Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	March 11, 2023, 10:27 a.m.	March 11, 2023, 10:44 a.m.

Size	17.0KB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`655f6edee75a4cc49a8fa34567037da9`
SHA256	`6481f9e27bec4cf6702b6d6a09761c62782f5010da0dfd0a396575c60200279d`
CRC32	`DE905A8B`
ssdeep	`384:kGbJcK05FdBu6wCX9oDPlMNcLlb5sVKOyv5Ct0:kGbqK2DQUclMNEhou`
Yara	UPX_Zero - UPX packed file Is_DotNET_EXE - (no description) Malicious_Packer_Zero - Malicious Packer IsPE32 - (no description) PE_Header_Zero - PE File Signature

1221.exe "C:\Users\test22\AppData\Local\Temp\1221.exe"
1700

Name	Response	Post-Analysis Lookup
songs-travel.at.ply.gg	A 209.25.142.223	209.25.142.223

IP Address	Status	Action
125.253.92.50	Active	Moloch
164.124.101.2	Active	Moloch
209.25.142.223	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (50 out of 58 events)

Time & API	Arguments	Status	Return
GetComputerNameW March 11, 2023, 10:20 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 11, 2023, 10:20 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 11, 2023, 10:20 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 11, 2023, 10:20 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 11, 2023, 10:20 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 11, 2023, 10:20 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 11, 2023, 10:20 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 11, 2023, 10:20 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 11, 2023, 10:20 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 11, 2023, 10:20 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 11, 2023, 10:20 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 11, 2023, 10:20 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 11, 2023, 10:20 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 11, 2023, 10:20 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 11, 2023, 10:20 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 11, 2023, 10:20 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 11, 2023, 10:20 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 11, 2023, 10:20 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 11, 2023, 10:21 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 11, 2023, 10:21 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 11, 2023, 10:21 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 11, 2023, 10:21 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 11, 2023, 10:21 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 11, 2023, 10:21 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 11, 2023, 10:21 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 11, 2023, 10:21 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 11, 2023, 10:21 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 11, 2023, 10:21 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 11, 2023, 10:21 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 11, 2023, 10:21 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 11, 2023, 10:21 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 11, 2023, 10:21 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 11, 2023, 10:21 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 11, 2023, 10:21 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 11, 2023, 10:21 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 11, 2023, 10:21 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 11, 2023, 10:21 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 11, 2023, 10:21 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 11, 2023, 10:21 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 11, 2023, 10:21 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 11, 2023, 10:21 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 11, 2023, 10:21 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 11, 2023, 10:21 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 11, 2023, 10:21 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 11, 2023, 10:21 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 11, 2023, 10:21 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 11, 2023, 10:22 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 11, 2023, 10:22 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 11, 2023, 10:22 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 11, 2023, 10:22 a.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (1 event)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent March 11, 2023, 10:20 a.m.			0	0

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx March 11, 2023, 10:20 a.m.		1	1	0

Allocates read-write-execute memory (usually to unpack itself) (50 out of 69 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory March 11, 2023, 10:20 a.m.	process_identifier: 1700 region_size: 2162688 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000650000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 11, 2023, 10:20 a.m.	process_identifier: 1700 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000007e0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 11, 2023, 10:20 a.m.	process_identifier: 1700 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35f1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 11, 2023, 10:20 a.m.	process_identifier: 1700 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef386e000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 11, 2023, 10:20 a.m.	process_identifier: 1700 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef386e000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 11, 2023, 10:20 a.m.	process_identifier: 1700 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef386f000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 11, 2023, 10:20 a.m.	process_identifier: 1700 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef386f000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 11, 2023, 10:20 a.m.	process_identifier: 1700 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef386f000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 11, 2023, 10:20 a.m.	process_identifier: 1700 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef386f000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 11, 2023, 10:20 a.m.	process_identifier: 1700 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef386f000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 11, 2023, 10:20 a.m.	process_identifier: 1700 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef386f000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 11, 2023, 10:20 a.m.	process_identifier: 1700 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef386f000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 11, 2023, 10:20 a.m.	process_identifier: 1700 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef386f000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 11, 2023, 10:20 a.m.	process_identifier: 1700 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3870000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 11, 2023, 10:20 a.m.	process_identifier: 1700 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3870000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 11, 2023, 10:20 a.m.	process_identifier: 1700 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3870000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 11, 2023, 10:20 a.m.	process_identifier: 1700 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3870000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 11, 2023, 10:20 a.m.	process_identifier: 1700 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3870000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 11, 2023, 10:20 a.m.	process_identifier: 1700 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3871000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 11, 2023, 10:20 a.m.	process_identifier: 1700 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3871000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 11, 2023, 10:20 a.m.	process_identifier: 1700 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3871000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 11, 2023, 10:20 a.m.	process_identifier: 1700 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3871000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 11, 2023, 10:20 a.m.	process_identifier: 1700 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef386e000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 11, 2023, 10:20 a.m.	process_identifier: 1700 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00052000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 11, 2023, 10:20 a.m.	process_identifier: 1700 region_size: 589824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff20000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 11, 2023, 10:20 a.m.	process_identifier: 1700 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 11, 2023, 10:20 a.m.	process_identifier: 1700 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 11, 2023, 10:20 a.m.	process_identifier: 1700 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 11, 2023, 10:20 a.m.	process_identifier: 1700 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 11, 2023, 10:20 a.m.	process_identifier: 1700 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff0010a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 11, 2023, 10:20 a.m.	process_identifier: 1700 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00042000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 11, 2023, 10:20 a.m.	process_identifier: 1700 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00053000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 11, 2023, 10:20 a.m.	process_identifier: 1700 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff0011a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 11, 2023, 10:20 a.m.	process_identifier: 1700 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00142000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 11, 2023, 10:20 a.m.	process_identifier: 1700 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff0011d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 11, 2023, 10:20 a.m.	process_identifier: 1700 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff0005c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 11, 2023, 10:20 a.m.	process_identifier: 1700 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00054000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 11, 2023, 10:20 a.m.	process_identifier: 1700 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00056000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 11, 2023, 10:20 a.m.	process_identifier: 1700 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00190000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 11, 2023, 10:20 a.m.	process_identifier: 1700 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff0010b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 11, 2023, 10:20 a.m.	process_identifier: 1700 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00102000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 11, 2023, 10:20 a.m.	process_identifier: 1700 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff0006f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 11, 2023, 10:20 a.m.	process_identifier: 1700 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff000a4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 11, 2023, 10:20 a.m.	process_identifier: 1700 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00073000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 11, 2023, 10:20 a.m.	process_identifier: 1700 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00057000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 11, 2023, 10:20 a.m.	process_identifier: 1700 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00191000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 11, 2023, 10:20 a.m.	process_identifier: 1700 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff0005a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 11, 2023, 10:20 a.m.	process_identifier: 1700 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00043000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 11, 2023, 10:20 a.m.	process_identifier: 1700 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00058000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 11, 2023, 10:20 a.m.	process_identifier: 1700 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff001d0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 event)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW March 11, 2023, 10:20 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Executes one or more WMI queries which can be used to identify virtual machines (1 event)

wmi	select * from Win32_Processor

Communicates with host for which no DNS query was performed (1 event)

host

125.253.92.50

Checks the CPU name from registry, possibly for anti-virtualization (1 event)

registry

HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString

Executes one or more WMI queries (4 events)

wmi	Select * from AntiVirusProduct
wmi	select * from Win32_Processor
wmi	select * from Win32_OperatingSystem
wmi	SELECT * FROM FirewallProduct

File has been identified by 45 AntiVirus engines on VirusTotal as malicious (45 events)

Bkav	W32.AIDetectNet.01
Elastic	malicious (high confidence)
MicroWorld-eScan	IL:Trojan.MSILZilla.47877
FireEye	Generic.mg.655f6edee75a4cc4
CAT-QuickHeal	Trojan.Generic.TRFH253
ALYac	IL:Trojan.MSILZilla.47877
Malwarebytes	Crypt.Trojan.MSIL.DDS
VIPRE	IL:Trojan.MSILZilla.47877
Sangfor	Suspicious.Win32.Save.a
K7AntiVirus	Trojan ( 700000121 )
K7GW	Trojan ( 700000121 )
CrowdStrike	win/malicious_confidence_100% (D)
Arcabit	IL:Trojan.MSILZilla.DBB05
VirIT	Backdoor.Win32.RevetRat.C
Cyren	W32/Revetrat.A.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of MSIL/Agent.APN
Cynet	Malicious (score: 100)
ClamAV	Win.Dropper.LimeRAT-9776087-0
Kaspersky	HEUR:Backdoor.MSIL.Revenge.gen
BitDefender	IL:Trojan.MSILZilla.47877
Avast	Win32:MalwareX-gen [Trj]
Sophos	Mal/Revet-A
DrWeb	BackDoor.RevetRat.2
Zillya	Trojan.Agent.Win32.840141
TrendMicro	BKDR_REVET.SM
McAfee-GW-Edition	BehavesLike.Win32.Generic.lm
Trapmine	malicious.high.ml.score
Emsisoft	IL:Trojan.MSILZilla.47877 (B)
SentinelOne	Static AI - Malicious PE
Avira	TR/ATRAPS.Gen
MAX	malware (ai score=82)
Xcitium	Backdoor.MSIL.Revetrat.A@8fr3ae
GData	IL:Trojan.MSILZilla.47877
Google	Detected
AhnLab-V3	Trojan/Win.MSIL.R524851
Acronis	suspicious
McAfee	GenericRXEK-KS!655F6EDEE75A
VBA32	Backdoor.MSIL.Revenge.Heur
Cylance	unsafe
TrendMicro-HouseCall	BKDR_REVET.SM
Ikarus	Backdoor-Rat.Revenge
Fortinet	MSIL/RevengeRat.APN!tr
BitDefenderTheta	Gen:NN.ZemsilF.36308.biW@aKfoPOl
AVG	Win32:MalwareX-gen [Trj]

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (13 events)

dead_host	192.168.56.103:49188
dead_host	192.168.56.103:49170
dead_host	192.168.56.103:49190
dead_host	192.168.56.103:49163
dead_host	192.168.56.103:49180
dead_host	192.168.56.103:49184
dead_host	192.168.56.103:49182
dead_host	192.168.56.103:49172
dead_host	192.168.56.103:49186
dead_host	192.168.56.103:49176
dead_host	192.168.56.103:49174
dead_host	192.168.56.103:49178
dead_host	192.168.56.103:49168

1221.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All