Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Aug. 2, 2023, 9:52 a.m.	Aug. 2, 2023, 10 a.m.

Size	2.8MB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`5efbe5d0bcd3b6a78d4ee2b4ea3236e4`
SHA256	`d7426a296d6be3d59f4a746b7ac5bfaf32c55279485dd67054e7f50ac6fdd181`
CRC32	`C191F6FB`
ssdeep	`49152:xuPeaOJ1momZQaOqThKidlPrttczuW9TB++q2ETAkdPS3KNGfXcR5JbIl:I1DZQaOqTQoPhXW9TQEEgKNccRQ`
Yara	UPX_Zero - UPX packed file Obsidium_Zero - Obsidium protector file anti_vm_detect - Possibly employs anti-virtualization techniques Is_DotNET_EXE - (no description) PE_Header_Zero - PE File Signature themida_packer - themida packer IsPE32 - (no description) Generic_Malware_Zero - Generic Malware

BRR.exe "C:\Users\test22\AppData\Local\Temp\BRR.exe"
2544

Name	Response	Post-Analysis Lookup
pastebin.com	A 172.67.34.170 A 104.20.67.143 A 104.20.68.143	172.67.34.170

IP Address	Status	Action
164.124.101.2	Active	Moloch
172.67.34.170	Active	Moloch
95.143.190.57	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.101:49165 -> 172.67.34.170:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined

Suricata TLS

Flow	Issuer	Subject	Fingerprint
TLSv1 192.168.56.101:49165 172.67.34.170:443	C=US, O=Cloudflare, Inc., CN=Cloudflare Inc RSA CA-2	C=US, ST=California, L=San Francisco, O=Cloudflare, Inc., CN=sni.cloudflaressl.com	c7:af:cc:81:4d:27:d1:4c:7c:f4:bf:5d:55:9d:80:50:3b:6f:6c:cd

Queries for the computername (1 event)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameW Aug. 2, 2023, 9:52 a.m.	computer_name: TEST22-PC	1	1	0

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Aug. 2, 2023, 9:52 a.m.			0	0
IsDebuggerPresent Aug. 2, 2023, 9:52 a.m.			0	0

Uses Windows APIs to generate a cryptographic key (3 events)

Time & API	Arguments	Status	Return
CryptExportKey Aug. 2, 2023, 9:52 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00cb68a8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 2, 2023, 9:52 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00cb68a8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 2, 2023, 9:52 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00cb6768 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Aug. 2, 2023, 9:52 a.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 events)

section
section	.themida
section	.boot

One or more processes crashed (5 events)

Time & API	Arguments	Status
__exception__ Aug. 2, 2023, 9:52 a.m.	stacktrace: brr+0x4442da @ 0x8442da brr+0x405e84 @ 0x805e84 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc e9 30 5e c9 8a 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008e exception.offset: 46887 exception.address: 0x7597b727 registers.esp: 1638148 registers.edi: 4816896 registers.eax: 1638148 registers.ebp: 1638228 registers.edx: 2130566132 registers.ebx: 0 registers.esi: 1995994155 registers.ecx: 2122317824	1
__exception__ Aug. 2, 2023, 9:52 a.m.	stacktrace: exception.instruction_r: ed e9 84 78 06 00 c3 e9 76 e2 06 00 e6 aa 00 00 exception.symbol: brr+0x3ba7e2 exception.instruction: in eax, dx exception.module: BRR.exe exception.exception_code: 0xc0000096 exception.offset: 3909602 exception.address: 0x7ba7e2 registers.esp: 1638268 registers.edi: 6686904 registers.eax: 1750617430 registers.ebp: 4816896 registers.edx: 22614 registers.ebx: 4194304 registers.esi: 6341403 registers.ecx: 20	1
__exception__ Aug. 2, 2023, 9:52 a.m.	stacktrace: exception.instruction_r: ed e9 22 f4 01 00 8b 52 27 44 5a ed 7b 00 0a 00 exception.symbol: brr+0x41c211 exception.instruction: in eax, dx exception.module: BRR.exe exception.exception_code: 0xc0000096 exception.offset: 4309521 exception.address: 0x81c211 registers.esp: 1638268 registers.edi: 6686904 registers.eax: 1447909480 registers.ebp: 4816896 registers.edx: 22104 registers.ebx: 2256917605 registers.esi: 6341403 registers.ecx: 10	1
__exception__ Aug. 2, 2023, 9:52 a.m.	stacktrace: 0x5824cac 0x5824c68 0x4ea65b2 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x727a2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x727b264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x727b2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x728674ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72867610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x728f1dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x728f1e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x728f1f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x728f416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7415f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x741d7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x741d4de3 exception.instruction_r: 8b 4e 04 8d 83 c6 fe ff ff 8b 15 44 38 a8 03 3b exception.instruction: mov ecx, dword ptr [esi + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x5826212 registers.esp: 1635448 registers.edi: 45040016 registers.eax: 92430848 registers.ebp: 1635460 registers.edx: 45040016 registers.ebx: 326 registers.esi: 0 registers.ecx: 0	1
__exception__ Aug. 2, 2023, 9:53 a.m.	stacktrace: 0x5824cac 0x5824c68 0x4ea65b2 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x727a2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x727b264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x727b2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x728674ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72867610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x728f1dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x728f1e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x728f1f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x728f416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7415f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x741d7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x741d4de3 exception.instruction_r: 8b 4e 04 8d 83 c6 fe ff ff 8b 15 44 38 a8 03 3b exception.instruction: mov ecx, dword ptr [esi + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x5826212 registers.esp: 1635448 registers.edi: 45200832 registers.eax: 45200832 registers.ebp: 1635460 registers.edx: 45200832 registers.ebx: 326 registers.esi: 0 registers.ecx: 0	1

HTTP traffic contains suspicious features which may be indicative of malware related traffic (1 event)

suspicious_features

GET method with no useragent header

suspicious_request

GET https://pastebin.com/raw/V1mwGj8h

Performs some HTTP requests (1 event)

request

GET https://pastebin.com/raw/V1mwGj8h

Allocates read-write-execute memory (usually to unpack itself) (50 out of 131 events)

Time & API	Arguments	Status
NtProtectVirtualMemory Aug. 2, 2023, 9:52 a.m.	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x755c1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 2, 2023, 9:52 a.m.	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7597d000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 2, 2023, 9:52 a.m.	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x755c4000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 2, 2023, 9:52 a.m.	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x755dc000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 2, 2023, 9:52 a.m.	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x755c1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 2, 2023, 9:52 a.m.	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7597b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 2, 2023, 9:52 a.m.	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x755c1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 2, 2023, 9:52 a.m.	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7597b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 2, 2023, 9:52 a.m.	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x755c1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 2, 2023, 9:52 a.m.	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7597d000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 2, 2023, 9:52 a.m.	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x755c7000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 2, 2023, 9:52 a.m.	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7597e000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 2, 2023, 9:52 a.m.	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x755ec000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 2, 2023, 9:52 a.m.	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7597b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 2, 2023, 9:52 a.m.	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x755ed000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 2, 2023, 9:52 a.m.	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7597c000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 2, 2023, 9:52 a.m.	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x755c4000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 2, 2023, 9:52 a.m.	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7597d000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 2, 2023, 9:52 a.m.	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x755c1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 2, 2023, 9:52 a.m.	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7597d000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 2, 2023, 9:52 a.m.	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x755dc000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 2, 2023, 9:52 a.m.	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75984000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 2, 2023, 9:52 a.m.	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x755da000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 2, 2023, 9:52 a.m.	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x755c5000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 2, 2023, 9:52 a.m.	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7597b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 2, 2023, 9:52 a.m.	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x755dc000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 2, 2023, 9:52 a.m.	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7597b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 2, 2023, 9:52 a.m.	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x755c1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 2, 2023, 9:52 a.m.	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7597b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 2, 2023, 9:52 a.m.	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x755c4000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 2, 2023, 9:52 a.m.	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7597b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 2, 2023, 9:52 a.m.	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x755c1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 2, 2023, 9:52 a.m.	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75981000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 2, 2023, 9:52 a.m.	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x755da000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 2, 2023, 9:52 a.m.	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x755c5000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 2, 2023, 9:52 a.m.	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x755c4000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 2, 2023, 9:52 a.m.	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75981000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 2, 2023, 9:52 a.m.	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x755c4000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 2, 2023, 9:52 a.m.	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x755c4000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 2, 2023, 9:52 a.m.	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75981000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 2, 2023, 9:52 a.m.	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x755c4000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 2, 2023, 9:52 a.m.	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x755c4000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 2, 2023, 9:52 a.m.	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75980000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 2, 2023, 9:52 a.m.	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x755c1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 2, 2023, 9:52 a.m.	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75981000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 2, 2023, 9:52 a.m.	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7563f000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 2, 2023, 9:52 a.m.	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x755c1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 2, 2023, 9:52 a.m.	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7597d000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 2, 2023, 9:52 a.m.	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x755c5000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 2, 2023, 9:52 a.m.	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x755c1000 process_handle: 0xffffffff	1

A process attempted to delay the analysis task. (1 event)

description

BRR.exe tried to sleep 127 seconds, actually delayed analysis time by 127 seconds

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses Aug. 2, 2023, 9:52 a.m.	flags: 15 family: 0		111	0

The binary likely contains encrypted or compressed data indicative of a packer (4 events)

section

{u'size_of_data': u'0x00043400', u'virtual_address': u'0x00002000', u'entropy': 7.991006543466323, u'name': u' ', u'virtual_size': u'0x00076000'}

entropy

7.99100654347

description

A section with a high entropy has been found

section

{u'size_of_data': u'0x0000e400', u'virtual_address': u'0x00078000', u'entropy': 7.937991943331222, u'name': u' ', u'virtual_size': u'0x000131d7'}

entropy

7.93799194333

description

A section with a high entropy has been found

section

{u'size_of_data': u'0x00277a00', u'virtual_address': u'0x004b2000', u'entropy': 7.934395865914733, u'name': u'.boot', u'virtual_size': u'0x00277a00'}

entropy

7.93439586591

description

A section with a high entropy has been found

entropy

0.990279465371

description

Overall entropy of this PE file is high

Expresses interest in specific running processes (1 event)

process

system

Communicates with host for which no DNS query was performed (1 event)

host

95.143.190.57

Checks for the presence of known windows from debuggers and forensic tools (12 events)

Time & API	Arguments	Status	Return	Repeated
FindWindowA Aug. 2, 2023, 9:52 a.m.	class_name: OLLYDBG window_name:		0	0
FindWindowA Aug. 2, 2023, 9:52 a.m.	class_name: GBDYLLO window_name:		0	0
FindWindowA Aug. 2, 2023, 9:52 a.m.	class_name: pediy06 window_name:		0	0
FindWindowA Aug. 2, 2023, 9:52 a.m.	class_name: RegmonClass window_name:		0	0
FindWindowA Aug. 2, 2023, 9:52 a.m.	class_name: RegmonClass window_name:		0	0
FindWindowA Aug. 2, 2023, 9:52 a.m.	class_name: Registry Monitor - Sysinternals: www.sysinternals.com window_name:		0	0
FindWindowA Aug. 2, 2023, 9:52 a.m.	class_name: 18467-41 window_name:		0	0
FindWindowA Aug. 2, 2023, 9:52 a.m.	class_name: FilemonClass window_name:		0	0
FindWindowA Aug. 2, 2023, 9:52 a.m.	class_name: FilemonClass window_name:		0	0
FindWindowA Aug. 2, 2023, 9:52 a.m.	class_name: #0 window_name: File Monitor - Sysinternals: www.sysinternals.com		0	0
FindWindowA Aug. 2, 2023, 9:52 a.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA Aug. 2, 2023, 9:52 a.m.	class_name: #0 window_name: Process Monitor - Sysinternals: www.sysinternals.com		0	0

Checks the version of Bios, possibly for anti-virtualization (2 events)

registry	HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion
registry	HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion

Detects Virtual Machines through their custom firmware (1 event)

Time & API	Arguments	Status	Return	Repeated
NtQuerySystemInformation Aug. 2, 2023, 9:52 a.m.	information_class: 76 (SystemFirmwareTableInformation)		3221225507	0

Detects VMWare through the in instruction feature (1 event)

Time & API	Arguments	Status	Return	Repeated
__exception__ Aug. 2, 2023, 9:52 a.m.	stacktrace: exception.instruction_r: ed e9 22 f4 01 00 8b 52 27 44 5a ed 7b 00 0a 00 exception.symbol: brr+0x41c211 exception.instruction: in eax, dx exception.module: BRR.exe exception.exception_code: 0xc0000096 exception.offset: 4309521 exception.address: 0x81c211 registers.esp: 1638268 registers.edi: 6686904 registers.eax: 1447909480 registers.ebp: 4816896 registers.edx: 22104 registers.ebx: 2256917605 registers.esi: 6341403 registers.ecx: 10	1	0	0

Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) (1 event)

dead_host

95.143.190.57:15647

File has been identified by 31 AntiVirus engines on VirusTotal as malicious (31 events)

Bkav	W32.AIDetectMalware
Lionic	Trojan.Win32.Convagent.trYj
tehtris	Generic.Malware
Cylance	unsafe
Sangfor	Suspicious.Win32.Save.a
Cybereason	malicious.b8acd5
BitDefenderTheta	Gen:NN.ZexaF.36348.0E0@aykXp4ci
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
APEX	Malicious
Cynet	Malicious (score: 100)
Kaspersky	UDS:DangerousObject.Multi.Generic
NANO-Antivirus	Virus.Win32.Gen-Crypt.ccnc
Avast	FileRepMalware [Drp]
McAfee-GW-Edition	BehavesLike.Win32.Generic.vc
Trapmine	malicious.high.ml.score
FireEye	Generic.mg.5efbe5d0bcd3b6a7
Sophos	Generic ML PUA (PUA)
Gridinsoft	Trojan.Win32.Gen.bot
ZoneAlarm	UDS:DangerousObject.Multi.Generic
Microsoft	Trojan:Win32/Sabsik.FL.B!ml
AhnLab-V3	Trojan/Win.Generic.R422854
Acronis	suspicious
McAfee	Artemis!5EFBE5D0BCD3
Malwarebytes	Trojan.MalPack
Zoner	Probably Heur.ExeHeaderL
Rising	Trojan.Generic@AI.100 (RDML:ulcU5jefa59/QLU829AyNQ)
SentinelOne	Static AI - Malicious PE
AVG	FileRepMalware [Drp]
DeepInstinct	MALICIOUS
CrowdStrike	win/malicious_confidence_100% (W)

BRR.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All