Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	July 20, 2023, 7:42 a.m.	July 20, 2023, 7:46 a.m.

Size	432.6KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5	`12864f3dc3fbedfb22b049d0b7ea8958`
SHA256	`d363a0101122b51e0bf68805358b28d087a616ebf04d666c6182fc6549fc8a22`
CRC32	`58AE5BF1`
ssdeep	`12288:vYJCgAZBow1kBbvWC0CCYlpVssLtqVs0OlpxX:vYJovahvWC0CppVDLtqujpF`
Yara	UPX_Zero - UPX packed file NSIS_Installer - Null Soft Installer Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature IsPE32 - (no description)

ChromeSetup.exe "C:\Users\test22\AppData\Local\Temp\ChromeSetup.exe"
2648
- ChromeSetup.exe "C:\Users\test22\AppData\Local\Temp\ChromeSetup.exe"
  2760
explorer.exe C:\Windows\Explorer.EXE
1452

Name	Response	Post-Analysis Lookup
us2.smtp.mailhostbox.com	A 208.91.199.224 A 208.91.198.143 A 208.91.199.225 A 208.91.199.223	208.91.199.225
showip.net	A 162.55.60.2	162.55.60.2

IP Address	Status	Action
162.55.60.2	Active	Moloch
164.124.101.2	Active	Moloch
208.91.199.224	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.101:49167 -> 162.55.60.2:80	2008987	ET POLICY IP Check Domain (showip in HTTP Host)	Attempted Information Leak
TCP 208.91.199.224:587 -> 192.168.56.101:49202	2260002	SURICATA Applayer Detect protocol only one direction	Generic Protocol Command Decode
TCP 192.168.56.101:49202 -> 208.91.199.224:587	2044136	ET INFO Possible SMTP Data Exfiltration - File Attachment Named Files.zip	Potentially Bad Traffic
TCP 208.91.199.224:587 -> 192.168.56.101:49203	2260002	SURICATA Applayer Detect protocol only one direction	Generic Protocol Command Decode
TCP 192.168.56.101:49203 -> 208.91.199.224:587	2044136	ET INFO Possible SMTP Data Exfiltration - File Attachment Named Files.zip	Potentially Bad Traffic

Suricata TLS

No Suricata TLS

Queries for the computername (6 events)

Time & API	Arguments	Status	Return
GetComputerNameW July 20, 2023, 7:42 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 20, 2023, 7:42 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 20, 2023, 7:42 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 20, 2023, 7:42 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 20, 2023, 7:42 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 20, 2023, 7:42 a.m.	computer_name: TEST22-PC	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx July 20, 2023, 7:42 a.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

.ndata

One or more processes crashed (50 out of 94 events)

Time & API	Arguments	Status
__exception__ July 20, 2023, 7:42 a.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7597b727 registers.esp: 1635032 registers.edi: 6452448 registers.eax: 1635032 registers.ebp: 1635112 registers.edx: 0 registers.ebx: 6452448 registers.esi: 6452448 registers.ecx: 2	1
__exception__ July 20, 2023, 7:42 a.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7597b727 registers.esp: 1633992 registers.edi: 6452448 registers.eax: 1633992 registers.ebp: 1634072 registers.edx: 0 registers.ebx: 6452448 registers.esi: 6452448 registers.ecx: 2	1
__exception__ July 20, 2023, 7:42 a.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7597b727 registers.esp: 1633992 registers.edi: 6452448 registers.eax: 1633992 registers.ebp: 1634072 registers.edx: 0 registers.ebx: 6452448 registers.esi: 6452448 registers.ecx: 2	1
__exception__ July 20, 2023, 7:42 a.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7597b727 registers.esp: 1633992 registers.edi: 6452448 registers.eax: 1633992 registers.ebp: 1634072 registers.edx: 0 registers.ebx: 6452448 registers.esi: 6452448 registers.ecx: 2	1
__exception__ July 20, 2023, 7:42 a.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7597b727 registers.esp: 1633992 registers.edi: 6452448 registers.eax: 1633992 registers.ebp: 1634072 registers.edx: 0 registers.ebx: 6452448 registers.esi: 6452448 registers.ecx: 2	1
__exception__ July 20, 2023, 7:42 a.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7597b727 registers.esp: 1633916 registers.edi: 6452448 registers.eax: 1633916 registers.ebp: 1633996 registers.edx: 0 registers.ebx: 6452448 registers.esi: 6452448 registers.ecx: 2	1
__exception__ July 20, 2023, 7:42 a.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7597b727 registers.esp: 1633916 registers.edi: 6452448 registers.eax: 1633916 registers.ebp: 1633996 registers.edx: 0 registers.ebx: 6452448 registers.esi: 6452448 registers.ecx: 2	1
__exception__ July 20, 2023, 7:42 a.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7597b727 registers.esp: 1634284 registers.edi: 1634560 registers.eax: 1634284 registers.ebp: 1634364 registers.edx: 0 registers.ebx: 6452448 registers.esi: 1634560 registers.ecx: 2	1
__exception__ July 20, 2023, 7:42 a.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7597b727 registers.esp: 1634284 registers.edi: 1634560 registers.eax: 1634284 registers.ebp: 1634364 registers.edx: 0 registers.ebx: 6452448 registers.esi: 1634560 registers.ecx: 2	1
__exception__ July 20, 2023, 7:42 a.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7597b727 registers.esp: 1633308 registers.edi: 6452448 registers.eax: 1633308 registers.ebp: 1633388 registers.edx: 0 registers.ebx: 6452448 registers.esi: 6452448 registers.ecx: 2	1
__exception__ July 20, 2023, 7:42 a.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7597b727 registers.esp: 1633916 registers.edi: 6452448 registers.eax: 1633916 registers.ebp: 1633996 registers.edx: 0 registers.ebx: 6452448 registers.esi: 6452448 registers.ecx: 2	1
__exception__ July 20, 2023, 7:42 a.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7597b727 registers.esp: 1633916 registers.edi: 6452448 registers.eax: 1633916 registers.ebp: 1633996 registers.edx: 0 registers.ebx: 6452448 registers.esi: 6452448 registers.ecx: 2	1
__exception__ July 20, 2023, 7:42 a.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7597b727 registers.esp: 1634284 registers.edi: 1634560 registers.eax: 1634284 registers.ebp: 1634364 registers.edx: 0 registers.ebx: 6452448 registers.esi: 1634560 registers.ecx: 2	1
__exception__ July 20, 2023, 7:42 a.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7597b727 registers.esp: 1634284 registers.edi: 1634560 registers.eax: 1634284 registers.ebp: 1634364 registers.edx: 0 registers.ebx: 6452448 registers.esi: 1634560 registers.ecx: 2	1
__exception__ July 20, 2023, 7:42 a.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7597b727 registers.esp: 1633308 registers.edi: 6452448 registers.eax: 1633308 registers.ebp: 1633388 registers.edx: 0 registers.ebx: 6452448 registers.esi: 6452448 registers.ecx: 2	1
__exception__ July 20, 2023, 7:42 a.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7597b727 registers.esp: 1633916 registers.edi: 6452448 registers.eax: 1633916 registers.ebp: 1633996 registers.edx: 0 registers.ebx: 6452448 registers.esi: 6452448 registers.ecx: 2	1
__exception__ July 20, 2023, 7:42 a.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7597b727 registers.esp: 1633916 registers.edi: 6452448 registers.eax: 1633916 registers.ebp: 1633996 registers.edx: 0 registers.ebx: 6452448 registers.esi: 6452448 registers.ecx: 2	1
__exception__ July 20, 2023, 7:42 a.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7597b727 registers.esp: 1634284 registers.edi: 1634560 registers.eax: 1634284 registers.ebp: 1634364 registers.edx: 0 registers.ebx: 6452448 registers.esi: 1634560 registers.ecx: 2	1
__exception__ July 20, 2023, 7:42 a.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7597b727 registers.esp: 1634284 registers.edi: 1634560 registers.eax: 1634284 registers.ebp: 1634364 registers.edx: 0 registers.ebx: 6452448 registers.esi: 1634560 registers.ecx: 2	1
__exception__ July 20, 2023, 7:42 a.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7597b727 registers.esp: 1633308 registers.edi: 6452448 registers.eax: 1633308 registers.ebp: 1633388 registers.edx: 0 registers.ebx: 6452448 registers.esi: 6452448 registers.ecx: 2	1
__exception__ July 20, 2023, 7:42 a.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7597b727 registers.esp: 1633916 registers.edi: 6452448 registers.eax: 1633916 registers.ebp: 1633996 registers.edx: 0 registers.ebx: 6452448 registers.esi: 6452448 registers.ecx: 2	1
__exception__ July 20, 2023, 7:42 a.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7597b727 registers.esp: 1633916 registers.edi: 6452448 registers.eax: 1633916 registers.ebp: 1633996 registers.edx: 0 registers.ebx: 6452448 registers.esi: 6452448 registers.ecx: 2	1
__exception__ July 20, 2023, 7:42 a.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7597b727 registers.esp: 1635056 registers.edi: 6452448 registers.eax: 1635056 registers.ebp: 1635136 registers.edx: 0 registers.ebx: 6452448 registers.esi: 6452448 registers.ecx: 2	1
__exception__ July 20, 2023, 7:42 a.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7597b727 registers.esp: 1635056 registers.edi: 6452448 registers.eax: 1635056 registers.ebp: 1635136 registers.edx: 0 registers.ebx: 6452448 registers.esi: 6452448 registers.ecx: 2	1
__exception__ July 20, 2023, 7:42 a.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7597b727 registers.esp: 1634844 registers.edi: 6452448 registers.eax: 1634844 registers.ebp: 1634924 registers.edx: 0 registers.ebx: 6452448 registers.esi: 6452448 registers.ecx: 2	1
__exception__ July 20, 2023, 7:42 a.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7597b727 registers.esp: 1634844 registers.edi: 6452448 registers.eax: 1634844 registers.ebp: 1634924 registers.edx: 0 registers.ebx: 6452448 registers.esi: 6452448 registers.ecx: 2	1
__exception__ July 20, 2023, 7:42 a.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7597b727 registers.esp: 1634844 registers.edi: 6452448 registers.eax: 1634844 registers.ebp: 1634924 registers.edx: 0 registers.ebx: 6452448 registers.esi: 6452448 registers.ecx: 2	1
__exception__ July 20, 2023, 7:42 a.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7597b727 registers.esp: 1634260 registers.edi: 6452448 registers.eax: 1634260 registers.ebp: 1634340 registers.edx: 0 registers.ebx: 6452448 registers.esi: 6452448 registers.ecx: 2	1
__exception__ July 20, 2023, 7:42 a.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7597b727 registers.esp: 1634844 registers.edi: 6452448 registers.eax: 1634844 registers.ebp: 1634924 registers.edx: 0 registers.ebx: 6452448 registers.esi: 6452448 registers.ecx: 2	1
__exception__ July 20, 2023, 7:42 a.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7597b727 registers.esp: 1634844 registers.edi: 6452448 registers.eax: 1634844 registers.ebp: 1634924 registers.edx: 0 registers.ebx: 6452448 registers.esi: 6452448 registers.ecx: 2	1
__exception__ July 20, 2023, 7:42 a.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7597b727 registers.esp: 1634844 registers.edi: 6452448 registers.eax: 1634844 registers.ebp: 1634924 registers.edx: 0 registers.ebx: 6452448 registers.esi: 6452448 registers.ecx: 2	1
__exception__ July 20, 2023, 7:42 a.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7597b727 registers.esp: 1634260 registers.edi: 6452448 registers.eax: 1634260 registers.ebp: 1634340 registers.edx: 0 registers.ebx: 6452448 registers.esi: 6452448 registers.ecx: 2	1
__exception__ July 20, 2023, 7:42 a.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7597b727 registers.esp: 1634844 registers.edi: 6452448 registers.eax: 1634844 registers.ebp: 1634924 registers.edx: 0 registers.ebx: 6452448 registers.esi: 6452448 registers.ecx: 2	1
__exception__ July 20, 2023, 7:42 a.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7597b727 registers.esp: 1634844 registers.edi: 6452448 registers.eax: 1634844 registers.ebp: 1634924 registers.edx: 0 registers.ebx: 6452448 registers.esi: 6452448 registers.ecx: 2	1
__exception__ July 20, 2023, 7:42 a.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7597b727 registers.esp: 1634844 registers.edi: 6452448 registers.eax: 1634844 registers.ebp: 1634924 registers.edx: 0 registers.ebx: 6452448 registers.esi: 6452448 registers.ecx: 2	1
__exception__ July 20, 2023, 7:42 a.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7597b727 registers.esp: 1634260 registers.edi: 6452448 registers.eax: 1634260 registers.ebp: 1634340 registers.edx: 0 registers.ebx: 6452448 registers.esi: 6452448 registers.ecx: 2	1
__exception__ July 20, 2023, 7:42 a.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7597b727 registers.esp: 1634844 registers.edi: 6452448 registers.eax: 1634844 registers.ebp: 1634924 registers.edx: 0 registers.ebx: 6452448 registers.esi: 6452448 registers.ecx: 2	1
__exception__ July 20, 2023, 7:42 a.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7597b727 registers.esp: 1634844 registers.edi: 6452448 registers.eax: 1634844 registers.ebp: 1634924 registers.edx: 0 registers.ebx: 6452448 registers.esi: 6452448 registers.ecx: 2	1
__exception__ July 20, 2023, 7:42 a.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7597b727 registers.esp: 1634844 registers.edi: 6452448 registers.eax: 1634844 registers.ebp: 1634924 registers.edx: 0 registers.ebx: 6452448 registers.esi: 6452448 registers.ecx: 2	1
__exception__ July 20, 2023, 7:42 a.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7597b727 registers.esp: 1634260 registers.edi: 6452448 registers.eax: 1634260 registers.ebp: 1634340 registers.edx: 0 registers.ebx: 6452448 registers.esi: 6452448 registers.ecx: 2	1
__exception__ July 20, 2023, 7:42 a.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7597b727 registers.esp: 1634844 registers.edi: 6452448 registers.eax: 1634844 registers.ebp: 1634924 registers.edx: 0 registers.ebx: 6452448 registers.esi: 6452448 registers.ecx: 2	1
__exception__ July 20, 2023, 7:42 a.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7597b727 registers.esp: 1634844 registers.edi: 6452448 registers.eax: 1634844 registers.ebp: 1634924 registers.edx: 0 registers.ebx: 6452448 registers.esi: 6452448 registers.ecx: 2	1
__exception__ July 20, 2023, 7:42 a.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7597b727 registers.esp: 1634844 registers.edi: 6452448 registers.eax: 1634844 registers.ebp: 1634924 registers.edx: 0 registers.ebx: 6452448 registers.esi: 6452448 registers.ecx: 2	1
__exception__ July 20, 2023, 7:42 a.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7597b727 registers.esp: 1634260 registers.edi: 6452448 registers.eax: 1634260 registers.ebp: 1634340 registers.edx: 0 registers.ebx: 6452448 registers.esi: 6452448 registers.ecx: 2	1
__exception__ July 20, 2023, 7:42 a.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7597b727 registers.esp: 1634844 registers.edi: 6452448 registers.eax: 1634844 registers.ebp: 1634924 registers.edx: 0 registers.ebx: 6452448 registers.esi: 6452448 registers.ecx: 2	1
__exception__ July 20, 2023, 7:42 a.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7597b727 registers.esp: 1634844 registers.edi: 6452448 registers.eax: 1634844 registers.ebp: 1634924 registers.edx: 0 registers.ebx: 6452448 registers.esi: 6452448 registers.ecx: 2	1
__exception__ July 20, 2023, 7:42 a.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7597b727 registers.esp: 1634844 registers.edi: 6452448 registers.eax: 1634844 registers.ebp: 1634924 registers.edx: 0 registers.ebx: 6452448 registers.esi: 6452448 registers.ecx: 2	1
__exception__ July 20, 2023, 7:42 a.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7597b727 registers.esp: 1634260 registers.edi: 6452448 registers.eax: 1634260 registers.ebp: 1634340 registers.edx: 0 registers.ebx: 6452448 registers.esi: 6452448 registers.ecx: 2	1
__exception__ July 20, 2023, 7:42 a.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7597b727 registers.esp: 1633508 registers.edi: 6452448 registers.eax: 1633508 registers.ebp: 1633588 registers.edx: 0 registers.ebx: 6452448 registers.esi: 6452448 registers.ecx: 2	1
__exception__ July 20, 2023, 7:42 a.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7597b727 registers.esp: 1634844 registers.edi: 6452448 registers.eax: 1634844 registers.ebp: 1634924 registers.edx: 0 registers.ebx: 6452448 registers.esi: 6452448 registers.ecx: 2	1

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Performs some HTTP requests (1 event)

request

GET http://showip.net/

Allocates read-write-execute memory (usually to unpack itself) (6 events)

Time & API	Arguments	Status
NtProtectVirtualMemory July 20, 2023, 7:42 a.m.	process_identifier: 2648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x732a2000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 20, 2023, 7:42 a.m.	process_identifier: 2648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7394b000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 20, 2023, 7:42 a.m.	process_identifier: 2648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x031b0000 allocation_type: 12289 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtProtectVirtualMemory July 20, 2023, 7:42 a.m.	process_identifier: 2760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73bc2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 20, 2023, 7:42 a.m.	process_identifier: 2760 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04fc0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 20, 2023, 7:43 a.m.	process_identifier: 1452 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000004160000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1

Creates (office) documents on the filesystem (17 events)

file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Templates\TEST22-PC-test22\Files\UQHeQomDjE.docx
file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Templates\TEST22-PC-test22\Files\vSjjFAKhemtn.doc
file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Templates\TEST22-PC-test22\Files\readme.doc
file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Templates\TEST22-PC-test22\Files\cXMLMLMlMJidCP.doc
file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Templates\TEST22-PC-test22\Files\FQcCKdEdqPGjQ.doc
file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Templates\TEST22-PC-test22\Files\ONyeiyAHXnG.docx
file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Templates\TEST22-PC-test22\Files\iZaIwdonvHsGmWxjG.docm
file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Templates\TEST22-PC-test22\Files\jrbJWKHgEixaZk.docx
file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Templates\TEST22-PC-test22\Files\WmXfDlmbAt.doc
file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Templates\TEST22-PC-test22\Files\FOwRatdvSt.docm
file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Templates\TEST22-PC-test22\Files\KIprYLexEf.doc
file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Templates\TEST22-PC-test22\Files\JDHeJjBWHuxqp.doc
file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Templates\TEST22-PC-test22\Files\tfWgfaUyXRlwSTg.docm
file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Templates\TEST22-PC-test22\Files\sByekmDWYN.docm
file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Templates\TEST22-PC-test22\Files\readme.xls
file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Templates\TEST22-PC-test22\Files\FAaWoqRZplEQFsGvV.docm
file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Templates\TEST22-PC-test22\Files\ATwjKHHgPIXqpQbCw.doc

Creates executable files on the filesystem (2 events)

file	C:\Users\Public\Libraries\vbsqlite3.dll
file	C:\Users\test22\AppData\Local\Temp\nsjF2DD.tmp\rqqir.dll

Drops an executable to the user AppData folder (1 event)

file	C:\Users\test22\AppData\Local\Temp\nsjF2DD.tmp\rqqir.dll

Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time) (1 event)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory July 20, 2023, 7:42 a.m.	process_identifier: 2760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 24576 protection: 32 (PAGE_EXECUTE_READ) base_address: 0x004c0000 process_handle: 0xffffffff	1	0	0

Attempts to identify installed AV products by installation directory (1 event)

file	C:\Users\test22\AppData\Local\Temp\SandboxieInstall.exe

Harvests credentials from local email clients (2 events)

registry	HKEY_CURRENT_USER\Software\Microsoft\Windows Mail\Store Root
registry	HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Account Manager\Shared

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2648 called NtSetContextThread to modify thread in remote process 2760
NtSetContextThread July 20, 2023, 7:42 a.m.	registers.eip: 1995571652 registers.esp: 1638384 registers.edi: 0 registers.eax: 4210004 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000224 process_identifier: 2760	1	0	0

File has been identified by 31 AntiVirus engines on VirusTotal as malicious (31 events)

Bkav	W32.AIDetectMalware
Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.Nemesis.25268
VIPRE	Gen:Variant.Nemesis.25268
Sangfor	Suspicious.Win32.Save.ins
CrowdStrike	win/malicious_confidence_100% (D)
Arcabit	Trojan.Nemesis.D62B4 [many]
Cyren	W32/Injector.BOI.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
Cynet	Malicious (score: 100)
APEX	Malicious
Kaspersky	VHO:Trojan.Win32.Convagent.gen
BitDefender	Gen:Variant.Nemesis.25268
Emsisoft	Gen:Variant.Nemesis.25268 (B)
McAfee-GW-Edition	BehavesLike.Win32.Generic.gc
Trapmine	malicious.moderate.ml.score
FireEye	Generic.mg.12864f3dc3fbedfb
Sophos	Generic ML PUA (PUA)
Ikarus	Trojan.Win32.Injector
Microsoft	Trojan:Win32/Sabsik.TE.B!ml
ZoneAlarm	VHO:Trojan.Win32.Convagent.gen
GData	Zum.Androm.1
Google	Detected
AhnLab-V3	Trojan/Win.Generic.R587806
Acronis	suspicious
MAX	malware (ai score=82)
Rising	Trojan.Injector!1.E835 (CLASSIC)
SentinelOne	Static AI - Suspicious PE
Fortinet	NSIS/Agent.DCAC!tr
Cybereason	malicious.dc3fbe
DeepInstinct	MALICIOUS

ChromeSetup.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All