Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Feb. 4, 2024, 4:39 p.m.	Feb. 4, 2024, 4:43 p.m.

Size	418.5KB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`5bb552a7343723e6d81249cf19572f68`
SHA256	`f1885b88ad120bd0d62adc1d98e4e2d2d046440ccc0479713e57e4565dc98eed`
CRC32	`7973B769`
ssdeep	`12288:/0T9xnqfojPqWg8gbQ5mVfr419h3Rg/9:/0hxn9ji8gs5mVo9t2/`
Yara	IsPE32 - (no description) PE_Header_Zero - PE File Signature Is_DotNET_EXE - (no description)

V-14.exe "C:\Users\test22\AppData\Local\Temp\V-14.exe"
2552
- powershell.exe "powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'V-14';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'V-14' -Value '"C:\Users\test22\AppData\Local\Temp\V-14.exe"' -PropertyType 'String'
  2744

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
212.224.86.223	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.101:49163 -> 212.224.86.223:56002	2230002	SURICATA TLS invalid record type	Generic Protocol Command Decode
TCP 192.168.56.101:49163 -> 212.224.86.223:56002	2230010	SURICATA TLS invalid record/traffic	Generic Protocol Command Decode
TCP 192.168.56.101:49163 -> 212.224.86.223:56002	2260002	SURICATA Applayer Detect protocol only one direction	Generic Protocol Command Decode
TCP 212.224.86.223:56002 -> 192.168.56.101:49163	2230002	SURICATA TLS invalid record type	Generic Protocol Command Decode
TCP 212.224.86.223:56002 -> 192.168.56.101:49163	2230010	SURICATA TLS invalid record/traffic	Generic Protocol Command Decode
TCP 212.224.86.223:56002 -> 192.168.56.101:49163	2035595	ET MALWARE Generic AsyncRAT Style SSL Cert	Domain Observed Used for C2 Detected

Suricata TLS

Flow	Issuer	Subject	Fingerprint
TLSv1 192.168.56.101:49163 212.224.86.223:56002	CN=Wmphjepx	CN=Wmphjepx	71:0d:6d:c0:f6:2d:44:6d:1d:32:14:6f:51:41:32:5f:2d:dc:89:7f

Queries for the computername (13 events)

Time & API	Arguments	Status	Return
GetComputerNameW Feb. 4, 2024, 4:39 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Feb. 4, 2024, 4:39 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Feb. 4, 2024, 4:39 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Feb. 4, 2024, 4:39 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Feb. 4, 2024, 4:39 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Feb. 4, 2024, 4:39 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Feb. 4, 2024, 4:39 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Feb. 4, 2024, 4:39 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Feb. 4, 2024, 4:39 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Feb. 4, 2024, 4:39 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Feb. 4, 2024, 4:39 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Feb. 4, 2024, 4:39 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Feb. 4, 2024, 4:39 p.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (3 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Feb. 4, 2024, 4:39 p.m.			0	0
IsDebuggerPresent Feb. 4, 2024, 4:39 p.m.			0	0
IsDebuggerPresent Feb. 4, 2024, 4:39 p.m.			0	0

Command line console output was observed (19 events)

Time & API	Arguments	Status	Return
WriteConsoleW Feb. 4, 2024, 4:39 p.m.	buffer: Remove-ItemProperty : Property V-14 does not exist at path HKEY_CURRENT_USER\SO console_handle: 0x00000023	1	1
WriteConsoleW Feb. 4, 2024, 4:39 p.m.	buffer: FTWARE\Microsoft\Windows\CurrentVersion\Run. console_handle: 0x0000002f	1	1
WriteConsoleW Feb. 4, 2024, 4:39 p.m.	buffer: At line:1 char:20 console_handle: 0x0000003b	1	1
WriteConsoleW Feb. 4, 2024, 4:39 p.m.	buffer: + Remove-ItemProperty <<<< -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVers console_handle: 0x00000047	1	1
WriteConsoleW Feb. 4, 2024, 4:39 p.m.	buffer: ion\Run' -Name 'V-14';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\ console_handle: 0x00000053	1	1
WriteConsoleW Feb. 4, 2024, 4:39 p.m.	buffer: CurrentVersion\Run' -Name 'V-14' -Value 'C:\Users\test22\AppData\Local\Temp\V-1 console_handle: 0x0000005f	1	1
WriteConsoleW Feb. 4, 2024, 4:39 p.m.	buffer: 4.exe' -PropertyType 'String' console_handle: 0x0000006b	1	1
WriteConsoleW Feb. 4, 2024, 4:39 p.m.	buffer: + CategoryInfo : InvalidArgument: (V-14:String) [Remove-ItemPrope console_handle: 0x00000077	1	1
WriteConsoleW Feb. 4, 2024, 4:39 p.m.	buffer: rty], PSArgumentException console_handle: 0x00000083	1	1
WriteConsoleW Feb. 4, 2024, 4:39 p.m.	buffer: + FullyQualifiedErrorId : System.Management.Automation.PSArgumentException console_handle: 0x0000008f	1	1
WriteConsoleW Feb. 4, 2024, 4:39 p.m.	buffer: ,Microsoft.PowerShell.Commands.RemoveItemPropertyCommand console_handle: 0x0000009b	1	1
WriteConsoleW Feb. 4, 2024, 4:39 p.m.	buffer: PSPath : Microsoft.PowerShell.Core\Registry::HKEY_CURRENT_USER\SOFTWARE\M console_handle: 0x000000b7	1	1
WriteConsoleW Feb. 4, 2024, 4:39 p.m.	buffer: icrosoft\Windows\CurrentVersion\Run console_handle: 0x000000bb	1	1
WriteConsoleW Feb. 4, 2024, 4:39 p.m.	buffer: PSParentPath : Microsoft.PowerShell.Core\Registry::HKEY_CURRENT_USER\SOFTWARE\M console_handle: 0x000000bf	1	1
WriteConsoleW Feb. 4, 2024, 4:39 p.m.	buffer: icrosoft\Windows\CurrentVersion console_handle: 0x000000c3	1	1
WriteConsoleW Feb. 4, 2024, 4:39 p.m.	buffer: PSChildName : Run console_handle: 0x000000c7	1	1
WriteConsoleW Feb. 4, 2024, 4:39 p.m.	buffer: PSDrive : HKCU console_handle: 0x000000cb	1	1
WriteConsoleW Feb. 4, 2024, 4:39 p.m.	buffer: PSProvider : Microsoft.PowerShell.Core\Registry console_handle: 0x000000cf	1	1
WriteConsoleW Feb. 4, 2024, 4:39 p.m.	buffer: V-14 : C:\Users\test22\AppData\Local\Temp\V-14.exe console_handle: 0x000000d3	1	1

Uses Windows APIs to generate a cryptographic key (46 events)

Time & API	Arguments	Status	Return
CryptExportKey Feb. 4, 2024, 4:39 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0048af40 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 4, 2024, 4:39 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0048b800 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 4, 2024, 4:39 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0048b800 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 4, 2024, 4:39 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0048b800 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 4, 2024, 4:39 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0048aec0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 4, 2024, 4:39 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0048aec0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 4, 2024, 4:39 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0048aec0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 4, 2024, 4:39 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0048aec0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 4, 2024, 4:39 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0048aec0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 4, 2024, 4:39 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0048aec0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 4, 2024, 4:39 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0048b280 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 4, 2024, 4:39 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0048b280 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 4, 2024, 4:39 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0048b280 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 4, 2024, 4:39 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0048b800 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 4, 2024, 4:39 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0048b800 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 4, 2024, 4:39 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0048b800 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 4, 2024, 4:39 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0048b500 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 4, 2024, 4:39 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0048b800 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 4, 2024, 4:39 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0048b800 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 4, 2024, 4:39 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0048b800 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 4, 2024, 4:39 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0048b800 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 4, 2024, 4:39 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0048b800 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 4, 2024, 4:39 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0048b800 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 4, 2024, 4:39 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0048b800 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 4, 2024, 4:39 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0048ba00 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 4, 2024, 4:39 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0048ba00 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 4, 2024, 4:39 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0048ba00 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 4, 2024, 4:39 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0048ba00 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 4, 2024, 4:39 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0048ba00 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 4, 2024, 4:39 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0048ba00 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 4, 2024, 4:39 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0048ba00 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 4, 2024, 4:39 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0048ba00 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 4, 2024, 4:39 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0048ba00 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 4, 2024, 4:39 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0048ba00 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 4, 2024, 4:39 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0048ba00 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 4, 2024, 4:39 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0048ba00 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 4, 2024, 4:39 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0048ba00 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 4, 2024, 4:39 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0048ba00 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 4, 2024, 4:39 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0048ba80 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 4, 2024, 4:39 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0048ba80 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 4, 2024, 4:39 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0048ba80 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 4, 2024, 4:39 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0048ba80 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 4, 2024, 4:39 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0048ba80 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 4, 2024, 4:39 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0048ba80 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 4, 2024, 4:39 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0048ba80 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 4, 2024, 4:39 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0048ba80 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Feb. 4, 2024, 4:39 p.m.		1	1	0

Allocates read-write-execute memory (usually to unpack itself) (50 out of 234 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Feb. 4, 2024, 4:39 p.m.	process_identifier: 2552 region_size: 917504 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005a0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 4, 2024, 4:39 p.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00640000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Feb. 4, 2024, 4:39 p.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x727a1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Feb. 4, 2024, 4:39 p.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x727a2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 4, 2024, 4:39 p.m.	process_identifier: 2552 region_size: 1245184 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01eb0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 4, 2024, 4:39 p.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01fa0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 4, 2024, 4:39 p.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005c2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 4, 2024, 4:39 p.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005f5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 4, 2024, 4:39 p.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005fb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 4, 2024, 4:39 p.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005f7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 4, 2024, 4:39 p.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005dc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 4, 2024, 4:39 p.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f60000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 4, 2024, 4:39 p.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005e6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 4, 2024, 4:39 p.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005ea000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 4, 2024, 4:39 p.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005e7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 4, 2024, 4:39 p.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005ca000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 4, 2024, 4:39 p.m.	process_identifier: 2552 region_size: 28672 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f61000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 4, 2024, 4:39 p.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f68000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 4, 2024, 4:39 p.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005dd000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 4, 2024, 4:39 p.m.	process_identifier: 2552 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f69000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 4, 2024, 4:39 p.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01fff000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 4, 2024, 4:39 p.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01ff0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 4, 2024, 4:39 p.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f6b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 4, 2024, 4:39 p.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f6c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 4, 2024, 4:39 p.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005de000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 4, 2024, 4:39 p.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04d50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 4, 2024, 4:39 p.m.	process_identifier: 2552 region_size: 36864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04d51000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 4, 2024, 4:39 p.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04d5a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 4, 2024, 4:39 p.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04d5b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 4, 2024, 4:39 p.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04d5c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 4, 2024, 4:39 p.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04d5d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 4, 2024, 4:39 p.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04d5e000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 4, 2024, 4:39 p.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04d5f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 4, 2024, 4:39 p.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01ff1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 4, 2024, 4:39 p.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04380000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 4, 2024, 4:39 p.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04381000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 4, 2024, 4:39 p.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04382000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 4, 2024, 4:39 p.m.	process_identifier: 2552 region_size: 327680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef50000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 4, 2024, 4:39 p.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 4, 2024, 4:39 p.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 4, 2024, 4:39 p.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef58000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 4, 2024, 4:39 p.m.	process_identifier: 2552 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef40000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 4, 2024, 4:39 p.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 4, 2024, 4:39 p.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04383000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 4, 2024, 4:39 p.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04384000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 4, 2024, 4:39 p.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005df000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 4, 2024, 4:39 p.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04385000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 4, 2024, 4:39 p.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04386000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 4, 2024, 4:39 p.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04c10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 4, 2024, 4:39 p.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04387000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Creates a shortcut to an executable file (1 event)

file	C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk

Creates a suspicious process (1 event)

cmdline

"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'V-14';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'V-14' -Value '"C:\Users\test22\AppData\Local\Temp\V-14.exe"' -PropertyType 'String'

A process created a hidden window (1 event)

Time & API	Arguments	Status	Return	Repeated
CreateProcessInternalW Feb. 4, 2024, 4:39 p.m.	thread_identifier: 2748 thread_handle: 0x000002ac process_identifier: 2744 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: "powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'V-14';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'V-14' -Value '"C:\Users\test22\AppData\Local\Temp\V-14.exe"' -PropertyType 'String' filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 1 process_handle: 0x000002b0	1	1	0

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x00068000', u'virtual_address': u'0x00002000', u'entropy': 7.993975714300093, u'name': u'.text', u'virtual_size': u'0x00067f28'}

entropy

7.9939757143

description

A section with a high entropy has been found

entropy

0.995215311005

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (2 events)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW Feb. 4, 2024, 4:39 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0
LookupPrivilegeValueW Feb. 4, 2024, 4:39 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Communicates with host for which no DNS query was performed (1 event)

host

212.224.86.223

Looks for the Windows Idle Time to determine the uptime (1 event)

Time & API	Arguments	Status	Return	Repeated
NtQuerySystemInformation Feb. 4, 2024, 4:40 p.m.	information_class: 8 (SystemProcessorPerformanceInformation)	1	0	0

A process attempted to delay the analysis task. (1 event)

description

V-14.exe tried to sleep 1162197771 seconds, actually delayed analysis time by 1162197771 seconds

Installs itself for autorun at Windows startup (1 event)

reg_key

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\V-14

reg_value

C:\Users\test22\AppData\Local\Temp\V-14.exe

Attempts to access Bitcoin/ALTCoin wallets (1 event)

file	C:\Users\test22\AppData\Roaming\Electrum\wallets

Appends a known CryptoMix ransomware file extension to files that have been encrypted (1 event)

file	C:\Users\test22\AppData\Roaming\Exodus\exodus.wallet

The process powershell.exe wrote an executable file to disk (20 events)

file	C:\Windows\System32\ie4uinit.exe
file	C:\Program Files\Windows Sidebar\sidebar.exe
file	C:\Windows\System32\WindowsAnytimeUpgradeUI.exe
file	C:\Windows\System32\xpsrchvw.exe
file	C:\Windows\System32\displayswitch.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe
file	C:\Windows\System32\mblctr.exe
file	C:\Windows\System32\mstsc.exe
file	C:\Windows\System32\SnippingTool.exe
file	C:\Windows\System32\SoundRecorder.exe
file	C:\Windows\System32\dfrgui.exe
file	C:\Windows\System32\msinfo32.exe
file	C:\Windows\System32\rstrui.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe
file	C:\Program Files\Windows Journal\Journal.exe
file	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
file	C:\Windows\System32\MdSched.exe
file	C:\Windows\System32\msconfig.exe
file	C:\Windows\System32\recdisc.exe
file	C:\Windows\System32\msra.exe

Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) (1 event)

dead_host

212.224.86.223:56001

V-14.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All