Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	April 20, 2023, 6:44 p.m.	April 20, 2023, 6:46 p.m.

Size	5.1MB
Type	PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
MD5	`295d168271a2ac16dd17c7b5113876e9`
SHA256	`8d98fe5bd21e49af44f2623573708994b548b6e6c019736544474dd81569014e`
CRC32	`0E7169CF`
ssdeep	`98304:RfSvh+qyzjND3SJDUPU2FhdM61ZbdjND3SJDUPU2FhdM61ZbdByA:R6vhxsNjwJebM611djNjwJebM611dcA`
PDB Path	C:\Users\oakley\source\repos\WebBrowser-master\obj\x86\Debug\Web Browser (HW-RGM-2012).pdb
Yara	IsPE64 - (no description) Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT PE_Header_Zero - PE File Signature Malicious_Library_Zero - Malicious_Library

haddd.exe "C:\Users\test22\AppData\Local\Temp\haddd.exe"
2564
- Setup.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\Setup.exe"
  2700

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent April 20, 2023, 6:37 p.m.			0	0
IsDebuggerPresent April 20, 2023, 6:37 p.m.			0	0

Uses Windows APIs to generate a cryptographic key (6 events)

Time & API	Arguments	Status	Return
CryptExportKey April 20, 2023, 6:37 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000003e8220 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey April 20, 2023, 6:37 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000000042b710 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey April 20, 2023, 6:37 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000000042b710 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey April 20, 2023, 6:37 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000000042cf10 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey April 20, 2023, 6:37 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000000042cf10 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey April 20, 2023, 6:37 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000000042cf10 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

This executable has a PDB path (1 event)

pdb_path

C:\Users\oakley\source\repos\WebBrowser-master\obj\x86\Debug\Web Browser (HW-RGM-2012).pdb

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx April 20, 2023, 6:37 p.m.		1	1	0

One or more processes crashed (1 event)

Time & API	Arguments	Status	Return	Repeated
__exception__ April 20, 2023, 6:45 p.m.	stacktrace: 0x42db72 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x4f06c registers.esp: 3668692 registers.edi: 3141592654 registers.eax: 3668720 registers.ebp: 3668728 registers.edx: 4381549 registers.ebx: 4294901760 registers.esi: 0 registers.ecx: 0	1	0	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (50 out of 95 events)

Time & API	Arguments	Status	Return
NtAllocateVirtualMemory April 20, 2023, 6:37 p.m.	process_identifier: 2564 region_size: 720896 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000670000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1	0
NtAllocateVirtualMemory April 20, 2023, 6:37 p.m.	process_identifier: 2564 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000006a0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0
NtProtectVirtualMemory April 20, 2023, 6:37 p.m.	process_identifier: 2564 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3a21000 process_handle: 0xffffffffffffffff	1	0
NtProtectVirtualMemory April 20, 2023, 6:37 p.m.	process_identifier: 2564 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef40bb000 process_handle: 0xffffffffffffffff	1	0
NtAllocateVirtualMemory April 20, 2023, 6:37 p.m.	process_identifier: 2564 region_size: 2555904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002600000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1	0
NtAllocateVirtualMemory April 20, 2023, 6:37 p.m.	process_identifier: 2564 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000027f0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0
NtProtectVirtualMemory April 20, 2023, 6:37 p.m.	process_identifier: 2564 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3a22000 process_handle: 0xffffffffffffffff	1	0
NtProtectVirtualMemory April 20, 2023, 6:37 p.m.	process_identifier: 2564 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3a22000 process_handle: 0xffffffffffffffff	1	0
NtProtectVirtualMemory April 20, 2023, 6:37 p.m.	process_identifier: 2564 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3a22000 process_handle: 0xffffffffffffffff	1	0
NtProtectVirtualMemory April 20, 2023, 6:37 p.m.	process_identifier: 2564 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3a22000 process_handle: 0xffffffffffffffff	1	0
NtProtectVirtualMemory April 20, 2023, 6:37 p.m.	process_identifier: 2564 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3a22000 process_handle: 0xffffffffffffffff	1	0
NtProtectVirtualMemory April 20, 2023, 6:37 p.m.	process_identifier: 2564 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3a22000 process_handle: 0xffffffffffffffff	1	0
NtProtectVirtualMemory April 20, 2023, 6:37 p.m.	process_identifier: 2564 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3a22000 process_handle: 0xffffffffffffffff	1	0
NtProtectVirtualMemory April 20, 2023, 6:37 p.m.	process_identifier: 2564 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3a22000 process_handle: 0xffffffffffffffff	1	0
NtProtectVirtualMemory April 20, 2023, 6:37 p.m.	process_identifier: 2564 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3a22000 process_handle: 0xffffffffffffffff	1	0
NtProtectVirtualMemory April 20, 2023, 6:37 p.m.	process_identifier: 2564 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3a22000 process_handle: 0xffffffffffffffff	1	0
NtProtectVirtualMemory April 20, 2023, 6:37 p.m.	process_identifier: 2564 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3a22000 process_handle: 0xffffffffffffffff	1	0
NtProtectVirtualMemory April 20, 2023, 6:37 p.m.	process_identifier: 2564 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3a24000 process_handle: 0xffffffffffffffff	1	0
NtProtectVirtualMemory April 20, 2023, 6:37 p.m.	process_identifier: 2564 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3a24000 process_handle: 0xffffffffffffffff	1	0
NtProtectVirtualMemory April 20, 2023, 6:37 p.m.	process_identifier: 2564 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3a24000 process_handle: 0xffffffffffffffff	1	0
NtProtectVirtualMemory April 20, 2023, 6:37 p.m.	process_identifier: 2564 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3a24000 process_handle: 0xffffffffffffffff	1	0
NtAllocateVirtualMemory April 20, 2023, 6:37 p.m.	process_identifier: 2564 region_size: 655360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1	0
NtAllocateVirtualMemory April 20, 2023, 6:37 p.m.	process_identifier: 2564 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0
NtAllocateVirtualMemory April 20, 2023, 6:37 p.m.	process_identifier: 2564 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0
NtAllocateVirtualMemory April 20, 2023, 6:37 p.m.	process_identifier: 2564 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0
NtAllocateVirtualMemory April 20, 2023, 6:37 p.m.	process_identifier: 2564 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1	0
NtAllocateVirtualMemory April 20, 2023, 6:37 p.m.	process_identifier: 2564 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0
NtAllocateVirtualMemory April 20, 2023, 6:37 p.m.	process_identifier: 2564 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe942aa000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0
NtAllocateVirtualMemory April 20, 2023, 6:37 p.m.	process_identifier: 2564 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe9435c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0
NtAllocateVirtualMemory April 20, 2023, 6:37 p.m.	process_identifier: 2564 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe94386000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0
NtAllocateVirtualMemory April 20, 2023, 6:37 p.m.	process_identifier: 2564 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe94360000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0
NtAllocateVirtualMemory April 20, 2023, 6:37 p.m.	process_identifier: 2564 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe942bc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0
NtAllocateVirtualMemory April 20, 2023, 6:37 p.m.	process_identifier: 2564 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe943d0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0
NtAllocateVirtualMemory April 20, 2023, 6:37 p.m.	process_identifier: 2564 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe942ac000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0
NtAllocateVirtualMemory April 20, 2023, 6:37 p.m.	process_identifier: 2564 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe942ba000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0
NtAllocateVirtualMemory April 20, 2023, 6:37 p.m.	process_identifier: 2564 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe942cb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0
NtAllocateVirtualMemory April 20, 2023, 6:37 p.m.	process_identifier: 2564 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe942fc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0
NtAllocateVirtualMemory April 20, 2023, 6:37 p.m.	process_identifier: 2564 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe942cd000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0
NtAllocateVirtualMemory April 20, 2023, 6:37 p.m.	process_identifier: 2564 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe942a2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0
NtAllocateVirtualMemory April 20, 2023, 6:37 p.m.	process_identifier: 2564 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe942bb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0
NtAllocateVirtualMemory April 20, 2023, 6:37 p.m.	process_identifier: 2564 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe94410000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0
NtAllocateVirtualMemory April 20, 2023, 6:37 p.m.	process_identifier: 2564 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe94411000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0
NtAllocateVirtualMemory April 20, 2023, 6:37 p.m.	process_identifier: 2564 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe942ab000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0
NtAllocateVirtualMemory April 20, 2023, 6:37 p.m.	process_identifier: 2564 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe94412000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0
NtAllocateVirtualMemory April 20, 2023, 6:37 p.m.	process_identifier: 2564 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe943d1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0
NtProtectVirtualMemory April 20, 2023, 6:37 p.m.	process_identifier: 2564 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 6 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000000000 process_handle: 0xffffffffffffffff		-1073741800
NtProtectVirtualMemory April 20, 2023, 6:37 p.m.	process_identifier: 2564 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 2 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000000000007b process_handle: 0xffffffffffffffff		-1073741800
NtAllocateVirtualMemory April 20, 2023, 6:37 p.m.	process_identifier: 2564 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe943d2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0
NtAllocateVirtualMemory April 20, 2023, 6:37 p.m.	process_identifier: 2564 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe942fd000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0
NtAllocateVirtualMemory April 20, 2023, 6:37 p.m.	process_identifier: 2564 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe94430000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x00517200', u'virtual_address': u'0x00002000', u'entropy': 7.939617866551956, u'name': u'.text', u'virtual_size': u'0x0051700c'}

entropy

7.93961786655

description

A section with a high entropy has been found

entropy

0.999520613615

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (3 events)

Time & API	Arguments	Status	Return
LookupPrivilegeValueW April 20, 2023, 6:38 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW April 20, 2023, 6:38 p.m.	system_name: privilege_name: SeLoadDriverPrivilege	1	1
LookupPrivilegeValueW April 20, 2023, 6:38 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1

Potentially malicious URLs were found in the process memory dump (2 events)

url	https://t.me/tg_duckworld
url	https://steamcommunity.com/profiles/76561199497218285

Yara rule detected in process memory (10 events)

description	Code injection with CreateRemoteThread in a remote process	rule	Code_injection
description	Win32 PWS Loki	rule	Win32_PWS_Loki_Zero
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep

Terminates another process (18 events)

Time & API	Arguments	Status
NtTerminateProcess April 20, 2023, 6:38 p.m.	status_code: 0xffffffff process_identifier: 3056 process_handle: 0x00000000000002c4
NtTerminateProcess April 20, 2023, 6:38 p.m.	status_code: 0xffffffff process_identifier: 3056 process_handle: 0x00000000000002c4	1
NtTerminateProcess April 20, 2023, 6:38 p.m.	status_code: 0xffffffff process_identifier: 1152 process_handle: 0x00000000000002b8
NtTerminateProcess April 20, 2023, 6:38 p.m.	status_code: 0xffffffff process_identifier: 1152 process_handle: 0x00000000000002b8	1
NtTerminateProcess April 20, 2023, 6:38 p.m.	status_code: 0xffffffff process_identifier: 148 process_handle: 0x0000000000000224
NtTerminateProcess April 20, 2023, 6:38 p.m.	status_code: 0xffffffff process_identifier: 148 process_handle: 0x0000000000000224	1
NtTerminateProcess April 20, 2023, 6:38 p.m.	status_code: 0xffffffff process_identifier: 2248 process_handle: 0x0000000000000218
NtTerminateProcess April 20, 2023, 6:38 p.m.	status_code: 0xffffffff process_identifier: 2248 process_handle: 0x0000000000000218	1
NtTerminateProcess April 20, 2023, 6:38 p.m.	status_code: 0xffffffff process_identifier: 2324 process_handle: 0x0000000000000304
NtTerminateProcess April 20, 2023, 6:38 p.m.	status_code: 0xffffffff process_identifier: 2324 process_handle: 0x0000000000000304	1
NtTerminateProcess April 20, 2023, 6:38 p.m.	status_code: 0xffffffff process_identifier: 2472 process_handle: 0x0000000000000308
NtTerminateProcess April 20, 2023, 6:38 p.m.	status_code: 0xffffffff process_identifier: 2472 process_handle: 0x0000000000000308	1
NtTerminateProcess April 20, 2023, 6:38 p.m.	status_code: 0xffffffff process_identifier: 2516 process_handle: 0x00000000000002a8
NtTerminateProcess April 20, 2023, 6:38 p.m.	status_code: 0xffffffff process_identifier: 2516 process_handle: 0x00000000000002a8	1
NtTerminateProcess April 20, 2023, 6:38 p.m.	status_code: 0xffffffff process_identifier: 2600 process_handle: 0x00000000000002a0
NtTerminateProcess April 20, 2023, 6:38 p.m.	status_code: 0xffffffff process_identifier: 2600 process_handle: 0x00000000000002a0	1
NtTerminateProcess April 20, 2023, 6:38 p.m.	status_code: 0xffffffff process_identifier: 2368 process_handle: 0x00000000000002d0
NtTerminateProcess April 20, 2023, 6:38 p.m.	status_code: 0xffffffff process_identifier: 2368 process_handle: 0x00000000000002d0	1

One or more of the buffers contains an embedded PE file (1 event)

buffer

Buffer with sha1: f068f3f1e272b6d9d635bccf3224fd5c038981ee

Allocates execute permission to another process indicative of possible code injection (2 events)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory April 20, 2023, 6:38 p.m.	process_identifier: 3056 region_size: 442368 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000000000002f4		-1073741800	0
NtAllocateVirtualMemory April 20, 2023, 6:38 p.m.	process_identifier: 2700 region_size: 442368 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000000000002b0	1	0	0

Installs itself for autorun at Windows startup (1 event)

reg_key

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\TaskKill\ImagePath

reg_value

\??\C:\Users\test22\AppData\Local\Temp\Иисус.sys

Loads a driver (1 event)

Time & API	Arguments	Status	Return	Repeated
NtLoadDriver April 20, 2023, 6:38 p.m.	driver_service_name: \Registry\Machine\System\CurrentControlSet\Services\TaskKill		-1073740760	0

Manipulates memory of a non-child process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2564 manipulating memory of non-child process 3056
NtAllocateVirtualMemory April 20, 2023, 6:38 p.m.	process_identifier: 3056 region_size: 442368 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000000000002f4		-1073741800	0

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2564 resumed a thread in remote process 2700
NtResumeThread April 20, 2023, 6:38 p.m.	thread_handle: 0x00000000000002d0 suspend_count: 1 process_identifier: 2700	1	0	0

File has been identified by 20 AntiVirus engines on VirusTotal as malicious (20 events)

Elastic	malicious (moderate confidence)
Cylance	unsafe
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of MSIL/GenKryptik.GIZG
Paloalto	generic.ml
Kaspersky	HEUR:Trojan.MSIL.Bsymem.gen
Avast	Win64:PWSX-gen [Trj]
F-Secure	Trojan.TR/AD.BadNetLdr.ngeno
McAfee-GW-Edition	Artemis!Trojan
Sophos	Mal/Generic-S
GData	Win32.Trojan-Stealer.Arkei.E9NXY8
Avira	TR/AD.BadNetLdr.ngeno
Gridinsoft	Trojan.Win64.Downloader.sa
ZoneAlarm	HEUR:Trojan.MSIL.Bsymem.gen
Microsoft	Trojan:MSIL/Vidar.C!MTB
McAfee	Artemis!295D168271A2
Panda	Trj/Chgt.AD
Fortinet	MSIL/GenKryptik.GIZG!tr
AVG	Win64:PWSX-gen [Trj]
DeepInstinct	MALICIOUS

Stops Windows services (1 event)

service

TaskKill (regkey HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\TaskKill\Start)

Executed a process and injected code into it, probably while unpacking (23 events)

Time & API	Arguments	Status	Return
NtResumeThread April 20, 2023, 6:37 p.m.	thread_handle: 0x00000000000000c4 suspend_count: 1 process_identifier: 2564	1	0
NtResumeThread April 20, 2023, 6:37 p.m.	thread_handle: 0x0000000000000138 suspend_count: 1 process_identifier: 2564	1	0
NtResumeThread April 20, 2023, 6:37 p.m.	thread_handle: 0x0000000000000180 suspend_count: 1 process_identifier: 2564	1	0
NtResumeThread April 20, 2023, 6:37 p.m.	thread_handle: 0x0000000000000228 suspend_count: 1 process_identifier: 2564	1	0
NtResumeThread April 20, 2023, 6:37 p.m.	thread_handle: 0x0000000000000240 suspend_count: 1 process_identifier: 2564	1	0
NtResumeThread April 20, 2023, 6:38 p.m.	thread_handle: 0x00000000000002b0 suspend_count: 1 process_identifier: 2564	1	0
NtResumeThread April 20, 2023, 6:38 p.m.	thread_handle: 0x00000000000002c8 suspend_count: 1 process_identifier: 2564	1	0
NtGetContextThread April 20, 2023, 6:38 p.m.	thread_handle: 0x0000000000000138	1	0
NtGetContextThread April 20, 2023, 6:38 p.m.	thread_handle: 0x0000000000000138	1	0
NtResumeThread April 20, 2023, 6:38 p.m.	thread_handle: 0x0000000000000138 suspend_count: 1 process_identifier: 2564	1	0
CreateProcessInternalW April 20, 2023, 6:38 p.m.	thread_identifier: 3060 thread_handle: 0x00000000000002f8 process_identifier: 3056 current_directory: filepath: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\KOR\Setup.exe track: 1 command_line: filepath_r: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\KOR\Setup.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000000000002f4	1	1
NtAllocateVirtualMemory April 20, 2023, 6:38 p.m.	process_identifier: 3056 region_size: 442368 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000000000002f4		-1073741800
CreateProcessInternalW April 20, 2023, 6:38 p.m.	thread_identifier: 940 thread_handle: 0x00000000000002c4 process_identifier: 1152 current_directory: filepath: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regiis.exe track: 1 command_line: filepath_r: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regiis.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000000000002c0	1	1
CreateProcessInternalW April 20, 2023, 6:38 p.m.	thread_identifier: 2184 thread_handle: 0x00000000000002b8 process_identifier: 148 current_directory: filepath: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe track: 1 command_line: filepath_r: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000000000002bc	1	1
CreateProcessInternalW April 20, 2023, 6:38 p.m.	thread_identifier: 2240 thread_handle: 0x0000000000000224 process_identifier: 2248 current_directory: filepath: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ilasm.exe track: 1 command_line: filepath_r: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ilasm.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x0000000000000220	1	1
CreateProcessInternalW April 20, 2023, 6:38 p.m.	thread_identifier: 2376 thread_handle: 0x0000000000000218 process_identifier: 2324 current_directory: filepath: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regsql.exe track: 1 command_line: filepath_r: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regsql.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x000000000000021c	1	1
CreateProcessInternalW April 20, 2023, 6:38 p.m.	thread_identifier: 2464 thread_handle: 0x0000000000000304 process_identifier: 2472 current_directory: filepath: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe track: 1 command_line: filepath_r: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x0000000000000228	1	1
CreateProcessInternalW April 20, 2023, 6:38 p.m.	thread_identifier: 2504 thread_handle: 0x0000000000000308 process_identifier: 2516 current_directory: filepath: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe track: 1 command_line: filepath_r: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000000000002fc	1	1
CreateProcessInternalW April 20, 2023, 6:38 p.m.	thread_identifier: 2596 thread_handle: 0x00000000000002a8 process_identifier: 2600 current_directory: filepath: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe track: 1 command_line: filepath_r: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000000000002ac	1	1
CreateProcessInternalW April 20, 2023, 6:38 p.m.	thread_identifier: 2364 thread_handle: 0x00000000000002a0 process_identifier: 2368 current_directory: filepath: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe track: 1 command_line: filepath_r: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000000000002a4	1	1
CreateProcessInternalW April 20, 2023, 6:38 p.m.	thread_identifier: 2704 thread_handle: 0x00000000000002d0 process_identifier: 2700 current_directory: filepath: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\Setup.exe track: 1 command_line: filepath_r: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\Setup.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000000000002b0	1	1
NtAllocateVirtualMemory April 20, 2023, 6:38 p.m.	process_identifier: 2700 region_size: 442368 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000000000002b0	1	0
NtResumeThread April 20, 2023, 6:38 p.m.	thread_handle: 0x00000000000002d0 suspend_count: 1 process_identifier: 2700	1	0

haddd.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All