Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Aug. 7, 2023, 8:42 a.m.	Aug. 7, 2023, 8:47 a.m.

Size	1.1MB
Type	PE32+ executable (GUI) x86-64, for MS Windows
MD5	`a490f1848b792df4dc37c9e1b200578d`
SHA256	`b61325a676000c0afb169f63048c583bc81cb52e1690a6ccf5642decb7831b5e`
CRC32	`210B8D41`
ssdeep	`24576:mDXdMCbh0lhSMXlPFN3RFEuHhra2oQfKhBdY7O8gz/7:mBMPt/G29fKhBdYy8ij`
Yara	UPX_Zero - UPX packed file OS_Processor_Check_Zero - OS Processor Check IsPE64 - (no description) Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature

Documents-EnemyFrauz.exe "C:\Users\test22\AppData\Local\Temp\Documents-EnemyFrauz.exe"
652
- Documents-EnemyFrauz.exe "C:\Users\test22\AppData\Local\Temp\Documents-EnemyFrauz.exe"
  2076
  - cmd.exe "C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\test22\AppData\Local\Temp\Documents-EnemyFrauz.exe"
    2716
    - PING.EXE ping 1.1.1.1 -n 1 -w 3000
      2780

Name	Response	Post-Analysis Lookup
api.ipify.org	A 64.185.227.156 CNAME api4.ipify.org A 104.237.62.211 A 173.231.16.76	64.185.227.156

IP Address	Status	Action
164.124.101.2	Active	Moloch
173.231.16.76	Active	Moloch
89.208.103.63	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.103:49164 -> 89.208.103.63:15666	2046303	ET MALWARE [ANY.RUN] Meduza Stealer Exfiltration	A Network Trojan was detected
TCP 192.168.56.103:49165 -> 173.231.16.76:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.103:49164 -> 89.208.103.63:15666	2046303	ET MALWARE [ANY.RUN] Meduza Stealer Exfiltration	A Network Trojan was detected
TCP 173.231.16.76:443 -> 192.168.56.103:49168	2029340	ET INFO TLS Handshake Failure	Potentially Bad Traffic
TCP 89.208.103.63:15666 -> 192.168.56.103:49164	2260003	SURICATA Applayer Protocol detection skipped	Generic Protocol Command Decode
TCP 192.168.56.103:49167 -> 173.231.16.76:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined

Suricata TLS

No Suricata TLS

Queries for the computername (1 event)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameW Aug. 7, 2023, 8:36 a.m.	computer_name: TEST22-PC	1	1	0

Checks if process is being debugged by a debugger (1 event)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Aug. 7, 2023, 8:35 a.m.			0	0

Tries to locate where the browsers are installed (1 event)

file	C:\Program Files\Mozilla Firefox\nss3.dll

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Aug. 7, 2023, 8:36 a.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (2 events)

section	_RDATA
section	.byteSec

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Steals private information from local Internet browsers (50 out of 282 events)

file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Web Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\SwReporter
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\igkpcodhieompeloncfnbekccinhapdb
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local Extension Settings\dfmbcapkkeejcpmfhpnglndfkgmalhik
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bocpokimicclpaiekenaeelehdjllofo
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gehmmocbbkpblljhkekmfhjpfbkclbph
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Login Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ldinpeekobnhjjdofggfgjlcehhmanlj
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Login Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\BrowserMetrics
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhhldecdfagpbfggphklkaeiocfnaafm
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddffflal
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Ya Passman Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local Extension Settings\apnehcjmnengpnmccpaibjmhhoadaico
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gjagmgiddbbciopjhllkdnddhcglnemk
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\UC Login Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local Extension Settings\dppgmdbiimibapkepcbdbmkaabgiofem
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjmkndjhnagcfbpiemnkdpomccnjblmj
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\BrowserMetrics-spare.pma
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Crashpad
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfel
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local Extension Settings\oeljdldpnmdbchonielidgobddffflal
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\OnDeviceHeadSuggestModel
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\OriginTrials
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Floc
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local Extension Settings\mfgccjchihfkkindfppnaooecgfneiii
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local Extension Settings\nhhldecdfagpbfggphklkaeiocfnaafm
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local Extension Settings\naepdomgkenhinolocfifgehidddafch
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje

Looks up the external IP address (1 event)

domain

api.ipify.org

Creates a shortcut to an executable file (1 event)

file	C:\Windows\System32\migwiz.lnk

Creates a suspicious process (2 events)

cmdline	"C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\test22\AppData\Local\Temp\Documents-EnemyFrauz.exe"
cmdline	cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\test22\AppData\Local\Temp\Documents-EnemyFrauz.exe"

A process created a hidden window (1 event)

Time & API	Arguments	Status	Return	Repeated
ShellExecuteExW Aug. 7, 2023, 8:36 a.m.	show_type: 0 filepath_r: cmd.exe parameters: /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\test22\AppData\Local\Temp\Documents-EnemyFrauz.exe" filepath: cmd.exe	1	1	0

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x000b7400', u'virtual_address': u'0x00069000', u'entropy': 7.466455517295297, u'name': u'.byteSec', u'virtual_size': u'0x000b7400'}

entropy

7.4664555173

description

A section with a high entropy has been found

entropy

0.647526501767

description

Overall entropy of this PE file is high

Yara rule detected in process memory (13 events)

description	Communications over RAW Socket	rule	Network_TCP_Socket
description	Match Windows Http API call	rule	Str_Win32_Http_API
description	Take ScreenShot	rule	ScreenShot
description	Code injection with CreateRemoteThread in a remote process	rule	Code_injection
description	Match Windows Inet API call	rule	Str_Win32_Internet_API
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep

Queries for potentially installed applications (2 events)

Time & API	Arguments	Status	Return	Repeated
RegOpenKeyExA Aug. 7, 2023, 8:36 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{53F49750-6209-4FBF-9CA8-7A333C87D1ED}_is1 base_handle: 0xffffffff80000001 key_handle: 0x0000000000000000 options: 0 access: 0x00020019 regkey: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{53F49750-6209-4FBF-9CA8-7A333C87D1ED}_is1		2	0
RegOpenKeyExA Aug. 7, 2023, 8:36 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{C4A4AE8F-B9F7-4CC7-8A6C-BF7EEE87ACA5}_is1 base_handle: 0xffffffff80000001 key_handle: 0x0000000000000000 options: 0 access: 0x00020019 regkey: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{C4A4AE8F-B9F7-4CC7-8A6C-BF7EEE87ACA5}_is1		2	0

Uses Windows utilities for basic Windows functionality (3 events)

cmdline	"C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\test22\AppData\Local\Temp\Documents-EnemyFrauz.exe"
cmdline	cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\test22\AppData\Local\Temp\Documents-EnemyFrauz.exe"
cmdline	ping 1.1.1.1 -n 1 -w 3000

Communicates with host for which no DNS query was performed (1 event)

host

89.208.103.63

Allocates execute permission to another process indicative of possible code injection (1 event)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory Aug. 7, 2023, 8:35 a.m.	process_identifier: 2076 region_size: 782336 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000140000000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000000000000230	1	0	0

Attempts to identify installed AV products by installation directory (7 events)

file	C:\Users\test22\AppData\Local\AVAST Software\Browser
file	C:\Users\test22\AppData\Roaming\AVAST Software\Browser
file	C:\Users\test22\AppData\Local\AVG\Browser
file	C:\Users\test22\AppData\Roaming\AVG\Browser
file	C:\ProgramData\Microsoft\Microsoft Antimalware
file	C:\Windows\Sandboxie.ini
file	C:\ProgramData\Microsoft\Microsoft Security Client

Attempts to access Bitcoin/ALTCoin wallets (2 events)

file	C:\Users\test22\AppData\Roaming\Electrum\config
file	C:\Users\test22\AppData\Roaming\Electrum\wallets

Attempts to detect Cuckoo Sandbox through the presence of a file (3 events)

file	C:\Python27\agent.pyw
file	C:\tmpvmqcut\analyzer.py
file	C:\tmp6o6lvv\analyzer.py

Creates known Dapato Trojan files, registry keys and/or mutexes (1 event)

file	C:\Windows\debug\PASSWD.LOG

Drops a binary and executes it (1 event)

file	C:\Users\test22\AppData\Local\Temp\Documents-EnemyFrauz.exe

Creates known Dyreza Banking Trojan files, registry keys and/or mutexes (1 event)

file	C:\Windows\SysWOW64\mfcsubs.dll

Creates known Hupigon files, registry keys and/or mutexes (1 event)

file	C:\Windows\bootstat.dat

Potential code injection by writing to the memory of another process (11 events)

Time & API	Arguments	Status	Return
WriteProcessMemory Aug. 7, 2023, 8:35 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $m8)rV_)rV_)rV_úQ^(rV_úP^(rV_S^IrV_R^9rV_U^!rV_úS^rV_úU^%rV_úR^<rV_)rW_ÃrV_úW^>rV_= _^%rV_= ©_(rV_= T^(rV_Rich)rV_PEdÿÂËdð"$ö H@ð` Ü ðÐàP@hà( ) 8) (à' @ è.textLõö `.rdataDà âú@@.data´CÜ @À.pdata@hPjú @@_RDATA\Àd@@.rsrcàÐf@@.reloc(àh@B base_address: 0x0000000140000000 process_identifier: 2076 process_handle: 0x0000000000000230	1	1
WriteProcessMemory Aug. 7, 2023, 8:35 a.m.	buffer: @ base_address: 0x000007fffffda010 process_identifier: 2076 process_handle: 0x0000000000000230	1	1
WriteProcessMemory Aug. 7, 2023, 8:35 a.m.	buffer: @ base_address: 0x000007fffffda010 process_identifier: 2076 process_handle: 0x0000000000000230	1	1
WriteProcessMemory Aug. 7, 2023, 8:35 a.m.	buffer: @ base_address: 0x000007fffffda010 process_identifier: 2076 process_handle: 0x0000000000000230	1	1
WriteProcessMemory Aug. 7, 2023, 8:35 a.m.	buffer: @ base_address: 0x000007fffffda010 process_identifier: 2076 process_handle: 0x0000000000000230	1	1
WriteProcessMemory Aug. 7, 2023, 8:35 a.m.	buffer: ²®»©äÔ·¥ ÷éàÐ³¡;4-&÷ûôíæßÕËÁ·ãÜÕÎÇÀ¹²« Ø o ` à} E 6 ÀS ø f¢_¢Q¢C¢5¢!¢ ¢ù¡å¡£££s£e£Q£=£)££ò¤ë¤Ý¤Ï¤Á¤³¤¥¤¤¤ base_address: 0x00000001400bc000 process_identifier: 2076 process_handle: 0x0000000000000230	1	1
WriteProcessMemory Aug. 7, 2023, 8:35 a.m.	buffer: @ base_address: 0x000007fffffda010 process_identifier: 2076 process_handle: 0x0000000000000230	1	1
WriteProcessMemory Aug. 7, 2023, 8:35 a.m.	buffer: 0 H`Ð}<?xml version='1.0' encoding='UTF-8' standalone='yes'?> <assembly xmlns='urn:schemas-microsoft-com:asm.v1' manifestVersion='1.0'> <trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"> <security> <requestedPrivileges> <requestedExecutionLevel level='asInvoker' uiAccess='false' /> </requestedPrivileges> </security> </trustInfo> </assembly> base_address: 0x00000001400bd000 process_identifier: 2076 process_handle: 0x0000000000000230	1	1
WriteProcessMemory Aug. 7, 2023, 8:35 a.m.	buffer: @ base_address: 0x000007fffffda010 process_identifier: 2076 process_handle: 0x0000000000000230	1	1
WriteProcessMemory Aug. 7, 2023, 8:35 a.m.	buffer: \|è¥ð¥ø¥¦¦¦(¦0¦8¦@¦H¦P¦X¦`¦h¦p¦x¦¦¦¦¦ ¦¨¦°¦¸¦À¦È¦Ð¦Ø¦à¦è¦ð¦ø¦§§§§ §(§0§8§@§H§P§X§p§x§§§§§ §¨§°§Ø§à§è§ Ø@¨P¨X¨`¨h¨p¨x¨¨¨¨¨ ¨¨¨°¨¸¨À¨È¨©© ©¨©°©¸©À©È©Ð©Ø©à©è©ð©ø©ªªªª ª(ª0ª8ª@ªHªPªXª`ªhªpªxªªªªª ª¨ª°ª¸ªÀªÈªÐªØªàªðªøª«««« «(«0«8«@«H«P«X«`«h«p«x««««« «¨«°«¸«À«È«Ð«Ø«à«è«ð«ø«¬¬¬¬ ¬(¬0¬8¬@¬H¬0 ( 0 8 @ H P X ` h p x Ð¨Ø¨à¨è¨ð¨ø¨©©©© ©(©0©8©@©H©¸©È©Ø©è©ø©ªª(ª8ªHªXªhªxªªª¨ª¸ªÈªØªèªøª««(«8«H«X«h«x«@ ÀÈ¤Ð¤Ø¤à¤0¥@¥P¥`¥p¥¥¥ ¥°¥À¥Ð¥à¥ð¥¦¦ ¦0¦@¦P¦`¦p¦¦¦ ¦°¦À¦Ð¦à¦ð¦§§ §0§@§P§`§p§§§ §°§À§Ð§à§ð§¨¨ ¨0¨@¨P¨`¨p¨¨¨ ¨°¨À¨Ð¨à¨ð¨©© ©0©P©`©p©©© ©°©À©Ð©à©ð©ªª ª0ª@ªPª`ªpªªª ª°ªP d(¥8¥H¥X¥h¥x¥¥¥¨¥¸¥È¥Ø¥è¥ø¥¦¦(¦8¦H¦X¦h¦x¦¦¦¨¦¸¦È¦Ø¦è¦ø¦§§(§8§H§X§h§x§§§¨§¸§È§Ø§è§ø§¨¨(¨8¨H¨X¨h¨x¨¨¨¨¨¸¨È¨Ø¨è¨ø¨©©(©8©H©X©h©x©©©¨©¸©È©Ø©è©ø©ªª(ª8ªHªXªhªxªªª¨ª¸ªÈªØªèªøª««(«8«H«X«h«x«««¨«¸«È«Ø«è«ø«¬¬(¬8¬H¬X¬h¬x¬¬¬¨¬¸¬È¬Ø¬è¬ø¬(8HXhx¨¸ÈØèø®®(®8®H®X®h®x®®®¨®¸®È®Ø®è®ø®¯¯(¯8¯H¯X¯h¯x¯¯¯¨¯¸¯È¯Ø¯è¯ø¯` ( 8 H X h x ¨ ¸ È Ø è ø ¡¡(¡8¡H¡X¡h¡x¡¡¡¨¡¸¡È¡Ø¡è¡ø¡¢¢(¢8¢H¢X¢h¢x¢¢¢¨¢¸¢È¢Ø¢è¢ø¢££(£8£H£X£p¯¯¯ ¯°¯À¯Ð¯à¯ð¯p À 0 @ P ` p ° À Ð à ð ¡¡ ¡0¡@¡P¡`¡p¡¡¡ ¡°¡À¡Ð¡à¡ð¡¢¢ ¢0¢@¢P¢`¢p¢¢¢ ¢°¢À¢Ð¢à¢ð¢££ £0£@£P£`£p£££ £°£À£Ð£à£ð£¤¤ ¤0¤@¤P¤`¤p¤¤¤ ¤°¤À¤Ð¤à¤ð¤¥¥ ¥0¥@¥P¥`¥p¥¥¥ ¥°¥À¥Ð¥à¥ð¥¦¦ ¦0¦@¦P¦`¦p¦¦¦ ¦°¦À¦Ð¦à¦ð¦§§ §0§@§P§`§p§§§ §°§À§Ð§à§ð§¨¨ ¨0¨@¨P¨`¨p¨¨¨ ¨°¨À¨Ð¨à¨ð¨©© ©0©@©P©`©p©©© ©°©À©Ð©à©ð©ªª ª0ª@ªPª`ªpªªª ª°ªÀªÐªàªðª«« «0«@«P«`«p««« «°«À«Ð«à«ð«¬¬ ¬0¬@¬P¬`¬p¬¬¬ ¬°¬À¬Ð¬à¬ð¬ 0@P`p H¤P¤X¤`¤h¤p¤x¤¤¤¤¨¤°¤¸¤¦ ¦(¦0¦P¦`¦p¦¦¦ ¦°¦À¦Ð¦à¦ð¦§§ §0§@§P§`§p§§§ §°§À§Ð§à§ð§¨¨ ¨0¨@¨P¨`¨p¨¨¨ ¨°¨À¨Ð¨à¨ð¨©© ©0©@©P©`©p©©© ©°©À©Ð©à©ð©ªª ª0ª@ªPª`ªpªªª ª°ªÀªÐªàªðª«« «0«@«P«`«p««« «°«À«Ð«à«ð«¬¬ ¬0¬@¬P¬`¬p¬¬¬ ¬°¬À¬Ð¬à¬ð¬ 0@P° Ì ¤(¤0¤`¦h¦p¦¦¦ ¦¨¦°¦¸¦À¦È¦Ð¦Ø¦à¦è¦©¨©¸©È©Ø©è©ø©ªª(ª8ªHªXªhªxªªª¨ª¸ªÈªØªèªøª««(«8«H«X«h«x«««¨«¸«È«Ø«è«ø«¬¬(¬8¬H¬X¬h¬x¬¬¬¨¬¸¬È¬Ø¬è¬ø¬(8HXhx¨¸ÈØèø®®(®8®H®X®h®x®À XH¥P¥X¥`¥h¥p¥x¥¥¥¥ ¥¨¥°¥¸¥À¥È¥Ð¥Ø¥à¥è¥ð¥ø¥¦¦¦¦ ¦(¦0¦8¦@¦H¦P¦X¦`¦h¦p¦x¦¦¦¦¦ ¦¨¦°¦¸¦À¦È¦Ð¦Ø¦à¦è¦ð¦ø¦§§§§ §(§0§8§@§H§P§X§`§h§p§x§§§§§ §¨§°§¸§À§È§Ð§Ø§à§è§ð§ø§¨¨¨¨ ¨(¨0¨8¨@¨h¨p¨x¨¨¨¨¨Ð¨Ø¨à¨è¨ð¨ø¨©©©© ©(©0©8©@©H©P©X©`©h©ø©ªªªª ª(ª0ª8ª@ªHªPªXª`ªhªpªxªªªªª¬ ¬0¬8¬@¬H¬P¬X¬`¬h¬x¬¬¬¬¬ ¬¨¬°¬È¬Ø¬è¬ð¬ø¬ ø¢££££ £x£££ £¨£°£À¤È¤Ð¤Ø¤à¤è¤ð¤ø¤¥¥¥¥ ¥(¥0¥¨¥°¥¸¥À¥È¥¨¦°¦¸¦À¦È¦Ð¦Ø¦PX`hpx ¨°¸ÀÈÐØàèðø 0¯8¯@¯H¯ Hà è ð ð¥ø¥¦¦¦¦ ¦(¦8¦§§§ §(§0§8§8¨P¨X¨à¨ø¨©©©©©©©©h ( 0 8 @ H P X h p x ¨ Ø¡à¡(¢H¢h¢¢¨¢Ø¢ð¢ø¢£8£@£ £¨£0¥8¥@¥H¥ ¬°¬À¬à®¯0¯X¯¯°¯Ø¯l 0 x ¨ à ¡X¡¡È¡ø¡(¢P¢p¢À¢£`££°£à£¤P¤¤Ð¤(¥P¥x¥¨¥à¥¦0¦p¦ ¦Ð¦0§§è§¨X¨¨Ð¨©`©°©ø© ª`ªðª8«`«¬ base_address: 0x00000001400be000 process_identifier: 2076 process_handle: 0x0000000000000230	1	1
WriteProcessMemory Aug. 7, 2023, 8:35 a.m.	buffer: @ base_address: 0x000007fffffda010 process_identifier: 2076 process_handle: 0x0000000000000230	1	1

Code injection by writing an executable or DLL to the memory of another process (1 event)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory Aug. 7, 2023, 8:35 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $m8)rV_)rV_)rV_úQ^(rV_úP^(rV_S^IrV_R^9rV_U^!rV_úS^rV_úU^%rV_úR^<rV_)rW_ÃrV_úW^>rV_= _^%rV_= ©_(rV_= T^(rV_Rich)rV_PEdÿÂËdð"$ö H@ð` Ü ðÐàP@hà( ) 8) (à' @ è.textLõö `.rdataDà âú@@.data´CÜ @À.pdata@hPjú @@_RDATA\Àd@@.rsrcàÐf@@.reloc(àh@B base_address: 0x0000000140000000 process_identifier: 2076 process_handle: 0x0000000000000230	1	1	0

Harvests credentials from local email clients (5 events)

file	C:\Users\test22\AppData\Local\Thunderbird\Profiles\hzkyl8yo.default
file	C:\Users\test22\AppData\Roaming\Thunderbird\Profiles\hzkyl8yo.default
registry	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676
registry	HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\HTTPMail Password
registry	HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001\IMAP User Name

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 652 called NtSetContextThread to modify thread in remote process 2076
NtSetContextThread Aug. 7, 2023, 8:35 a.m.	registers.r14: 0 registers.r15: 0 registers.rcx: 5369200712 registers.rsi: 0 registers.r10: 0 registers.rbx: 0 registers.rsp: 1898648 registers.r11: 0 registers.r8: 0 registers.r9: 0 registers.rip: 2003748096 registers.rdx: 8796092866560 registers.r12: 0 registers.rbp: 0 registers.rdi: 0 registers.rax: 0 registers.r13: 0 thread_handle: 0x000000000000022c process_identifier: 2076	1	0	0

Appends a known CryptoMix ransomware file extension to files that have been encrypted (1 event)

file	C:\Users\test22\AppData\Roaming\Exodus\exodus.wallet

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 652 resumed a thread in remote process 2076
NtResumeThread Aug. 7, 2023, 8:35 a.m.	thread_handle: 0x000000000000022c suspend_count: 1 process_identifier: 2076	1	0	0

Creates known Upatre files, registry keys and/or mutexes (1 event)

file	C:\Windows\System32\qcap.dll

Detects VirtualBox through the presence of a file (2 events)

file	C:\Windows\SysWOW64\VBoxOGL.dll
file	C:\Windows\Prefetch\VBOXDRVINST.EXE-7DCD6070.pf

Detects VirtualBox through the presence of a registry key (1 event)

registry

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\VirtualDeviceDrivers

Generates some ICMP traffic

Executed a process and injected code into it, probably while unpacking (23 events)

Time & API	Arguments	Status	Return
CreateProcessInternalW Aug. 7, 2023, 8:35 a.m.	thread_identifier: 2080 thread_handle: 0x000000000000022c process_identifier: 2076 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\Documents-EnemyFrauz.exe track: 1 command_line: filepath_r: C:\Users\test22\AppData\Local\Temp\Documents-EnemyFrauz.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x0000000000000230	1	1
NtGetContextThread Aug. 7, 2023, 8:35 a.m.	thread_handle: 0x000000000000022c	1	0
NtAllocateVirtualMemory Aug. 7, 2023, 8:35 a.m.	process_identifier: 2076 region_size: 782336 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000140000000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000000000000230	1	0
WriteProcessMemory Aug. 7, 2023, 8:35 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $m8)rV_)rV_)rV_úQ^(rV_úP^(rV_S^IrV_R^9rV_U^!rV_úS^rV_úU^%rV_úR^<rV_)rW_ÃrV_úW^>rV_= _^%rV_= ©_(rV_= T^(rV_Rich)rV_PEdÿÂËdð"$ö H@ð` Ü ðÐàP@hà( ) 8) (à' @ è.textLõö `.rdataDà âú@@.data´CÜ @À.pdata@hPjú @@_RDATA\Àd@@.rsrcàÐf@@.reloc(àh@B base_address: 0x0000000140000000 process_identifier: 2076 process_handle: 0x0000000000000230	1	1
WriteProcessMemory Aug. 7, 2023, 8:35 a.m.	buffer: base_address: 0x0000000140001000 process_identifier: 2076 process_handle: 0x0000000000000230	1	1
WriteProcessMemory Aug. 7, 2023, 8:35 a.m.	buffer: @ base_address: 0x000007fffffda010 process_identifier: 2076 process_handle: 0x0000000000000230	1	1
WriteProcessMemory Aug. 7, 2023, 8:35 a.m.	buffer: base_address: 0x0000000140091000 process_identifier: 2076 process_handle: 0x0000000000000230	1	1
WriteProcessMemory Aug. 7, 2023, 8:35 a.m.	buffer: @ base_address: 0x000007fffffda010 process_identifier: 2076 process_handle: 0x0000000000000230	1	1
WriteProcessMemory Aug. 7, 2023, 8:35 a.m.	buffer: base_address: 0x00000001400b0000 process_identifier: 2076 process_handle: 0x0000000000000230	1	1
WriteProcessMemory Aug. 7, 2023, 8:35 a.m.	buffer: @ base_address: 0x000007fffffda010 process_identifier: 2076 process_handle: 0x0000000000000230	1	1
WriteProcessMemory Aug. 7, 2023, 8:35 a.m.	buffer: base_address: 0x00000001400b5000 process_identifier: 2076 process_handle: 0x0000000000000230	1	1
WriteProcessMemory Aug. 7, 2023, 8:35 a.m.	buffer: @ base_address: 0x000007fffffda010 process_identifier: 2076 process_handle: 0x0000000000000230	1	1
WriteProcessMemory Aug. 7, 2023, 8:35 a.m.	buffer: ²®»©äÔ·¥ ÷éàÐ³¡;4-&÷ûôíæßÕËÁ·ãÜÕÎÇÀ¹²« Ø o ` à} E 6 ÀS ø f¢_¢Q¢C¢5¢!¢ ¢ù¡å¡£££s£e£Q£=£)££ò¤ë¤Ý¤Ï¤Á¤³¤¥¤¤¤ base_address: 0x00000001400bc000 process_identifier: 2076 process_handle: 0x0000000000000230	1	1
WriteProcessMemory Aug. 7, 2023, 8:35 a.m.	buffer: @ base_address: 0x000007fffffda010 process_identifier: 2076 process_handle: 0x0000000000000230	1	1
WriteProcessMemory Aug. 7, 2023, 8:35 a.m.	buffer: 0 H`Ð}<?xml version='1.0' encoding='UTF-8' standalone='yes'?> <assembly xmlns='urn:schemas-microsoft-com:asm.v1' manifestVersion='1.0'> <trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"> <security> <requestedPrivileges> <requestedExecutionLevel level='asInvoker' uiAccess='false' /> </requestedPrivileges> </security> </trustInfo> </assembly> base_address: 0x00000001400bd000 process_identifier: 2076 process_handle: 0x0000000000000230	1	1
WriteProcessMemory Aug. 7, 2023, 8:35 a.m.	buffer: @ base_address: 0x000007fffffda010 process_identifier: 2076 process_handle: 0x0000000000000230	1	1
WriteProcessMemory Aug. 7, 2023, 8:35 a.m.	buffer: \|è¥ð¥ø¥¦¦¦(¦0¦8¦@¦H¦P¦X¦`¦h¦p¦x¦¦¦¦¦ ¦¨¦°¦¸¦À¦È¦Ð¦Ø¦à¦è¦ð¦ø¦§§§§ §(§0§8§@§H§P§X§p§x§§§§§ §¨§°§Ø§à§è§ Ø@¨P¨X¨`¨h¨p¨x¨¨¨¨¨ ¨¨¨°¨¸¨À¨È¨©© ©¨©°©¸©À©È©Ð©Ø©à©è©ð©ø©ªªªª ª(ª0ª8ª@ªHªPªXª`ªhªpªxªªªªª ª¨ª°ª¸ªÀªÈªÐªØªàªðªøª«««« «(«0«8«@«H«P«X«`«h«p«x««««« «¨«°«¸«À«È«Ð«Ø«à«è«ð«ø«¬¬¬¬ ¬(¬0¬8¬@¬H¬0 ( 0 8 @ H P X ` h p x Ð¨Ø¨à¨è¨ð¨ø¨©©©© ©(©0©8©@©H©¸©È©Ø©è©ø©ªª(ª8ªHªXªhªxªªª¨ª¸ªÈªØªèªøª««(«8«H«X«h«x«@ ÀÈ¤Ð¤Ø¤à¤0¥@¥P¥`¥p¥¥¥ ¥°¥À¥Ð¥à¥ð¥¦¦ ¦0¦@¦P¦`¦p¦¦¦ ¦°¦À¦Ð¦à¦ð¦§§ §0§@§P§`§p§§§ §°§À§Ð§à§ð§¨¨ ¨0¨@¨P¨`¨p¨¨¨ ¨°¨À¨Ð¨à¨ð¨©© ©0©P©`©p©©© ©°©À©Ð©à©ð©ªª ª0ª@ªPª`ªpªªª ª°ªP d(¥8¥H¥X¥h¥x¥¥¥¨¥¸¥È¥Ø¥è¥ø¥¦¦(¦8¦H¦X¦h¦x¦¦¦¨¦¸¦È¦Ø¦è¦ø¦§§(§8§H§X§h§x§§§¨§¸§È§Ø§è§ø§¨¨(¨8¨H¨X¨h¨x¨¨¨¨¨¸¨È¨Ø¨è¨ø¨©©(©8©H©X©h©x©©©¨©¸©È©Ø©è©ø©ªª(ª8ªHªXªhªxªªª¨ª¸ªÈªØªèªøª««(«8«H«X«h«x«««¨«¸«È«Ø«è«ø«¬¬(¬8¬H¬X¬h¬x¬¬¬¨¬¸¬È¬Ø¬è¬ø¬(8HXhx¨¸ÈØèø®®(®8®H®X®h®x®®®¨®¸®È®Ø®è®ø®¯¯(¯8¯H¯X¯h¯x¯¯¯¨¯¸¯È¯Ø¯è¯ø¯` ( 8 H X h x ¨ ¸ È Ø è ø ¡¡(¡8¡H¡X¡h¡x¡¡¡¨¡¸¡È¡Ø¡è¡ø¡¢¢(¢8¢H¢X¢h¢x¢¢¢¨¢¸¢È¢Ø¢è¢ø¢££(£8£H£X£p¯¯¯ ¯°¯À¯Ð¯à¯ð¯p À 0 @ P ` p ° À Ð à ð ¡¡ ¡0¡@¡P¡`¡p¡¡¡ ¡°¡À¡Ð¡à¡ð¡¢¢ ¢0¢@¢P¢`¢p¢¢¢ ¢°¢À¢Ð¢à¢ð¢££ £0£@£P£`£p£££ £°£À£Ð£à£ð£¤¤ ¤0¤@¤P¤`¤p¤¤¤ ¤°¤À¤Ð¤à¤ð¤¥¥ ¥0¥@¥P¥`¥p¥¥¥ ¥°¥À¥Ð¥à¥ð¥¦¦ ¦0¦@¦P¦`¦p¦¦¦ ¦°¦À¦Ð¦à¦ð¦§§ §0§@§P§`§p§§§ §°§À§Ð§à§ð§¨¨ ¨0¨@¨P¨`¨p¨¨¨ ¨°¨À¨Ð¨à¨ð¨©© ©0©@©P©`©p©©© ©°©À©Ð©à©ð©ªª ª0ª@ªPª`ªpªªª ª°ªÀªÐªàªðª«« «0«@«P«`«p««« «°«À«Ð«à«ð«¬¬ ¬0¬@¬P¬`¬p¬¬¬ ¬°¬À¬Ð¬à¬ð¬ 0@P`p H¤P¤X¤`¤h¤p¤x¤¤¤¤¨¤°¤¸¤¦ ¦(¦0¦P¦`¦p¦¦¦ ¦°¦À¦Ð¦à¦ð¦§§ §0§@§P§`§p§§§ §°§À§Ð§à§ð§¨¨ ¨0¨@¨P¨`¨p¨¨¨ ¨°¨À¨Ð¨à¨ð¨©© ©0©@©P©`©p©©© ©°©À©Ð©à©ð©ªª ª0ª@ªPª`ªpªªª ª°ªÀªÐªàªðª«« «0«@«P«`«p««« «°«À«Ð«à«ð«¬¬ ¬0¬@¬P¬`¬p¬¬¬ ¬°¬À¬Ð¬à¬ð¬ 0@P° Ì ¤(¤0¤`¦h¦p¦¦¦ ¦¨¦°¦¸¦À¦È¦Ð¦Ø¦à¦è¦©¨©¸©È©Ø©è©ø©ªª(ª8ªHªXªhªxªªª¨ª¸ªÈªØªèªøª««(«8«H«X«h«x«««¨«¸«È«Ø«è«ø«¬¬(¬8¬H¬X¬h¬x¬¬¬¨¬¸¬È¬Ø¬è¬ø¬(8HXhx¨¸ÈØèø®®(®8®H®X®h®x®À XH¥P¥X¥`¥h¥p¥x¥¥¥¥ ¥¨¥°¥¸¥À¥È¥Ð¥Ø¥à¥è¥ð¥ø¥¦¦¦¦ ¦(¦0¦8¦@¦H¦P¦X¦`¦h¦p¦x¦¦¦¦¦ ¦¨¦°¦¸¦À¦È¦Ð¦Ø¦à¦è¦ð¦ø¦§§§§ §(§0§8§@§H§P§X§`§h§p§x§§§§§ §¨§°§¸§À§È§Ð§Ø§à§è§ð§ø§¨¨¨¨ ¨(¨0¨8¨@¨h¨p¨x¨¨¨¨¨Ð¨Ø¨à¨è¨ð¨ø¨©©©© ©(©0©8©@©H©P©X©`©h©ø©ªªªª ª(ª0ª8ª@ªHªPªXª`ªhªpªxªªªªª¬ ¬0¬8¬@¬H¬P¬X¬`¬h¬x¬¬¬¬¬ ¬¨¬°¬È¬Ø¬è¬ð¬ø¬ ø¢££££ £x£££ £¨£°£À¤È¤Ð¤Ø¤à¤è¤ð¤ø¤¥¥¥¥ ¥(¥0¥¨¥°¥¸¥À¥È¥¨¦°¦¸¦À¦È¦Ð¦Ø¦PX`hpx ¨°¸ÀÈÐØàèðø 0¯8¯@¯H¯ Hà è ð ð¥ø¥¦¦¦¦ ¦(¦8¦§§§ §(§0§8§8¨P¨X¨à¨ø¨©©©©©©©©h ( 0 8 @ H P X h p x ¨ Ø¡à¡(¢H¢h¢¢¨¢Ø¢ð¢ø¢£8£@£ £¨£0¥8¥@¥H¥ ¬°¬À¬à®¯0¯X¯¯°¯Ø¯l 0 x ¨ à ¡X¡¡È¡ø¡(¢P¢p¢À¢£`££°£à£¤P¤¤Ð¤(¥P¥x¥¨¥à¥¦0¦p¦ ¦Ð¦0§§è§¨X¨¨Ð¨©`©°©ø© ª`ªðª8«`«¬ base_address: 0x00000001400be000 process_identifier: 2076 process_handle: 0x0000000000000230	1	1
WriteProcessMemory Aug. 7, 2023, 8:35 a.m.	buffer: @ base_address: 0x000007fffffda010 process_identifier: 2076 process_handle: 0x0000000000000230	1	1
NtSetContextThread Aug. 7, 2023, 8:35 a.m.	registers.r14: 0 registers.r15: 0 registers.rcx: 5369200712 registers.rsi: 0 registers.r10: 0 registers.rbx: 0 registers.rsp: 1898648 registers.r11: 0 registers.r8: 0 registers.r9: 0 registers.rip: 2003748096 registers.rdx: 8796092866560 registers.r12: 0 registers.rbp: 0 registers.rdi: 0 registers.rax: 0 registers.r13: 0 thread_handle: 0x000000000000022c process_identifier: 2076	1	0
NtResumeThread Aug. 7, 2023, 8:35 a.m.	thread_handle: 0x000000000000022c suspend_count: 1 process_identifier: 2076	1	0
CreateProcessInternalW Aug. 7, 2023, 8:36 a.m.	thread_identifier: 2720 thread_handle: 0x00000000000003f4 process_identifier: 2716 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\cmd.exe track: 1 command_line: "C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\test22\AppData\Local\Temp\Documents-EnemyFrauz.exe" filepath_r: C:\Windows\System32\cmd.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x00000000000003fc	1	1
CreateProcessInternalW Aug. 7, 2023, 8:36 a.m.	thread_identifier: 2784 thread_handle: 0x0000000000000064 process_identifier: 2780 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\PING.EXE track: 1 command_line: ping 1.1.1.1 -n 1 -w 3000 filepath_r: C:\Windows\system32\PING.EXE stack_pivoted: 0 creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x0000000000000068	1	1
NtResumeThread Aug. 7, 2023, 8:36 a.m.	thread_handle: 0x00000000000000c0 suspend_count: 1 process_identifier: 2780	1	0

Documents-EnemyFrauz.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All