Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	Sept. 20, 2022, 11:04 a.m.	Sept. 20, 2022, 11:07 a.m.

Size	1.3MB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`c56268bd887cf060acae169c64e60a49`
SHA256	`0aeea48dc9c774a36110cb4c41168552c7b438b2e5ab16ed91a4e901da8d1299`
CRC32	`CAC694BA`
ssdeep	`24576:kRmJkcoQricOIQxiZY1iau0Arqh7kwhNzM5oPd3Y2MbIU:hJZoQrbTFZY1iaMo7zhNo5o1iD`
Yara	IsPE32 - (no description) Generic_Malware_Zero - Generic Malware OS_Processor_Check_Zero - OS Processor Check PE_Header_Zero - PE File Signature Malicious_Library_Zero - Malicious_Library UPX_Zero - UPX packed file

采购订单要求 & 绘图样本..exe "C:\Users\test22\AppData\Local\Temp\采购订单要求 & 绘图样本..exe"
1860
- HEHDNB.exe "C:\Users\test22\AppData\Local\Temp\HEHDNB.exe"
  1548
- cmd.exe C:\Windows\system32\cmd.exe /c schtasks /create /tn HOPRFU.exe /tr C:\Users\test22\AppData\Roaming\Windata\Acrobat Reader DC.exe /sc minute /mo 1
  2396
  - schtasks.exe schtasks /create /tn HOPRFU.exe /tr C:\Users\test22\AppData\Roaming\Windata\Acrobat Reader DC.exe /sc minute /mo 1
    1660
- wscript.exe WSCript C:\Users\test22\AppData\Local\Temp\HOPRFU.vbs
  2412
explorer.exe C:\Windows\Explorer.EXE
1388

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
164.124.101.2	Active	Moloch
194.5.98.212	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (50 out of 1663 events)

Time & API	Arguments	Status	Return
GetComputerNameW Sept. 20, 2022, 11:04 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 20, 2022, 11:04 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 20, 2022, 11:04 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 20, 2022, 11:04 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 20, 2022, 11:04 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 20, 2022, 11:04 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 20, 2022, 11:04 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 20, 2022, 11:04 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 20, 2022, 11:04 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 20, 2022, 11:04 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 20, 2022, 11:04 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 20, 2022, 11:04 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 20, 2022, 11:04 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 20, 2022, 11:04 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 20, 2022, 11:04 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 20, 2022, 11:04 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 20, 2022, 11:04 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 20, 2022, 11:04 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 20, 2022, 11:04 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 20, 2022, 11:04 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 20, 2022, 11:04 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 20, 2022, 11:04 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 20, 2022, 11:04 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 20, 2022, 11:04 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 20, 2022, 11:04 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 20, 2022, 11:04 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 20, 2022, 11:04 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 20, 2022, 11:04 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 20, 2022, 11:04 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 20, 2022, 11:04 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 20, 2022, 11:04 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 20, 2022, 11:04 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 20, 2022, 11:04 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 20, 2022, 11:04 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 20, 2022, 11:04 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 20, 2022, 11:04 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 20, 2022, 11:04 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 20, 2022, 11:04 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 20, 2022, 11:04 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 20, 2022, 11:04 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 20, 2022, 11:04 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 20, 2022, 11:04 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 20, 2022, 11:04 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 20, 2022, 11:04 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 20, 2022, 11:04 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 20, 2022, 11:04 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 20, 2022, 11:04 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 20, 2022, 11:04 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 20, 2022, 11:04 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 20, 2022, 11:04 a.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (4 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Sept. 20, 2022, 11:04 a.m.			0	0
IsDebuggerPresent Sept. 20, 2022, 11:04 a.m.			0	0
IsDebuggerPresent Sept. 20, 2022, 11:04 a.m.			0	0
IsDebuggerPresent Sept. 20, 2022, 11:04 a.m.			0	0

Command line console output was observed (2 events)

Time & API	Arguments	Status	Return	Repeated
WriteConsoleW Sept. 20, 2022, 11:04 a.m.	buffer: ERROR: console_handle: 0x0000000b	1	1	0
WriteConsoleW Sept. 20, 2022, 11:04 a.m.	buffer: Invalid argument/option - 'Reader'. Type "SCHTASKS /CREATE /?" for usage. console_handle: 0x0000000b	1	1	0

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Sept. 20, 2022, 11:04 a.m.		1	1	0

Allocates read-write-execute memory (usually to unpack itself) (42 events)

Time & API	Arguments	Status
NtProtectVirtualMemory Sept. 20, 2022, 11:04 a.m.	process_identifier: 1860 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x744f2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 20, 2022, 11:04 a.m.	process_identifier: 1548 region_size: 720896 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000620000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 20, 2022, 11:04 a.m.	process_identifier: 1548 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000650000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 20, 2022, 11:04 a.m.	process_identifier: 1548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2e61000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 20, 2022, 11:04 a.m.	process_identifier: 1548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef34fb000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 20, 2022, 11:04 a.m.	process_identifier: 1548 region_size: 2228224 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002210000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 20, 2022, 11:04 a.m.	process_identifier: 1548 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000023b0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 20, 2022, 11:04 a.m.	process_identifier: 1548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2e62000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 20, 2022, 11:04 a.m.	process_identifier: 1548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2e62000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 20, 2022, 11:04 a.m.	process_identifier: 1548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2e62000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 20, 2022, 11:04 a.m.	process_identifier: 1548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2e62000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 20, 2022, 11:04 a.m.	process_identifier: 1548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2e62000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 20, 2022, 11:04 a.m.	process_identifier: 1548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2e62000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 20, 2022, 11:04 a.m.	process_identifier: 1548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2e62000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 20, 2022, 11:04 a.m.	process_identifier: 1548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2e62000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 20, 2022, 11:04 a.m.	process_identifier: 1548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2e62000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 20, 2022, 11:04 a.m.	process_identifier: 1548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2e62000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 20, 2022, 11:04 a.m.	process_identifier: 1548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2e62000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 20, 2022, 11:04 a.m.	process_identifier: 1548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2e64000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 20, 2022, 11:04 a.m.	process_identifier: 1548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2e64000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 20, 2022, 11:04 a.m.	process_identifier: 1548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2e64000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 20, 2022, 11:04 a.m.	process_identifier: 1548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2e64000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 20, 2022, 11:04 a.m.	process_identifier: 1548 region_size: 655360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 20, 2022, 11:04 a.m.	process_identifier: 1548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 20, 2022, 11:04 a.m.	process_identifier: 1548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 20, 2022, 11:04 a.m.	process_identifier: 1548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 20, 2022, 11:04 a.m.	process_identifier: 1548 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 20, 2022, 11:04 a.m.	process_identifier: 1548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 20, 2022, 11:04 a.m.	process_identifier: 1548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe936da000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 20, 2022, 11:04 a.m.	process_identifier: 1548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe9378c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 20, 2022, 11:04 a.m.	process_identifier: 1548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe937b6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 20, 2022, 11:04 a.m.	process_identifier: 1548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93790000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 20, 2022, 11:04 a.m.	process_identifier: 1548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe936ec000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 20, 2022, 11:04 a.m.	process_identifier: 1548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93800000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 20, 2022, 11:04 a.m.	process_identifier: 1548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe936db000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 20, 2022, 11:04 a.m.	process_identifier: 1548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe936fb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 20, 2022, 11:05 a.m.	process_identifier: 1548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe936d2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 20, 2022, 11:05 a.m.	process_identifier: 1548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe9372c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 20, 2022, 11:05 a.m.	process_identifier: 1548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe936fd000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 20, 2022, 11:06 a.m.	process_identifier: 1548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93840000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 20, 2022, 11:05 a.m.	process_identifier: 1388 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000004710000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 20, 2022, 11:04 a.m.	process_identifier: 2412 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x744f2000 process_handle: 0xffffffff	1

Checks whether any human activity is being performed by constantly checking whether the foreground window changed

Creates executable files on the filesystem (4 events)

file	C:\Users\test22\AppData\Local\Temp\HEHDNB.exe
file	C:\Users\test22\AppData\Roaming\Windata\Acrobat Reader DC.exe
file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HOPRFU.lnk
file	C:\Users\test22\AppData\Local\Temp\HOPRFU.vbs

Creates a shortcut to an executable file (1 event)

file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HOPRFU.lnk

Creates a suspicious process (2 events)

cmdline	C:\Windows\system32\cmd.exe /c schtasks /create /tn HOPRFU.exe /tr C:\Users\test22\AppData\Roaming\Windata\Acrobat Reader DC.exe /sc minute /mo 1
cmdline	schtasks /create /tn HOPRFU.exe /tr C:\Users\test22\AppData\Roaming\Windata\Acrobat Reader DC.exe /sc minute /mo 1

Drops a binary and executes it (1 event)

file	C:\Users\test22\AppData\Local\Temp\HEHDNB.exe

Drops an executable to the user AppData folder (2 events)

file	C:\Users\test22\AppData\Local\Temp\HEHDNB.exe
file	C:\Users\test22\AppData\Roaming\Windata\Acrobat Reader DC.exe

Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (13 events)

Time & API	Arguments	Status	Return
Process32NextW Sept. 20, 2022, 11:04 a.m.	snapshot_handle: 0x000003ac process_name: mobsync.exe process_identifier: 2476	1	1
Process32NextW Sept. 20, 2022, 11:04 a.m.	snapshot_handle: 0x000003ac process_name: tvnserver.exe process_identifier: 2616	1	1
Process32NextW Sept. 20, 2022, 11:04 a.m.	snapshot_handle: 0x000003ac process_name: taskhost.exe process_identifier: 2772	1	1
Process32NextW Sept. 20, 2022, 11:04 a.m.	snapshot_handle: 0x000003ac process_name: wsqmcons.exe process_identifier: 2780	1	1
Process32NextW Sept. 20, 2022, 11:04 a.m.	snapshot_handle: 0x000003ac process_name: cmd.exe process_identifier: 2984	1	1
Process32NextW Sept. 20, 2022, 11:04 a.m.	snapshot_handle: 0x000003ac process_name: conhost.exe process_identifier: 2992	1	1
Process32NextW Sept. 20, 2022, 11:04 a.m.	snapshot_handle: 0x000003ac process_name: SearchProtocolHost.exe process_identifier: 3000	1	1
Process32NextW Sept. 20, 2022, 11:04 a.m.	snapshot_handle: 0x000003ac process_name: pw.exe process_identifier: 2144	1	1
Process32NextW Sept. 20, 2022, 11:04 a.m.	snapshot_handle: 0x000003ac process_name: sppsvc.exe process_identifier: 1792	1	1
Process32NextW Sept. 20, 2022, 11:04 a.m.	snapshot_handle: 0x000003ac process_name: HEHDNB.exe process_identifier: 1548	1	1
Process32NextW Sept. 20, 2022, 11:04 a.m.	snapshot_handle: 0x000003ac process_name: cmd.exe process_identifier: 2396	1	1
Process32NextW Sept. 20, 2022, 11:04 a.m.	snapshot_handle: 0x000003ac process_name: conhost.exe process_identifier: 2448	1	1
Process32NextW Sept. 20, 2022, 11:04 a.m.	snapshot_handle: 0x000003b4 process_name: wscript.exe process_identifier: 2412	1	1

Expresses interest in specific running processes (1 event)

process

wscript.exe

Yara rule detected in process memory (10 events)

description	task schedule	rule	schtasks_Zero
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerCheck__RemoteAPI
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep

Uses Windows utilities for basic Windows functionality (2 events)

cmdline	C:\Windows\system32\cmd.exe /c schtasks /create /tn HOPRFU.exe /tr C:\Users\test22\AppData\Roaming\Windata\Acrobat Reader DC.exe /sc minute /mo 1
cmdline	schtasks /create /tn HOPRFU.exe /tr C:\Users\test22\AppData\Roaming\Windata\Acrobat Reader DC.exe /sc minute /mo 1

Communicates with host for which no DNS query was performed (1 event)

host

194.5.98.212

Installs itself for autorun at Windows startup (4 events)

reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\HOPRFU	reg_value	"C:\Users\test22\AppData\Roaming\Windata\Acrobat Reader DC.exe"
file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HOPRFU.lnk
cmdline	C:\Windows\system32\cmd.exe /c schtasks /create /tn HOPRFU.exe /tr C:\Users\test22\AppData\Roaming\Windata\Acrobat Reader DC.exe /sc minute /mo 1
cmdline	schtasks /create /tn HOPRFU.exe /tr C:\Users\test22\AppData\Roaming\Windata\Acrobat Reader DC.exe /sc minute /mo 1

Executes one or more WMI queries (2 events)

wmi	Select * from AntiVirusProduct
wmi	Select * from Win32_Process where name like '?????? & ????..exe'

One or more non-whitelisted processes were created (1 event)

parent_process

wscript.exe

martian_process

C:\Users\test22\AppData\Local\Temp\?????? & ????..exe

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1860 resumed a thread in remote process 1548
NtResumeThread Sept. 20, 2022, 11:04 a.m.	thread_handle: 0x0000033c suspend_count: 1 process_identifier: 1548	1	0	0

The process wscript.exe wrote an executable file to disk (1 event)

file	C:\Windows\SysWOW64\wscript.exe

File has been identified by 49 AntiVirus engines on VirusTotal as malicious (49 events)

Bkav	W32.AIDetect.malware2
tehtris	Generic.Malware
Cynet	Malicious (score: 100)
FireEye	Generic.mg.c56268bd887cf060
McAfee	Trojan-AutoIt.g
Cylance	Unsafe
VIPRE	AIT:Trojan.Nymeria.5273
Sangfor	Virus.Win32.Save.a
Cybereason	malicious.d887cf
Arcabit	AIT:Trojan.Nymeria.D1499
Cyren	W32/AutoIt.SM.gen!Eldorado
Elastic	malicious (high confidence)
ESET-NOD32	multiple detections
APEX	Malicious
ClamAV	Txt.Malware.LodaRAT-9769386-0
Kaspersky	HEUR:Backdoor.Script.LodaRat.b
BitDefender	AIT:Trojan.Nymeria.5273
NANO-Antivirus	Trojan.Win32.Crysan.jqapjf
MicroWorld-eScan	AIT:Trojan.Nymeria.5273
Avast	AutoIt:Dropper-DU [Trj]
Ad-Aware	AIT:Trojan.Nymeria.5273
Emsisoft	AIT:Trojan.Nymeria.5273 (B)
DrWeb	BackDoor.AsyncRATNET.1
TrendMicro	TROJ_GEN.R06CC0WGA22
McAfee-GW-Edition	BehavesLike.Win32.Dropper.tc
Trapmine	malicious.high.ml.score
Sophos	Mal/AutoIt-O
Ikarus	Trojan.MSIL.Agent
Jiangmin	Backdoor.Script.nl
Avira	HEUR/AGEN.1229397
Antiy-AVL	Trojan/Generic.ASBOL.C6D6
Kingsoft	Win32.Hack.Undef.(kcloud)
Microsoft	Trojan:Win32/Wacatac.B!ml
GData	Trojan.GenericKD.61021517 (2x)
Google	Detected
AhnLab-V3	Trojan/Win.AutoIt.R499897
Acronis	suspicious
ALYac	Trojan.GenericKD.61021517
MAX	malware (ai score=89)
VBA32	Trojan-Downloader.Autoit.gen
Malwarebytes	Malware.AI.4220736909
TrendMicro-HouseCall	TROJ_GEN.R06CC0WGA22
Rising	Trojan.AntiVM!1.CF63 (CLASSIC)
Yandex	Trojan.Agent!z7LgrVRkIfM
MaxSecure	Trojan.Autoit.AZA
Fortinet	AutoIt/Agent.DB!tr
BitDefenderTheta	AI:Packer.599AA70016
AVG	AutoIt:Dropper-DU [Trj]
CrowdStrike	win/malicious_confidence_100% (D)

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (11 events)

dead_host	192.168.56.102:49172
dead_host	192.168.56.102:49173
dead_host	192.168.56.102:49178
dead_host	194.5.98.212:4001
dead_host	192.168.56.102:49176
dead_host	192.168.56.102:49170
dead_host	192.168.56.102:49177
dead_host	192.168.56.102:49171
dead_host	192.168.56.102:49169
dead_host	192.168.56.102:49174
dead_host	192.168.56.102:49175

采购订单要求 & 绘图样本..exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All