Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	March 29, 2023, 9:50 a.m.	March 29, 2023, 9:54 a.m.

Size	528.8KB
Type	UTF-8 Unicode text, with very long lines, with CRLF line terminators
MD5	`bb3afc961cd9b132922db723407508e7`
SHA256	`ff328209c9f4604d3ccc0639621d4c64a4b4cdba7bec8e1626bc258b91e041e4`
CRC32	`7F98F648`
ssdeep	`1536:Jpt+TtlEaMAGD6I24uey6tpCCst3o3EX8df688Qry50Mty87hh38HDvOUmdh7c8E:4TtlEaMqy0AvfVrCL1vZknLVC50H3`
Yara	hide_executable_file - Hide executable file PowerShell_Script_Include_2_Zero - PowerShell Script Include [Zero] PowerShell_Script_MZ_Zero - PowerShell Script MZ [Zero]

chrome.exe "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" C:\Users\test22\AppData\Local\Temp\atom.xml
3028
- chrome.exe "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\test22\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\test22\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\test22\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=86.0.4240.111 --initial-client-data=0xb0,0xb4,0xb8,0x84,0xbc,0x7fef3406e00,0x7fef3406e10,0x7fef3406e20
  944

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
164.124.101.2	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (19 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent March 29, 2023, 9:50 a.m.			0	0
IsDebuggerPresent March 29, 2023, 9:50 a.m.			0	0
IsDebuggerPresent March 29, 2023, 9:50 a.m.			0	0
IsDebuggerPresent March 29, 2023, 9:50 a.m.			0	0
IsDebuggerPresent March 29, 2023, 9:50 a.m.			0	0
IsDebuggerPresent March 29, 2023, 9:50 a.m.			0	0
IsDebuggerPresent March 29, 2023, 9:50 a.m.			0	0
IsDebuggerPresent March 29, 2023, 9:50 a.m.			0	0
IsDebuggerPresent March 29, 2023, 9:50 a.m.			0	0
IsDebuggerPresent March 29, 2023, 9:50 a.m.			0	0
IsDebuggerPresent March 29, 2023, 9:50 a.m.			0	0
IsDebuggerPresent March 29, 2023, 9:51 a.m.			0	0
IsDebuggerPresent March 29, 2023, 9:51 a.m.			0	0
IsDebuggerPresent March 29, 2023, 9:51 a.m.			0	0
IsDebuggerPresent March 29, 2023, 9:51 a.m.			0	0
IsDebuggerPresent March 29, 2023, 9:51 a.m.			0	0
IsDebuggerPresent March 29, 2023, 9:50 a.m.			0	0
IsDebuggerPresent March 29, 2023, 9:50 a.m.			0	0
IsDebuggerPresent March 29, 2023, 9:50 a.m.			0	0

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

Tries to locate where the browsers are installed (1 event)

file	C:\Program Files (x86)\Google\Chrome\Application\86.0.4240.111\Locales

One or more processes crashed (1 event)

Time & API	Arguments	Status	Return	Repeated
__exception__ March 29, 2023, 9:51 a.m.	stacktrace: 0xa21e80 0x99000a 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 exception.instruction_r: f0 1d a2 00 00 00 00 00 10 1f a2 00 00 00 00 00 exception.instruction: sbb eax, 0xa2 exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xa21e80 registers.r14: 248573064 registers.r15: 85093424 registers.rcx: 1100 registers.rsi: 17302540 registers.r10: 0 registers.rbx: 248572320 registers.rsp: 248572040 registers.r11: 248575936 registers.r8: 2000388492 registers.r9: 0 registers.rdx: 1300 registers.r12: 248572680 registers.rbp: 248572176 registers.rdi: 85108576 registers.rax: 10027008 registers.r13: 51749296	1	0	0

Allocates read-write-execute memory (usually to unpack itself) (3 events)

Time & API	Arguments	Status
NtProtectVirtualMemory March 29, 2023, 9:50 a.m.	process_identifier: 3028 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefa1b7000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 29, 2023, 9:51 a.m.	process_identifier: 3028 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef69c9000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 29, 2023, 9:50 a.m.	process_identifier: 944 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefa1b7000 process_handle: 0xffffffffffffffff	1

An application raised an exception which may be indicative of an exploit crash (2 events)

Time & API	Arguments	Status	Return	Repeated
Application Crash	Process chrome.exe with pid 3028 crashed
__exception__ March 29, 2023, 9:51 a.m.	stacktrace: 0xa21e80 0x99000a 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 exception.instruction_r: f0 1d a2 00 00 00 00 00 10 1f a2 00 00 00 00 00 exception.instruction: sbb eax, 0xa2 exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xa21e80 registers.r14: 248573064 registers.r15: 85093424 registers.rcx: 1100 registers.rsi: 17302540 registers.r10: 0 registers.rbx: 248572320 registers.rsp: 248572040 registers.r11: 248575936 registers.r8: 2000388492 registers.r9: 0 registers.rdx: 1300 registers.r12: 248572680 registers.rbp: 248572176 registers.rdi: 85108576 registers.rax: 10027008 registers.r13: 51749296	1	0	0

Steals private information from local Internet browsers (20 events)

file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Crashpad
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Crashpad\reports\bcfec263-731d-425a-88c8-e77286079b13.dmp
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-64240EAB-BD4.pma
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\CrashpadMetrics-spare.pma
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\CrashpadMetrics-active.pma
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local State
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\ShaderCache\GPUCache\index
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\BrowserMetrics
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\ShaderCache\GPUCache\data_2
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\ShaderCache\GPUCache
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\First Run
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\CrashpadMetrics.pma
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Crashpad\reports
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Crashpad\metadata
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\ShaderCache\GPUCache\data_0
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\ShaderCache\GPUCache\data_1
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\BrowserMetrics-spare.pma
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\ShaderCache\GPUCache\data_3

File has been identified by 2 AntiVirus engines on VirusTotal as malicious (2 events)

Kaspersky	HEUR:Trojan.PowerShell.Kryptik.gen
AhnLab-V3	Trojan/PowerShell.Agent.SC185668

Terminates another process (2 events)

Time & API	Arguments	Status	Return	Repeated
NtTerminateProcess March 29, 2023, 9:51 a.m.	status_code: 0xc0000005 process_identifier: 3028 process_handle: 0x00000000000000bc		0	0
NtTerminateProcess March 29, 2023, 9:51 a.m.	status_code: 0xc0000005 process_identifier: 3028 process_handle: 0x00000000000000bc	1	0	0

One or more non-whitelisted processes were created (2 events)

parent_process	chrome.exe				martian_process	"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\test22\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\test22\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\test22\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=86.0.4240.111 --initial-client-data=0xb0,0xb4,0xb8,0x84,0xbc,0x7fef3406e00,0x7fef3406e10,0x7fef3406e20
parent_process	chrome.exe				martian_process	"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=984,3375334487714666926,12179509446429117539,131072 --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=1052 /prefetch:2

Resumed a suspended thread in a remote process potentially indicative of process injection (21 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 944 resumed a thread in remote process 3028
NtResumeThread March 29, 2023, 9:51 a.m.	thread_handle: 0x000000000000014c suspend_count: 2 process_identifier: 3028	1	0	0
NtResumeThread March 29, 2023, 9:51 a.m.	thread_handle: 0x000000000000014c suspend_count: 2 process_identifier: 3028	1	0	0
NtResumeThread March 29, 2023, 9:51 a.m.	thread_handle: 0x000000000000014c suspend_count: 2 process_identifier: 3028	1	0	0
NtResumeThread March 29, 2023, 9:51 a.m.	thread_handle: 0x000000000000014c suspend_count: 2 process_identifier: 3028	1	0	0
NtResumeThread March 29, 2023, 9:51 a.m.	thread_handle: 0x000000000000014c suspend_count: 2 process_identifier: 3028	1	0	0
NtResumeThread March 29, 2023, 9:51 a.m.	thread_handle: 0x000000000000014c suspend_count: 2 process_identifier: 3028	1	0	0
NtResumeThread March 29, 2023, 9:51 a.m.	thread_handle: 0x000000000000014c suspend_count: 2 process_identifier: 3028	1	0	0
NtResumeThread March 29, 2023, 9:51 a.m.	thread_handle: 0x000000000000014c suspend_count: 2 process_identifier: 3028	1	0	0
NtResumeThread March 29, 2023, 9:51 a.m.	thread_handle: 0x000000000000014c suspend_count: 2 process_identifier: 3028	1	0	0
NtResumeThread March 29, 2023, 9:51 a.m.	thread_handle: 0x000000000000014c suspend_count: 2 process_identifier: 3028	1	0	0
NtResumeThread March 29, 2023, 9:51 a.m.	thread_handle: 0x000000000000014c suspend_count: 2 process_identifier: 3028	1	0	0
NtResumeThread March 29, 2023, 9:51 a.m.	thread_handle: 0x000000000000014c suspend_count: 2 process_identifier: 3028	1	0	0
NtResumeThread March 29, 2023, 9:51 a.m.	thread_handle: 0x000000000000014c suspend_count: 2 process_identifier: 3028	1	0	0
NtResumeThread March 29, 2023, 9:51 a.m.	thread_handle: 0x000000000000014c suspend_count: 2 process_identifier: 3028	1	0	0
NtResumeThread March 29, 2023, 9:51 a.m.	thread_handle: 0x000000000000014c suspend_count: 2 process_identifier: 3028	1	0	0
NtResumeThread March 29, 2023, 9:51 a.m.	thread_handle: 0x000000000000014c suspend_count: 2 process_identifier: 3028	1	0	0
NtResumeThread March 29, 2023, 9:51 a.m.	thread_handle: 0x000000000000014c suspend_count: 2 process_identifier: 3028	1	0	0
NtResumeThread March 29, 2023, 9:51 a.m.	thread_handle: 0x000000000000014c suspend_count: 2 process_identifier: 3028	1	0	0
NtResumeThread March 29, 2023, 9:51 a.m.	thread_handle: 0x000000000000014c suspend_count: 2 process_identifier: 3028	1	0	0
NtResumeThread March 29, 2023, 9:51 a.m.	thread_handle: 0x000000000000014c suspend_count: 2 process_identifier: 3028	1	0	0

atom.xml

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All