Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	July 12, 2023, 5:24 p.m.	July 12, 2023, 5:27 p.m.

Size	13.0KB
Type	PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
MD5	`6f665047f3ccce8c93bdd5eead1318de`
SHA256	`4a4f33afe3086aa1962d92412fc2166c5e6b565087bbe20cc411dfc0e9ded6a0`
CRC32	`52E49225`
ssdeep	`192:e05nsnX+MyUY2NV28bBGnV87xKh8OuAU1OizJRRk1FShS7:HxsntyUZNVRtGocHuAUrzJUShS7`
Yara	UPX_Zero - UPX packed file IsPE64 - (no description) PE_Header_Zero - PE File Signature

HHH1.exe "C:\Users\test22\AppData\Local\Temp\HHH1.exe"
1540
- jsc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe"
  3064

Name	Response	Post-Analysis Lookup
kyliansuperm92139124.shop	A 104.21.18.206 A 172.67.183.88	104.21.18.206

IP Address	Status	Action
104.21.18.206	Active	Moloch
164.124.101.2	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.103:49162 -> 104.21.18.206:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined

Suricata TLS

Flow	Issuer	Subject	Fingerprint
TLSv1 192.168.56.103:49162 104.21.18.206:443	C=US, O=Google Trust Services LLC, CN=GTS CA 1P5	CN=kyliansuperm92139124.shop	5d:12:dd:20:a0:65:30:8a:69:86:14:a3:f1:fa:b8:aa:9e:5d:b8:35

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent July 12, 2023, 5:24 p.m.			0	0
IsDebuggerPresent July 12, 2023, 5:24 p.m.			0	0

Uses Windows APIs to generate a cryptographic key (6 events)

Time & API	Arguments	Status	Return
CryptExportKey July 12, 2023, 5:24 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000004656e0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 12, 2023, 5:24 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000000465750 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 12, 2023, 5:24 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000000465750 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 12, 2023, 5:25 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000000465d70 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 12, 2023, 5:25 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000004661d0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 12, 2023, 5:25 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000004661d0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx July 12, 2023, 5:24 p.m.		1	1	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

HTTP traffic contains suspicious features which may be indicative of malware related traffic (1 event)

suspicious_features

GET method with no useragent header

suspicious_request

GET https://kyliansuperm92139124.shop/customer/978

Performs some HTTP requests (1 event)

request

GET https://kyliansuperm92139124.shop/customer/978

Allocates read-write-execute memory (usually to unpack itself) (50 out of 99 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory July 12, 2023, 5:24 p.m.	process_identifier: 1540 region_size: 1441792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000006e0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 12, 2023, 5:24 p.m.	process_identifier: 1540 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000007c0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 12, 2023, 5:24 p.m.	process_identifier: 1540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35f1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 12, 2023, 5:24 p.m.	process_identifier: 1540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3c8b000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 12, 2023, 5:24 p.m.	process_identifier: 1540 region_size: 2031616 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002090000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 12, 2023, 5:24 p.m.	process_identifier: 1540 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002200000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 12, 2023, 5:24 p.m.	process_identifier: 1540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35f2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 12, 2023, 5:24 p.m.	process_identifier: 1540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35f2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 12, 2023, 5:24 p.m.	process_identifier: 1540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35f2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 12, 2023, 5:24 p.m.	process_identifier: 1540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35f2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 12, 2023, 5:24 p.m.	process_identifier: 1540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35f2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 12, 2023, 5:24 p.m.	process_identifier: 1540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35f2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 12, 2023, 5:24 p.m.	process_identifier: 1540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35f2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 12, 2023, 5:24 p.m.	process_identifier: 1540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35f2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 12, 2023, 5:24 p.m.	process_identifier: 1540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35f2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 12, 2023, 5:24 p.m.	process_identifier: 1540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35f2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 12, 2023, 5:24 p.m.	process_identifier: 1540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35f2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 12, 2023, 5:24 p.m.	process_identifier: 1540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35f4000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 12, 2023, 5:24 p.m.	process_identifier: 1540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35f4000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 12, 2023, 5:24 p.m.	process_identifier: 1540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35f4000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 12, 2023, 5:24 p.m.	process_identifier: 1540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35f4000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 12, 2023, 5:24 p.m.	process_identifier: 1540 region_size: 655360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 12, 2023, 5:24 p.m.	process_identifier: 1540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 12, 2023, 5:24 p.m.	process_identifier: 1540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 12, 2023, 5:24 p.m.	process_identifier: 1540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 12, 2023, 5:24 p.m.	process_identifier: 1540 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 12, 2023, 5:24 p.m.	process_identifier: 1540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 12, 2023, 5:24 p.m.	process_identifier: 1540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93e3a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 12, 2023, 5:24 p.m.	process_identifier: 1540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93eec000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 12, 2023, 5:24 p.m.	process_identifier: 1540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93f16000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 12, 2023, 5:24 p.m.	process_identifier: 1540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93ef0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 12, 2023, 5:24 p.m.	process_identifier: 1540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93e4c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 12, 2023, 5:24 p.m.	process_identifier: 1540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93f60000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 12, 2023, 5:24 p.m.	process_identifier: 1540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93e3c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 12, 2023, 5:24 p.m.	process_identifier: 1540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93f61000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 12, 2023, 5:24 p.m.	process_identifier: 1540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93e5b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 12, 2023, 5:24 p.m.	process_identifier: 1540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93e8c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 12, 2023, 5:24 p.m.	process_identifier: 1540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93e5d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 12, 2023, 5:24 p.m.	process_identifier: 1540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93e4a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 12, 2023, 5:24 p.m.	process_identifier: 1540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93e3b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 12, 2023, 5:24 p.m.	process_identifier: 1540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93e32000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 12, 2023, 5:24 p.m.	process_identifier: 1540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93fa0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 12, 2023, 5:25 p.m.	process_identifier: 1540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93e8d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 12, 2023, 5:25 p.m.	process_identifier: 1540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93fa1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 12, 2023, 5:25 p.m.	process_identifier: 1540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93e4b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 12, 2023, 5:25 p.m.	process_identifier: 1540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93fb0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 12, 2023, 5:25 p.m.	process_identifier: 1540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93fb1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 12, 2023, 5:25 p.m.	process_identifier: 1540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93fb2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 12, 2023, 5:25 p.m.	process_identifier: 1540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93fb3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 12, 2023, 5:25 p.m.	process_identifier: 1540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93fb4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses July 12, 2023, 5:25 p.m.	flags: 15 family: 0		111	0

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 event)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW July 12, 2023, 5:25 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Potentially malicious URLs were found in the process memory dump (1 event)

url	http://www.microsoft.com/exporting

Yara rule detected in process memory (8 events)

description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep

Terminates another process (24 events)

Time & API	Arguments	Status
NtTerminateProcess July 12, 2023, 5:25 p.m.	status_code: 0xffffffff process_identifier: 2632 process_handle: 0x00000000000005ac
NtTerminateProcess July 12, 2023, 5:25 p.m.	status_code: 0xffffffff process_identifier: 2632 process_handle: 0x00000000000005ac	1
NtTerminateProcess July 12, 2023, 5:25 p.m.	status_code: 0xffffffff process_identifier: 2668 process_handle: 0x00000000000005b8
NtTerminateProcess July 12, 2023, 5:25 p.m.	status_code: 0xffffffff process_identifier: 2668 process_handle: 0x00000000000005b8	1
NtTerminateProcess July 12, 2023, 5:25 p.m.	status_code: 0xffffffff process_identifier: 2704 process_handle: 0x00000000000005c0
NtTerminateProcess July 12, 2023, 5:25 p.m.	status_code: 0xffffffff process_identifier: 2704 process_handle: 0x00000000000005c0	1
NtTerminateProcess July 12, 2023, 5:25 p.m.	status_code: 0xffffffff process_identifier: 2740 process_handle: 0x00000000000005c8
NtTerminateProcess July 12, 2023, 5:25 p.m.	status_code: 0xffffffff process_identifier: 2740 process_handle: 0x00000000000005c8	1
NtTerminateProcess July 12, 2023, 5:25 p.m.	status_code: 0xffffffff process_identifier: 2776 process_handle: 0x00000000000005d0
NtTerminateProcess July 12, 2023, 5:25 p.m.	status_code: 0xffffffff process_identifier: 2776 process_handle: 0x00000000000005d0	1
NtTerminateProcess July 12, 2023, 5:25 p.m.	status_code: 0xffffffff process_identifier: 2812 process_handle: 0x00000000000005d8
NtTerminateProcess July 12, 2023, 5:25 p.m.	status_code: 0xffffffff process_identifier: 2812 process_handle: 0x00000000000005d8	1
NtTerminateProcess July 12, 2023, 5:25 p.m.	status_code: 0xffffffff process_identifier: 2848 process_handle: 0x00000000000005e0
NtTerminateProcess July 12, 2023, 5:25 p.m.	status_code: 0xffffffff process_identifier: 2848 process_handle: 0x00000000000005e0	1
NtTerminateProcess July 12, 2023, 5:25 p.m.	status_code: 0xffffffff process_identifier: 2884 process_handle: 0x00000000000005e8
NtTerminateProcess July 12, 2023, 5:25 p.m.	status_code: 0xffffffff process_identifier: 2884 process_handle: 0x00000000000005e8	1
NtTerminateProcess July 12, 2023, 5:25 p.m.	status_code: 0xffffffff process_identifier: 2920 process_handle: 0x00000000000005f0
NtTerminateProcess July 12, 2023, 5:25 p.m.	status_code: 0xffffffff process_identifier: 2920 process_handle: 0x00000000000005f0	1
NtTerminateProcess July 12, 2023, 5:25 p.m.	status_code: 0xffffffff process_identifier: 2956 process_handle: 0x00000000000005f8
NtTerminateProcess July 12, 2023, 5:25 p.m.	status_code: 0xffffffff process_identifier: 2956 process_handle: 0x00000000000005f8	1
NtTerminateProcess July 12, 2023, 5:25 p.m.	status_code: 0xffffffff process_identifier: 2992 process_handle: 0x0000000000000600
NtTerminateProcess July 12, 2023, 5:25 p.m.	status_code: 0xffffffff process_identifier: 2992 process_handle: 0x0000000000000600	1
NtTerminateProcess July 12, 2023, 5:25 p.m.	status_code: 0xffffffff process_identifier: 3028 process_handle: 0x0000000000000608
NtTerminateProcess July 12, 2023, 5:25 p.m.	status_code: 0xffffffff process_identifier: 3028 process_handle: 0x0000000000000608	1

Uses Windows utilities for basic Windows functionality (2 events)

cmdline	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe
cmdline	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe

One or more of the buffers contains an embedded PE file (3 events)

buffer	Buffer with sha1: 76952648041784ea318cc2c8fe151bbed113ab7b
buffer	Buffer with sha1: 5c7e4790c26ed2304d086dea7bb4b7785eddc40e
buffer	Buffer with sha1: e7cdf77cbb31d8b53742c9a1144a56fbbed0110b

Allocates execute permission to another process indicative of possible code injection (1 event)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory July 12, 2023, 5:25 p.m.	process_identifier: 3064 region_size: 212992 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000000000000604	1	0	0

Created a service where a service was also not started (1 event)

Time & API	Arguments	Status	Return	Repeated
CreateServiceA July 12, 2023, 5:25 p.m.	service_start_name: start_type: 3 password: display_name: Zemana filepath: C:\Zemana.sys service_name: Zemana filepath_r: C:\Zemana.sys desired_access: 983551 service_handle: 0x000000001bc15fb0 error_control: 0 service_type: 1 service_manager_handle: 0x000000001bc15bf0	1	465657776	0

Attempts to create or modify system certificates (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F81F111D0E5AB58D396F7BF525577FD30FDC95AA\Blob

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1540 resumed a thread in remote process 3064
NtResumeThread July 12, 2023, 5:25 p.m.	thread_handle: 0x0000000000000608 suspend_count: 1 process_identifier: 3064	1	0	0

File has been identified by 24 AntiVirus engines on VirusTotal as malicious (24 events)

McAfee	Artemis!6F665047F3CC
Sangfor	Downloader.Msil.Agent.Vm3g
Alibaba	Trojan:MSIL/Generic.b9f378fc
VirIT	Trojan.Win64.MSIL_Heur.A
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of MSIL/TrojanDownloader.Agent_AGen.AVN
Cynet	Malicious (score: 99)
Kaspersky	UDS:DangerousObject.Multi.Generic
Avast	Win64:TrojanX-gen [Trj]
Tencent	Msil.Trojan-Downloader.Ader.Jqil
F-Secure	Trojan.TR/Agent_AGen.nvgpd
DrWeb	Trojan.PackedNET.2167
McAfee-GW-Edition	Artemis!Trojan
Ikarus	Trojan-Downloader.MSIL.Agent
Webroot	W32.Trojan.Gen
Microsoft	Trojan:Win32/Casdet!rfn
ZoneAlarm	UDS:DangerousObject.Multi.Generic
Google	Detected
Rising	Malware.Obfus/MSIL@AI.80 (RDM.MSIL2:Y0GSgves7jYmBdJL98sudg)
SentinelOne	Static AI - Malicious PE
Fortinet	MSIL/AgentMnt.AE6D!tr.dldr
AVG	Win64:TrojanX-gen [Trj]
DeepInstinct	MALICIOUS
CrowdStrike	win/malicious_confidence_100% (W)

Executed a process and injected code into it, probably while unpacking (46 events)

Time & API	Arguments	Status	Return
NtResumeThread July 12, 2023, 5:24 p.m.	thread_handle: 0x00000000000000c4 suspend_count: 1 process_identifier: 1540	1	0
NtResumeThread July 12, 2023, 5:24 p.m.	thread_handle: 0x0000000000000134 suspend_count: 1 process_identifier: 1540	1	0
NtResumeThread July 12, 2023, 5:24 p.m.	thread_handle: 0x0000000000000174 suspend_count: 1 process_identifier: 1540	1	0
NtResumeThread July 12, 2023, 5:25 p.m.	thread_handle: 0x0000000000000358 suspend_count: 1 process_identifier: 1540	1	0
NtResumeThread July 12, 2023, 5:25 p.m.	thread_handle: 0x0000000000000220 suspend_count: 1 process_identifier: 1540	1	0
NtResumeThread July 12, 2023, 5:25 p.m.	thread_handle: 0x0000000000000340 suspend_count: 1 process_identifier: 1540	1	0
NtGetContextThread July 12, 2023, 5:25 p.m.	thread_handle: 0x00000000000000c8	1	0
NtResumeThread July 12, 2023, 5:25 p.m.	thread_handle: 0x00000000000000c8 suspend_count: 1 process_identifier: 1540	1	0
NtGetContextThread July 12, 2023, 5:25 p.m.	thread_handle: 0x0000000000000340	1	0
NtGetContextThread July 12, 2023, 5:25 p.m.	thread_handle: 0x0000000000000340	1	0
NtResumeThread July 12, 2023, 5:25 p.m.	thread_handle: 0x0000000000000340 suspend_count: 1 process_identifier: 1540	1	0
NtGetContextThread July 12, 2023, 5:25 p.m.	thread_handle: 0x0000000000000340	1	0
NtResumeThread July 12, 2023, 5:25 p.m.	thread_handle: 0x0000000000000340 suspend_count: 1 process_identifier: 1540	1	0
NtGetContextThread July 12, 2023, 5:25 p.m.	thread_handle: 0x00000000000000c8	1	0
NtGetContextThread July 12, 2023, 5:25 p.m.	thread_handle: 0x00000000000000c8	1	0
NtResumeThread July 12, 2023, 5:25 p.m.	thread_handle: 0x00000000000000c8 suspend_count: 1 process_identifier: 1540	1	0
NtGetContextThread July 12, 2023, 5:25 p.m.	thread_handle: 0x00000000000000c8	1	0
NtGetContextThread July 12, 2023, 5:25 p.m.	thread_handle: 0x00000000000000c8	1	0
NtResumeThread July 12, 2023, 5:25 p.m.	thread_handle: 0x00000000000000c8 suspend_count: 1 process_identifier: 1540	1	0
NtGetContextThread July 12, 2023, 5:25 p.m.	thread_handle: 0x0000000000000340	1	0
NtGetContextThread July 12, 2023, 5:25 p.m.	thread_handle: 0x0000000000000340	1	0
NtResumeThread July 12, 2023, 5:25 p.m.	thread_handle: 0x0000000000000340 suspend_count: 1 process_identifier: 1540	1	0
NtGetContextThread July 12, 2023, 5:25 p.m.	thread_handle: 0x00000000000000c8	1	0
NtGetContextThread July 12, 2023, 5:25 p.m.	thread_handle: 0x00000000000000c8	1	0
NtResumeThread July 12, 2023, 5:25 p.m.	thread_handle: 0x00000000000000c8 suspend_count: 1 process_identifier: 1540	1	0
NtGetContextThread July 12, 2023, 5:25 p.m.	thread_handle: 0x00000000000000c8	1	0
NtGetContextThread July 12, 2023, 5:25 p.m.	thread_handle: 0x00000000000000c8	1	0
NtResumeThread July 12, 2023, 5:25 p.m.	thread_handle: 0x00000000000000c8 suspend_count: 1 process_identifier: 1540	1	0
CreateProcessInternalW July 12, 2023, 5:25 p.m.	thread_identifier: 2636 thread_handle: 0x000000000000023c process_identifier: 2632 current_directory: filepath: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\CasPol.exe track: 1 command_line: filepath_r: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\CasPol.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000000000005a4	1	1
CreateProcessInternalW July 12, 2023, 5:25 p.m.	thread_identifier: 2672 thread_handle: 0x00000000000005ac process_identifier: 2668 current_directory: filepath: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe track: 1 command_line: filepath_r: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000000000005b4	1	1
CreateProcessInternalW July 12, 2023, 5:25 p.m.	thread_identifier: 2708 thread_handle: 0x00000000000005b8 process_identifier: 2704 current_directory: filepath: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regsql.exe track: 1 command_line: filepath_r: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regsql.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000000000005b0	1	1
CreateProcessInternalW July 12, 2023, 5:25 p.m.	thread_identifier: 2744 thread_handle: 0x00000000000005c0 process_identifier: 2740 current_directory: filepath: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe track: 1 command_line: filepath_r: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000000000005bc	1	1
CreateProcessInternalW July 12, 2023, 5:25 p.m.	thread_identifier: 2780 thread_handle: 0x00000000000005c8 process_identifier: 2776 current_directory: filepath: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe track: 1 command_line: filepath_r: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000000000005c4	1	1
CreateProcessInternalW July 12, 2023, 5:25 p.m.	thread_identifier: 2816 thread_handle: 0x00000000000005d0 process_identifier: 2812 current_directory: filepath: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ComSvcConfig.exe track: 1 command_line: filepath_r: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ComSvcConfig.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000000000005cc	1	1
CreateProcessInternalW July 12, 2023, 5:25 p.m.	thread_identifier: 2852 thread_handle: 0x00000000000005d8 process_identifier: 2848 current_directory: filepath: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe track: 1 command_line: filepath_r: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000000000005d4	1	1
CreateProcessInternalW July 12, 2023, 5:25 p.m.	thread_identifier: 2888 thread_handle: 0x00000000000005e0 process_identifier: 2884 current_directory: filepath: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WsatConfig.exe track: 1 command_line: filepath_r: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WsatConfig.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000000000005dc	1	1
CreateProcessInternalW July 12, 2023, 5:25 p.m.	thread_identifier: 2924 thread_handle: 0x00000000000005e8 process_identifier: 2920 current_directory: filepath: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe track: 1 command_line: filepath_r: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000000000005e4	1	1
CreateProcessInternalW July 12, 2023, 5:25 p.m.	thread_identifier: 2960 thread_handle: 0x00000000000005f0 process_identifier: 2956 current_directory: filepath: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe track: 1 command_line: filepath_r: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000000000005ec	1	1
NtGetContextThread July 12, 2023, 5:25 p.m.	thread_handle: 0x0000000000000340	1	0
NtGetContextThread July 12, 2023, 5:25 p.m.	thread_handle: 0x0000000000000340	1	0
NtResumeThread July 12, 2023, 5:25 p.m.	thread_handle: 0x0000000000000340 suspend_count: 1 process_identifier: 1540	1	0
CreateProcessInternalW July 12, 2023, 5:25 p.m.	thread_identifier: 2996 thread_handle: 0x00000000000005f8 process_identifier: 2992 current_directory: filepath: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Workflow.Compiler.exe track: 1 command_line: filepath_r: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Workflow.Compiler.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000000000005f4	1	1
CreateProcessInternalW July 12, 2023, 5:25 p.m.	thread_identifier: 3032 thread_handle: 0x0000000000000600 process_identifier: 3028 current_directory: filepath: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\DataSvcUtil.exe track: 1 command_line: filepath_r: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\DataSvcUtil.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000000000005fc	1	1
CreateProcessInternalW July 12, 2023, 5:25 p.m.	thread_identifier: 3068 thread_handle: 0x0000000000000608 process_identifier: 3064 current_directory: filepath: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe track: 1 command_line: filepath_r: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x0000000000000604	1	1
NtAllocateVirtualMemory July 12, 2023, 5:25 p.m.	process_identifier: 3064 region_size: 212992 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000000000000604	1	0
NtResumeThread July 12, 2023, 5:25 p.m.	thread_handle: 0x0000000000000608 suspend_count: 1 process_identifier: 3064	1	0

HHH1.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All