Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	July 23, 2023, 9:40 a.m.	July 23, 2023, 9:45 a.m.

Size	2.0MB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`8bb15c76e2d55780ced07a1a2c589486`
SHA256	`d9f6408b67628d5618a4fbaba97404ac55988633ccb2a02a09c95b0b134bafc9`
CRC32	`4F4A0273`
ssdeep	`49152:dusT49TJp6obw7prohAAGQFEVxYL+7vAzieEdfr:FaPtGXVKEvAz+dr`
Yara	UPX_Zero - UPX packed file Lazarus_Zero - Lazarus Generic Malware Is_DotNET_EXE - (no description) Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature themida_packer - themida packer IsPE32 - (no description)

new.exe "C:\Users\test22\AppData\Local\Temp\new.exe"
2652
- AppLaunch.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2848

Name	Response	Post-Analysis Lookup
gstatic-node.io	A 172.67.204.199 A 104.21.37.53	172.67.204.199

IP Address	Status	Action
164.124.101.2	Active	Moloch
172.67.204.199	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.101:49168 -> 172.67.204.199:80	2043206	ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2	A Network Trojan was detected
TCP 192.168.56.101:49172 -> 172.67.204.199:80	2043206	ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2	A Network Trojan was detected
TCP 192.168.56.101:49171 -> 172.67.204.199:80	2043206	ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2	A Network Trojan was detected
TCP 192.168.56.101:49169 -> 172.67.204.199:80	2043206	ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2	A Network Trojan was detected
TCP 192.168.56.101:49170 -> 172.67.204.199:80	2043206	ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2	A Network Trojan was detected
TCP 192.168.56.101:49173 -> 172.67.204.199:80	2043206	ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2	A Network Trojan was detected
TCP 192.168.56.101:49174 -> 172.67.204.199:80	2043206	ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2	A Network Trojan was detected
TCP 192.168.56.101:49176 -> 172.67.204.199:80	2043206	ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2	A Network Trojan was detected
TCP 192.168.56.101:49177 -> 172.67.204.199:80	2043206	ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2	A Network Trojan was detected
TCP 192.168.56.101:49178 -> 172.67.204.199:80	2043206	ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2	A Network Trojan was detected
TCP 192.168.56.101:49182 -> 172.67.204.199:80	2043206	ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2	A Network Trojan was detected
TCP 192.168.56.101:49179 -> 172.67.204.199:80	2043206	ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2	A Network Trojan was detected
TCP 192.168.56.101:49185 -> 172.67.204.199:80	2043206	ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2	A Network Trojan was detected
TCP 192.168.56.101:49180 -> 172.67.204.199:80	2043206	ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2	A Network Trojan was detected
TCP 192.168.56.101:49187 -> 172.67.204.199:80	2043206	ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2	A Network Trojan was detected
TCP 192.168.56.101:49188 -> 172.67.204.199:80	2043206	ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2	A Network Trojan was detected
TCP 192.168.56.101:49181 -> 172.67.204.199:80	2043206	ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2	A Network Trojan was detected
TCP 192.168.56.101:49189 -> 172.67.204.199:80	2043206	ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2	A Network Trojan was detected
TCP 192.168.56.101:49191 -> 172.67.204.199:80	2043206	ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2	A Network Trojan was detected
TCP 192.168.56.101:49175 -> 172.67.204.199:80	2043206	ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2	A Network Trojan was detected
TCP 192.168.56.101:49190 -> 172.67.204.199:80	2043206	ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2	A Network Trojan was detected
TCP 192.168.56.101:49197 -> 172.67.204.199:80	2043206	ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2	A Network Trojan was detected
TCP 192.168.56.101:49198 -> 172.67.204.199:80	2043206	ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2	A Network Trojan was detected
TCP 192.168.56.101:49183 -> 172.67.204.199:80	2043206	ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2	A Network Trojan was detected
TCP 192.168.56.101:49203 -> 172.67.204.199:80	2043206	ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2	A Network Trojan was detected
TCP 192.168.56.101:49184 -> 172.67.204.199:80	2043206	ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2	A Network Trojan was detected
TCP 192.168.56.101:49186 -> 172.67.204.199:80	2043206	ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2	A Network Trojan was detected
TCP 192.168.56.101:49207 -> 172.67.204.199:80	2043206	ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2	A Network Trojan was detected
TCP 192.168.56.101:49192 -> 172.67.204.199:80	2043206	ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2	A Network Trojan was detected
TCP 192.168.56.101:49200 -> 172.67.204.199:80	2043206	ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2	A Network Trojan was detected
TCP 192.168.56.101:49199 -> 172.67.204.199:80	2043206	ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2	A Network Trojan was detected
TCP 192.168.56.101:49202 -> 172.67.204.199:80	2043206	ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2	A Network Trojan was detected
TCP 192.168.56.101:49193 -> 172.67.204.199:80	2043206	ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2	A Network Trojan was detected
TCP 192.168.56.101:49201 -> 172.67.204.199:80	2043206	ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2	A Network Trojan was detected
TCP 192.168.56.101:49194 -> 172.67.204.199:80	2043206	ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2	A Network Trojan was detected
TCP 192.168.56.101:49204 -> 172.67.204.199:80	2043206	ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2	A Network Trojan was detected
TCP 192.168.56.101:49195 -> 172.67.204.199:80	2043206	ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2	A Network Trojan was detected
TCP 192.168.56.101:49196 -> 172.67.204.199:80	2043206	ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2	A Network Trojan was detected
TCP 192.168.56.101:49205 -> 172.67.204.199:80	2043206	ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2	A Network Trojan was detected
TCP 192.168.56.101:49206 -> 172.67.204.199:80	2043206	ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2	A Network Trojan was detected
TCP 192.168.56.101:49208 -> 172.67.204.199:80	2043206	ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2	A Network Trojan was detected

Suricata TLS

No Suricata TLS

Queries for the computername (1 event)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameA July 23, 2023, 9:41 a.m.	computer_name: TEST22-PC	1	1	0

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent July 23, 2023, 9:40 a.m.			0	0
IsDebuggerPresent July 23, 2023, 9:40 a.m.			0	0

Tries to locate where the browsers are installed (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx July 23, 2023, 9:40 a.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 events)

section
section	.themida
section	.boot

One or more processes crashed (3 events)

Time & API	Arguments	Status
__exception__ July 23, 2023, 9:40 a.m.	stacktrace: new+0x3af105 @ 0x152f105 new+0x3af1b4 @ 0x152f1b4 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc e9 75 5b a2 8b 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008e exception.offset: 46887 exception.address: 0x7597b727 registers.esp: 2882236 registers.edi: 19210240 registers.eax: 2882236 registers.ebp: 2882316 registers.edx: 2130566132 registers.ebx: 1971716070 registers.esi: 1995994155 registers.ecx: 1643577344	1
__exception__ July 23, 2023, 9:40 a.m.	stacktrace: exception.instruction_r: ed 64 8f 05 00 00 00 00 83 c4 04 e9 10 d7 e4 ff exception.symbol: new+0x3d4186 exception.instruction: in eax, dx exception.module: new.exe exception.exception_code: 0xc0000096 exception.offset: 4014470 exception.address: 0x1554186 registers.esp: 2882356 registers.edi: 20572927 registers.eax: 1750617430 registers.ebp: 19210240 registers.edx: 22614 registers.ebx: 2147483650 registers.esi: 20585770 registers.ecx: 20	1
__exception__ July 23, 2023, 9:40 a.m.	stacktrace: exception.instruction_r: ed 64 8f 05 00 00 00 00 83 c4 04 81 fb 68 58 4d exception.symbol: new+0x3d41fa exception.instruction: in eax, dx exception.module: new.exe exception.exception_code: 0xc0000096 exception.offset: 4014586 exception.address: 0x15541fa registers.esp: 2882356 registers.edi: 20572927 registers.eax: 1447909480 registers.ebp: 19210240 registers.edx: 22104 registers.ebx: 2256917605 registers.esi: 20585770 registers.ecx: 10	1

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

HTTP traffic contains suspicious features which may be indicative of malware related traffic (2 events)

suspicious_features	POST method with no referer header, POST method with no useragent header				suspicious_request	POST http://gstatic-node.io/c2conf
suspicious_features	POST method with no referer header				suspicious_request	POST http://gstatic-node.io/c2sock

Performs some HTTP requests (3 events)

request	GET http://gstatic-node.io/
request	POST http://gstatic-node.io/c2conf
request	POST http://gstatic-node.io/c2sock

Sends data using the HTTP POST Method (2 events)

request	POST http://gstatic-node.io/c2conf
request	POST http://gstatic-node.io/c2sock

Allocates read-write-execute memory (usually to unpack itself) (50 out of 213 events)

Time & API	Arguments	Status
NtProtectVirtualMemory July 23, 2023, 9:40 a.m.	process_identifier: 2652 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x755dc000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 23, 2023, 9:40 a.m.	process_identifier: 2652 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x755c5000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 23, 2023, 9:40 a.m.	process_identifier: 2652 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x755c5000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 23, 2023, 9:40 a.m.	process_identifier: 2652 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75703000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 23, 2023, 9:40 a.m.	process_identifier: 2652 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x755c1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 23, 2023, 9:40 a.m.	process_identifier: 2652 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7597d000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 23, 2023, 9:40 a.m.	process_identifier: 2652 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x755c4000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 23, 2023, 9:40 a.m.	process_identifier: 2652 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75981000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 23, 2023, 9:40 a.m.	process_identifier: 2652 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x755dc000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 23, 2023, 9:40 a.m.	process_identifier: 2652 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75981000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 23, 2023, 9:40 a.m.	process_identifier: 2652 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x755c3000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 23, 2023, 9:40 a.m.	process_identifier: 2652 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75981000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 23, 2023, 9:40 a.m.	process_identifier: 2652 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x755c1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 23, 2023, 9:40 a.m.	process_identifier: 2652 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75981000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 23, 2023, 9:40 a.m.	process_identifier: 2652 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x755dc000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 23, 2023, 9:40 a.m.	process_identifier: 2652 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75984000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 23, 2023, 9:40 a.m.	process_identifier: 2652 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x755da000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 23, 2023, 9:40 a.m.	process_identifier: 2652 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x755c1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 23, 2023, 9:40 a.m.	process_identifier: 2652 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7597b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 23, 2023, 9:40 a.m.	process_identifier: 2652 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x755dc000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 23, 2023, 9:40 a.m.	process_identifier: 2652 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7597b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 23, 2023, 9:40 a.m.	process_identifier: 2652 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x755c1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 23, 2023, 9:40 a.m.	process_identifier: 2652 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7597b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 23, 2023, 9:40 a.m.	process_identifier: 2652 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x755c3000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 23, 2023, 9:40 a.m.	process_identifier: 2652 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7597c000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 23, 2023, 9:40 a.m.	process_identifier: 2652 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x755c1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 23, 2023, 9:40 a.m.	process_identifier: 2652 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7597d000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 23, 2023, 9:40 a.m.	process_identifier: 2652 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x755c5000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 23, 2023, 9:40 a.m.	process_identifier: 2652 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7585f000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 23, 2023, 9:40 a.m.	process_identifier: 2652 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75868000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 23, 2023, 9:40 a.m.	process_identifier: 2652 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x755e3000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 23, 2023, 9:40 a.m.	process_identifier: 2652 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x755e8000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 23, 2023, 9:40 a.m.	process_identifier: 2652 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7563e000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 23, 2023, 9:40 a.m.	process_identifier: 2652 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x755e5000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 23, 2023, 9:40 a.m.	process_identifier: 2652 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x755c3000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 23, 2023, 9:40 a.m.	process_identifier: 2652 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75981000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 23, 2023, 9:40 a.m.	process_identifier: 2652 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x755c4000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 23, 2023, 9:40 a.m.	process_identifier: 2652 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7597d000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 23, 2023, 9:40 a.m.	process_identifier: 2652 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x755c1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 23, 2023, 9:40 a.m.	process_identifier: 2652 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7597d000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 23, 2023, 9:40 a.m.	process_identifier: 2652 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x755da000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 23, 2023, 9:40 a.m.	process_identifier: 2652 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x755c4000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 23, 2023, 9:40 a.m.	process_identifier: 2652 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75981000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 23, 2023, 9:40 a.m.	process_identifier: 2652 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x755c4000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 23, 2023, 9:40 a.m.	process_identifier: 2652 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x755c4000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 23, 2023, 9:40 a.m.	process_identifier: 2652 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75981000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 23, 2023, 9:40 a.m.	process_identifier: 2652 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x755c4000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 23, 2023, 9:40 a.m.	process_identifier: 2652 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x755ec000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 23, 2023, 9:40 a.m.	process_identifier: 2652 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7597b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 23, 2023, 9:40 a.m.	process_identifier: 2652 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x755ed000 process_handle: 0xffffffff	1

Steals private information from local Internet browsers (50 out of 64 events)

file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Web Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Login Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000004.log
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\CURRENT
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local State
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm

Foreign language identified in PE resource (1 event)

name

RT_VERSION

language

LANG_KOREAN

filetype

data

sublanguage

SUBLANG_KOREAN

offset

0x000cbf64

size

0x00000300

Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (2 events)

Time & API	Arguments	Status	Return	Repeated
Process32NextW July 23, 2023, 9:41 a.m.	snapshot_handle: 0x000003bc process_name: taskhost.exe process_identifier: 2544	1	1	0
Process32NextW July 23, 2023, 9:41 a.m.	snapshot_handle: 0x000003bc process_name: AppLaunch.exe process_identifier: 2848	1	1	0

The binary likely contains encrypted or compressed data indicative of a packer (3 events)

section

{u'size_of_data': u'0x00082600', u'virtual_address': u'0x00002000', u'entropy': 7.999508194467296, u'name': u' ', u'virtual_size': u'0x0009e000'}

entropy

7.99950819447

description

A section with a high entropy has been found

section

{u'size_of_data': u'0x0015a600', u'virtual_address': u'0x00424000', u'entropy': 7.954860268731865, u'name': u'.boot', u'virtual_size': u'0x0015a600'}

entropy

7.95486026873

description

A section with a high entropy has been found

entropy

0.913095523103

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 event)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW July 23, 2023, 9:41 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Expresses interest in specific running processes (1 event)

process

system

Repeatedly searches for a not-found process, you may want to run a web browser during analysis (9 events)

Time & API	Arguments	Status	Return	Repeated
Process32NextW July 23, 2023, 9:41 a.m.	snapshot_handle: 0x00000470 process_name: AppLaunch.exe process_identifier: 2848		0	0
Process32NextW July 23, 2023, 9:41 a.m.	snapshot_handle: 0x00000464 process_name: AppLaunch.exe process_identifier: 2848		0	0
Process32NextW July 23, 2023, 9:41 a.m.	snapshot_handle: 0x00000470 process_name: AppLaunch.exe process_identifier: 2848		0	0
Process32NextW July 23, 2023, 9:41 a.m.	snapshot_handle: 0x00000464 process_name: AppLaunch.exe process_identifier: 2848		0	0
Process32NextW July 23, 2023, 9:41 a.m.	snapshot_handle: 0x00000470 process_name: AppLaunch.exe process_identifier: 2848		0	0
Process32NextW July 23, 2023, 9:41 a.m.	snapshot_handle: 0x00000464 process_name: AppLaunch.exe process_identifier: 2848		0	0
Process32NextW July 23, 2023, 9:41 a.m.	snapshot_handle: 0x00000470 process_name: AppLaunch.exe process_identifier: 2848		0	0
Process32NextW July 23, 2023, 9:41 a.m.	snapshot_handle: 0x00000464 process_name: AppLaunch.exe process_identifier: 2848		0	0
Process32NextW July 23, 2023, 9:41 a.m.	snapshot_handle: 0x00000470 process_name: AppLaunch.exe process_identifier: 2848		0	0

Yara rule detected in process memory (12 events)

description	Match Windows Http API call	rule	Str_Win32_Http_API
description	Communications over HTTP	rule	Network_HTTP
description	Take ScreenShot	rule	ScreenShot
description	Match Windows Inet API call	rule	Str_Win32_Internet_API
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep

Queries for potentially installed applications (39 events)

Time & API	Arguments	Status
RegOpenKeyExW July 23, 2023, 9:41 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall base_handle: 0x80000002 key_handle: 0x00000808 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall	1
RegOpenKeyExW July 23, 2023, 9:41 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook base_handle: 0x80000002 key_handle: 0x00000804 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook	1
RegOpenKeyExW July 23, 2023, 9:41 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager base_handle: 0x80000002 key_handle: 0x00000804 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager	1
RegOpenKeyExW July 23, 2023, 9:41 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx base_handle: 0x80000002 key_handle: 0x00000804 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx	1
RegOpenKeyExW July 23, 2023, 9:41 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\EditPlus base_handle: 0x80000002 key_handle: 0x00000804 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\EditPlus	1
RegOpenKeyExW July 23, 2023, 9:41 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ENTERPRISE base_handle: 0x80000002 key_handle: 0x00000804 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ENTERPRISE	1
RegOpenKeyExW July 23, 2023, 9:41 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore base_handle: 0x80000002 key_handle: 0x00000804 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore	1
RegOpenKeyExW July 23, 2023, 9:41 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome base_handle: 0x80000002 key_handle: 0x00000804 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome	1
RegOpenKeyExW July 23, 2023, 9:41 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Haansoft HWord 80 Korean base_handle: 0x80000002 key_handle: 0x00000804 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Haansoft HWord 80 Korean	1
RegOpenKeyExW July 23, 2023, 9:41 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE40 base_handle: 0x80000002 key_handle: 0x00000804 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE40	1
RegOpenKeyExW July 23, 2023, 9:41 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data base_handle: 0x80000002 key_handle: 0x00000804 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data	1
RegOpenKeyExW July 23, 2023, 9:41 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX base_handle: 0x80000002 key_handle: 0x00000804 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX	1
RegOpenKeyExW July 23, 2023, 9:41 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IEData base_handle: 0x80000002 key_handle: 0x00000804 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IEData	1
RegOpenKeyExW July 23, 2023, 9:41 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack base_handle: 0x80000002 key_handle: 0x00000804 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack	1
RegOpenKeyExW July 23, 2023, 9:41 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent base_handle: 0x80000002 key_handle: 0x00000804 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent	1
RegOpenKeyExW July 23, 2023, 9:41 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WIC base_handle: 0x80000002 key_handle: 0x00000804 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WIC	1
RegOpenKeyExW July 23, 2023, 9:41 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{01B845D4-B73E-4CF7-A377-94BC7BB4F77B} base_handle: 0x80000002 key_handle: 0x00000804 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{01B845D4-B73E-4CF7-A377-94BC7BB4F77B}	1
RegOpenKeyExW July 23, 2023, 9:41 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1D91F7DA-F517-4727-9E62-B7EA978BE980} base_handle: 0x80000002 key_handle: 0x00000804 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1D91F7DA-F517-4727-9E62-B7EA978BE980}	1
RegOpenKeyExW July 23, 2023, 9:41 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA} base_handle: 0x80000002 key_handle: 0x00000804 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}	1
RegOpenKeyExW July 23, 2023, 9:41 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0015-0412-0000-0000000FF1CE} base_handle: 0x80000002 key_handle: 0x00000804 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0015-0412-0000-0000000FF1CE}	1
RegOpenKeyExW July 23, 2023, 9:41 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0016-0412-0000-0000000FF1CE} base_handle: 0x80000002 key_handle: 0x00000804 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0016-0412-0000-0000000FF1CE}	1
RegOpenKeyExW July 23, 2023, 9:41 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0018-0412-0000-0000000FF1CE} base_handle: 0x80000002 key_handle: 0x00000804 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0018-0412-0000-0000000FF1CE}	1
RegOpenKeyExW July 23, 2023, 9:41 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0019-0412-0000-0000000FF1CE} base_handle: 0x80000002 key_handle: 0x00000804 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0019-0412-0000-0000000FF1CE}	1
RegOpenKeyExW July 23, 2023, 9:41 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001A-0412-0000-0000000FF1CE} base_handle: 0x80000002 key_handle: 0x00000804 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001A-0412-0000-0000000FF1CE}	1
RegOpenKeyExW July 23, 2023, 9:41 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001B-0412-0000-0000000FF1CE} base_handle: 0x80000002 key_handle: 0x00000804 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001B-0412-0000-0000000FF1CE}	1
RegOpenKeyExW July 23, 2023, 9:41 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001F-0409-0000-0000000FF1CE} base_handle: 0x80000002 key_handle: 0x00000804 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001F-0409-0000-0000000FF1CE}	1
RegOpenKeyExW July 23, 2023, 9:41 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001F-0412-0000-0000000FF1CE} base_handle: 0x80000002 key_handle: 0x00000804 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001F-0412-0000-0000000FF1CE}	1
RegOpenKeyExW July 23, 2023, 9:41 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0028-0412-0000-0000000FF1CE} base_handle: 0x80000002 key_handle: 0x00000804 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0028-0412-0000-0000000FF1CE}	1
RegOpenKeyExW July 23, 2023, 9:41 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-002C-0412-0000-0000000FF1CE} base_handle: 0x80000002 key_handle: 0x00000804 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-002C-0412-0000-0000000FF1CE}	1
RegOpenKeyExW July 23, 2023, 9:41 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0030-0000-0000-0000000FF1CE} base_handle: 0x80000002 key_handle: 0x00000804 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0030-0000-0000-0000000FF1CE}	1
RegOpenKeyExW July 23, 2023, 9:41 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0044-0412-0000-0000000FF1CE} base_handle: 0x80000002 key_handle: 0x00000804 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0044-0412-0000-0000000FF1CE}	1
RegOpenKeyExW July 23, 2023, 9:41 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-006E-0409-0000-0000000FF1CE} base_handle: 0x80000002 key_handle: 0x00000804 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-006E-0409-0000-0000000FF1CE}	1
RegOpenKeyExW July 23, 2023, 9:41 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-006E-0412-0000-0000000FF1CE} base_handle: 0x80000002 key_handle: 0x00000804 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-006E-0412-0000-0000000FF1CE}	1
RegOpenKeyExW July 23, 2023, 9:41 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-00A1-0412-0000-0000000FF1CE} base_handle: 0x80000002 key_handle: 0x00000804 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-00A1-0412-0000-0000000FF1CE}	1
RegOpenKeyExW July 23, 2023, 9:41 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-00BA-0409-0000-0000000FF1CE} base_handle: 0x80000002 key_handle: 0x00000804 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-00BA-0409-0000-0000000FF1CE}	1
RegOpenKeyExW July 23, 2023, 9:41 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0114-0412-0000-0000000FF1CE} base_handle: 0x80000002 key_handle: 0x00000804 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0114-0412-0000-0000000FF1CE}	1
RegOpenKeyExW July 23, 2023, 9:41 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{939659F3-71D2-461F-B24D-91D05A4389B4} base_handle: 0x80000002 key_handle: 0x00000804 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{939659F3-71D2-461F-B24D-91D05A4389B4}	1
RegOpenKeyExW July 23, 2023, 9:41 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{9B84A461-3B4C-40E2-B44F-CE22E215EE40} base_handle: 0x80000002 key_handle: 0x00000804 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{9B84A461-3B4C-40E2-B44F-CE22E215EE40}	1
RegOpenKeyExW July 23, 2023, 9:41 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d992c12e-cab2-426f-bde3-fb8c53950b0d} base_handle: 0x80000002 key_handle: 0x00000804 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d992c12e-cab2-426f-bde3-fb8c53950b0d}	1

Terminates another process (2 events)

Time & API	Arguments	Status	Return	Repeated
NtTerminateProcess July 23, 2023, 9:41 a.m.	status_code: 0xffffffff process_identifier: 2812 process_handle: 0x00000244		0	0
NtTerminateProcess July 23, 2023, 9:41 a.m.	status_code: 0xffffffff process_identifier: 2812 process_handle: 0x00000244	1	0	0

One or more of the buffers contains an embedded PE file (2 events)

buffer	Buffer with sha1: 399d287a7d49703d2c709f3c9b4a4ab5735acf00
buffer	Buffer with sha1: 8a7a16e1bb29ef6a29ec7e71bdc776d6bdfda170

Allocates execute permission to another process indicative of possible code injection (2 events)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory July 23, 2023, 9:41 a.m.	process_identifier: 2812 region_size: 413696 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000023c		3221225496	0
NtAllocateVirtualMemory July 23, 2023, 9:41 a.m.	process_identifier: 2848 region_size: 413696 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000240	1	0	0

Checks for the presence of known windows from debuggers and forensic tools (12 events)

Time & API	Arguments	Status	Return	Repeated
FindWindowA July 23, 2023, 9:40 a.m.	class_name: OLLYDBG window_name:		0	0
FindWindowA July 23, 2023, 9:40 a.m.	class_name: GBDYLLO window_name:		0	0
FindWindowA July 23, 2023, 9:40 a.m.	class_name: pediy06 window_name:		0	0
FindWindowA July 23, 2023, 9:40 a.m.	class_name: RegmonClass window_name:		0	0
FindWindowA July 23, 2023, 9:40 a.m.	class_name: RegmonClass window_name:		0	0
FindWindowA July 23, 2023, 9:40 a.m.	class_name: Registry Monitor - Sysinternals: www.sysinternals.com window_name:		0	0
FindWindowA July 23, 2023, 9:40 a.m.	class_name: 18467-41 window_name:		0	0
FindWindowA July 23, 2023, 9:40 a.m.	class_name: FilemonClass window_name:		0	0
FindWindowA July 23, 2023, 9:40 a.m.	class_name: FilemonClass window_name:		0	0
FindWindowA July 23, 2023, 9:40 a.m.	class_name: #0 window_name: File Monitor - Sysinternals: www.sysinternals.com		0	0
FindWindowA July 23, 2023, 9:40 a.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA July 23, 2023, 9:40 a.m.	class_name: #0 window_name: Process Monitor - Sysinternals: www.sysinternals.com		0	0

Checks the version of Bios, possibly for anti-virtualization (2 events)

registry	HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion
registry	HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion

Attempts to access Bitcoin/ALTCoin wallets (2 events)

file	C:\Users\test22\AppData\Roaming\Bitcoin\wallets
file	C:\Users\test22\AppData\Roaming\Electrum\wallets

Manipulates memory of a non-child process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2652 manipulating memory of non-child process 2812
NtAllocateVirtualMemory July 23, 2023, 9:41 a.m.	process_identifier: 2812 region_size: 413696 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000023c		3221225496	0

Potential code injection by writing to the memory of another process (2 events)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory July 23, 2023, 9:41 a.m.	buffer: MZx@xº´ Í!¸LÍ!This program cannot be run in DOS mode.$PELJ«µdàFà\|:@P@ï 0L0ÀLò.textÑDF `.rdata,¦`¨J@@.dataò@À.relocL0@B base_address: 0x00400000 process_identifier: 2848 process_handle: 0x00000240	1	1	0
WriteProcessMemory July 23, 2023, 9:41 a.m.	buffer: @ base_address: 0xfffde008 process_identifier: 2848 process_handle: 0x00000240	1	1	0

Code injection by writing an executable or DLL to the memory of another process (1 event)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory July 23, 2023, 9:41 a.m.	buffer: MZx@xº´ Í!¸LÍ!This program cannot be run in DOS mode.$PELJ«µdàFà\|:@P@ï 0L0ÀLò.textÑDF `.rdata,¦`¨J@@.dataò@À.relocL0@B base_address: 0x00400000 process_identifier: 2848 process_handle: 0x00000240	1	1	0

Collects information about installed applications (27 events)

Time & API	Arguments	Status
RegQueryValueExW July 23, 2023, 9:41 a.m.	key_handle: 0x00000804 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: EditPlus regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\EditPlus\DisplayName	1
RegQueryValueExW July 23, 2023, 9:41 a.m.	key_handle: 0x00000804 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Enterprise 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\ENTERPRISE\DisplayName	1
RegQueryValueExW July 23, 2023, 9:41 a.m.	key_handle: 0x00000804 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Chrome regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome\DisplayName	1
RegQueryValueExW July 23, 2023, 9:41 a.m.	key_handle: 0x00000804 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: 한컴오피스 한글 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Haansoft HWord 80 Korean\DisplayName	1
RegQueryValueExW July 23, 2023, 9:41 a.m.	key_handle: 0x00000804 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: HttpWatch Professional 9.3.39 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{01B845D4-B73E-4CF7-A377-94BC7BB4F77B}\DisplayName	1
RegQueryValueExW July 23, 2023, 9:41 a.m.	key_handle: 0x00000804 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: 한컴오피스 한글 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D91F7DA-F517-4727-9E62-B7EA978BE980}\DisplayName	1
RegQueryValueExW July 23, 2023, 9:41 a.m.	key_handle: 0x00000804 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Google Update Helper regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}\DisplayName	1
RegQueryValueExW July 23, 2023, 9:41 a.m.	key_handle: 0x00000804 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Access MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0015-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW July 23, 2023, 9:41 a.m.	key_handle: 0x00000804 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Excel MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0016-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW July 23, 2023, 9:41 a.m.	key_handle: 0x00000804 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office PowerPoint MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0018-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW July 23, 2023, 9:41 a.m.	key_handle: 0x00000804 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Publisher MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0019-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW July 23, 2023, 9:41 a.m.	key_handle: 0x00000804 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Outlook MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001A-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW July 23, 2023, 9:41 a.m.	key_handle: 0x00000804 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Word MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001B-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW July 23, 2023, 9:41 a.m.	key_handle: 0x00000804 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Proof (English) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001F-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW July 23, 2023, 9:41 a.m.	key_handle: 0x00000804 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Proof (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001F-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW July 23, 2023, 9:41 a.m.	key_handle: 0x00000804 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office IME (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0028-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW July 23, 2023, 9:41 a.m.	key_handle: 0x00000804 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Proofing (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-002C-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW July 23, 2023, 9:41 a.m.	key_handle: 0x00000804 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Enterprise 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0030-0000-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW July 23, 2023, 9:41 a.m.	key_handle: 0x00000804 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office InfoPath MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0044-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW July 23, 2023, 9:41 a.m.	key_handle: 0x00000804 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Shared MUI (English) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-006E-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW July 23, 2023, 9:41 a.m.	key_handle: 0x00000804 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Shared MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-006E-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW July 23, 2023, 9:41 a.m.	key_handle: 0x00000804 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office OneNote MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-00A1-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW July 23, 2023, 9:41 a.m.	key_handle: 0x00000804 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Groove MUI (English) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-00BA-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW July 23, 2023, 9:41 a.m.	key_handle: 0x00000804 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Groove Setup Metadata MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0114-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW July 23, 2023, 9:41 a.m.	key_handle: 0x00000804 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Adobe Flash Player 13 ActiveX regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{939659F3-71D2-461F-B24D-91D05A4389B4}\DisplayName	1
RegQueryValueExW July 23, 2023, 9:41 a.m.	key_handle: 0x00000804 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Adobe Flash Player 13 NPAPI regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{9B84A461-3B4C-40E2-B44F-CE22E215EE40}\DisplayName	1
RegQueryValueExW July 23, 2023, 9:41 a.m.	key_handle: 0x00000804 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Visual C++ 2015 Redistributable (x64) - 14.0.24215 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{d992c12e-cab2-426f-bde3-fb8c53950b0d}\DisplayName	1

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2652 called NtSetContextThread to modify thread in remote process 2848
NtSetContextThread July 23, 2023, 9:41 a.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4405884 registers.ebp: 0 registers.edx: 0 registers.ebx: -139264 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000244 process_identifier: 2848	1	0	0

Appends a known CryptoMix ransomware file extension to files that have been encrypted (1 event)

file	C:\Users\test22\AppData\Roaming\Exodus\exodus.wallet

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2652 resumed a thread in remote process 2848
NtResumeThread July 23, 2023, 9:41 a.m.	thread_handle: 0x00000244 suspend_count: 1 process_identifier: 2848	1	0	0

Detects Virtual Machines through their custom firmware (1 event)

Time & API	Arguments	Status	Return	Repeated
NtQuerySystemInformation July 23, 2023, 9:40 a.m.	information_class: 76 (SystemFirmwareTableInformation)		3221225507	0

Detects VMWare through the in instruction feature (1 event)

Time & API	Arguments	Status	Return	Repeated
__exception__ July 23, 2023, 9:40 a.m.	stacktrace: exception.instruction_r: ed 64 8f 05 00 00 00 00 83 c4 04 81 fb 68 58 4d exception.symbol: new+0x3d41fa exception.instruction: in eax, dx exception.module: new.exe exception.exception_code: 0xc0000096 exception.offset: 4014586 exception.address: 0x15541fa registers.esp: 2882356 registers.edi: 20572927 registers.eax: 1447909480 registers.ebp: 19210240 registers.edx: 22104 registers.ebx: 2256917605 registers.esi: 20585770 registers.ecx: 10	1	0	0

File has been identified by 24 AntiVirus engines on VirusTotal as malicious (24 events)

Bkav	W32.AIDetectMalware
Elastic	malicious (high confidence)
Sangfor	Trojan.Win32.Save.a
CrowdStrike	win/malicious_confidence_100% (W)
BitDefenderTheta	Gen:NN.ZexaF.36318.cA1@aG@zdSbO
Symantec	ML.Attribute.HighConfidence
tehtris	Generic.Malware
ESET-NOD32	a variant of Win32/GenCBL.DLB
Cynet	Malicious (score: 100)
APEX	Malicious
Kaspersky	VHO:Backdoor.Win32.Agent.gen
NANO-Antivirus	Virus.Win32.Gen-Crypt.ccnc
Trapmine	malicious.high.ml.score
FireEye	Generic.mg.8bb15c76e2d55780
SentinelOne	Static AI - Suspicious PE
Microsoft	Trojan:Win32/Emotet!ml
ZoneAlarm	VHO:Backdoor.Win32.Agent.gen
Google	Detected
Acronis	suspicious
VBA32	BScope.Trojan.Occamy
Cylance	unsafe
Rising	Trojan.Generic@AI.100 (RDML:x2xwA+H+6iJUyGz5giNBuA)
Ikarus	Trojan.Agent
DeepInstinct	MALICIOUS

Executed a process and injected code into it, probably while unpacking (19 events)

Time & API	Arguments	Status	Return
NtGetContextThread July 23, 2023, 9:40 a.m.	thread_handle: 0xfffffffe	1	0
NtResumeThread July 23, 2023, 9:40 a.m.	thread_handle: 0x000000f8 suspend_count: 1 process_identifier: 2652	1	0
NtResumeThread July 23, 2023, 9:40 a.m.	thread_handle: 0x00000168 suspend_count: 1 process_identifier: 2652	1	0
NtResumeThread July 23, 2023, 9:40 a.m.	thread_handle: 0x000001a4 suspend_count: 1 process_identifier: 2652	1	0
CreateProcessInternalW July 23, 2023, 9:41 a.m.	thread_identifier: 2816 thread_handle: 0x00000238 process_identifier: 2812 current_directory: filepath: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe track: 1 command_line: filepath_r: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x0000023c	1	1
NtGetContextThread July 23, 2023, 9:41 a.m.	thread_handle: 0x00000238	1	0
NtAllocateVirtualMemory July 23, 2023, 9:41 a.m.	process_identifier: 2812 region_size: 413696 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000023c		3221225496
CreateProcessInternalW July 23, 2023, 9:41 a.m.	thread_identifier: 2852 thread_handle: 0x00000244 process_identifier: 2848 current_directory: filepath: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe track: 1 command_line: filepath_r: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000240	1	1
NtGetContextThread July 23, 2023, 9:41 a.m.	thread_handle: 0x00000244	1	0
NtAllocateVirtualMemory July 23, 2023, 9:41 a.m.	process_identifier: 2848 region_size: 413696 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000240	1	0
WriteProcessMemory July 23, 2023, 9:41 a.m.	buffer: MZx@xº´ Í!¸LÍ!This program cannot be run in DOS mode.$PELJ«µdàFà\|:@P@ï 0L0ÀLò.textÑDF `.rdata,¦`¨J@@.dataò@À.relocL0@B base_address: 0x00400000 process_identifier: 2848 process_handle: 0x00000240	1	1
WriteProcessMemory July 23, 2023, 9:41 a.m.	buffer: base_address: 0x00401000 process_identifier: 2848 process_handle: 0x00000240	1	1
WriteProcessMemory July 23, 2023, 9:41 a.m.	buffer: base_address: 0x00456000 process_identifier: 2848 process_handle: 0x00000240	1	1
WriteProcessMemory July 23, 2023, 9:41 a.m.	buffer: base_address: 0x00461000 process_identifier: 2848 process_handle: 0x00000240	1	1
WriteProcessMemory July 23, 2023, 9:41 a.m.	buffer: base_address: 0x00463000 process_identifier: 2848 process_handle: 0x00000240	1	1
WriteProcessMemory July 23, 2023, 9:41 a.m.	buffer: @ base_address: 0xfffde008 process_identifier: 2848 process_handle: 0x00000240	1	1
NtSetContextThread July 23, 2023, 9:41 a.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4405884 registers.ebp: 0 registers.edx: 0 registers.ebx: -139264 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000244 process_identifier: 2848	1	0
NtResumeThread July 23, 2023, 9:41 a.m.	thread_handle: 0x00000244 suspend_count: 1 process_identifier: 2848	1	0
NtResumeThread July 23, 2023, 9:41 a.m.	thread_handle: 0x0000011c suspend_count: 1 process_identifier: 2848	1	0

new.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All