Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Aug. 3, 2023, 1:47 p.m.	Aug. 3, 2023, 1:50 p.m.

Size	1.2MB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`7456977c738208470a01d84ed531f081`
SHA256	`a8365f11592d8734cd2ca079a900cefa76831f672034a234aeab699f0c6cf0e5`
CRC32	`F66E3D03`
ssdeep	`24576:eFjEtEIaUGEKFHyjWhejQ9fzed3qRv0R69H2yedYl3/5L6:CsEzNbHyj4eEQ3qRo69NUM`
Yara	Is_DotNET_EXE - (no description) PE_Header_Zero - PE File Signature IsPE32 - (no description)

pablozx.exe "C:\Users\test22\AppData\Local\Temp\pablozx.exe"
2560
- cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /release
  2684
  - ipconfig.exe ipconfig /release
    2768
- cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /renew
  940
  - ipconfig.exe ipconfig /renew
    2112
- aspnet_compiler.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  2192
explorer.exe C:\Windows\Explorer.EXE
1452

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
62.102.148.185	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (2 events)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameW Aug. 3, 2023, 1:48 p.m.	computer_name: TEST22-PC	1	1	0
GetComputerNameW Aug. 3, 2023, 1:48 p.m.	computer_name: TEST22-PC	1	1	0

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Aug. 3, 2023, 1:47 p.m.			0	0
IsDebuggerPresent Aug. 3, 2023, 1:47 p.m.			0	0

Command line console output was observed (4 events)

Time & API	Arguments	Status	Return
WriteConsoleW Aug. 3, 2023, 1:47 p.m.	buffer: Windows IP Configuration console_handle: 0x00000007	1	1
WriteConsoleW Aug. 3, 2023, 1:47 p.m.	buffer: The operation failed as no adapter is in the state permissible for this operation. console_handle: 0x00000007	1	1
WriteConsoleW Aug. 3, 2023, 1:48 p.m.	buffer: Windows IP Configuration console_handle: 0x00000007	1	1
WriteConsoleW Aug. 3, 2023, 1:48 p.m.	buffer: The operation failed as no adapter is in the state permissible for this operation. console_handle: 0x00000007	1	1

Uses Windows APIs to generate a cryptographic key (5 events)

Time & API	Arguments	Status	Return
CryptExportKey Aug. 3, 2023, 1:47 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005ebb10 flags: 0 crypto_export_handle: 0x00000000 blob_type: 8	1	1
CryptExportKey Aug. 3, 2023, 1:47 p.m.	buffer: f · Î~º¦"¤ ÎB,¨ÁÚâ¸`ü¸Ó åNæ crypto_handle: 0x005ebb10 flags: 0 crypto_export_handle: 0x00000000 blob_type: 8	1	1
CryptExportKey Aug. 3, 2023, 1:47 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005eb490 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 3, 2023, 1:47 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005eb490 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 3, 2023, 1:47 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005eb650 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

Tries to locate where the browsers are installed (2 events)

file	C:\Program Files\Mozilla Firefox\firefox.exe
registry	HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\App Paths\firefox.exe

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Aug. 3, 2023, 1:47 p.m.		1	1	0

One or more processes crashed (1 event)

Time & API	Arguments	Status	Return	Repeated
__exception__ Aug. 3, 2023, 1:48 p.m.	stacktrace: aspnet_compiler+0x3738 @ 0x403738 aspnet_compiler+0x12a34 @ 0x412a34 aspnet_compiler+0x1570a @ 0x41570a aspnet_compiler+0x5ea7 @ 0x405ea7 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: 0f b7 01 66 89 02 41 41 42 42 66 85 c0 75 f1 c7 exception.symbol: lstrcpyW+0x16 IsBadStringPtrA-0x5b kernel32+0x33118 exception.instruction: movzx eax, word ptr [ecx] exception.module: kernel32.dll exception.exception_code: 0xc0000005 exception.offset: 209176 exception.address: 0x755e3118 registers.esp: 1831984 registers.edi: 1832116 registers.eax: 1832008 registers.ebp: 1832024 registers.edx: 46530560 registers.ebx: 0 registers.esi: 1832280 registers.ecx: 0	1	0	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (50 out of 101 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Aug. 3, 2023, 1:47 p.m.	process_identifier: 2560 region_size: 1245184 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00880000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 3, 2023, 1:47 p.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00970000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 3, 2023, 1:47 p.m.	process_identifier: 2560 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x727a1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 3, 2023, 1:47 p.m.	process_identifier: 2560 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x727a2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 3, 2023, 1:47 p.m.	process_identifier: 2560 region_size: 1048576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x020d0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 3, 2023, 1:47 p.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02190000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 3, 2023, 1:47 p.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004d2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 3, 2023, 1:47 p.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0056c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 3, 2023, 1:47 p.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007a0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 3, 2023, 1:47 p.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00585000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 3, 2023, 1:47 p.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0058b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 3, 2023, 1:47 p.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00587000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 3, 2023, 1:47 p.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007a1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 3, 2023, 1:47 p.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004da000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 3, 2023, 1:47 p.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0057a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 3, 2023, 1:47 p.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00577000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 3, 2023, 1:47 p.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0056a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 3, 2023, 1:47 p.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00576000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 3, 2023, 1:47 p.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007a2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 3, 2023, 1:47 p.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007a3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 3, 2023, 1:47 p.m.	process_identifier: 2560 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007a4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 3, 2023, 1:47 p.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007a6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 3, 2023, 1:47 p.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007a7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 3, 2023, 1:47 p.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007a8000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 3, 2023, 1:47 p.m.	process_identifier: 2560 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007a9000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 3, 2023, 1:47 p.m.	process_identifier: 2560 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x732a2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 3, 2023, 1:47 p.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007ab000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 3, 2023, 1:47 p.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007ac000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 3, 2023, 1:47 p.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05150000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 3, 2023, 1:47 p.m.	process_identifier: 2560 region_size: 28672 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05151000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 3, 2023, 1:47 p.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05158000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 3, 2023, 1:47 p.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x021d0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 3, 2023, 1:47 p.m.	process_identifier: 2560 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73c14000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 3, 2023, 1:47 p.m.	process_identifier: 2560 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05159000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 3, 2023, 1:47 p.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0056d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 3, 2023, 1:47 p.m.	process_identifier: 2560 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0515b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 3, 2023, 1:47 p.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0515d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 3, 2023, 1:47 p.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0056e000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 3, 2023, 1:47 p.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x021ef000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 3, 2023, 1:47 p.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x021e0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 3, 2023, 1:47 p.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0515e000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 3, 2023, 1:47 p.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05640000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 3, 2023, 1:47 p.m.	process_identifier: 2560 region_size: 61440 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05641000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 3, 2023, 1:47 p.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04570000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 3, 2023, 1:47 p.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04571000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 3, 2023, 1:47 p.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04572000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 3, 2023, 1:47 p.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04573000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 3, 2023, 1:47 p.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04574000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 3, 2023, 1:47 p.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04575000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 3, 2023, 1:47 p.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04576000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

A process attempted to delay the analysis task. (1 event)

description

aspnet_compiler.exe tried to sleep 121 seconds, actually delayed analysis time by 121 seconds

Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation (1 event)

Time & API	Arguments	Status	Return	Repeated
GetDiskFreeSpaceW Aug. 3, 2023, 1:48 p.m.	number_of_free_clusters: 8362495 sectors_per_cluster: 8362495 bytes_per_sector: 512 root_path: C: total_number_of_clusters: 8362495	1	1	0

Steals private information from local Internet browsers (3 events)

file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local State
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Login Data
file	C:\Users\test22\AppData\Local\Chromium\User Data\Default\Login Data

Creates executable files on the filesystem (6 events)

file	C:\Users\test22\AppData\Local\Temp\softokn3.dll
file	C:\Users\test22\AppData\Local\Temp\vcruntime140.dll
file	C:\Users\test22\AppData\Local\Temp\mozglue.dll
file	C:\Users\test22\AppData\Local\Temp\nss3.dll
file	C:\Users\test22\AppData\Local\Temp\msvcp140.dll
file	C:\Users\test22\AppData\Local\Temp\freebl3.dll

Creates a suspicious process (2 events)

cmdline	"C:\Windows\System32\cmd.exe" /c ipconfig /release
cmdline	"C:\Windows\System32\cmd.exe" /c ipconfig /renew

Executes one or more WMI queries (1 event)

wmi

A process created a hidden window (2 events)

Time & API	Arguments	Status	Return	Repeated
ShellExecuteExW Aug. 3, 2023, 1:47 p.m.	show_type: 0 filepath_r: cmd parameters: /c ipconfig /release filepath: cmd	1	1	0
ShellExecuteExW Aug. 3, 2023, 1:48 p.m.	show_type: 0 filepath_r: cmd parameters: /c ipconfig /renew filepath: cmd	1	1	0

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses Aug. 3, 2023, 1:47 p.m.	flags: 15 family: 2		111	0

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x000d6a00', u'virtual_address': u'0x00002000', u'entropy': 7.913801159578582, u'name': u'.text', u'virtual_size': u'0x000d6904'}

entropy

7.91380115958

description

A section with a high entropy has been found

entropy

0.723861720067

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 event)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW Aug. 3, 2023, 1:47 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Yara rule detected in process memory (17 events)

description	Escalate priviledges	rule	Escalate_priviledges
description	PWS Memory	rule	Generic_PWS_Memory_Zero
description	Communications use DNS	rule	Network_DNS
description	Code injection with CreateRemoteThread in a remote process	rule	Code_injection
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep
description	Affect hook table	rule	win_hook
description	Install itself for autorun at Windows startup	rule	Persistence
description	email clients info stealer	rule	infoStealer_emailClients_Zero
description	Run a KeyLogger	rule	KeyLogger
description	File Downloader	rule	Network_Downloader

Terminates another process (2 events)

Time & API	Arguments	Status	Return	Repeated
NtTerminateProcess Aug. 3, 2023, 1:48 p.m.	status_code: 0xffffffff process_identifier: 152 process_handle: 0x000003c8		0	0
NtTerminateProcess Aug. 3, 2023, 1:48 p.m.	status_code: 0xffffffff process_identifier: 152 process_handle: 0x000003c8	1	0	0

Uses Windows utilities for basic Windows functionality (6 events)

cmdline	ipconfig /renew
cmdline	ipconfig /release
cmdline	"C:\Windows\System32\cmd.exe" /c ipconfig /release
cmdline	cmd /c ipconfig /renew
cmdline	cmd /c ipconfig /release
cmdline	"C:\Windows\System32\cmd.exe" /c ipconfig /renew

One or more of the buffers contains an embedded PE file (1 event)

buffer

Buffer with sha1: 572efc91e13f3120b49e2e3c4dc5ce2c4f2cd460

Communicates with host for which no DNS query was performed (1 event)

host

62.102.148.185

Allocates execute permission to another process indicative of possible code injection (2 events)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory Aug. 3, 2023, 1:48 p.m.	process_identifier: 152 region_size: 1433600 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000003b0		3221225496	0
NtAllocateVirtualMemory Aug. 3, 2023, 1:48 p.m.	process_identifier: 2192 region_size: 1433600 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000003a8	1	0	0

Installs itself for autorun at Windows startup (1 event)

reg_key

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\Pnuheqgk

reg_value

C:\Users\test22\AppData\Roaming\Pnuheqgk.exe

Manipulates memory of a non-child process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2560 manipulating memory of non-child process 152
NtAllocateVirtualMemory Aug. 3, 2023, 1:48 p.m.	process_identifier: 152 region_size: 1433600 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000003b0		3221225496	0

Potential code injection by writing to the memory of another process (3 events)

Time & API	Arguments	Status	Return
WriteProcessMemory Aug. 3, 2023, 1:48 p.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $n·ÇìäÇìäÇìäã_äÆìäÎäÆìäã]äÅìäàmäÆìäànäÄìäÂàäÆìäÎäÃìäÎäØìäÇìä5ìäT å°ìäTåÆìäRichÇìäPELrìE_àRP(^p@à@ª,°à0©p.textwPR `.rdata\|NpPV@@.dataÐíÀ¨¦@À.relocà°N@B.bssÐ`@@ base_address: 0x00400000 process_identifier: 2192 process_handle: 0x000003a8	1	1
WriteProcessMemory Aug. 3, 2023, 1:48 p.m.	buffer: 2ðì)>:©?©ÛÝß¬_zÎZÔ õýã3ìÍ\¾ð¾2y-ûETIï%JlïÁ¾f`Pøtßa9X©Xd¿lq¥7_ÕÔ[m`Q·uL»Î`Ô3\|Í¶H<¦J×¶gìú¯d4(êàDä;ïÝfhâ {¢ÐÀÎ¢³øÔèÓÓÑ,©²_,5Z¥Øhûï}î¥ýÈ6Ø½ W.¬å¸(.¯/üì° base_address: 0x0055d000 process_identifier: 2192 process_handle: 0x000003a8	1	1
WriteProcessMemory Aug. 3, 2023, 1:48 p.m.	buffer: @ base_address: 0x7efde008 process_identifier: 2192 process_handle: 0x000003a8	1	1

Code injection by writing an executable or DLL to the memory of another process (1 event)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory Aug. 3, 2023, 1:48 p.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $n·ÇìäÇìäÇìäã_äÆìäÎäÆìäã]äÅìäàmäÆìäànäÄìäÂàäÆìäÎäÃìäÎäØìäÇìä5ìäT å°ìäTåÆìäRichÇìäPELrìE_àRP(^p@à@ª,°à0©p.textwPR `.rdata\|NpPV@@.dataÐíÀ¨¦@À.relocà°N@B.bssÐ`@@ base_address: 0x00400000 process_identifier: 2192 process_handle: 0x000003a8	1	1	0

Harvests credentials from local email clients (3 events)

registry	HKEY_CURRENT_USER\Software\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676
registry	HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
registry	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2560 called NtSetContextThread to modify thread in remote process 2192
NtSetContextThread Aug. 3, 2023, 1:48 p.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4218408 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x000003c8 process_identifier: 2192	1	0	0

Attempts to remove evidence of file being downloaded from the Internet (1 event)

file	C:\Users\test22\AppData\Local\Temp\:Zone.Identifier

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2560 resumed a thread in remote process 2192
NtResumeThread Aug. 3, 2023, 1:48 p.m.	thread_handle: 0x000003c8 suspend_count: 1 process_identifier: 2192	1	0	0

Collects information on the system (ipconfig, netstat, systeminfo) (2 events)

cmdline	cmd /c ipconfig /renew
cmdline	cmd /c ipconfig /release

Executed a process and injected code into it, probably while unpacking (22 events)

Time & API	Arguments	Status	Return
NtResumeThread Aug. 3, 2023, 1:47 p.m.	thread_handle: 0x000000dc suspend_count: 1 process_identifier: 2560	1	0
NtResumeThread Aug. 3, 2023, 1:47 p.m.	thread_handle: 0x00000150 suspend_count: 1 process_identifier: 2560	1	0
NtResumeThread Aug. 3, 2023, 1:47 p.m.	thread_handle: 0x00000190 suspend_count: 1 process_identifier: 2560	1	0
CreateProcessInternalW Aug. 3, 2023, 1:47 p.m.	thread_identifier: 2688 thread_handle: 0x0000039c process_identifier: 2684 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\cmd.exe track: 1 command_line: "C:\Windows\System32\cmd.exe" /c ipconfig /release filepath_r: C:\Windows\System32\cmd.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x000003a4	1	1
CreateProcessInternalW Aug. 3, 2023, 1:48 p.m.	thread_identifier: 1964 thread_handle: 0x000003c0 process_identifier: 940 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\cmd.exe track: 1 command_line: "C:\Windows\System32\cmd.exe" /c ipconfig /renew filepath_r: C:\Windows\System32\cmd.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x000003d4	1	1
CreateProcessInternalW Aug. 3, 2023, 1:48 p.m.	thread_identifier: 196 thread_handle: 0x000003ac process_identifier: 152 current_directory: filepath: track: 1 command_line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe filepath_r: stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x000003b0	1	1
NtGetContextThread Aug. 3, 2023, 1:48 p.m.	thread_handle: 0x000003ac	1	0
NtAllocateVirtualMemory Aug. 3, 2023, 1:48 p.m.	process_identifier: 152 region_size: 1433600 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000003b0		3221225496
CreateProcessInternalW Aug. 3, 2023, 1:48 p.m.	thread_identifier: 2196 thread_handle: 0x000003c8 process_identifier: 2192 current_directory: filepath: track: 1 command_line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe filepath_r: stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x000003a8	1	1
NtGetContextThread Aug. 3, 2023, 1:48 p.m.	thread_handle: 0x000003c8	1	0
NtAllocateVirtualMemory Aug. 3, 2023, 1:48 p.m.	process_identifier: 2192 region_size: 1433600 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000003a8	1	0
WriteProcessMemory Aug. 3, 2023, 1:48 p.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $n·ÇìäÇìäÇìäã_äÆìäÎäÆìäã]äÅìäàmäÆìäànäÄìäÂàäÆìäÎäÃìäÎäØìäÇìä5ìäT å°ìäTåÆìäRichÇìäPELrìE_àRP(^p@à@ª,°à0©p.textwPR `.rdata\|NpPV@@.dataÐíÀ¨¦@À.relocà°N@B.bssÐ`@@ base_address: 0x00400000 process_identifier: 2192 process_handle: 0x000003a8	1	1
WriteProcessMemory Aug. 3, 2023, 1:48 p.m.	buffer: base_address: 0x00401000 process_identifier: 2192 process_handle: 0x000003a8	1	1
WriteProcessMemory Aug. 3, 2023, 1:48 p.m.	buffer: base_address: 0x00417000 process_identifier: 2192 process_handle: 0x000003a8	1	1
WriteProcessMemory Aug. 3, 2023, 1:48 p.m.	buffer: base_address: 0x0041c000 process_identifier: 2192 process_handle: 0x000003a8	1	1
WriteProcessMemory Aug. 3, 2023, 1:48 p.m.	buffer: base_address: 0x0055b000 process_identifier: 2192 process_handle: 0x000003a8	1	1
WriteProcessMemory Aug. 3, 2023, 1:48 p.m.	buffer: 2ðì)>:©?©ÛÝß¬_zÎZÔ õýã3ìÍ\¾ð¾2y-ûETIï%JlïÁ¾f`Pøtßa9X©Xd¿lq¥7_ÕÔ[m`Q·uL»Î`Ô3\|Í¶H<¦J×¶gìú¯d4(êàDä;ïÝfhâ {¢ÐÀÎ¢³øÔèÓÓÑ,©²_,5Z¥Øhûï}î¥ýÈ6Ø½ W.¬å¸(.¯/üì° base_address: 0x0055d000 process_identifier: 2192 process_handle: 0x000003a8	1	1
WriteProcessMemory Aug. 3, 2023, 1:48 p.m.	buffer: @ base_address: 0x7efde008 process_identifier: 2192 process_handle: 0x000003a8	1	1
NtSetContextThread Aug. 3, 2023, 1:48 p.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4218408 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x000003c8 process_identifier: 2192	1	0
NtResumeThread Aug. 3, 2023, 1:48 p.m.	thread_handle: 0x000003c8 suspend_count: 1 process_identifier: 2192	1	0
CreateProcessInternalW Aug. 3, 2023, 1:47 p.m.	thread_identifier: 2772 thread_handle: 0x00000084 process_identifier: 2768 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\ipconfig.exe track: 1 command_line: ipconfig /release filepath_r: C:\Windows\system32\ipconfig.exe stack_pivoted: 0 creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x00000088	1	1
CreateProcessInternalW Aug. 3, 2023, 1:48 p.m.	thread_identifier: 2116 thread_handle: 0x00000084 process_identifier: 2112 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\ipconfig.exe track: 1 command_line: ipconfig /renew filepath_r: C:\Windows\system32\ipconfig.exe stack_pivoted: 0 creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x00000088	1	1

File has been identified by 43 AntiVirus engines on VirusTotal as malicious (43 events)

Lionic	Trojan.Win32.Seraph.4!c
Cynet	Malicious (score: 100)
Cylance	unsafe
Sangfor	Suspicious.Win32.Save.a
Alibaba	Trojan:MSIL/GenKryptik.eb65bbb0
Cybereason	malicious.032ecd
BitDefenderTheta	Gen:NN.ZemsilF.36348.kn0@aakHlhh
VirIT	Trojan.Win32.MSIL_Heur.A
Cyren	W32/MSIL_Kryptik.JRW.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	a variant of MSIL/GenKryptik.GMKS
APEX	Malicious
Kaspersky	UDS:DangerousObject.Multi.Generic
BitDefender	Gen:Variant.Ser.MSILHeracles.2311
MicroWorld-eScan	Gen:Variant.Ser.MSILHeracles.2311
Avast	FileRepMalware [Trj]
Rising	Trojan.Kryptik!8.8 (CLOUD)
Emsisoft	Gen:Variant.Ser.MSILHeracles.2311 (B)
F-Secure	Trojan.TR/Kryptik.lfimw
VIPRE	Gen:Variant.Ser.MSILHeracles.2311
McAfee-GW-Edition	BehavesLike.Win32.Generic.th
Trapmine	malicious.moderate.ml.score
FireEye	Generic.mg.7456977c73820847
Sophos	Mal/Generic-S
Ikarus	Win32.Outbreak
GData	Gen:Variant.Ser.MSILHeracles.2311
Avira	TR/Kryptik.lfimw
Arcabit	Trojan.Ser.MSILHeracles.D907
ZoneAlarm	UDS:DangerousObject.Multi.Generic
Microsoft	Trojan:Win32/Wacatac.B!ml
Google	Detected
Acronis	suspicious
McAfee	Artemis!7456977C7382
MAX	malware (ai score=84)
Malwarebytes	MachineLearning/Anomalous.100%
Panda	Trj/Chgt.AD
SentinelOne	Static AI - Malicious PE
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	MSIL/GenKryptik.GMKS!tr
AVG	FileRepMalware [Trj]
DeepInstinct	MALICIOUS
CrowdStrike	win/malicious_confidence_100% (W)

pablozx.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All