Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	July 16, 2023, 11:05 a.m.	July 16, 2023, 11:11 a.m.

Size	2.3MB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`0644a6d1a7994445f05f3d4e20e82140`
SHA256	`cc0f70f4c9b185dacf984c2f7f721d11ad293a7e2b654fbf26180e7ebfe54f81`
CRC32	`70A89E5B`
ssdeep	`49152:gyNiUjN6oC52Fn8ItuWod1SPoDnIlu4VauAfZGdJETV5y1Ou:jQoC5IvozIcHuAfmGV5y1N`
Yara	anti_vm_detect - Possibly employs anti-virtualization techniques Is_DotNET_EXE - (no description) PE_Header_Zero - PE File Signature themida_packer - themida packer IsPE32 - (no description) Generic_Malware_Zero - Generic Malware

file.exe "C:\Users\test22\AppData\Local\Temp\file.exe"
2540

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
147.135.165.22	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent July 16, 2023, 11:05 a.m.			0	0
IsDebuggerPresent July 16, 2023, 11:05 a.m.			0	0

Uses Windows APIs to generate a cryptographic key (14 events)

Time & API	Arguments	Status	Return
CryptExportKey July 16, 2023, 11:05 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00bc86f0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 16, 2023, 11:05 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00bc86f0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 16, 2023, 11:05 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00bc86f0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 16, 2023, 11:05 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00bc86f0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 16, 2023, 11:05 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00bc8770 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 16, 2023, 11:05 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00bc8770 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 16, 2023, 11:05 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00bc8670 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 16, 2023, 11:05 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00bc8670 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 16, 2023, 11:05 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00bc8670 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 16, 2023, 11:05 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00bc8670 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 16, 2023, 11:05 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00bc8670 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 16, 2023, 11:05 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00bc86f0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 16, 2023, 11:05 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00bc86f0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 16, 2023, 11:05 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00bc88f0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx July 16, 2023, 11:05 a.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (4 events)

section
section	.imports
section	.themida
section	.boot

One or more processes crashed (3 events)

Time & API	Arguments	Status
__exception__ July 16, 2023, 11:05 a.m.	stacktrace: file+0x42533a @ 0x55533a file+0x3fc711 @ 0x52c711 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc e9 11 08 8d 8a 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008e exception.offset: 46887 exception.address: 0x7597b727 registers.esp: 11271336 registers.edi: 1482752 registers.eax: 11271336 registers.ebp: 11271416 registers.edx: 2130566132 registers.ebx: 32 registers.esi: 1995994155 registers.ecx: 2062942208	1
__exception__ July 16, 2023, 11:05 a.m.	stacktrace: exception.instruction_r: ed e9 ec 74 01 00 7d d8 ab e5 86 7d 8f 0b 73 ab exception.symbol: file+0x46b1c9 exception.instruction: in eax, dx exception.module: file.exe exception.exception_code: 0xc0000096 exception.offset: 4633033 exception.address: 0x59b1c9 registers.esp: 11271456 registers.edi: 3100364 registers.eax: 1750617430 registers.ebp: 1482752 registers.edx: 2130532438 registers.ebx: 0 registers.esi: 11976968 registers.ecx: 20	1
__exception__ July 16, 2023, 11:05 a.m.	stacktrace: exception.instruction_r: ed e9 19 68 09 00 c3 e9 b5 13 05 00 a2 a4 1c 85 exception.symbol: file+0x3ea61b exception.instruction: in eax, dx exception.module: file.exe exception.exception_code: 0xc0000096 exception.offset: 4105755 exception.address: 0x51a61b registers.esp: 11271456 registers.edi: 3100364 registers.eax: 1447909480 registers.ebp: 1482752 registers.edx: 22104 registers.ebx: 2256917605 registers.esi: 11976968 registers.ecx: 10	1

Allocates read-write-execute memory (usually to unpack itself) (50 out of 132 events)

Time & API	Arguments	Status
NtProtectVirtualMemory July 16, 2023, 11:05 a.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x755c4000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 16, 2023, 11:05 a.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75981000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 16, 2023, 11:05 a.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x755dc000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 16, 2023, 11:05 a.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75981000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 16, 2023, 11:05 a.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x755c3000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 16, 2023, 11:05 a.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75981000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 16, 2023, 11:05 a.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x755c1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 16, 2023, 11:05 a.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75981000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 16, 2023, 11:05 a.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x755c1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 16, 2023, 11:05 a.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7597b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 16, 2023, 11:05 a.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x755ec000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 16, 2023, 11:05 a.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7597b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 16, 2023, 11:05 a.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x755ed000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 16, 2023, 11:05 a.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7597c000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 16, 2023, 11:05 a.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x755c3000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 16, 2023, 11:05 a.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7597c000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 16, 2023, 11:05 a.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7563f000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 16, 2023, 11:05 a.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x755c4000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 16, 2023, 11:05 a.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75980000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 16, 2023, 11:05 a.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x755c1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 16, 2023, 11:05 a.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75981000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 16, 2023, 11:05 a.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x755c3000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 16, 2023, 11:05 a.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7598b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 16, 2023, 11:05 a.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x755c5000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 16, 2023, 11:05 a.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7598b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 16, 2023, 11:05 a.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x755c1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 16, 2023, 11:05 a.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7597d000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 16, 2023, 11:05 a.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x755c5000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 16, 2023, 11:05 a.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7597b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 16, 2023, 11:05 a.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x755c4000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 16, 2023, 11:05 a.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75981000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 16, 2023, 11:05 a.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x755c4000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 16, 2023, 11:05 a.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x755c4000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 16, 2023, 11:05 a.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75981000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 16, 2023, 11:05 a.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x755c4000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 16, 2023, 11:05 a.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x755c4000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 16, 2023, 11:05 a.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7597d000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 16, 2023, 11:05 a.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x755c1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 16, 2023, 11:05 a.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7597d000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 16, 2023, 11:05 a.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x755e3000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 16, 2023, 11:05 a.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x755e8000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 16, 2023, 11:05 a.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7563e000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 16, 2023, 11:05 a.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x755e5000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 16, 2023, 11:05 a.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x755c1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 16, 2023, 11:05 a.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7597b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 16, 2023, 11:05 a.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x755c3000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 16, 2023, 11:05 a.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75981000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 16, 2023, 11:05 a.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x755c1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 16, 2023, 11:05 a.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7597d000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 16, 2023, 11:05 a.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x755c5000 process_handle: 0xffffffff	1

A process attempted to delay the analysis task. (1 event)

description

file.exe tried to sleep 195 seconds, actually delayed analysis time by 195 seconds

The binary likely contains encrypted or compressed data indicative of a packer (4 events)

section

{u'size_of_data': u'0x0000ec36', u'virtual_address': u'0x00002000', u'entropy': 7.9776745986244775, u'name': u' ', u'virtual_size': u'0x00022000'}

entropy

7.97767459862

description

A section with a high entropy has been found

section

{u'size_of_data': u'0x000031a9', u'virtual_address': u'0x00024000', u'entropy': 7.957407475593307, u'name': u' ', u'virtual_size': u'0x0000dcda'}

entropy

7.95740747559

description

A section with a high entropy has been found

section

{u'size_of_data': u'0x00232c24', u'virtual_address': u'0x004b8000', u'entropy': 7.96390383690848, u'name': u'.boot', u'virtual_size': u'0x00232e00'}

entropy

7.96390383691

description

A section with a high entropy has been found

entropy

0.994640447869

description

Overall entropy of this PE file is high

Communicates with host for which no DNS query was performed (1 event)

host

147.135.165.22

Checks for the presence of known windows from debuggers and forensic tools (50 out of 159 events)

Time & API	Arguments	Status	Return	Repeated
FindWindowA July 16, 2023, 11:05 a.m.	class_name: FilemonClass window_name:		0	0
FindWindowA July 16, 2023, 11:05 a.m.	class_name: FilemonClass window_name:		0	0
FindWindowA July 16, 2023, 11:05 a.m.	class_name: File Monitor - Sysinternals: www.sysinternals.com window_name:		0	0
FindWindowA July 16, 2023, 11:05 a.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA July 16, 2023, 11:05 a.m.	class_name: Process Monitor - Sysinternals: www.sysinternals.com window_name:		0	0
FindWindowA July 16, 2023, 11:05 a.m.	class_name: RegmonClass window_name:		0	0
FindWindowA July 16, 2023, 11:05 a.m.	class_name: RegmonClass window_name:		0	0
FindWindowA July 16, 2023, 11:05 a.m.	class_name: Registry Monitor - Sysinternals: www.sysinternals.com window_name:		0	0
FindWindowA July 16, 2023, 11:05 a.m.	class_name: 18467-41 window_name:		0	0
FindWindowA July 16, 2023, 11:05 a.m.	class_name: Regmonclass window_name:		0	0
FindWindowA July 16, 2023, 11:05 a.m.	class_name: Regmonclass window_name:		0	0
FindWindowA July 16, 2023, 11:05 a.m.	class_name: 18467-41 window_name:		0	0
FindWindowA July 16, 2023, 11:05 a.m.	class_name: Filemonclass window_name:		0	0
FindWindowA July 16, 2023, 11:05 a.m.	class_name: Filemonclass window_name:		0	0
FindWindowA July 16, 2023, 11:05 a.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA July 16, 2023, 11:05 a.m.	class_name: Regmonclass window_name:		0	0
FindWindowA July 16, 2023, 11:05 a.m.	class_name: Regmonclass window_name:		0	0
FindWindowA July 16, 2023, 11:05 a.m.	class_name: 18467-41 window_name:		0	0
FindWindowA July 16, 2023, 11:05 a.m.	class_name: Filemonclass window_name:		0	0
FindWindowA July 16, 2023, 11:05 a.m.	class_name: Filemonclass window_name:		0	0
FindWindowA July 16, 2023, 11:05 a.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA July 16, 2023, 11:05 a.m.	class_name: Regmonclass window_name:		0	0
FindWindowA July 16, 2023, 11:05 a.m.	class_name: Regmonclass window_name:		0	0
FindWindowA July 16, 2023, 11:05 a.m.	class_name: 18467-41 window_name:		0	0
FindWindowA July 16, 2023, 11:05 a.m.	class_name: Filemonclass window_name:		0	0
FindWindowA July 16, 2023, 11:05 a.m.	class_name: Filemonclass window_name:		0	0
FindWindowA July 16, 2023, 11:05 a.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA July 16, 2023, 11:05 a.m.	class_name: Regmonclass window_name:		0	0
FindWindowA July 16, 2023, 11:05 a.m.	class_name: Regmonclass window_name:		0	0
FindWindowA July 16, 2023, 11:05 a.m.	class_name: 18467-41 window_name:		0	0
FindWindowA July 16, 2023, 11:05 a.m.	class_name: Filemonclass window_name:		0	0
FindWindowA July 16, 2023, 11:05 a.m.	class_name: Filemonclass window_name:		0	0
FindWindowA July 16, 2023, 11:05 a.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA July 16, 2023, 11:05 a.m.	class_name: Regmonclass window_name:		0	0
FindWindowA July 16, 2023, 11:05 a.m.	class_name: Regmonclass window_name:		0	0
FindWindowA July 16, 2023, 11:05 a.m.	class_name: 18467-41 window_name:		0	0
FindWindowA July 16, 2023, 11:05 a.m.	class_name: Filemonclass window_name:		0	0
FindWindowA July 16, 2023, 11:05 a.m.	class_name: Filemonclass window_name:		0	0
FindWindowA July 16, 2023, 11:05 a.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA July 16, 2023, 11:05 a.m.	class_name: Regmonclass window_name:		0	0
FindWindowA July 16, 2023, 11:05 a.m.	class_name: Regmonclass window_name:		0	0
FindWindowA July 16, 2023, 11:05 a.m.	class_name: 18467-41 window_name:		0	0
FindWindowA July 16, 2023, 11:05 a.m.	class_name: Filemonclass window_name:		0	0
FindWindowA July 16, 2023, 11:05 a.m.	class_name: Filemonclass window_name:		0	0
FindWindowA July 16, 2023, 11:05 a.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA July 16, 2023, 11:05 a.m.	class_name: Regmonclass window_name:		0	0
FindWindowA July 16, 2023, 11:05 a.m.	class_name: Regmonclass window_name:		0	0
FindWindowA July 16, 2023, 11:05 a.m.	class_name: 18467-41 window_name:		0	0
FindWindowA July 16, 2023, 11:05 a.m.	class_name: Filemonclass window_name:		0	0
FindWindowA July 16, 2023, 11:05 a.m.	class_name: Filemonclass window_name:		0	0

Checks the version of Bios, possibly for anti-virtualization (2 events)

registry	HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion
registry	HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion

Detects Virtual Machines through their custom firmware (1 event)

Time & API	Arguments	Status	Return	Repeated
NtQuerySystemInformation July 16, 2023, 11:05 a.m.	information_class: 76 (SystemFirmwareTableInformation)		3221225507	0

Detects VMWare through the in instruction feature (1 event)

Time & API	Arguments	Status	Return	Repeated
__exception__ July 16, 2023, 11:05 a.m.	stacktrace: exception.instruction_r: ed e9 19 68 09 00 c3 e9 b5 13 05 00 a2 a4 1c 85 exception.symbol: file+0x3ea61b exception.instruction: in eax, dx exception.module: file.exe exception.exception_code: 0xc0000096 exception.offset: 4105755 exception.address: 0x51a61b registers.esp: 11271456 registers.edi: 3100364 registers.eax: 1447909480 registers.ebp: 1482752 registers.edx: 22104 registers.ebx: 2256917605 registers.esi: 11976968 registers.ecx: 10	1	0	0

Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) (1 event)

dead_host

147.135.165.22:17748

File has been identified by 39 AntiVirus engines on VirusTotal as malicious (39 events)

Bkav	W32.AIDetectMalware
tehtris	Generic.Malware
MicroWorld-eScan	Trojan.GenericKD.68159906
FireEye	Generic.mg.0644a6d1a7994445
McAfee	Artemis!0644A6D1A799
Malwarebytes	Trojan.MalPack
Sangfor	Suspicious.Win32.Save.a
Cybereason	malicious.d0f124
Cyren	W32/Agent.CGU.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	a variant of Win32/Packed.Themida.HQG
Cynet	Malicious (score: 100)
APEX	Malicious
Kaspersky	VHO:Backdoor.Win32.Agent.gen
BitDefender	Trojan.GenericKD.68159906
Avast	Win32:Evo-gen [Trj]
Sophos	Generic ML PUA (PUA)
VIPRE	Trojan.GenericKD.68159906
McAfee-GW-Edition	BehavesLike.Win32.Generic.vc
Trapmine	malicious.high.ml.score
Emsisoft	Trojan.GenericKD.68159906 (B)
SentinelOne	Static AI - Malicious PE
Microsoft	Trojan:Win32/Sabsik.FL.B!ml
Gridinsoft	Ransom.Win32.STOP.dd!n
Arcabit	Trojan.Generic.D41009A2
ZoneAlarm	VHO:Backdoor.Win32.Agent.gen
GData	Win32.Trojan-Stealer.Cordimik.EPGMI6
Google	Detected
Acronis	suspicious
BitDefenderTheta	Gen:NN.ZexaF.36318.sE0@aq!lIopi
MAX	malware (ai score=84)
Cylance	unsafe
Zoner	Probably Heur.ExeHeaderL
Rising	Trojan.Generic@AI.100 (RDML:C1HgZLZgmkYK+kUBEINO8g)
MaxSecure	Trojan.Malware.300983.susgen
AVG	Win32:Evo-gen [Trj]
DeepInstinct	MALICIOUS
CrowdStrike	win/malicious_confidence_100% (W)

file.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All