Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	July 28, 2022, 9:02 a.m.	July 28, 2022, 9:28 a.m.

Size	1000.5KB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`3974f1aac0c9b865dba7d775ade14aac`
SHA256	`27911c4af8f6e031cca41f65ad2fb8793c4e07649e0d3c0d92d64b5e5fe9d816`
CRC32	`0810C0B0`
ssdeep	`12288:4/fmpw4UZvaVJ9ZzxUaeiGJ8Iy2TiGrSXvt/EIZ0QASHqYrFkRidLyYLxGsl2hHo:zw4UZvybcv8vUyASHrZDWWYPhZGxQmH`
Yara	IsPE32 - (no description) Win32_Trojan_PWS_Net_1_Zero - Win32 Trojan PWS .NET Azorult Is_DotNET_EXE - (no description) PE_Header_Zero - PE File Signature

scrss.exe "C:\Users\test22\AppData\Local\Temp\scrss.exe"
2312
- scrss.exe "C:\Users\test22\AppData\Local\Temp\scrss.exe"
  2704
explorer.exe C:\Windows\Explorer.EXE
1236

Name	Response	Post-Analysis Lookup
microsoft.com	A 20.81.111.85 A 20.53.203.50 A 20.84.181.62 A 20.103.85.33 A 20.112.52.29	20.112.52.29

IP Address	Status	Action
164.124.101.2	Active	Moloch
20.84.181.62	Active	Moloch
45.87.61.202	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.103:49167 -> 20.84.181.62:80	2260002	SURICATA Applayer Detect protocol only one direction	Generic Protocol Command Decode

Suricata TLS

No Suricata TLS

Queries for the computername (3 events)

Time & API	Arguments	Status	Return
GetComputerNameW July 28, 2022, 9:03 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 28, 2022, 9:03 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA July 28, 2022, 9:03 a.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent July 28, 2022, 9:02 a.m.			0	0
IsDebuggerPresent July 28, 2022, 9:02 a.m.			0	0

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

Tries to locate where the browsers are installed (1 event)

registry

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\App Paths\firefox.exe

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx July 28, 2022, 9:02 a.m.		1	1	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (50 out of 54 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory July 28, 2022, 9:02 a.m.	process_identifier: 2312 region_size: 2097152 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00670000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2022, 9:02 a.m.	process_identifier: 2312 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00830000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory July 28, 2022, 9:02 a.m.	process_identifier: 2312 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73941000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 28, 2022, 9:02 a.m.	process_identifier: 2312 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73942000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2022, 9:02 a.m.	process_identifier: 2312 region_size: 327680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005b0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2022, 9:02 a.m.	process_identifier: 2312 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005c0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2022, 9:02 a.m.	process_identifier: 2312 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00552000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2022, 9:02 a.m.	process_identifier: 2312 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0056c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2022, 9:02 a.m.	process_identifier: 2312 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00af0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2022, 9:02 a.m.	process_identifier: 2312 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00af1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2022, 9:02 a.m.	process_identifier: 2312 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00af2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2022, 9:02 a.m.	process_identifier: 2312 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00585000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2022, 9:02 a.m.	process_identifier: 2312 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0058b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2022, 9:02 a.m.	process_identifier: 2312 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00587000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2022, 9:02 a.m.	process_identifier: 2312 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0055a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2022, 9:02 a.m.	process_identifier: 2312 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0055c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2022, 9:02 a.m.	process_identifier: 2312 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00af3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2022, 9:02 a.m.	process_identifier: 2312 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0057a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2022, 9:02 a.m.	process_identifier: 2312 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00577000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2022, 9:02 a.m.	process_identifier: 2312 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0056a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2022, 9:02 a.m.	process_identifier: 2312 region_size: 24576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00af4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2022, 9:02 a.m.	process_identifier: 2312 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00576000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2022, 9:02 a.m.	process_identifier: 2312 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00afa000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2022, 9:02 a.m.	process_identifier: 2312 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00afb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2022, 9:02 a.m.	process_identifier: 2312 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00afc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2022, 9:02 a.m.	process_identifier: 2312 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00afd000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2022, 9:02 a.m.	process_identifier: 2312 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00afe000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2022, 9:02 a.m.	process_identifier: 2312 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00aff000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2022, 9:02 a.m.	process_identifier: 2312 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00e40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2022, 9:02 a.m.	process_identifier: 2312 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00e41000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2022, 9:02 a.m.	process_identifier: 2312 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00e42000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2022, 9:02 a.m.	process_identifier: 2312 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00e43000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2022, 9:02 a.m.	process_identifier: 2312 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00e44000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2022, 9:02 a.m.	process_identifier: 2312 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0056d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2022, 9:02 a.m.	process_identifier: 2312 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0056e000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2022, 9:02 a.m.	process_identifier: 2312 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0056f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2022, 9:02 a.m.	process_identifier: 2312 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04be0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2022, 9:02 a.m.	process_identifier: 2312 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04be1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2022, 9:02 a.m.	process_identifier: 2312 region_size: 24576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00e45000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2022, 9:02 a.m.	process_identifier: 2312 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00e4b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2022, 9:02 a.m.	process_identifier: 2312 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00e4c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2022, 9:02 a.m.	process_identifier: 2312 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00e4d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2022, 9:02 a.m.	process_identifier: 2312 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x08300000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2022, 9:02 a.m.	process_identifier: 2312 region_size: 24576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x08301000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2022, 9:02 a.m.	process_identifier: 2312 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x08307000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2022, 9:02 a.m.	process_identifier: 2312 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x08308000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2022, 9:02 a.m.	process_identifier: 2312 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0710f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2022, 9:02 a.m.	process_identifier: 2312 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x07100000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2022, 9:02 a.m.	process_identifier: 2312 region_size: 24576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x08309000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2022, 9:02 a.m.	process_identifier: 2312 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0830f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation (3 events)

Time & API	Arguments	Status	Return
GetDiskFreeSpaceW July 28, 2022, 9:03 a.m.	number_of_free_clusters: 8362495 sectors_per_cluster: 8362495 bytes_per_sector: 512 root_path: C: total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceW July 28, 2022, 9:03 a.m.	number_of_free_clusters: 2499127 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: \ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceExW July 28, 2022, 9:03 a.m.	total_number_of_free_bytes: 0 free_bytes_available: 10236862464 root_path: C:\Users\test22\AppData\Local\Microsoft\Windows\Explorer total_number_of_bytes: 0	1	1

Steals private information from local Internet browsers (23 events)

file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 3\Login Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 11\Login Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 20\Login Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 1\Login Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Login Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 5\Login Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 10\Login Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 8\Login Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local State
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 4\Login Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 15\Login Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 18\Login Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 9\Login Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 2\Login Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 7\Login Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 16\Login Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 13\Login Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 6\Login Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 17\Login Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 12\Login Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 14\Login Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 19\Login Data
file	C:\Users\test22\AppData\Local\Chromium\User Data\Default\Login Data

Executes one or more WMI queries (1 event)

wmi

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x000f5600', u'virtual_address': u'0x00002000', u'entropy': 7.744088524027439, u'name': u'.text', u'virtual_size': u'0x000f55c4'}

entropy

7.74408852403

description

A section with a high entropy has been found

entropy

0.9815

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 event)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW July 28, 2022, 9:02 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Potentially malicious URLs were found in the process memory dump (1 event)

url	http://microsoft.com/

Yara rule detected in process memory (18 events)

description	Communications over RAW Socket	rule	Network_TCP_Socket
description	Communications use DNS	rule	Network_DNS
description	Code injection with CreateRemoteThread in a remote process	rule	Code_injection
description	PWS Memory	rule	Generic_PWS_Memory_Zero
description	Run a KeyLogger	rule	KeyLogger
description	File Downloader	rule	Network_Downloader
description	Escalate priviledges	rule	Escalate_priviledges
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep
description	Affect hook table	rule	win_hook
description	Install itself for autorun at Windows startup	rule	Persistence
description	email clients info stealer	rule	infoStealer_emailClients_Zero

Terminates another process (2 events)

Time & API	Arguments	Status	Return	Repeated
NtTerminateProcess July 28, 2022, 9:02 a.m.	status_code: 0xffffffff process_identifier: 2668 process_handle: 0x00000264		0	0
NtTerminateProcess July 28, 2022, 9:02 a.m.	status_code: 0xffffffff process_identifier: 2668 process_handle: 0x00000264	1	0	0

One or more of the buffers contains an embedded PE file (1 event)

buffer

Buffer with sha1: f780bf9d7e75a569bb4f1c275d832c8ed6e5f5b0

Communicates with host for which no DNS query was performed (1 event)

host

45.87.61.202

Allocates execute permission to another process indicative of possible code injection (2 events)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory July 28, 2022, 9:02 a.m.	process_identifier: 2668 region_size: 1417216 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000001f0		3221225496	0
NtAllocateVirtualMemory July 28, 2022, 9:02 a.m.	process_identifier: 2704 region_size: 1417216 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000270	1	0	0

Manipulates memory of a non-child process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2312 manipulating memory of non-child process 2668
NtAllocateVirtualMemory July 28, 2022, 9:02 a.m.	process_identifier: 2668 region_size: 1417216 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000001f0		3221225496	0

Potential code injection by writing to the memory of another process (4 events)

Time & API	Arguments	Status	Return
WriteProcessMemory July 28, 2022, 9:02 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $OOhã.°.°.°È!Y° .°E± .°È![° .°E±.°,èk° .°,èh°.°" °.°E± .°E±.°.°á.°W±p.°Wù° .°W± .°Rich.°PELnÙbàrä¤m@ @PÌ,@p,pÄÊ.textqr `.rdataOPv@@.dataQàÆ@À.rsrcp,@.Ì@@.relocÄpú@B.bss@@ base_address: 0x00400000 process_identifier: 2704 process_handle: 0x00000270	1	1
WriteProcessMemory July 28, 2022, 9:02 a.m.	buffer: Æ@è@÷@@@$@3@U@d@y@TÍ<¨K¢`Ý;UBÄôK A³ÝJpMÛ(PáAPáAUìUEÈÒt ÆAêu÷]ÃUìd¡0ì@SVWxé§G03ö_,?EøB<}ôDxEðÀÁë3ÉÛt-}ø¾ÁÎ <aUø\| ÂÀàðëuøA;ËrßUü}ôEðL3ÛD ÂMìÉt<3ÿÊÀMøÑEè ÁÏ ¾ÁøBÉuñUü}øEø}ôÆ;Et EèC;]ìrÄWUüÒKÿÿÿ3À_^[ÉÂuðD$X·DÂëÝUìì¼ESVWXhLw&M ]¸èèþÿÿðÇEÄkern3ÀÇEÈel32EÐEÞEÄPÇEÌ.dllÇEàntdlÇEäl.dlfÇEèlÇEÔuserÇEØ32.dfÇEÜllfÇEø1fÇEü2ÿÖEàPÿÖEÔPÿÖhX¤SåèyþÿÿhyÌ?EèlþÿÿhEVEôè_þÿÿhDð5àEÀèRþÿÿhî¶PE¤èEþÿÿhÆREè8þÿÿh_xTîEðè+þÿÿhÚöÚOEèþÿÿøhÆp}´èþÿÿh_»ðèþÿÿh-W®[E¼èöýÿÿE¬3ÀPhjPPhSE¨ÿ×jEìPÿÖ]ø}°jh0WjÿÓðötîjE¨PW}ìVWÿU¼WÿUð>M]¸tjEøPPjÿUÀÆEhà.ÿU¤3À}«jDj«««DÿÿÿPèTýÿÿÄÿu jhÿÿÿUE¼ÀuOEPDÿÿÿP3ÀPPPPPPPSÿUôÀ¯PPjPPh@SE¸ÿU´øjÿÿtE¸ë^EüPPjÿUÀéeìMìQPÿU}ìtoEPDÿÿÿP3ÀPPPPPPPSÿUôÀuOPPjPPh@SEÿU´øjÿÿt*EPÿu°VWÿU¬WÿUðEPDÿÿÿP3ÀPPPPPPPSÿUôë EüPPjÿUÀÆEÿu¼ÿUð}åþÿÿ_^[ÉÃ¼ÁAd base_address: 0x0041e000 process_identifier: 2704 process_handle: 0x00000270	1	1
WriteProcessMemory July 28, 2022, 9:02 a.m.	buffer: 2§¸8MìØô¡G$[[K{lIäk¨ÉS<©KC¨¬ßÝG6\|°àÀ^MÜ¢SºµaDöW)ä¤Ú¶q¼~8aâøwÙÆ-{]~h Û<;?Äß¢-¸x«pu?âiÊ$¥$îÔD9*«Þ5Mc>¼öD°l?A base_address: 0x00559000 process_identifier: 2704 process_handle: 0x00000270	1	1
WriteProcessMemory July 28, 2022, 9:02 a.m.	buffer: @ base_address: 0x7efde008 process_identifier: 2704 process_handle: 0x00000270	1	1

Code injection by writing an executable or DLL to the memory of another process (1 event)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory July 28, 2022, 9:02 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $OOhã.°.°.°È!Y° .°E± .°È![° .°E±.°,èk° .°,èh°.°" °.°E± .°E±.°.°á.°W±p.°Wù° .°W± .°Rich.°PELnÙbàrä¤m@ @PÌ,@p,pÄÊ.textqr `.rdataOPv@@.dataQàÆ@À.rsrcp,@.Ì@@.relocÄpú@B.bss@@ base_address: 0x00400000 process_identifier: 2704 process_handle: 0x00000270	1	1	0

Harvests credentials from local email clients (2 events)

file	C:\Users\test22\AppData\Roaming\Thunderbird\profiles.ini
registry	HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2312 called NtSetContextThread to modify thread in remote process 2704
NtSetContextThread July 28, 2022, 9:02 a.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4222372 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000264 process_identifier: 2704	1	0	0

Attempts to remove evidence of file being downloaded from the Internet (1 event)

file	C:\Users\test22\AppData\Local\Temp\scrss.exe:Zone.Identifier

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2312 resumed a thread in remote process 2704
NtResumeThread July 28, 2022, 9:02 a.m.	thread_handle: 0x00000264 suspend_count: 1 process_identifier: 2704	1	0	0

Executed a process and injected code into it, probably while unpacking (23 events)

Time & API	Arguments	Status	Return
NtResumeThread July 28, 2022, 9:02 a.m.	thread_handle: 0x000000dc suspend_count: 1 process_identifier: 2312	1	0
NtResumeThread July 28, 2022, 9:02 a.m.	thread_handle: 0x00000150 suspend_count: 1 process_identifier: 2312	1	0
NtResumeThread July 28, 2022, 9:02 a.m.	thread_handle: 0x0000018c suspend_count: 1 process_identifier: 2312	1	0
NtResumeThread July 28, 2022, 9:02 a.m.	thread_handle: 0x00000200 suspend_count: 1 process_identifier: 2312	1	0
NtGetContextThread July 28, 2022, 9:02 a.m.	thread_handle: 0x000000e4	1	0
NtGetContextThread July 28, 2022, 9:02 a.m.	thread_handle: 0x000000e4	1	0
NtResumeThread July 28, 2022, 9:02 a.m.	thread_handle: 0x000000e4 suspend_count: 1 process_identifier: 2312	1	0
CreateProcessInternalW July 28, 2022, 9:02 a.m.	thread_identifier: 2672 thread_handle: 0x000001f4 process_identifier: 2668 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\scrss.exe track: 1 command_line: filepath_r: C:\Users\test22\AppData\Local\Temp\scrss.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x000001f0	1	1
NtGetContextThread July 28, 2022, 9:02 a.m.	thread_handle: 0x000001f4	1	0
NtAllocateVirtualMemory July 28, 2022, 9:02 a.m.	process_identifier: 2668 region_size: 1417216 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000001f0		3221225496
CreateProcessInternalW July 28, 2022, 9:02 a.m.	thread_identifier: 2708 thread_handle: 0x00000264 process_identifier: 2704 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\scrss.exe track: 1 command_line: filepath_r: C:\Users\test22\AppData\Local\Temp\scrss.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000270	1	1
NtGetContextThread July 28, 2022, 9:02 a.m.	thread_handle: 0x00000264	1	0
NtAllocateVirtualMemory July 28, 2022, 9:02 a.m.	process_identifier: 2704 region_size: 1417216 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000270	1	0
WriteProcessMemory July 28, 2022, 9:02 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $OOhã.°.°.°È!Y° .°E± .°È![° .°E±.°,èk° .°,èh°.°" °.°E± .°E±.°.°á.°W±p.°Wù° .°W± .°Rich.°PELnÙbàrä¤m@ @PÌ,@p,pÄÊ.textqr `.rdataOPv@@.dataQàÆ@À.rsrcp,@.Ì@@.relocÄpú@B.bss@@ base_address: 0x00400000 process_identifier: 2704 process_handle: 0x00000270	1	1
WriteProcessMemory July 28, 2022, 9:02 a.m.	buffer: base_address: 0x00401000 process_identifier: 2704 process_handle: 0x00000270	1	1
WriteProcessMemory July 28, 2022, 9:02 a.m.	buffer: base_address: 0x00419000 process_identifier: 2704 process_handle: 0x00000270	1	1
WriteProcessMemory July 28, 2022, 9:02 a.m.	buffer: Æ@è@÷@@@$@3@U@d@y@TÍ<¨K¢`Ý;UBÄôK A³ÝJpMÛ(PáAPáAUìUEÈÒt ÆAêu÷]ÃUìd¡0ì@SVWxé§G03ö_,?EøB<}ôDxEðÀÁë3ÉÛt-}ø¾ÁÎ <aUø\| ÂÀàðëuøA;ËrßUü}ôEðL3ÛD ÂMìÉt<3ÿÊÀMøÑEè ÁÏ ¾ÁøBÉuñUü}øEø}ôÆ;Et EèC;]ìrÄWUüÒKÿÿÿ3À_^[ÉÂuðD$X·DÂëÝUìì¼ESVWXhLw&M ]¸èèþÿÿðÇEÄkern3ÀÇEÈel32EÐEÞEÄPÇEÌ.dllÇEàntdlÇEäl.dlfÇEèlÇEÔuserÇEØ32.dfÇEÜllfÇEø1fÇEü2ÿÖEàPÿÖEÔPÿÖhX¤SåèyþÿÿhyÌ?EèlþÿÿhEVEôè_þÿÿhDð5àEÀèRþÿÿhî¶PE¤èEþÿÿhÆREè8þÿÿh_xTîEðè+þÿÿhÚöÚOEèþÿÿøhÆp}´èþÿÿh_»ðèþÿÿh-W®[E¼èöýÿÿE¬3ÀPhjPPhSE¨ÿ×jEìPÿÖ]ø}°jh0WjÿÓðötîjE¨PW}ìVWÿU¼WÿUð>M]¸tjEøPPjÿUÀÆEhà.ÿU¤3À}«jDj«««DÿÿÿPèTýÿÿÄÿu jhÿÿÿUE¼ÀuOEPDÿÿÿP3ÀPPPPPPPSÿUôÀ¯PPjPPh@SE¸ÿU´øjÿÿtE¸ë^EüPPjÿUÀéeìMìQPÿU}ìtoEPDÿÿÿP3ÀPPPPPPPSÿUôÀuOPPjPPh@SEÿU´øjÿÿt*EPÿu°VWÿU¬WÿUðEPDÿÿÿP3ÀPPPPPPPSÿUôë EüPPjÿUÀÆEÿu¼ÿUð}åþÿÿ_^[ÉÃ¼ÁAd base_address: 0x0041e000 process_identifier: 2704 process_handle: 0x00000270	1	1
WriteProcessMemory July 28, 2022, 9:02 a.m.	buffer: base_address: 0x00554000 process_identifier: 2704 process_handle: 0x00000270	1	1
WriteProcessMemory July 28, 2022, 9:02 a.m.	buffer: base_address: 0x00557000 process_identifier: 2704 process_handle: 0x00000270	1	1
WriteProcessMemory July 28, 2022, 9:02 a.m.	buffer: 2§¸8MìØô¡G$[[K{lIäk¨ÉS<©KC¨¬ßÝG6\|°àÀ^MÜ¢SºµaDöW)ä¤Ú¶q¼~8aâøwÙÆ-{]~h Û<;?Äß¢-¸x«pu?âiÊ$¥$îÔD9*«Þ5Mc>¼öD°l?A base_address: 0x00559000 process_identifier: 2704 process_handle: 0x00000270	1	1
WriteProcessMemory July 28, 2022, 9:02 a.m.	buffer: @ base_address: 0x7efde008 process_identifier: 2704 process_handle: 0x00000270	1	1
NtSetContextThread July 28, 2022, 9:02 a.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4222372 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000264 process_identifier: 2704	1	0
NtResumeThread July 28, 2022, 9:02 a.m.	thread_handle: 0x00000264 suspend_count: 1 process_identifier: 2704	1	0

File has been identified by 51 AntiVirus engines on VirusTotal as malicious (50 out of 51 events)

Bkav	W32.AIDetectNet.01
Lionic	Trojan.Multi.Generic.4!c
MicroWorld-eScan	Trojan.GenericKD.61043854
ALYac	Trojan.GenericKD.61043854
Cylance	Unsafe
Sangfor	Trojan.Win32.Kryptik.Vou3
K7AntiVirus	Trojan ( 005961e31 )
Alibaba	Trojan:Win32/Kryptik.ali2000016
K7GW	Trojan ( 005961e31 )
Arcabit	Trojan.Generic.D3A3748E
Cyren	W32/MSIL_Agent.DPT.gen!Eldorado
Symantec	Scr.Malcode!gdn34
Elastic	malicious (high confidence)
ESET-NOD32	a variant of MSIL/GenKryptik.FXYX
APEX	Malicious
Paloalto	generic.ml
Kaspersky	HEUR:Trojan-Spy.MSIL.SnakeLogger.gen
BitDefender	Trojan.GenericKD.61043854
Avast	Win32:PWSX-gen [Trj]
Tencent	Msil.Trojan-spy.Snakelogger.Lkxo
Ad-Aware	Trojan.GenericKD.61043854
Sophos	ML/PE-A
DrWeb	Trojan.PackedNET.1462
VIPRE	Trojan.GenericKD.61043854
McAfee-GW-Edition	BehavesLike.Win32.Generic.fc
Trapmine	suspicious.low.ml.score
FireEye	Generic.mg.3974f1aac0c9b865
Emsisoft	Trojan.GenericKD.61043854 (B)
SentinelOne	Static AI - Malicious PE
Webroot	W32.Trojan.Gen
Avira	TR/AD.MortyStealer.rrsau
Kingsoft	Win32.Troj.Undef.(kcloud)
Gridinsoft	Ransom.Win32.Sabsik.sa
Microsoft	Trojan:Win32/Woreflint.A!cl
GData	Trojan.GenericKD.61043854
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win.Generic.C5214552
Acronis	suspicious
McAfee	RDN/Generic PWS.y
MAX	malware (ai score=98)
VBA32	CIL.HeapOverride.Heur
Malwarebytes	Trojan.MalPack.PNG.Generic
TrendMicro-HouseCall	TROJ_GEN.R002H07GQ22
Rising	Trojan.Generic/MSIL@AI.100 (RDM.MSIL:Awc8AqtGvI36Z3q/n5kJZA)
Ikarus	Trojan-Spy.FormBook
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	MSIL/GenKryptik.FVXS!tr
BitDefenderTheta	Gen:NN.ZemsilF.34806.!m0@ayPoQMd
AVG	Win32:PWSX-gen [Trj]
Panda	Trj/RnkBend.A

scrss.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All