Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	March 20, 2024, 7:55 a.m.	March 20, 2024, 8 a.m.

Size	1.3MB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`b26007c701f550b1bff5150c37f824f7`
SHA256	`867e3c9147ef41bc4edff6002959c37c785d919b13edbd7e8ed150ea51f9f15d`
CRC32	`558B6A77`
ssdeep	`24576:oAHnh+eWsN3skA4RV1Hom2KXMmHaYQ3viOWeXvtSHIqS5NV9n5:vh+ZkldoPK8YaYrHIqONVr`
Yara	Malicious_Library_Zero - Malicious_Library Process_Snapshot_Kill_Zero - Process Kill Zero PE_Header_Zero - PE File Signature FindFirstVolume_Zero - FindFirstVolume Zero CryptGenKey_Zero - CryptGenKey Zero Device_Check_Zero - Device Check Zero IsPE32 - (no description) UPX_Zero - UPX packed file OS_Processor_Check_Zero - OS Processor Check

wininit.exe "C:\Users\test22\AppData\Local\Temp\wininit.exe"
2552
- b.exe "C:\Users\test22\AppData\Local\Temp\wininit.exe"
  2756
  - b.exe "C:\Users\test22\AppData\Local\directory\b.exe"
    2828
    - b.exe "C:\Users\test22\AppData\Local\directory\b.exe"
      2884
      - b.exe "C:\Users\test22\AppData\Local\directory\b.exe"
        2932
        
        b.exe "C:\Users\test22\AppData\Local\directory\b.exe"
        3000
        
        b.exe "C:\Users\test22\AppData\Local\directory\b.exe"
        3044
        
        b.exe "C:\Users\test22\AppData\Local\directory\b.exe"
        2116
        
        b.exe "C:\Users\test22\AppData\Local\directory\b.exe"
        152
        
        b.exe "C:\Users\test22\AppData\Local\directory\b.exe"
        2212
        
        b.exe "C:\Users\test22\AppData\Local\directory\b.exe"
        2460
        
        b.exe "C:\Users\test22\AppData\Local\directory\b.exe"
        2540
        
        b.exe "C:\Users\test22\AppData\Local\directory\b.exe"
        2372
        
        b.exe "C:\Users\test22\AppData\Local\directory\b.exe"
        776
        
        b.exe "C:\Users\test22\AppData\Local\directory\b.exe"
        2288
        
        b.exe "C:\Users\test22\AppData\Local\directory\b.exe"
        2000
        
        b.exe "C:\Users\test22\AppData\Local\directory\b.exe"
        2784
        
        b.exe "C:\Users\test22\AppData\Local\directory\b.exe"
        2912
        
        b.exe "C:\Users\test22\AppData\Local\directory\b.exe"
        3020
        
        b.exe "C:\Users\test22\AppData\Local\directory\b.exe"
        1484
        
        b.exe "C:\Users\test22\AppData\Local\directory\b.exe"
        2188
        
        b.exe "C:\Users\test22\AppData\Local\directory\b.exe"
        2320
        
        b.exe "C:\Users\test22\AppData\Local\directory\b.exe"
        2584
        
        b.exe "C:\Users\test22\AppData\Local\directory\b.exe"
        2384
        
        b.exe "C:\Users\test22\AppData\Local\directory\b.exe"
        1596
        
        b.exe "C:\Users\test22\AppData\Local\directory\b.exe"
        2316
        
        b.exe "C:\Users\test22\AppData\Local\directory\b.exe"
        2280
        
        b.exe "C:\Users\test22\AppData\Local\directory\b.exe"
        2772
        
        b.exe "C:\Users\test22\AppData\Local\directory\b.exe"
        1868
        
        b.exe "C:\Users\test22\AppData\Local\directory\b.exe"
        2916
        
        b.exe "C:\Users\test22\AppData\Local\directory\b.exe"
        2860
        
        b.exe "C:\Users\test22\AppData\Local\directory\b.exe"
        2268
        
        b.exe "C:\Users\test22\AppData\Local\directory\b.exe"
        2636
        
        b.exe "C:\Users\test22\AppData\Local\directory\b.exe"
        944

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (50 out of 68 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent March 20, 2024, 7:55 a.m.			0	0
IsDebuggerPresent March 20, 2024, 7:55 a.m.			0	0
IsDebuggerPresent March 20, 2024, 7:56 a.m.			0	0
IsDebuggerPresent March 20, 2024, 7:56 a.m.			0	0
IsDebuggerPresent March 20, 2024, 7:56 a.m.			0	0
IsDebuggerPresent March 20, 2024, 7:56 a.m.			0	0
IsDebuggerPresent March 20, 2024, 7:56 a.m.			0	0
IsDebuggerPresent March 20, 2024, 7:56 a.m.			0	0
IsDebuggerPresent March 20, 2024, 7:56 a.m.			0	0
IsDebuggerPresent March 20, 2024, 7:56 a.m.			0	0
IsDebuggerPresent March 20, 2024, 7:56 a.m.			0	0
IsDebuggerPresent March 20, 2024, 7:56 a.m.			0	0
IsDebuggerPresent March 20, 2024, 7:56 a.m.			0	0
IsDebuggerPresent March 20, 2024, 7:56 a.m.			0	0
IsDebuggerPresent March 20, 2024, 7:56 a.m.			0	0
IsDebuggerPresent March 20, 2024, 7:56 a.m.			0	0
IsDebuggerPresent March 20, 2024, 7:56 a.m.			0	0
IsDebuggerPresent March 20, 2024, 7:56 a.m.			0	0
IsDebuggerPresent March 20, 2024, 7:56 a.m.			0	0
IsDebuggerPresent March 20, 2024, 7:56 a.m.			0	0
IsDebuggerPresent March 20, 2024, 7:56 a.m.			0	0
IsDebuggerPresent March 20, 2024, 7:56 a.m.			0	0
IsDebuggerPresent March 20, 2024, 7:56 a.m.			0	0
IsDebuggerPresent March 20, 2024, 7:56 a.m.			0	0
IsDebuggerPresent March 20, 2024, 7:56 a.m.			0	0
IsDebuggerPresent March 20, 2024, 7:56 a.m.			0	0
IsDebuggerPresent March 20, 2024, 7:56 a.m.			0	0
IsDebuggerPresent March 20, 2024, 7:56 a.m.			0	0
IsDebuggerPresent March 20, 2024, 7:56 a.m.			0	0
IsDebuggerPresent March 20, 2024, 7:56 a.m.			0	0
IsDebuggerPresent March 20, 2024, 7:57 a.m.			0	0
IsDebuggerPresent March 20, 2024, 7:57 a.m.			0	0
IsDebuggerPresent March 20, 2024, 7:57 a.m.			0	0
IsDebuggerPresent March 20, 2024, 7:57 a.m.			0	0
IsDebuggerPresent March 20, 2024, 7:57 a.m.			0	0
IsDebuggerPresent March 20, 2024, 7:57 a.m.			0	0
IsDebuggerPresent March 20, 2024, 7:57 a.m.			0	0
IsDebuggerPresent March 20, 2024, 7:57 a.m.			0	0
IsDebuggerPresent March 20, 2024, 7:57 a.m.			0	0
IsDebuggerPresent March 20, 2024, 7:57 a.m.			0	0
IsDebuggerPresent March 20, 2024, 7:57 a.m.			0	0
IsDebuggerPresent March 20, 2024, 7:57 a.m.			0	0
IsDebuggerPresent March 20, 2024, 7:57 a.m.			0	0
IsDebuggerPresent March 20, 2024, 7:57 a.m.			0	0
IsDebuggerPresent March 20, 2024, 7:57 a.m.			0	0
IsDebuggerPresent March 20, 2024, 7:57 a.m.			0	0
IsDebuggerPresent March 20, 2024, 7:57 a.m.			0	0
IsDebuggerPresent March 20, 2024, 7:57 a.m.			0	0
IsDebuggerPresent March 20, 2024, 7:57 a.m.			0	0
IsDebuggerPresent March 20, 2024, 7:57 a.m.			0	0

Allocates read-write-execute memory (usually to unpack itself) (50 out of 100 events)

Time & API	Arguments	Status	Return
NtProtectVirtualMemory March 20, 2024, 7:55 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x734c2000 process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory March 20, 2024, 7:55 a.m.	process_identifier: 2552 region_size: 16384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a00000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1	0
NtProtectVirtualMemory March 20, 2024, 7:56 a.m.	process_identifier: 2756 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73872000 process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory March 20, 2024, 7:56 a.m.	process_identifier: 2756 region_size: 16384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00740000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory March 20, 2024, 7:56 a.m.	process_identifier: 2756 region_size: 532480 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory March 20, 2024, 7:56 a.m.	process_identifier: 2828 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73872000 process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory March 20, 2024, 7:56 a.m.	process_identifier: 2828 region_size: 16384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00de0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory March 20, 2024, 7:56 a.m.	process_identifier: 2828 region_size: 532480 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory March 20, 2024, 7:56 a.m.	process_identifier: 2884 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x734c2000 process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory March 20, 2024, 7:56 a.m.	process_identifier: 2884 region_size: 16384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002f0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory March 20, 2024, 7:56 a.m.	process_identifier: 2884 region_size: 532480 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory March 20, 2024, 7:56 a.m.	process_identifier: 2932 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x734c2000 process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory March 20, 2024, 7:56 a.m.	process_identifier: 2932 region_size: 16384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00bb0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory March 20, 2024, 7:56 a.m.	process_identifier: 2932 region_size: 532480 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory March 20, 2024, 7:56 a.m.	process_identifier: 3000 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x734c2000 process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory March 20, 2024, 7:56 a.m.	process_identifier: 3000 region_size: 16384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02760000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory March 20, 2024, 7:56 a.m.	process_identifier: 3000 region_size: 532480 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory March 20, 2024, 7:56 a.m.	process_identifier: 3044 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x736d2000 process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory March 20, 2024, 7:56 a.m.	process_identifier: 3044 region_size: 16384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00730000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory March 20, 2024, 7:56 a.m.	process_identifier: 3044 region_size: 532480 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory March 20, 2024, 7:56 a.m.	process_identifier: 2116 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73872000 process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory March 20, 2024, 7:56 a.m.	process_identifier: 2116 region_size: 16384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00910000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory March 20, 2024, 7:56 a.m.	process_identifier: 2116 region_size: 532480 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory March 20, 2024, 7:56 a.m.	process_identifier: 152 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73872000 process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory March 20, 2024, 7:56 a.m.	process_identifier: 152 region_size: 16384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00cf0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory March 20, 2024, 7:56 a.m.	process_identifier: 152 region_size: 532480 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory March 20, 2024, 7:56 a.m.	process_identifier: 2212 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x734c2000 process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory March 20, 2024, 7:56 a.m.	process_identifier: 2212 region_size: 16384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00830000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory March 20, 2024, 7:56 a.m.	process_identifier: 2212 region_size: 532480 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory March 20, 2024, 7:56 a.m.	process_identifier: 2460 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73662000 process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory March 20, 2024, 7:56 a.m.	process_identifier: 2460 region_size: 16384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002c0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory March 20, 2024, 7:56 a.m.	process_identifier: 2460 region_size: 532480 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory March 20, 2024, 7:56 a.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x734c2000 process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory March 20, 2024, 7:56 a.m.	process_identifier: 2540 region_size: 16384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00830000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory March 20, 2024, 7:56 a.m.	process_identifier: 2540 region_size: 532480 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory March 20, 2024, 7:56 a.m.	process_identifier: 2372 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x736d2000 process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory March 20, 2024, 7:56 a.m.	process_identifier: 2372 region_size: 16384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003c0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory March 20, 2024, 7:56 a.m.	process_identifier: 2372 region_size: 532480 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory March 20, 2024, 7:56 a.m.	process_identifier: 776 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73442000 process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory March 20, 2024, 7:56 a.m.	process_identifier: 776 region_size: 16384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006c0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory March 20, 2024, 7:56 a.m.	process_identifier: 776 region_size: 532480 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory March 20, 2024, 7:56 a.m.	process_identifier: 2288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73652000 process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory March 20, 2024, 7:56 a.m.	process_identifier: 2288 region_size: 16384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00bf0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory March 20, 2024, 7:57 a.m.	process_identifier: 2288 region_size: 532480 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory March 20, 2024, 7:57 a.m.	process_identifier: 2000 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x734c2000 process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory March 20, 2024, 7:57 a.m.	process_identifier: 2000 region_size: 16384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02790000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory March 20, 2024, 7:57 a.m.	process_identifier: 2000 region_size: 532480 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory March 20, 2024, 7:57 a.m.	process_identifier: 2784 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x736d2000 process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory March 20, 2024, 7:57 a.m.	process_identifier: 2784 region_size: 16384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01210000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory March 20, 2024, 7:57 a.m.	process_identifier: 2784 region_size: 532480 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff		3221225496

Creates executable files on the filesystem (2 events)

file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\b.vbs
file	C:\Users\test22\AppData\Local\directory\b.exe

Drops a binary and executes it (1 event)

file	C:\Users\test22\AppData\Local\directory\b.exe

Drops an executable to the user AppData folder (1 event)

file	C:\Users\test22\AppData\Local\directory\b.exe

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x00079800', u'virtual_address': u'0x000c8000', u'entropy': 7.9318083009623725, u'name': u'.rsrc', u'virtual_size': u'0x00079720'}

entropy

7.93180830096

description

A section with a high entropy has been found

entropy

0.375434530707

description

Overall entropy of this PE file is high

Installs itself for autorun at Windows startup (1 event)

file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\b.vbs

File has been identified by 31 AntiVirus engines on VirusTotal as malicious (31 events)

Lionic	Trojan.Win32.AutoIt.4!c
Elastic	malicious (high confidence)
Skyhigh	BehavesLike.Win32.TrojanAitInject.tc
Cylance	unsafe
Sangfor	Virus.Win32.Save.a
Symantec	Trojan.Gen.2
ESET-NOD32	a variant of Win32/Injector.Autoit.FVW
APEX	Malicious
McAfee	Artemis!B26007C701F5
Avast	FileRepMalware [Misc]
Kaspersky	UDS:DangerousObject.Multi.Generic
Alibaba	Trojan:Win32/Strab.3cb5ef63
Rising	Trojan.Injector/Autoit!1.F5AA (CLASSIC)
DrWeb	Trojan.AutoIt.1343
FireEye	Generic.mg.b26007c701f550b1
Sophos	Mal/Generic-S
Ikarus	Trojan.Win32.Strab
Webroot	W32.Malware.Gen
Google	Detected
Kingsoft	Win32.Troj.Unknown.a
Microsoft	Trojan:Win32/Strab.GPX!MTB
ZoneAlarm	UDS:DangerousObject.Multi.Generic
Varist	W32/AutoIt.IJ.gen!Eldorado
DeepInstinct	MALICIOUS
VBA32	Trojan.Autoit.F
Malwarebytes	Trojan.Injector.AutoIt
SentinelOne	Static AI - Malicious PE
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	AutoIt/Injector.AAD!tr
AVG	FileRepMalware [Misc]
CrowdStrike	win/malicious_confidence_100% (W)

wininit.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All