Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	July 14, 2023, 7:31 a.m.	July 14, 2023, 7:43 a.m.

Size	13.0KB
Type	PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
MD5	`2e29ca797a270d08c074968bd8c42649`
SHA256	`241074924c7b51be32a2bd658a84deab2bcd30a4bc48d8a71e92123c941887ba`
CRC32	`A1C14169`
ssdeep	`192:W8tagmRO023mvFTaFs/vNgQeV8U2N1rv8slbtkTBEqMeSo7wQb7PdQZiSB0mtpt/:W8tHm80CyvNgQWAUCQy+7tC28D/`
Yara	UPX_Zero - UPX packed file IsPE64 - (no description) PE_Header_Zero - PE File Signature

HHH1.exe "C:\Users\test22\AppData\Local\Temp\HHH1.exe"
1884
- CasPol.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
  2564

Name	Response	Post-Analysis Lookup
kyliansuperm92139124.shop	A 172.67.183.88 A 104.21.18.206	172.67.183.88

IP Address	Status	Action
164.124.101.2	Active	Moloch
172.67.183.88	Active	Moloch
5.42.65.67	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.103:49162 -> 172.67.183.88:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined

Suricata TLS

Flow	Issuer	Subject	Fingerprint
TLSv1 192.168.56.103:49162 172.67.183.88:443	C=US, O=Google Trust Services LLC, CN=GTS CA 1P5	CN=kyliansuperm92139124.shop	5d:12:dd:20:a0:65:30:8a:69:86:14:a3:f1:fa:b8:aa:9e:5d:b8:35

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent July 14, 2023, 7:23 a.m.			0	0
IsDebuggerPresent July 14, 2023, 7:23 a.m.			0	0

Uses Windows APIs to generate a cryptographic key (6 events)

Time & API	Arguments	Status	Return
CryptExportKey July 14, 2023, 7:24 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000004f6830 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 14, 2023, 7:24 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000004f6d70 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 14, 2023, 7:24 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000004f6d70 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 14, 2023, 7:24 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001bedda00 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 14, 2023, 7:24 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001bedda00 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 14, 2023, 7:24 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001bedda00 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx July 14, 2023, 7:23 a.m.		1	1	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

HTTP traffic contains suspicious features which may be indicative of malware related traffic (1 event)

suspicious_features

GET method with no useragent header

suspicious_request

GET https://kyliansuperm92139124.shop/customer/1117

Performs some HTTP requests (1 event)

request

GET https://kyliansuperm92139124.shop/customer/1117

Allocates read-write-execute memory (usually to unpack itself) (50 out of 101 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory July 14, 2023, 7:23 a.m.	process_identifier: 1884 region_size: 983040 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000780000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 14, 2023, 7:23 a.m.	process_identifier: 1884 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000007f0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 14, 2023, 7:23 a.m.	process_identifier: 1884 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35f1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 14, 2023, 7:23 a.m.	process_identifier: 1884 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3c8b000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 14, 2023, 7:23 a.m.	process_identifier: 1884 region_size: 1114112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000870000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 14, 2023, 7:23 a.m.	process_identifier: 1884 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000900000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 14, 2023, 7:23 a.m.	process_identifier: 1884 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35f2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 14, 2023, 7:23 a.m.	process_identifier: 1884 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35f2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 14, 2023, 7:23 a.m.	process_identifier: 1884 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35f2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 14, 2023, 7:23 a.m.	process_identifier: 1884 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35f2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 14, 2023, 7:23 a.m.	process_identifier: 1884 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35f2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 14, 2023, 7:23 a.m.	process_identifier: 1884 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35f2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 14, 2023, 7:23 a.m.	process_identifier: 1884 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35f2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 14, 2023, 7:23 a.m.	process_identifier: 1884 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35f2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 14, 2023, 7:23 a.m.	process_identifier: 1884 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35f2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 14, 2023, 7:23 a.m.	process_identifier: 1884 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35f2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 14, 2023, 7:23 a.m.	process_identifier: 1884 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35f2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 14, 2023, 7:23 a.m.	process_identifier: 1884 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35f4000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 14, 2023, 7:23 a.m.	process_identifier: 1884 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35f4000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 14, 2023, 7:23 a.m.	process_identifier: 1884 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35f4000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 14, 2023, 7:23 a.m.	process_identifier: 1884 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35f4000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 14, 2023, 7:23 a.m.	process_identifier: 1884 region_size: 655360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 14, 2023, 7:23 a.m.	process_identifier: 1884 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 14, 2023, 7:23 a.m.	process_identifier: 1884 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 14, 2023, 7:23 a.m.	process_identifier: 1884 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 14, 2023, 7:23 a.m.	process_identifier: 1884 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 14, 2023, 7:23 a.m.	process_identifier: 1884 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 14, 2023, 7:23 a.m.	process_identifier: 1884 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93e3a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 14, 2023, 7:23 a.m.	process_identifier: 1884 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93eec000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 14, 2023, 7:23 a.m.	process_identifier: 1884 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93f16000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 14, 2023, 7:23 a.m.	process_identifier: 1884 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93ef0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 14, 2023, 7:23 a.m.	process_identifier: 1884 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93e4c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 14, 2023, 7:23 a.m.	process_identifier: 1884 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93f60000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 14, 2023, 7:23 a.m.	process_identifier: 1884 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93e3c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 14, 2023, 7:23 a.m.	process_identifier: 1884 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93e5b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 14, 2023, 7:23 a.m.	process_identifier: 1884 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93f61000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 14, 2023, 7:23 a.m.	process_identifier: 1884 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93e8c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 14, 2023, 7:23 a.m.	process_identifier: 1884 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93e5d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 14, 2023, 7:23 a.m.	process_identifier: 1884 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93e4a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 14, 2023, 7:23 a.m.	process_identifier: 1884 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93e3b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 14, 2023, 7:23 a.m.	process_identifier: 1884 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93e32000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 14, 2023, 7:23 a.m.	process_identifier: 1884 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93fa0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 14, 2023, 7:23 a.m.	process_identifier: 1884 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93e8d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 14, 2023, 7:23 a.m.	process_identifier: 1884 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93fa1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 14, 2023, 7:23 a.m.	process_identifier: 1884 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93e4b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 14, 2023, 7:23 a.m.	process_identifier: 1884 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93fb0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 14, 2023, 7:24 a.m.	process_identifier: 1884 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93fb1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 14, 2023, 7:24 a.m.	process_identifier: 1884 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93fb2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 14, 2023, 7:24 a.m.	process_identifier: 1884 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93fb3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 14, 2023, 7:24 a.m.	process_identifier: 1884 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93fb4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses July 14, 2023, 7:23 a.m.	flags: 15 family: 0		111	0

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 event)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW July 14, 2023, 7:24 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Potentially malicious URLs were found in the process memory dump (1 event)

url	http://www.microsoft.com/exporting

Yara rule detected in process memory (8 events)

description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep

One or more of the buffers contains an embedded PE file (3 events)

buffer	Buffer with sha1: 76952648041784ea318cc2c8fe151bbed113ab7b
buffer	Buffer with sha1: c7561df6626b648f8e696c43857281438e3a0d73
buffer	Buffer with sha1: 5c7e4790c26ed2304d086dea7bb4b7785eddc40e

Communicates with host for which no DNS query was performed (1 event)

host

5.42.65.67

Allocates execute permission to another process indicative of possible code injection (1 event)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory July 14, 2023, 7:24 a.m.	process_identifier: 2564 region_size: 212992 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000000000005a0	1	0	0

Created a service where a service was also not started (1 event)

Time & API	Arguments	Status	Return	Repeated
CreateServiceA July 14, 2023, 7:24 a.m.	service_start_name: start_type: 3 password: display_name: Zemana filepath: C:\Zemana.sys service_name: Zemana filepath_r: C:\Zemana.sys desired_access: 983551 service_handle: 0x000000001bef79a0 error_control: 0 service_type: 1 service_manager_handle: 0x000000001bef75e0	1	468679072	0

Attempts to create or modify system certificates (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F81F111D0E5AB58D396F7BF525577FD30FDC95AA\Blob

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1884 resumed a thread in remote process 2564
NtResumeThread July 14, 2023, 7:24 a.m.	thread_handle: 0x0000000000000248 suspend_count: 1 process_identifier: 2564	1	0	0

File has been identified by 23 AntiVirus engines on VirusTotal as malicious (23 events)

Elastic	malicious (high confidence)
Malwarebytes	Generic.Malware/Suspicious
Sangfor	Trojan.Win64.Agent.V4ea
VirIT	Trojan.Win64.MSIL_Heur.A
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win64/Agent_AGen.AMQ
Cynet	Malicious (score: 99)
Kaspersky	UDS:DangerousObject.Multi.Generic
Avast	Win64:PWSX-gen [Trj]
DrWeb	Trojan.InjectNET.59
McAfee-GW-Edition	Artemis!Trojan
SentinelOne	Static AI - Suspicious PE
Webroot	W32.Trojan.Gen
Microsoft	Trojan:Win32/Casdet!rfn
ZoneAlarm	UDS:DangerousObject.Multi.Generic
Google	Detected
Acronis	suspicious
McAfee	Artemis!2E29CA797A27
TrendMicro-HouseCall	TROJ_GEN.R014H0DGD23
Ikarus	Trojan-Downloader.MSIL.Agent
AVG	Win64:PWSX-gen [Trj]
DeepInstinct	MALICIOUS
CrowdStrike	win/malicious_confidence_100% (W)

Executed a process and injected code into it, probably while unpacking (50 out of 75 events)

Time & API	Arguments	Status	Return
NtResumeThread July 14, 2023, 7:23 a.m.	thread_handle: 0x00000000000000c4 suspend_count: 1 process_identifier: 1884	1	0
NtResumeThread July 14, 2023, 7:23 a.m.	thread_handle: 0x0000000000000138 suspend_count: 1 process_identifier: 1884	1	0
NtResumeThread July 14, 2023, 7:23 a.m.	thread_handle: 0x0000000000000140 suspend_count: 1 process_identifier: 1884	1	0
NtResumeThread July 14, 2023, 7:23 a.m.	thread_handle: 0x0000000000000358 suspend_count: 1 process_identifier: 1884	1	0
NtResumeThread July 14, 2023, 7:24 a.m.	thread_handle: 0x0000000000000224 suspend_count: 1 process_identifier: 1884	1	0
NtResumeThread July 14, 2023, 7:24 a.m.	thread_handle: 0x000000000000037c suspend_count: 1 process_identifier: 1884	1	0
NtGetContextThread July 14, 2023, 7:24 a.m.	thread_handle: 0x00000000000000cc	1	0
NtGetContextThread July 14, 2023, 7:24 a.m.	thread_handle: 0x00000000000000cc	1	0
NtResumeThread July 14, 2023, 7:24 a.m.	thread_handle: 0x00000000000000cc suspend_count: 1 process_identifier: 1884	1	0
NtGetContextThread July 14, 2023, 7:24 a.m.	thread_handle: 0x00000000000000cc	1	0
NtGetContextThread July 14, 2023, 7:24 a.m.	thread_handle: 0x00000000000000cc	1	0
NtResumeThread July 14, 2023, 7:24 a.m.	thread_handle: 0x00000000000000cc suspend_count: 1 process_identifier: 1884	1	0
NtGetContextThread July 14, 2023, 7:24 a.m.	thread_handle: 0x00000000000000cc	1	0
NtGetContextThread July 14, 2023, 7:24 a.m.	thread_handle: 0x00000000000000cc	1	0
NtResumeThread July 14, 2023, 7:24 a.m.	thread_handle: 0x00000000000000cc suspend_count: 1 process_identifier: 1884	1	0
NtGetContextThread July 14, 2023, 7:24 a.m.	thread_handle: 0x00000000000000cc	1	0
NtGetContextThread July 14, 2023, 7:24 a.m.	thread_handle: 0x00000000000000cc	1	0
NtResumeThread July 14, 2023, 7:24 a.m.	thread_handle: 0x00000000000000cc suspend_count: 1 process_identifier: 1884	1	0
NtGetContextThread July 14, 2023, 7:24 a.m.	thread_handle: 0x000000000000037c	1	0
NtResumeThread July 14, 2023, 7:24 a.m.	thread_handle: 0x000000000000037c suspend_count: 1 process_identifier: 1884	1	0
CreateProcessInternalW July 14, 2023, 7:24 a.m.	thread_identifier: 2568 thread_handle: 0x0000000000000248 process_identifier: 2564 current_directory: filepath: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe track: 1 command_line: filepath_r: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000000000005a0	1	1
NtAllocateVirtualMemory July 14, 2023, 7:24 a.m.	process_identifier: 2564 region_size: 212992 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000000000005a0	1	0
NtGetContextThread July 14, 2023, 7:24 a.m.	thread_handle: 0x00000000000000cc	1	0
NtGetContextThread July 14, 2023, 7:24 a.m.	thread_handle: 0x00000000000000cc	1	0
NtResumeThread July 14, 2023, 7:24 a.m.	thread_handle: 0x00000000000000cc suspend_count: 1 process_identifier: 1884	1	0
NtResumeThread July 14, 2023, 7:24 a.m.	thread_handle: 0x0000000000000248 suspend_count: 1 process_identifier: 2564	1	0
NtGetContextThread July 14, 2023, 7:24 a.m.	thread_handle: 0x000000000000037c	1	0
NtGetContextThread July 14, 2023, 7:24 a.m.	thread_handle: 0x000000000000037c	1	0
NtResumeThread July 14, 2023, 7:24 a.m.	thread_handle: 0x000000000000037c suspend_count: 1 process_identifier: 1884	1	0
NtGetContextThread July 14, 2023, 7:24 a.m.	thread_handle: 0x000000000000037c	1	0
NtGetContextThread July 14, 2023, 7:24 a.m.	thread_handle: 0x000000000000037c	1	0
NtResumeThread July 14, 2023, 7:24 a.m.	thread_handle: 0x000000000000037c suspend_count: 1 process_identifier: 1884	1	0
NtGetContextThread July 14, 2023, 7:24 a.m.	thread_handle: 0x000000000000037c	1	0
NtGetContextThread July 14, 2023, 7:24 a.m.	thread_handle: 0x000000000000037c	1	0
NtResumeThread July 14, 2023, 7:24 a.m.	thread_handle: 0x000000000000037c suspend_count: 1 process_identifier: 1884	1	0
NtGetContextThread July 14, 2023, 7:24 a.m.	thread_handle: 0x000000000000037c	1	0
NtGetContextThread July 14, 2023, 7:24 a.m.	thread_handle: 0x000000000000037c	1	0
NtResumeThread July 14, 2023, 7:24 a.m.	thread_handle: 0x000000000000037c suspend_count: 1 process_identifier: 1884	1	0
NtGetContextThread July 14, 2023, 7:24 a.m.	thread_handle: 0x000000000000037c	1	0
NtGetContextThread July 14, 2023, 7:24 a.m.	thread_handle: 0x000000000000037c	1	0
NtResumeThread July 14, 2023, 7:24 a.m.	thread_handle: 0x000000000000037c suspend_count: 1 process_identifier: 1884	1	0
NtGetContextThread July 14, 2023, 7:24 a.m.	thread_handle: 0x000000000000037c	1	0
NtGetContextThread July 14, 2023, 7:24 a.m.	thread_handle: 0x000000000000037c	1	0
NtResumeThread July 14, 2023, 7:24 a.m.	thread_handle: 0x000000000000037c suspend_count: 1 process_identifier: 1884	1	0
NtGetContextThread July 14, 2023, 7:24 a.m.	thread_handle: 0x000000000000037c	1	0
NtGetContextThread July 14, 2023, 7:24 a.m.	thread_handle: 0x000000000000037c	1	0
NtResumeThread July 14, 2023, 7:24 a.m.	thread_handle: 0x000000000000037c suspend_count: 1 process_identifier: 1884	1	0
NtGetContextThread July 14, 2023, 7:24 a.m.	thread_handle: 0x000000000000037c	1	0
NtGetContextThread July 14, 2023, 7:24 a.m.	thread_handle: 0x000000000000037c	1	0
NtResumeThread July 14, 2023, 7:24 a.m.	thread_handle: 0x000000000000037c suspend_count: 1 process_identifier: 1884	1	0

HHH1.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All