Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	July 19, 2023, 3:32 p.m.	July 19, 2023, 3:36 p.m.

Size	428.3KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5	`70462b94519e8f0354cdde7584e536ce`
SHA256	`ad9af6543f3eda2c556ad005fc4f5b3b3b5298f54312d1fda5354534903f55af`
CRC32	`B55095F8`
ssdeep	`12288:/Y3DFejc4eN4rbwpN+Ftb4v3Gi2M/eXhjPC6cJ44MmSFJq:/Y3RwnbwpN6F4/gj1fe13Sq`
Yara	UPX_Zero - UPX packed file NSIS_Installer - Null Soft Installer Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature IsPE32 - (no description)

ChromeSetup.exe "C:\Users\test22\AppData\Local\Temp\ChromeSetup.exe"
1440
- ChromeSetup.exe "C:\Users\test22\AppData\Local\Temp\ChromeSetup.exe"
  1000

Name	Response	Post-Analysis Lookup
us2.smtp.mailhostbox.com	A 208.91.199.224 A 208.91.199.223 A 208.91.199.225 A 208.91.198.143	208.91.199.225
showip.net	A 162.55.60.2	162.55.60.2

IP Address	Status	Action
162.55.60.2	Active	Moloch
164.124.101.2	Active	Moloch
208.91.199.225	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 208.91.199.225:587 -> 192.168.56.103:49169	2260002	SURICATA Applayer Detect protocol only one direction	Generic Protocol Command Decode
TCP 192.168.56.103:49167 -> 162.55.60.2:80	2008987	ET POLICY IP Check Domain (showip in HTTP Host)	Attempted Information Leak

Suricata TLS

No Suricata TLS

Queries for the computername (11 events)

Time & API	Arguments	Status	Return
GetComputerNameW July 19, 2023, 3:32 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 19, 2023, 3:32 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 19, 2023, 3:32 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 19, 2023, 3:32 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 19, 2023, 3:32 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 19, 2023, 3:32 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 19, 2023, 3:32 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 19, 2023, 3:32 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 19, 2023, 3:32 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 19, 2023, 3:32 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 19, 2023, 3:32 p.m.	computer_name: TEST22-PC	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx July 19, 2023, 3:32 p.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

.ndata

One or more processes crashed (50 out of 352 events)

Time & API	Arguments	Status
__exception__ July 19, 2023, 3:32 p.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 1635032 registers.edi: 2900312 registers.eax: 1635032 registers.ebp: 1635112 registers.edx: 0 registers.ebx: 2900312 registers.esi: 2900312 registers.ecx: 2	1
__exception__ July 19, 2023, 3:32 p.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 1633992 registers.edi: 2900312 registers.eax: 1633992 registers.ebp: 1634072 registers.edx: 0 registers.ebx: 2900312 registers.esi: 2900312 registers.ecx: 2	1
__exception__ July 19, 2023, 3:32 p.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 1633992 registers.edi: 2900312 registers.eax: 1633992 registers.ebp: 1634072 registers.edx: 0 registers.ebx: 2900312 registers.esi: 2900312 registers.ecx: 2	1
__exception__ July 19, 2023, 3:32 p.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 1633992 registers.edi: 2900312 registers.eax: 1633992 registers.ebp: 1634072 registers.edx: 0 registers.ebx: 2900312 registers.esi: 2900312 registers.ecx: 2	1
__exception__ July 19, 2023, 3:32 p.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 1633992 registers.edi: 2900312 registers.eax: 1633992 registers.ebp: 1634072 registers.edx: 0 registers.ebx: 2900312 registers.esi: 2900312 registers.ecx: 2	1
__exception__ July 19, 2023, 3:32 p.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 1633916 registers.edi: 2900312 registers.eax: 1633916 registers.ebp: 1633996 registers.edx: 0 registers.ebx: 2900312 registers.esi: 2900312 registers.ecx: 2	1
__exception__ July 19, 2023, 3:32 p.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 1633916 registers.edi: 2900312 registers.eax: 1633916 registers.ebp: 1633996 registers.edx: 0 registers.ebx: 2900312 registers.esi: 2900312 registers.ecx: 2	1
__exception__ July 19, 2023, 3:32 p.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 1634284 registers.edi: 1634560 registers.eax: 1634284 registers.ebp: 1634364 registers.edx: 0 registers.ebx: 2900312 registers.esi: 1634560 registers.ecx: 2	1
__exception__ July 19, 2023, 3:32 p.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 1634284 registers.edi: 1634560 registers.eax: 1634284 registers.ebp: 1634364 registers.edx: 0 registers.ebx: 2900312 registers.esi: 1634560 registers.ecx: 2	1
__exception__ July 19, 2023, 3:32 p.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 1633308 registers.edi: 2900312 registers.eax: 1633308 registers.ebp: 1633388 registers.edx: 0 registers.ebx: 2900312 registers.esi: 2900312 registers.ecx: 2	1
__exception__ July 19, 2023, 3:32 p.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 1633916 registers.edi: 2900312 registers.eax: 1633916 registers.ebp: 1633996 registers.edx: 0 registers.ebx: 2900312 registers.esi: 2900312 registers.ecx: 2	1
__exception__ July 19, 2023, 3:32 p.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 1633916 registers.edi: 2900312 registers.eax: 1633916 registers.ebp: 1633996 registers.edx: 0 registers.ebx: 2900312 registers.esi: 2900312 registers.ecx: 2	1
__exception__ July 19, 2023, 3:32 p.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 1634284 registers.edi: 1634560 registers.eax: 1634284 registers.ebp: 1634364 registers.edx: 0 registers.ebx: 2900312 registers.esi: 1634560 registers.ecx: 2	1
__exception__ July 19, 2023, 3:32 p.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 1634284 registers.edi: 1634560 registers.eax: 1634284 registers.ebp: 1634364 registers.edx: 0 registers.ebx: 2900312 registers.esi: 1634560 registers.ecx: 2	1
__exception__ July 19, 2023, 3:32 p.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 1633308 registers.edi: 2900312 registers.eax: 1633308 registers.ebp: 1633388 registers.edx: 0 registers.ebx: 2900312 registers.esi: 2900312 registers.ecx: 2	1
__exception__ July 19, 2023, 3:32 p.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 1633916 registers.edi: 2900312 registers.eax: 1633916 registers.ebp: 1633996 registers.edx: 0 registers.ebx: 2900312 registers.esi: 2900312 registers.ecx: 2	1
__exception__ July 19, 2023, 3:32 p.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 1633916 registers.edi: 2900312 registers.eax: 1633916 registers.ebp: 1633996 registers.edx: 0 registers.ebx: 2900312 registers.esi: 2900312 registers.ecx: 2	1
__exception__ July 19, 2023, 3:32 p.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 1634284 registers.edi: 1634560 registers.eax: 1634284 registers.ebp: 1634364 registers.edx: 0 registers.ebx: 2900312 registers.esi: 1634560 registers.ecx: 2	1
__exception__ July 19, 2023, 3:32 p.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 1634284 registers.edi: 1634560 registers.eax: 1634284 registers.ebp: 1634364 registers.edx: 0 registers.ebx: 2900312 registers.esi: 1634560 registers.ecx: 2	1
__exception__ July 19, 2023, 3:32 p.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 1633308 registers.edi: 2900312 registers.eax: 1633308 registers.ebp: 1633388 registers.edx: 0 registers.ebx: 2900312 registers.esi: 2900312 registers.ecx: 2	1
__exception__ July 19, 2023, 3:32 p.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 1633916 registers.edi: 2900312 registers.eax: 1633916 registers.ebp: 1633996 registers.edx: 0 registers.ebx: 2900312 registers.esi: 2900312 registers.ecx: 2	1
__exception__ July 19, 2023, 3:32 p.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 1633916 registers.edi: 2900312 registers.eax: 1633916 registers.ebp: 1633996 registers.edx: 0 registers.ebx: 2900312 registers.esi: 2900312 registers.ecx: 2	1
__exception__ July 19, 2023, 3:32 p.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 1635056 registers.edi: 2900312 registers.eax: 1635056 registers.ebp: 1635136 registers.edx: 0 registers.ebx: 2900312 registers.esi: 2900312 registers.ecx: 2	1
__exception__ July 19, 2023, 3:32 p.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 1635056 registers.edi: 2900312 registers.eax: 1635056 registers.ebp: 1635136 registers.edx: 0 registers.ebx: 2900312 registers.esi: 2900312 registers.ecx: 2	1
__exception__ July 19, 2023, 3:32 p.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 1634844 registers.edi: 2900312 registers.eax: 1634844 registers.ebp: 1634924 registers.edx: 0 registers.ebx: 2900312 registers.esi: 2900312 registers.ecx: 2	1
__exception__ July 19, 2023, 3:32 p.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 1634844 registers.edi: 2900312 registers.eax: 1634844 registers.ebp: 1634924 registers.edx: 0 registers.ebx: 2900312 registers.esi: 2900312 registers.ecx: 2	1
__exception__ July 19, 2023, 3:32 p.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 1634844 registers.edi: 2900312 registers.eax: 1634844 registers.ebp: 1634924 registers.edx: 0 registers.ebx: 2900312 registers.esi: 2900312 registers.ecx: 2	1
__exception__ July 19, 2023, 3:32 p.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 1634260 registers.edi: 2900312 registers.eax: 1634260 registers.ebp: 1634340 registers.edx: 0 registers.ebx: 2900312 registers.esi: 2900312 registers.ecx: 2	1
__exception__ July 19, 2023, 3:32 p.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 1634844 registers.edi: 2900312 registers.eax: 1634844 registers.ebp: 1634924 registers.edx: 0 registers.ebx: 2900312 registers.esi: 2900312 registers.ecx: 2	1
__exception__ July 19, 2023, 3:32 p.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 1634844 registers.edi: 2900312 registers.eax: 1634844 registers.ebp: 1634924 registers.edx: 0 registers.ebx: 2900312 registers.esi: 2900312 registers.ecx: 2	1
__exception__ July 19, 2023, 3:32 p.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 1634844 registers.edi: 2900312 registers.eax: 1634844 registers.ebp: 1634924 registers.edx: 0 registers.ebx: 2900312 registers.esi: 2900312 registers.ecx: 2	1
__exception__ July 19, 2023, 3:32 p.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 1634260 registers.edi: 2900312 registers.eax: 1634260 registers.ebp: 1634340 registers.edx: 0 registers.ebx: 2900312 registers.esi: 2900312 registers.ecx: 2	1
__exception__ July 19, 2023, 3:32 p.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 1634844 registers.edi: 2900312 registers.eax: 1634844 registers.ebp: 1634924 registers.edx: 0 registers.ebx: 2900312 registers.esi: 2900312 registers.ecx: 2	1
__exception__ July 19, 2023, 3:32 p.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 1634844 registers.edi: 2900312 registers.eax: 1634844 registers.ebp: 1634924 registers.edx: 0 registers.ebx: 2900312 registers.esi: 2900312 registers.ecx: 2	1
__exception__ July 19, 2023, 3:32 p.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 1634844 registers.edi: 2900312 registers.eax: 1634844 registers.ebp: 1634924 registers.edx: 0 registers.ebx: 2900312 registers.esi: 2900312 registers.ecx: 2	1
__exception__ July 19, 2023, 3:32 p.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 1634260 registers.edi: 2900312 registers.eax: 1634260 registers.ebp: 1634340 registers.edx: 0 registers.ebx: 2900312 registers.esi: 2900312 registers.ecx: 2	1
__exception__ July 19, 2023, 3:32 p.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 1634844 registers.edi: 2900312 registers.eax: 1634844 registers.ebp: 1634924 registers.edx: 0 registers.ebx: 2900312 registers.esi: 2900312 registers.ecx: 2	1
__exception__ July 19, 2023, 3:32 p.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 1634844 registers.edi: 2900312 registers.eax: 1634844 registers.ebp: 1634924 registers.edx: 0 registers.ebx: 2900312 registers.esi: 2900312 registers.ecx: 2	1
__exception__ July 19, 2023, 3:32 p.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 1634844 registers.edi: 2900312 registers.eax: 1634844 registers.ebp: 1634924 registers.edx: 0 registers.ebx: 2900312 registers.esi: 2900312 registers.ecx: 2	1
__exception__ July 19, 2023, 3:32 p.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 1634260 registers.edi: 2900312 registers.eax: 1634260 registers.ebp: 1634340 registers.edx: 0 registers.ebx: 2900312 registers.esi: 2900312 registers.ecx: 2	1
__exception__ July 19, 2023, 3:32 p.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 1634844 registers.edi: 2900312 registers.eax: 1634844 registers.ebp: 1634924 registers.edx: 0 registers.ebx: 2900312 registers.esi: 2900312 registers.ecx: 2	1
__exception__ July 19, 2023, 3:32 p.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 1634844 registers.edi: 2900312 registers.eax: 1634844 registers.ebp: 1634924 registers.edx: 0 registers.ebx: 2900312 registers.esi: 2900312 registers.ecx: 2	1
__exception__ July 19, 2023, 3:32 p.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 1634844 registers.edi: 2900312 registers.eax: 1634844 registers.ebp: 1634924 registers.edx: 0 registers.ebx: 2900312 registers.esi: 2900312 registers.ecx: 2	1
__exception__ July 19, 2023, 3:32 p.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 1634260 registers.edi: 2900312 registers.eax: 1634260 registers.ebp: 1634340 registers.edx: 0 registers.ebx: 2900312 registers.esi: 2900312 registers.ecx: 2	1
__exception__ July 19, 2023, 3:32 p.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 1634844 registers.edi: 2900312 registers.eax: 1634844 registers.ebp: 1634924 registers.edx: 0 registers.ebx: 2900312 registers.esi: 2900312 registers.ecx: 2	1
__exception__ July 19, 2023, 3:32 p.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 1634844 registers.edi: 2900312 registers.eax: 1634844 registers.ebp: 1634924 registers.edx: 0 registers.ebx: 2900312 registers.esi: 2900312 registers.ecx: 2	1
__exception__ July 19, 2023, 3:32 p.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 1634844 registers.edi: 2900312 registers.eax: 1634844 registers.ebp: 1634924 registers.edx: 0 registers.ebx: 2900312 registers.esi: 2900312 registers.ecx: 2	1
__exception__ July 19, 2023, 3:32 p.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 1634260 registers.edi: 2900312 registers.eax: 1634260 registers.ebp: 1634340 registers.edx: 0 registers.ebx: 2900312 registers.esi: 2900312 registers.ecx: 2	1
__exception__ July 19, 2023, 3:32 p.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 1634844 registers.edi: 2900312 registers.eax: 1634844 registers.ebp: 1634924 registers.edx: 0 registers.ebx: 2900312 registers.esi: 2900312 registers.ecx: 2	1
__exception__ July 19, 2023, 3:32 p.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 1634844 registers.edi: 2900312 registers.eax: 1634844 registers.ebp: 1634924 registers.edx: 0 registers.ebx: 2900312 registers.esi: 2900312 registers.ecx: 2	1

Performs some HTTP requests (1 event)

request

GET http://showip.net/

Allocates read-write-execute memory (usually to unpack itself) (2 events)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory July 19, 2023, 3:32 p.m.	process_identifier: 1440 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x741db000 process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory July 19, 2023, 3:32 p.m.	process_identifier: 1440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01e40000 allocation_type: 12289 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1	0	0

Creates executable files on the filesystem (3 events)

file	C:\Users\Public\Libraries\vbsqlite3.dll
file	C:\Users\test22\AppData\Local\Temp\nsgC020.tmp\xhpimil.dll
file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Templates\fryers.exe

Drops an executable to the user AppData folder (2 events)

file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Templates\fryers.exe
file	C:\Users\test22\AppData\Local\Temp\nsgC020.tmp\xhpimil.dll

Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time) (1 event)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory July 19, 2023, 3:32 p.m.	process_identifier: 1000 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 24576 protection: 32 (PAGE_EXECUTE_READ) base_address: 0x00540000 process_handle: 0xffffffff	1	0	0

Makes SMTP requests, possibly sending spam (1 event)

sender

[u'001@efftem.com']

server

208.91.199.225

user

001@efftem.com

receiver

[u'resultlog60@gmail.com']

password

jCXzqcP1 daniel 3116

Attempts to identify installed AV products by installation directory (1 event)

file	C:\Users\test22\AppData\Local\Temp\SandboxieInstall.exe

Installs itself for autorun at Windows startup (1 event)

reg_key

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce\misinclination

reg_value

C:\Users\test22\AppData\Roaming\Microsoft\Windows\Templates\fryers.exe

Harvests credentials from local email clients (5 events)

file	C:\Users\test22\AppData\Local\Thunderbird\Profiles\hzkyl8yo.default
file	C:\Users\test22\AppData\Roaming\Thunderbird\Profiles\hzkyl8yo.default
file	C:\Users\test22\AppData\Roaming\Thunderbird\profiles.ini
registry	HKEY_CURRENT_USER\Software\Microsoft\Windows Mail\Store Root
registry	HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Account Manager\Shared

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1440 called NtSetContextThread to modify thread in remote process 1000
NtSetContextThread July 19, 2023, 3:32 p.m.	registers.eip: 2005598660 registers.esp: 1638384 registers.edi: 0 registers.eax: 4209688 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000228 process_identifier: 1000	1	0	0

File has been identified by 39 AntiVirus engines on VirusTotal as malicious (39 events)

Bkav	W32.AIDetectMalware
Lionic	Trojan.Win32.Agent.tshg
MicroWorld-eScan	Gen:Variant.Nemesis.25280
FireEye	Generic.mg.70462b94519e8f03
Malwarebytes	Trojan.Injector.NSIS
Sangfor	Suspicious.Win32.Save.ins
CrowdStrike	win/malicious_confidence_100% (W)
Arcabit	Trojan.Nemesis.D62C0 [many]
Cyren	W32/Injector.BOI.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	a variant of Win32/Injector.ETCY
APEX	Malicious
Cynet	Malicious (score: 100)
Kaspersky	HEUR:Trojan.Win32.Strab.gen
BitDefender	Gen:Variant.Nemesis.25280
Avast	Win32:TrojanX-gen [Trj]
Emsisoft	Gen:Variant.Nemesis.25280 (B)
F-Secure	Trojan.TR/AD.GenShell.rlhbe
VIPRE	Gen:Variant.Nemesis.25280
McAfee-GW-Edition	BehavesLike.Win32.Generic.gc
Trapmine	malicious.moderate.ml.score
Sophos	Mal/Generic-S
SentinelOne	Static AI - Suspicious PE
Avira	TR/AD.DarkCloudSteal.zlvkp
Microsoft	Trojan:Win32/Sabsik.FL.B!ml
ZoneAlarm	HEUR:Trojan-PSW.Win32.DarkCloud.gen
GData	Win32.Trojan.Agent.CVSNYE
Google	Detected
AhnLab-V3	Trojan/Win.TrojanX-gen.R592390
Acronis	suspicious
McAfee	Artemis!70462B94519E
MAX	malware (ai score=85)
Cylance	unsafe
Rising	Trojan.Injector!1.E835 (CLASSIC)
Ikarus	Trojan-Spy.FormBook
Fortinet	NSIS/Agent.DCAC!tr
AVG	Win32:TrojanX-gen [Trj]
DeepInstinct	MALICIOUS

ChromeSetup.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All