) (50 out of 106 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Jan. 24, 2022, 9:30 a.m.	process_identifier: 2776 region_size: 1900544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00560000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 24, 2022, 9:30 a.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006f0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 24, 2022, 9:30 a.m.	process_identifier: 2776 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72e31000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 24, 2022, 9:30 a.m.	process_identifier: 2776 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72e32000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 24, 2022, 9:30 a.m.	process_identifier: 2776 region_size: 2097152 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b90000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 24, 2022, 9:30 a.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00d50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 24, 2022, 9:30 a.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003f2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 24, 2022, 9:30 a.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00425000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 24, 2022, 9:30 a.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0042b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 24, 2022, 9:30 a.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00427000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 24, 2022, 9:30 a.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0040c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 24, 2022, 9:30 a.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x009d0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 24, 2022, 9:30 a.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003fc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 24, 2022, 9:30 a.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003fa000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 24, 2022, 9:30 a.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0041a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 24, 2022, 9:30 a.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00417000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 24, 2022, 9:30 a.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00416000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 24, 2022, 9:30 a.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x009d1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 24, 2022, 9:30 a.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0041b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 24, 2022, 9:30 a.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x009d2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 24, 2022, 9:30 a.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04d4f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 24, 2022, 9:30 a.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04d40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 24, 2022, 9:30 a.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x009d3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 24, 2022, 9:30 a.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x009d4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 24, 2022, 9:30 a.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x009d5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 24, 2022, 9:30 a.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x009d6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 24, 2022, 9:30 a.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x009d7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 24, 2022, 9:30 a.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x009d8000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 24, 2022, 9:30 a.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x009d9000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 24, 2022, 9:30 a.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x009da000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 24, 2022, 9:30 a.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0040d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 24, 2022, 9:30 a.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x009db000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 24, 2022, 9:30 a.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x009dc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 24, 2022, 9:30 a.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0040e000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 24, 2022, 9:30 a.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x009dd000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 24, 2022, 9:30 a.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x009de000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 24, 2022, 9:30 a.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x009df000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 24, 2022, 9:30 a.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04e40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 24, 2022, 9:30 a.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04e41000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 24, 2022, 9:30 a.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04e42000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 24, 2022, 9:30 a.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04e43000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 24, 2022, 9:30 a.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04e44000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 24, 2022, 9:30 a.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04e45000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 24, 2022, 9:30 a.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04e46000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 24, 2022, 9:30 a.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0040f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 24, 2022, 9:30 a.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04e47000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 24, 2022, 9:30 a.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04e48000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 24, 2022, 9:30 a.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04e49000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 24, 2022, 9:30 a.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04e4a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 24, 2022, 9:30 a.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04e4b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

An application raised an exception which may be indicative of an exploit crash (2 events)

Time & API	Arguments	Status	Return	Repeated
Application Crash	Process chrome.exe with pid 2920 crashed
__exception__ Jan. 24, 2022, 9:24 a.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 180415840 registers.r15: 180416280 registers.rcx: 1416 registers.rsi: 17302540 registers.r10: 0 registers.rbx: 88923792 registers.rsp: 180415000 registers.r11: 180419536 registers.r8: 2002289036 registers.r9: 0 registers.rdx: 1504 registers.r12: 32487696 registers.rbp: 180415152 registers.rdi: 32223936 registers.rax: 7548416 registers.r13: 180415712	1	0	0

Steals private information from local Internet browsers (38 events)

file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Stability\2920-1642984279390625.pma
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\CrashpadMetrics-spare.pma
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Safe Browsing Bloom Prefix Set
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Safe Browsing IP Blacklist
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\BrowserMetrics
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\ShaderCache\GPUCache
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\CrashpadMetrics.pma
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-61EE6D3E-B68.pma
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Safe Browsing Module Whitelist
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Safe Browsing\ChromeFilenameClientIncident.store
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Safe Browsing Side-Effect Free Whitelist
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Safe Browsing UwS List Prefix Set
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Safe Browsing Inclusion Whitelist
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Safe Browsing Csd Whitelist
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\CrashpadMetrics-active.pma
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local State
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Crashpad\reports\dd24b953-a4a4-45ab-b543-61a400d3a08f.dmp
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\BrowserMetrics-active.pma
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Safe Browsing Extension Blacklist
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\BrowserMetrics-spare.pma
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Crashpad
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Safe Browsing Resource Blacklist
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\First Run
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Crashpad\reports
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Safe Browsing Download Whitelist
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Safe Browsing Download
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\ShaderCache\GPUCache\data_0
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Safe Browsing\AnyIpMalware.store
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Safe Browsing UwS List
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Safe Browsing Bloom
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-5F2CDF32-998.pma
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Crashpad\metadata
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\ShaderCache\GPUCache\index
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\ShaderCache\GPUCache\data_1
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\ShaderCache\GPUCache\data_2
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\ShaderCache\GPUCache\data_3

Creates (office) documents on the filesystem (1 event)

file	C:\Users\test22\AppData\Local\Temp\Dunyfmjfile.pdf

Creates executable files on the filesystem (3 events)

file	C:\Users\test22\AppData\Local\Temp\FB_C1A5.tmp.exe
file	C:\Users\test22\AppData\Local\Temp\FB_C1F4.tmp.exe
file	C:\Users\test22\AppData\Local\Temp\ldvzwlrhmvi.vbs

Creates a suspicious process (1 event)

cmdline

"C:\Windows\System32\cmd.exe" /C ping google.com

Drops a binary and executes it (4 events)

file	C:\Users\test22\AppData\Local\Temp\ldvzwlrhmvi.vbs
file	C:\Users\test22\AppData\Local\Temp\Dunyfmjfile.pdf
file	C:\Users\test22\AppData\Local\Temp\FB_C1A5.tmp.exe
file	C:\Users\test22\AppData\Local\Temp\FB_C1F4.tmp.exe

Drops an executable to the user AppData folder (2 events)

file	C:\Users\test22\AppData\Local\Temp\FB_C1A5.tmp.exe
file	C:\Users\test22\AppData\Local\Temp\FB_C1F4.tmp.exe

A process created a hidden window (1 event)

Time & API	Arguments	Status	Return	Repeated
ShellExecuteExW Jan. 24, 2022, 9:30 a.m.	show_type: 0 filepath_r: cmd parameters: /C ping google.com filepath: cmd	1	1	0

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses Jan. 24, 2022, 9:30 a.m.	flags: 15 family: 0		111	0

Checks for the Locally Unique Identifier on the system for a suspicious privilege (3 events)

Time & API	Arguments	Status	Return
LookupPrivilegeValueW Jan. 24, 2022, 9:31 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Jan. 24, 2022, 9:31 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Jan. 24, 2022, 9:31 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1

Potentially malicious URLs were found in the process memory dump (50 out of 985 events)

url	https://docs.microsoft.com/windows/win32/fileio/maximum-file-path-limitation
url	http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
url	http://dts.search-results.com/sr?lng=
url	http://creativecommons.org/ns
url	https://qc.search.yahoo.com/search?ei=
url	https://cacert.omniroot.com/baltimoreroot.crt09
url	https://codereview.chromium.org/25305002).
url	https://search.yahoo.com/search?ei=
url	http://t1.symcb.com/ThawtePCA.crl0/
url	http://crbug.com/31395.
url	https://support.google.com/chrome/answer/165139
url	https://ct.googleapis.com/aviator/
url	http://crl.starfieldtech.com/sfroot-g2.crl0L
url	https://ct.startssl.com/
url	https://suggest.yandex.com.tr/suggest-ff.cgi?part=
url	https://de.search.yahoo.com/favicon.ico
url	https://github.com/GoogleChrome/Lighthouse/issues
url	http://www.searchnu.com/favicon.ico
url	https://support.google.com/installer/?product=
url	http://msdn.microsoft.com/en-us/library/ms792901.aspx
url	https://www.najdi.si/search.jsp?q=
url	http://x.ss2.us/x.cer0
url	http://crl.geotrust.com/crls/gtglobal.crl04
url	https://accounts.google.com/ServiceLogin
url	https://accounts.google.com/OAuthLogin
url	https://search.goo.ne.jp/sgt.jsp?MT=
url	https://www.google.com/tools/feedback/chrome/__submit
url	https://chrome.google.com/webstore/category/collection/dark_themes
url	http://ocsp.starfieldtech.com/08
url	http://crl.certum.pl/ca.crl0h
url	http://ator
url	https://suggest.yandex.by/suggest-ff.cgi?part=
url	http://feed.snap.do/?q=
url	https://sp.uk.ask.com/sh/i/a16/favicon/favicon.ico
url	http://www.language
url	https://support.google.com/chrome/
url	http://developer.chrome.com/apps/declare_permissions.html
url	http://www.google.com/chrome/intl/ko/eula_text.html
url	https://www.globalsign.com/repository/03
url	http://www.startssl.com/sfsca.crl0
url	http://UA-Compatible
url	https://se.search.yahoo.com/search?ei=
url	http://EVSecure-ocsp.geotrust.com0
url	https://developers.google.com/web/fundamentals/accessibility/accessible-styles
url	https://mammoth.ct.comodo.com/
url	http://hladaj.atlas.sk/fulltext/?phrase=
url	http://buscador.softonic.com/?q=
url	https://chrome-devtools-frontend.appspot.com/
url	https://hk.search.yahoo.com/sugg/chrome?output=fxjson
url	https://ph.search.yahoo.com/sugg/chrome?output=fxjson

Yara rule detected in process memory (50 out of 1377 events)

description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep
description	Create a windows service	rule	Create_Service
description	Communication using DGA	rule	Network_DGA
description	Communications over RAW Socket	rule	Network_TCP_Socket
description	browser info stealer	rule	infoStealer_browser_Zero
description	Communications use DNS	rule	Network_DNS
description	Match Windows Inet API call	rule	Str_Win32_Internet_API
description	Google Chrome User Data Check	rule	Chrome_User_Data_Check_Zero
description	Virtual currency	rule	Virtual_currency_Zero
description	Win.Trojan.agentTesla	rule	Win_Trojan_agentTesla_Zero
description	Code injection with CreateRemoteThread in a remote process	rule	Code_injection
description	Record Audio	rule	Sniff_Audio
description	Communications over HTTP	rule	Network_HTTP
description	Perform crypto currency mining	rule	BitCoin
description	Run a KeyLogger	rule	KeyLogger
description	Communications over FTP	rule	Network_FTP
description	Escalate priviledges	rule	Escalate_priviledges
description	File Downloader	rule	Network_Downloader
description	Take ScreenShot	rule	ScreenShot
description	Communications over P2P network	rule	Network_P2P_Win
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerCheck__RemoteAPI
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	DebuggerException__ConsoleCtrl
description	(no description)	rule	DebuggerException__SetConsoleCtrl
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	(no description)	rule	Check_Dlls
description	Possibly employs anti-virtualization techniques	rule	vmdetect
description	Checks if being debugged	rule	anti_dbg
description	Anti-Sandbox checks for ThreatExpert	rule	antisb_threatExpert
description	Bypass DEP	rule	disable_dep
description	Affect hook table	rule	win_hook
description	Install itself for autorun at Windows startup	rule	Persistence
description	Steal credential	rule	local_credential_Steal
description	Match Windows Http API call	rule	Str_Win32_Http_API
description	Create a windows service	rule	Create_Service
description	Communication using DGA	rule	Network_DGA
description	Communications over RAW Socket	rule	Network_TCP_Socket
description	browser info stealer	rule	infoStealer_browser_Zero
description	Communications use DNS	rule	Network_DNS

Uses Windows utilities for basic Windows functionality (3 events)

cmdline	"C:\Windows\System32\cmd.exe" /C ping google.com
cmdline	ping google.com
cmdline	cmd /C ping google.com

One or more of the buffers contains an embedded PE file (1 event)

buffer

Buffer with sha1: b88f7b1289901c72680ed07097426c862f267df6

Allocates execute permission to another process indicative of possible code injection (1 event)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory Jan. 24, 2022, 9:31 a.m.	process_identifier: 2572 region_size: 323584 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000038c	1	0	0

Installs itself for autorun at Windows startup (1 event)

reg_key

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\update.

reg_value

"C:\Users\test22\AppData\Roaming\update\update..exe"

Potential code injection by writing to the memory of another process (1 event)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory Jan. 24, 2022, 9:31 a.m.	buffer: @ base_address: 0x7efde008 process_identifier: 2572 process_handle: 0x0000038c	1	1	0

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2776 called NtSetContextThread to modify thread in remote process 2572
NtSetContextThread Jan. 24, 2022, 9:31 a.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4198800 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000558 process_identifier: 2572	1	0	0

One or more non-whitelisted processes were created (5 events)

parent_process	wscript.exe	martian_process	C:\Users\test22\AppData\Local\Temp\Dunyfmjfile.pdf
parent_process	wscript.exe	martian_process	"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" -- "C:\Users\test22\AppData\Local\Temp\Dunyfmjfile.pdf"
parent_process	chrome.exe	martian_process	"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=watcher --main-thread-id=2932 --on-initialized-event-handle=316 --parent-handle=320 /prefetch:6
parent_process	chrome.exe	martian_process	"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1140,18147332596268958739,10089783022908510456,131072 --gpu-preferences=KAAAAAAAAAAABwAAAQAAAAAAAAAAAGAAAQAAAAAAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAKAAAAEAAAAAAAAAAAAAAACwAAABAAAAAAAAAAAQAAAAoAAAAQAAAAAAAAAAEAAAALAAAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x80ee --gpu-device-id=0xbeef --gpu-driver-vendor=Microsoft --gpu-driver-version=6.1.7600.16385 --gpu-driver-date=6-21-2006 --service-request-channel-token=50B72F0C30E3815C0243CC7088A10F36 --mojo-platform-channel-handle=1260 --ignored=" --type=renderer " /prefetch:2
parent_process	chrome.exe	martian_process	"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\test22\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\test22\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\test22\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=65.0.3325.181 --initial-client-data=0x88,0x8c,0x90,0x84,0x94,0x7fef4bdf1e8,0x7fef4bdf1f8,0x7fef4bdf208

Found URLs in memory pointing to an IP address rather than a domain (potentially indicative of Command & Control traffic) (1 event)

url	http://127.0.0.1

Resumed a suspended thread in a remote process potentially indicative of process injection (40 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2776 resumed a thread in remote process 2572
Process injection	Process 2976 resumed a thread in remote process 2920
NtResumeThread Jan. 24, 2022, 9:31 a.m.	thread_handle: 0x00000558 suspend_count: 1 process_identifier: 2572	1	0	0
NtResumeThread Jan. 24, 2022, 9:24 a.m.	thread_handle: 0x0000000000000158 suspend_count: 2 process_identifier: 2920	1	0	0
NtResumeThread Jan. 24, 2022, 9:24 a.m.	thread_handle: 0x0000000000000158 suspend_count: 2 process_identifier: 2920	1	0	0
NtResumeThread Jan. 24, 2022, 9:24 a.m.	thread_handle: 0x0000000000000158 suspend_count: 2 process_identifier: 2920	1	0	0
NtResumeThread Jan. 24, 2022, 9:24 a.m.	thread_handle: 0x0000000000000158 suspend_count: 2 process_identifier: 2920	1	0	0
NtResumeThread Jan. 24, 2022, 9:24 a.m.	thread_handle: 0x0000000000000158 suspend_count: 2 process_identifier: 2920	1	0	0
NtResumeThread Jan. 24, 2022, 9:24 a.m.	thread_handle: 0x0000000000000158 suspend_count: 2 process_identifier: 2920	1	0	0
NtResumeThread Jan. 24, 2022, 9:24 a.m.	thread_handle: 0x0000000000000158 suspend_count: 2 process_identifier: 2920	1	0	0
NtResumeThread Jan. 24, 2022, 9:24 a.m.	thread_handle: 0x0000000000000158 suspend_count: 2 process_identifier: 2920	1	0	0
NtResumeThread Jan. 24, 2022, 9:24 a.m.	thread_handle: 0x0000000000000158 suspend_count: 2 process_identifier: 2920	1	0	0
NtResumeThread Jan. 24, 2022, 9:24 a.m.	thread_handle: 0x0000000000000158 suspend_count: 2 process_identifier: 2920	1	0	0
NtResumeThread Jan. 24, 2022, 9:24 a.m.	thread_handle: 0x0000000000000158 suspend_count: 2 process_identifier: 2920	1	0	0
NtResumeThread Jan. 24, 2022, 9:24 a.m.	thread_handle: 0x0000000000000158 suspend_count: 2 process_identifier: 2920	1	0	0
NtResumeThread Jan. 24, 2022, 9:24 a.m.	thread_handle: 0x0000000000000158 suspend_count: 2 process_identifier: 2920	1	0	0
NtResumeThread Jan. 24, 2022, 9:24 a.m.	thread_handle: 0x0000000000000158 suspend_count: 2 process_identifier: 2920	1	0	0
NtResumeThread Jan. 24, 2022, 9:24 a.m.	thread_handle: 0x0000000000000158 suspend_count: 2 process_identifier: 2920	1	0	0
NtResumeThread Jan. 24, 2022, 9:24 a.m.	thread_handle: 0x0000000000000158 suspend_count: 2 process_identifier: 2920	1	0	0
NtResumeThread Jan. 24, 2022, 9:24 a.m.	thread_handle: 0x0000000000000158 suspend_count: 2 process_identifier: 2920	1	0	0
NtResumeThread Jan. 24, 2022, 9:24 a.m.	thread_handle: 0x0000000000000158 suspend_count: 2 process_identifier: 2920	1	0	0
NtResumeThread Jan. 24, 2022, 9:24 a.m.	thread_handle: 0x0000000000000158 suspend_count: 2 process_identifier: 2920	1	0	0
NtResumeThread Jan. 24, 2022, 9:24 a.m.	thread_handle: 0x0000000000000158 suspend_count: 2 process_identifier: 2920	1	0	0
NtResumeThread Jan. 24, 2022, 9:24 a.m.	thread_handle: 0x0000000000000158 suspend_count: 2 process_identifier: 2920	1	0	0
NtResumeThread Jan. 24, 2022, 9:24 a.m.	thread_handle: 0x0000000000000158 suspend_count: 2 process_identifier: 2920	1	0	0
NtResumeThread Jan. 24, 2022, 9:24 a.m.	thread_handle: 0x0000000000000158 suspend_count: 2 process_identifier: 2920	1	0	0
NtResumeThread Jan. 24, 2022, 9:24 a.m.	thread_handle: 0x0000000000000158 suspend_count: 2 process_identifier: 2920	1	0	0
NtResumeThread Jan. 24, 2022, 9:24 a.m.	thread_handle: 0x0000000000000158 suspend_count: 2 process_identifier: 2920	1	0	0
NtResumeThread Jan. 24, 2022, 9:24 a.m.	thread_handle: 0x0000000000000158 suspend_count: 2 process_identifier: 2920	1	0	0
NtResumeThread Jan. 24, 2022, 9:24 a.m.	thread_handle: 0x0000000000000158 suspend_count: 2 process_identifier: 2920	1	0	0
NtResumeThread Jan. 24, 2022, 9:24 a.m.	thread_handle: 0x0000000000000158 suspend_count: 2 process_identifier: 2920	1	0	0
NtResumeThread Jan. 24, 2022, 9:24 a.m.	thread_handle: 0x0000000000000158 suspend_count: 2 process_identifier: 2920	1	0	0
NtResumeThread Jan. 24, 2022, 9:24 a.m.	thread_handle: 0x0000000000000158 suspend_count: 2 process_identifier: 2920	1	0	0
NtResumeThread Jan. 24, 2022, 9:24 a.m.	thread_handle: 0x0000000000000158 suspend_count: 2 process_identifier: 2920	1	0	0
NtResumeThread Jan. 24, 2022, 9:25 a.m.	thread_handle: 0x0000000000000158 suspend_count: 2 process_identifier: 2920	1	0	0
NtResumeThread Jan. 24, 2022, 9:25 a.m.	thread_handle: 0x0000000000000158 suspend_count: 2 process_identifier: 2920	1	0	0
NtResumeThread Jan. 24, 2022, 9:25 a.m.	thread_handle: 0x0000000000000158 suspend_count: 2 process_identifier: 2920	1	0	0
NtResumeThread Jan. 24, 2022, 9:25 a.m.	thread_handle: 0x0000000000000158 suspend_count: 2 process_identifier: 2920	1	0	0
NtResumeThread Jan. 24, 2022, 9:25 a.m.	thread_handle: 0x0000000000000158 suspend_count: 2 process_identifier: 2920	1	0	0
NtResumeThread Jan. 24, 2022, 9:25 a.m.	thread_handle: 0x0000000000000158 suspend_count: 2 process_identifier: 2920	1	0	0

Generates some ICMP traffic

Executed a process and injected code into it, probably while unpacking (50 out of 116 events)

Time & API	Arguments	Status	Return
NtResumeThread Jan. 24, 2022, 9:30 a.m.	thread_handle: 0x000000dc suspend_count: 1 process_identifier: 2776	1	0
NtResumeThread Jan. 24, 2022, 9:30 a.m.	thread_handle: 0x00000154 suspend_count: 1 process_identifier: 2776	1	0
NtResumeThread Jan. 24, 2022, 9:30 a.m.	thread_handle: 0x00000190 suspend_count: 1 process_identifier: 2776	1	0
NtResumeThread Jan. 24, 2022, 9:30 a.m.	thread_handle: 0x000001f8 suspend_count: 1 process_identifier: 2776	1	0
NtResumeThread Jan. 24, 2022, 9:30 a.m.	thread_handle: 0x0000021c suspend_count: 1 process_identifier: 2776	1	0
CreateProcessInternalW Jan. 24, 2022, 9:30 a.m.	thread_identifier: 2904 thread_handle: 0x0000037c process_identifier: 2900 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\cmd.exe track: 1 command_line: "C:\Windows\System32\cmd.exe" /C ping google.com filepath_r: C:\Windows\System32\cmd.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x00000384	1	1
NtResumeThread Jan. 24, 2022, 9:30 a.m.	thread_handle: 0x0000049c suspend_count: 1 process_identifier: 2776	1	0
NtResumeThread Jan. 24, 2022, 9:30 a.m.	thread_handle: 0x00000394 suspend_count: 1 process_identifier: 2776	1	0
NtGetContextThread Jan. 24, 2022, 9:30 a.m.	thread_handle: 0x000000e4	1	0
NtGetContextThread Jan. 24, 2022, 9:30 a.m.	thread_handle: 0x000000e4	1	0
NtResumeThread Jan. 24, 2022, 9:30 a.m.	thread_handle: 0x000000e4 suspend_count: 1 process_identifier: 2776	1	0
NtResumeThread Jan. 24, 2022, 9:31 a.m.	thread_handle: 0x00000394 suspend_count: 1 process_identifier: 2776	1	0
NtGetContextThread Jan. 24, 2022, 9:31 a.m.	thread_handle: 0x000000e4	1	0
NtGetContextThread Jan. 24, 2022, 9:31 a.m.	thread_handle: 0x000000e4	1	0
NtResumeThread Jan. 24, 2022, 9:31 a.m.	thread_handle: 0x000000e4 suspend_count: 1 process_identifier: 2776	1	0
NtResumeThread Jan. 24, 2022, 9:31 a.m.	thread_handle: 0x00000338 suspend_count: 1 process_identifier: 2776	1	0
CreateProcessInternalW Jan. 24, 2022, 9:31 a.m.	thread_identifier: 2488 thread_handle: 0x0000053c process_identifier: 2464 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\wscript.exe track: 1 command_line: "C:\Windows\System32\WScript.exe" "C:\Users\test22\AppData\Local\Temp\ldvzwlrhmvi.vbs" filepath_r: C:\Windows\System32\WScript.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x00000550	1	1
CreateProcessInternalW Jan. 24, 2022, 9:31 a.m.	thread_identifier: 2612 thread_handle: 0x00000558 process_identifier: 2572 current_directory: filepath: track: 1 command_line: C:\Users\test22\AppData\Local\Temp\121Oyzuedk.exe filepath_r: stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x0000038c	1	1
NtGetContextThread Jan. 24, 2022, 9:31 a.m.	thread_handle: 0x00000558	1	0
NtAllocateVirtualMemory Jan. 24, 2022, 9:31 a.m.	process_identifier: 2572 region_size: 323584 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000038c	1	0
WriteProcessMemory Jan. 24, 2022, 9:31 a.m.	buffer: base_address: 0x00400000 process_identifier: 2572 process_handle: 0x0000038c	1	1
WriteProcessMemory Jan. 24, 2022, 9:31 a.m.	buffer: base_address: 0x00401000 process_identifier: 2572 process_handle: 0x0000038c	1	1
WriteProcessMemory Jan. 24, 2022, 9:31 a.m.	buffer: base_address: 0x00402000 process_identifier: 2572 process_handle: 0x0000038c	1	1
WriteProcessMemory Jan. 24, 2022, 9:31 a.m.	buffer: base_address: 0x00403000 process_identifier: 2572 process_handle: 0x0000038c	1	1
WriteProcessMemory Jan. 24, 2022, 9:31 a.m.	buffer: base_address: 0x00404000 process_identifier: 2572 process_handle: 0x0000038c	1	1
WriteProcessMemory Jan. 24, 2022, 9:31 a.m.	buffer: @ base_address: 0x7efde008 process_identifier: 2572 process_handle: 0x0000038c	1	1
NtSetContextThread Jan. 24, 2022, 9:31 a.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4198800 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000558 process_identifier: 2572	1	0
NtResumeThread Jan. 24, 2022, 9:31 a.m.	thread_handle: 0x00000558 suspend_count: 1 process_identifier: 2572	1	0
CreateProcessInternalW Jan. 24, 2022, 9:30 a.m.	thread_identifier: 2976 thread_handle: 0x00000084 process_identifier: 2972 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\PING.EXE track: 1 command_line: ping google.com filepath_r: C:\Windows\system32\PING.EXE stack_pivoted: 0 creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x00000088	1	1
CreateProcessInternalW Jan. 24, 2022, 9:31 a.m.	thread_identifier: 2932 thread_handle: 0x000002c8 process_identifier: 2920 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe track: 1 command_line: "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" -- "C:\Users\test22\AppData\Local\Temp\Dunyfmjfile.pdf" filepath_r: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x000002c4	1	1
CreateProcessInternalW Jan. 24, 2022, 9:31 a.m.	thread_identifier: 2812 thread_handle: 0x0000026c process_identifier: 2820 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Users\test22\AppData\Local\Temp\FB_C1A5.tmp.exe track: 1 command_line: "C:\Users\test22\AppData\Local\Temp\FB_C1A5.tmp.exe" filepath_r: C:\Users\test22\AppData\Local\Temp\FB_C1A5.tmp.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x00000274	1	1
CreateProcessInternalW Jan. 24, 2022, 9:31 a.m.	thread_identifier: 2988 thread_handle: 0x00000270 process_identifier: 2992 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Users\test22\AppData\Local\Temp\FB_C1F4.tmp.exe track: 1 command_line: "C:\Users\test22\AppData\Local\Temp\FB_C1F4.tmp.exe" filepath_r: C:\Users\test22\AppData\Local\Temp\FB_C1F4.tmp.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x00000278	1	1
NtResumeThread Jan. 24, 2022, 9:31 a.m.	thread_handle: 0x000000dc suspend_count: 1 process_identifier: 2820	1	0
NtResumeThread Jan. 24, 2022, 9:31 a.m.	thread_handle: 0x00000154 suspend_count: 1 process_identifier: 2820	1	0
NtResumeThread Jan. 24, 2022, 9:31 a.m.	thread_handle: 0x00000198 suspend_count: 1 process_identifier: 2820	1	0
NtResumeThread Jan. 24, 2022, 9:31 a.m.	thread_handle: 0x00000230 suspend_count: 1 process_identifier: 2820	1	0
CreateProcessInternalW Jan. 24, 2022, 9:31 a.m.	thread_identifier: 0 thread_handle: 0x00000000 process_identifier: 0 current_directory: filepath: C:\Windows\SysWOW64\autoconv.exe track: 0 command_line: filepath_r: C:\Windows\SysWOW64\autoconv.exe stack_pivoted: 0 creation_flags: 134217740 (CREATE_NO_WINDOW\|CREATE_SUSPENDED\|DETACHED_PROCESS) inherit_handles: 0 process_handle: 0x00000000		0
CreateProcessInternalW Jan. 24, 2022, 9:24 a.m.	thread_identifier: 2944 thread_handle: 0x0000000000000098 process_identifier: 2976 current_directory: filepath: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe track: 1 command_line: "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\test22\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\test22\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\test22\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=65.0.3325.181 --initial-client-data=0x88,0x8c,0x90,0x84,0x94,0x7fef4bdf1e8,0x7fef4bdf1f8,0x7fef4bdf208 filepath_r: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe stack_pivoted: 0 creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x000000000000009c	1	1
CreateProcessInternalW Jan. 24, 2022, 9:24 a.m.	thread_identifier: 448 thread_handle: 0x0000000000000144 process_identifier: 232 current_directory: filepath: track: 1 command_line: "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=watcher --main-thread-id=2932 --on-initialized-event-handle=316 --parent-handle=320 /prefetch:6 filepath_r: stack_pivoted: 0 creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x0000000000000148	1	1
NtResumeThread Jan. 24, 2022, 9:24 a.m.	thread_handle: 0x00000000000001c0 suspend_count: 1 process_identifier: 2920	1	0
CreateProcessInternalW Jan. 24, 2022, 9:24 a.m.	thread_identifier: 2736 thread_handle: 0x000000000000063c process_identifier: 2708 current_directory: filepath: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe track: 1 command_line: "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1140,18147332596268958739,10089783022908510456,131072 --gpu-preferences=KAAAAAAAAAAABwAAAQAAAAAAAAAAAGAAAQAAAAAAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAKAAAAEAAAAAAAAAAAAAAACwAAABAAAAAAAAAAAQAAAAoAAAAQAAAAAAAAAAEAAAALAAAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x80ee --gpu-device-id=0xbeef --gpu-driver-vendor=Microsoft --gpu-driver-version=6.1.7600.16385 --gpu-driver-date=6-21-2006 --service-request-channel-token=50B72F0C30E3815C0243CC7088A10F36 --mojo-platform-channel-handle=1260 --ignored=" --type=renderer " /prefetch:2 filepath_r: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe stack_pivoted: 0 creation_flags: 17302540 (CREATE_BREAKAWAY_FROM_JOB\|CREATE_SUSPENDED\|CREATE_UNICODE_ENVIRONMENT\|DETACHED_PROCESS\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x00000000000005e0	1	1
NtResumeThread Jan. 24, 2022, 9:24 a.m.	thread_handle: 0x00000000000000f4 suspend_count: 1 process_identifier: 2976	1	0
NtGetContextThread Jan. 24, 2022, 9:24 a.m.	thread_handle: 0x0000000000000158	1	0
NtResumeThread Jan. 24, 2022, 9:24 a.m.	thread_handle: 0x0000000000000158 suspend_count: 2 process_identifier: 2920	1	0
NtGetContextThread Jan. 24, 2022, 9:24 a.m.	thread_handle: 0x0000000000000158	1	0
NtResumeThread Jan. 24, 2022, 9:24 a.m.	thread_handle: 0x0000000000000158 suspend_count: 2 process_identifier: 2920	1	0
NtGetContextThread Jan. 24, 2022, 9:24 a.m.	thread_handle: 0x0000000000000158	1	0
NtResumeThread Jan. 24, 2022, 9:24 a.m.	thread_handle: 0x0000000000000158 suspend_count: 2 process_identifier: 2920	1	0
NtGetContextThread Jan. 24, 2022, 9:24 a.m.	thread_handle: 0x0000000000000158	1	0
NtResumeThread Jan. 24, 2022, 9:24 a.m.	thread_handle: 0x0000000000000158 suspend_count: 2 process_identifier: 2920	1	0

File has been identified by 34 AntiVirus engines on VirusTotal as malicious (34 events)

Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.Strictor.267735
FireEye	Generic.mg.dce983778e604b79
McAfee	Artemis!DCE983778E60
Cylance	Unsafe
CrowdStrike	win/malicious_confidence_100% (W)
Cyren	W32/Faker.Q.gen!Eldorado
Symantec	MSIL.Downloader!gen7
ESET-NOD32	a variant of MSIL/TrojanDownloader.Agent.KBQ
APEX	Malicious
Paloalto	generic.ml
Kaspersky	HEUR:Trojan-PSW.MSIL.Agensla.gen
BitDefender	Gen:Variant.Strictor.267735
Avast	Win32:DropperX-gen [Drp]
Ad-Aware	Gen:Variant.Strictor.267735
Emsisoft	Gen:Variant.Strictor.267735 (B)
DrWeb	Trojan.DownloaderNET.288
McAfee-GW-Edition	Artemis
Sophos	Mal/Generic-S
SentinelOne	Static AI - Malicious PE
Avira	HEUR/AGEN.1133936
Microsoft	Trojan:Win32/Sabsik.FL.B!ml
GData	Gen:Variant.Strictor.267735
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win.MSILKrypt.R466822
BitDefenderTheta	Gen:NN.ZemsilF.34160.km0@aCZPdlf
ALYac	Gen:Variant.Strictor.267735
MAX	malware (ai score=83)
Malwarebytes	Trojan.Downloader
eGambit	Unsafe.AI_Score_99%
Fortinet	MSIL/Agent.KBQ!tr.dldr
AVG	Win32:DropperX-gen [Drp]
Cybereason	malicious.99b0b8
MaxSecure	Trojan.Malware.300983.susgen

The process wscript.exe wrote an executable file to disk which it then attempted to execute (2 events)

file	C:\Windows\SysWOW64\wscript.exe
file	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

121Oyzuedk.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All