Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	March 28, 2024, 7:50 a.m.	March 28, 2024, 7:53 a.m.

Size	4.8MB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`90489ae7eda45c9ab0904ec54c1caa71`
SHA256	`d545f5b27e90abc54cf5a37c35e866c08336a500cecd95e8267c0c729a6b9bbc`
CRC32	`F07DB72E`
ssdeep	`98304:qaKgooZW+SicdBQhBSpKw6XDb0j0VN6XXx86OA+jNIS+MYiZMqGk2s:qVglZW+SndB6PbQ06XCA+RISfZjGts`
PDB Path	D:\Projects\WinRAR\sfx\build\sfxzip32\Release\sfxzip.pdb
Yara	Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature IsPE32 - (no description) UPX_Zero - UPX packed file OS_Processor_Check_Zero - OS Processor Check

file.exe "C:\Users\test22\AppData\Local\Temp\file.exe"
1460
- wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\test22\AppData\Local\Temp\RarSFX0\run.vbs"
  2084
  - update.exe "C:\Users\test22\AppData\Local\Temp\RarSFX0\update.exe"
    2176
    - cvtres.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"
      2340
  - setup.exe "C:\Users\test22\AppData\Local\Temp\RarSFX0\setup.exe"
    2244
    - setup.exe "C:\Users\test22\AppData\Local\Temp\RarSFX0\setup.exe"
      2348
explorer.exe C:\Windows\Explorer.EXE
1236
ctfmon.exe "C:\Windows\SysWOW64\ctfmon.exe"
2836
- firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"
  1156
explorer.exe explorer.exe
2956

Name	Response	Post-Analysis Lookup
www.sqlite.org	A 45.33.6.223	45.33.6.223
www.331ke.com	A 34.120.231.129	34.120.231.129

IP Address	Status	Action
152.195.38.76	Active	Moloch
164.124.101.2	Active	Moloch
34.120.231.129	Active	Moloch
45.33.6.223	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (4 events)

Time & API	Arguments	Status	Return
GetComputerNameW March 28, 2024, 7:50 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 28, 2024, 7:50 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA March 28, 2024, 7:50 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 28, 2024, 7:50 a.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (8 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent March 28, 2024, 7:50 a.m.			0	0
IsDebuggerPresent March 28, 2024, 7:50 a.m.			0	0
IsDebuggerPresent March 28, 2024, 7:50 a.m.			0	0
IsDebuggerPresent March 28, 2024, 7:50 a.m.			0	0
IsDebuggerPresent March 28, 2024, 7:50 a.m.			0	0
IsDebuggerPresent March 28, 2024, 7:50 a.m.			0	0
IsDebuggerPresent March 28, 2024, 7:50 a.m.			0	0
IsDebuggerPresent March 28, 2024, 7:50 a.m.			0	0

Uses Windows APIs to generate a cryptographic key (15 events)

Time & API	Arguments	Status	Return
CryptExportKey March 28, 2024, 7:50 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004819f8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 28, 2024, 7:50 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004819f8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 28, 2024, 7:50 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00481ab8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 28, 2024, 7:50 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004819f8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 28, 2024, 7:50 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004819f8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 28, 2024, 7:50 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00481b38 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 28, 2024, 7:50 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003e8a08 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 28, 2024, 7:50 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003e8a08 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 28, 2024, 7:50 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003e8ac8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 28, 2024, 7:50 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003e8a08 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 28, 2024, 7:50 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003e8a08 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 28, 2024, 7:50 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003e8b88 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 28, 2024, 7:50 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006b2f28 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 28, 2024, 7:50 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006b2f68 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 28, 2024, 7:50 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006b2f68 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

This executable has a PDB path (1 event)

pdb_path

D:\Projects\WinRAR\sfx\build\sfxzip32\Release\sfxzip.pdb

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx March 28, 2024, 7:50 a.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

.didat

The file contains an unknown PE resource name possibly indicative of a packer (1 event)

resource name

PNG

One or more processes crashed (1 event)

Time & API	Arguments	Status	Return	Repeated
__exception__ March 28, 2024, 7:50 a.m.	stacktrace: RtlUnhandledExceptionFilter+0x2d2 LdrQueryModuleServiceTags-0x6e ntdll+0xc40f2 @ 0x777840f2 EtwEnumerateProcessRegGuids+0x216 RtlTraceDatabaseLock-0x2a ntdll+0xc4736 @ 0x77784736 RtlQueryProcessLockInformation+0x972 RtlTraceDatabaseEnumerate-0xe ntdll+0xc5942 @ 0x77785942 RtlLogStackBackTrace+0x444 RtlTraceDatabaseCreate-0x4ec ntdll+0xc75f4 @ 0x777875f4 RtlLogStackBackTrace+0x828 RtlTraceDatabaseCreate-0x108 ntdll+0xc79d8 @ 0x777879d8 MD5Final+0x9cb0 TpDbgSetLogRoutine-0x6920 ntdll+0x9c280 @ 0x7775c280 RtlSubAuthorityCountSid+0xcc8 RtlCompareUnicodeStrings-0x4b8 ntdll+0x31df8 @ 0x776f1df8 RtlSubAuthorityCountSid+0xb50 RtlCompareUnicodeStrings-0x630 ntdll+0x31c80 @ 0x776f1c80 RtlAllocateHeap+0x178 AlpcGetMessageAttribute-0x14e8 ntdll+0x53518 @ 0x77713518 RtlUpcaseUnicodeChar+0x342 EtwEventEnabled-0x12e ntdll+0x2bf82 @ 0x776ebf82 RtlQueryEnvironmentVariable+0x70c _wcsicmp-0x744 ntdll+0x2623c @ 0x776e623c RtlAllocateHeap+0xe8 AlpcGetMessageAttribute-0x1578 ntdll+0x53488 @ 0x77713488 I_RpcGetBufferWithObject+0x2cf I_RpcNegotiateTransferSyntax-0x1241 rpcrt4+0x4868f @ 0x7fefdf6868f NdrConformantStringUnmarshall+0x80a NdrConformantArrayUnmarshall-0x196 rpcrt4+0x4091a @ 0x7fefdf6091a I_RpcBindingCopy+0x55 I_RpcClearMutex-0x6ab rpcrt4+0x4e9e5 @ 0x7fefdf6e9e5 NDRCContextBinding+0x146b I_RpcBindingCopy-0x45 rpcrt4+0x4e94b @ 0x7fefdf6e94b NDRCContextBinding+0x1034 I_RpcBindingCopy-0x47c rpcrt4+0x4e514 @ 0x7fefdf6e514 Ndr64AsyncClientCall+0x49e NdrClientCall3-0xb32 rpcrt4+0xdc2fe @ 0x7fefdffc2fe Ndr64AsyncClientCall+0xe76 NdrClientCall3-0x15a rpcrt4+0xdccd6 @ 0x7fefdffccd6 NdrClientCall3+0xf5 Ndr64AsyncServerCall64-0x1c9b rpcrt4+0xdcf25 @ 0x7fefdffcf25 NdrFullPointerQueryPointer+0x2e2 NdrDllCanUnloadNow-0x5fe rpcrt4+0x22852 @ 0x7fefdf42852 RpcBindingInqAuthInfoExW+0x1216 TowerConstruct-0x45a rpcrt4+0x377b6 @ 0x7fefdf577b6 RpcBindingInqAuthInfoExW+0x1059 TowerConstruct-0x617 rpcrt4+0x375f9 @ 0x7fefdf575f9 RpcBindingInqAuthInfoExW+0xf9b TowerConstruct-0x6d5 rpcrt4+0x3753b @ 0x7fefdf5753b RpcBindingInqAuthInfoExW+0xea9 TowerConstruct-0x7c7 rpcrt4+0x37449 @ 0x7fefdf57449 RpcBindingInqAuthInfoExW+0xd17 TowerConstruct-0x959 rpcrt4+0x372b7 @ 0x7fefdf572b7 RpcMgmtSetComTimeout+0xae NdrConformantStringMemorySize-0x682 rpcrt4+0x3804e @ 0x7fefdf5804e NdrByteCountPointerUnmarshall+0xa0c RpcStringFreeW-0xa4 rpcrt4+0x3941c @ 0x7fefdf5941c I_RpcNegotiateTransferSyntax+0xab RpcAsyncRegisterInfo-0x1995 rpcrt4+0x4997b @ 0x7fefdf6997b Ndr64AsyncClientCall+0xa23 NdrClientCall3-0x5ad rpcrt4+0xdc883 @ 0x7fefdffc883 Ndr64AsyncClientCall+0xc9b NdrClientCall3-0x335 rpcrt4+0xdcafb @ 0x7fefdffcafb NdrClientCall3+0xf5 Ndr64AsyncServerCall64-0x1c9b rpcrt4+0xdcf25 @ 0x7fefdffcf25 WscGetSecurityProviderHealth+0x903 wscapi+0x704b @ 0x7fef426704b RtlLookupEntryHashTable+0x341 RtlDeregisterWaitEx-0x1bf ntdll+0xc271 @ 0x776cc271 TpReleaseIoCompletion+0x84c TpDisassociateCallback-0x374 ntdll+0x1656c @ 0x776d656c RtlRealSuccessor+0x136 TpCallbackMayRunLong-0x65a ntdll+0x20c26 @ 0x776e0c26 BaseThreadInitThunk+0xd CreateThread-0x53 kernel32+0x1652d @ 0x76fd652d RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x776ec521 exception.instruction_r: eb 00 48 8b 9c 24 d0 00 00 00 48 81 c4 c0 00 00 exception.symbol: RtlUnhandledExceptionFilter+0x2d2 LdrQueryModuleServiceTags-0x6e ntdll+0xc40f2 exception.instruction: jmp 0x777840f4 exception.module: ntdll.dll exception.exception_code: 0xc0000374 exception.offset: 803058 exception.address: 0x777840f2 registers.r14: 0 registers.r15: 0 registers.rcx: 73913664 registers.rsi: 0 registers.r10: 0 registers.rbx: 0 registers.rsp: 73924512 registers.r11: 646 registers.r8: 3668801806742034531 registers.r9: 1460712879 registers.rdx: 2004857936 registers.r12: 0 registers.rbp: 0 registers.rdi: 0 registers.rax: 1930982254 registers.r13: 0	1	0	0

Time & API

Arguments

Status

Return

Repeated

__exception__

March 28, 2024, 7:50 a.m.

stacktrace:

RtlUnhandledExceptionFilter+0x2d2 LdrQueryModuleServiceTags-0x6e ntdll+0xc40f2 @ 0x777840f2
EtwEnumerateProcessRegGuids+0x216 RtlTraceDatabaseLock-0x2a ntdll+0xc4736 @ 0x77784736
RtlQueryProcessLockInformation+0x972 RtlTraceDatabaseEnumerate-0xe ntdll+0xc5942 @ 0x77785942
RtlLogStackBackTrace+0x444 RtlTraceDatabaseCreate-0x4ec ntdll+0xc75f4 @ 0x777875f4
RtlLogStackBackTrace+0x828 RtlTraceDatabaseCreate-0x108 ntdll+0xc79d8 @ 0x777879d8
MD5Final+0x9cb0 TpDbgSetLogRoutine-0x6920 ntdll+0x9c280 @ 0x7775c280
RtlSubAuthorityCountSid+0xcc8 RtlCompareUnicodeStrings-0x4b8 ntdll+0x31df8 @ 0x776f1df8
RtlSubAuthorityCountSid+0xb50 RtlCompareUnicodeStrings-0x630 ntdll+0x31c80 @ 0x776f1c80
RtlAllocateHeap+0x178 AlpcGetMessageAttribute-0x14e8 ntdll+0x53518 @ 0x77713518
RtlUpcaseUnicodeChar+0x342 EtwEventEnabled-0x12e ntdll+0x2bf82 @ 0x776ebf82
RtlQueryEnvironmentVariable+0x70c _wcsicmp-0x744 ntdll+0x2623c @ 0x776e623c
RtlAllocateHeap+0xe8 AlpcGetMessageAttribute-0x1578 ntdll+0x53488 @ 0x77713488
I_RpcGetBufferWithObject+0x2cf I_RpcNegotiateTransferSyntax-0x1241 rpcrt4+0x4868f @ 0x7fefdf6868f
NdrConformantStringUnmarshall+0x80a NdrConformantArrayUnmarshall-0x196 rpcrt4+0x4091a @ 0x7fefdf6091a
I_RpcBindingCopy+0x55 I_RpcClearMutex-0x6ab rpcrt4+0x4e9e5 @ 0x7fefdf6e9e5
NDRCContextBinding+0x146b I_RpcBindingCopy-0x45 rpcrt4+0x4e94b @ 0x7fefdf6e94b
NDRCContextBinding+0x1034 I_RpcBindingCopy-0x47c rpcrt4+0x4e514 @ 0x7fefdf6e514
Ndr64AsyncClientCall+0x49e NdrClientCall3-0xb32 rpcrt4+0xdc2fe @ 0x7fefdffc2fe
Ndr64AsyncClientCall+0xe76 NdrClientCall3-0x15a rpcrt4+0xdccd6 @ 0x7fefdffccd6
NdrClientCall3+0xf5 Ndr64AsyncServerCall64-0x1c9b rpcrt4+0xdcf25 @ 0x7fefdffcf25
NdrFullPointerQueryPointer+0x2e2 NdrDllCanUnloadNow-0x5fe rpcrt4+0x22852 @ 0x7fefdf42852
RpcBindingInqAuthInfoExW+0x1216 TowerConstruct-0x45a rpcrt4+0x377b6 @ 0x7fefdf577b6
RpcBindingInqAuthInfoExW+0x1059 TowerConstruct-0x617 rpcrt4+0x375f9 @ 0x7fefdf575f9
RpcBindingInqAuthInfoExW+0xf9b TowerConstruct-0x6d5 rpcrt4+0x3753b @ 0x7fefdf5753b
RpcBindingInqAuthInfoExW+0xea9 TowerConstruct-0x7c7 rpcrt4+0x37449 @ 0x7fefdf57449
RpcBindingInqAuthInfoExW+0xd17 TowerConstruct-0x959 rpcrt4+0x372b7 @ 0x7fefdf572b7
RpcMgmtSetComTimeout+0xae NdrConformantStringMemorySize-0x682 rpcrt4+0x3804e @ 0x7fefdf5804e
NdrByteCountPointerUnmarshall+0xa0c RpcStringFreeW-0xa4 rpcrt4+0x3941c @ 0x7fefdf5941c
I_RpcNegotiateTransferSyntax+0xab RpcAsyncRegisterInfo-0x1995 rpcrt4+0x4997b @ 0x7fefdf6997b
Ndr64AsyncClientCall+0xa23 NdrClientCall3-0x5ad rpcrt4+0xdc883 @ 0x7fefdffc883
Ndr64AsyncClientCall+0xc9b NdrClientCall3-0x335 rpcrt4+0xdcafb @ 0x7fefdffcafb
NdrClientCall3+0xf5 Ndr64AsyncServerCall64-0x1c9b rpcrt4+0xdcf25 @ 0x7fefdffcf25
WscGetSecurityProviderHealth+0x903 wscapi+0x704b @ 0x7fef426704b
RtlLookupEntryHashTable+0x341 RtlDeregisterWaitEx-0x1bf ntdll+0xc271 @ 0x776cc271
TpReleaseIoCompletion+0x84c TpDisassociateCallback-0x374 ntdll+0x1656c @ 0x776d656c
RtlRealSuccessor+0x136 TpCallbackMayRunLong-0x65a ntdll+0x20c26 @ 0x776e0c26
BaseThreadInitThunk+0xd CreateThread-0x53 kernel32+0x1652d @ 0x76fd652d
RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x776ec521

exception.instruction_r: eb 00 48 8b 9c 24 d0 00 00 00 48 81 c4 c0 00 00
exception.symbol: RtlUnhandledExceptionFilter+0x2d2 LdrQueryModuleServiceTags-0x6e ntdll+0xc40f2
exception.instruction: jmp 0x777840f4
exception.module: ntdll.dll
exception.exception_code: 0xc0000374
exception.offset: 803058
exception.address: 0x777840f2
registers.r14: 0
registers.r15: 0
registers.rcx: 73913664
registers.rsi: 0
registers.r10: 0
registers.rbx: 0
registers.rsp: 73924512
registers.r11: 646
registers.r8: 3668801806742034531
registers.r9: 1460712879
registers.rdx: 2004857936
registers.r12: 0
registers.rbp: 0
registers.rdi: 0
registers.rax: 1930982254
registers.r13: 0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Performs some HTTP requests (3 events)

request	POST http://www.331ke.com/s8i3/
request	GET http://www.331ke.com/s8i3/?S2Z6=KrQl1n&cz=xGGM1mNauuB7IMPQGMssx+VfY5pPQub8kWqjyZgHyjSlKwbWNZJX5SkzlWTeY/HrNS4fCgv20YvEvj1QUUHZH0DDUXrLF6vVVn+bUx2o/wKk4ta1gL+LFnDYrevLImgnu5DmvXU=
request	GET http://www.sqlite.org/2016/sqlite-dll-win32-x86-3130000.zip

Sends data using the HTTP POST Method (1 event)

request

POST http://www.331ke.com/s8i3/

Allocates read-write-execute memory (usually to unpack itself) (50 out of 234 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory March 28, 2024, 7:50 a.m.	process_identifier: 2176 region_size: 1966080 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007e0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 28, 2024, 7:50 a.m.	process_identifier: 2176 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00980000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory March 28, 2024, 7:50 a.m.	process_identifier: 2176 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72cc1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 28, 2024, 7:50 a.m.	process_identifier: 2176 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72cc2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 28, 2024, 7:50 a.m.	process_identifier: 2176 region_size: 1572864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b50000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 28, 2024, 7:50 a.m.	process_identifier: 2176 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00c90000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 28, 2024, 7:50 a.m.	process_identifier: 2176 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00422000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 28, 2024, 7:50 a.m.	process_identifier: 2176 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0053c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 28, 2024, 7:50 a.m.	process_identifier: 2176 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00670000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 28, 2024, 7:50 a.m.	process_identifier: 2176 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00555000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 28, 2024, 7:50 a.m.	process_identifier: 2176 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0055b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 28, 2024, 7:50 a.m.	process_identifier: 2176 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00557000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 28, 2024, 7:50 a.m.	process_identifier: 2176 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0042c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 28, 2024, 7:50 a.m.	process_identifier: 2176 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00546000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 28, 2024, 7:50 a.m.	process_identifier: 2176 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00671000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 28, 2024, 7:50 a.m.	process_identifier: 2176 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00672000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 28, 2024, 7:50 a.m.	process_identifier: 2176 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0042a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 28, 2024, 7:50 a.m.	process_identifier: 2176 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0054a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 28, 2024, 7:50 a.m.	process_identifier: 2176 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00547000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 28, 2024, 7:50 a.m.	process_identifier: 2176 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00673000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 28, 2024, 7:50 a.m.	process_identifier: 2176 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00674000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 28, 2024, 7:50 a.m.	process_identifier: 2176 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04ba0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 28, 2024, 7:50 a.m.	process_identifier: 2176 region_size: 49152 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04ba1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 28, 2024, 7:50 a.m.	process_identifier: 2176 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04bad000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 28, 2024, 7:50 a.m.	process_identifier: 2176 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04bae000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 28, 2024, 7:50 a.m.	process_identifier: 2176 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0053a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 28, 2024, 7:50 a.m.	process_identifier: 2176 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04baf000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 28, 2024, 7:50 a.m.	process_identifier: 2176 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00ce0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory March 28, 2024, 7:50 a.m.	process_identifier: 2176 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73c54000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 28, 2024, 7:50 a.m.	process_identifier: 2176 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00f10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 28, 2024, 7:50 a.m.	process_identifier: 2176 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00f11000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 28, 2024, 7:50 a.m.	process_identifier: 2176 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0053d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 28, 2024, 7:50 a.m.	process_identifier: 2176 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00f12000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 28, 2024, 7:50 a.m.	process_identifier: 2176 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00f14000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 28, 2024, 7:50 a.m.	process_identifier: 2176 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00f15000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 28, 2024, 7:50 a.m.	process_identifier: 2176 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00dff000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 28, 2024, 7:50 a.m.	process_identifier: 2176 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00df0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 28, 2024, 7:50 a.m.	process_identifier: 2176 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00f16000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 28, 2024, 7:50 a.m.	process_identifier: 2176 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0053e000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 28, 2024, 7:50 a.m.	process_identifier: 2176 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x056d0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 28, 2024, 7:50 a.m.	process_identifier: 2176 region_size: 81920 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x056d1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 28, 2024, 7:50 a.m.	process_identifier: 2176 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x056e5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 28, 2024, 7:50 a.m.	process_identifier: 2176 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x056e6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 28, 2024, 7:50 a.m.	process_identifier: 2176 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x056e8000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 28, 2024, 7:50 a.m.	process_identifier: 2176 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x056e9000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 28, 2024, 7:50 a.m.	process_identifier: 2176 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x056ea000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 28, 2024, 7:50 a.m.	process_identifier: 2176 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x056eb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 28, 2024, 7:50 a.m.	process_identifier: 2176 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x056ec000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 28, 2024, 7:50 a.m.	process_identifier: 2176 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x056ed000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 28, 2024, 7:50 a.m.	process_identifier: 2176 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x056ee000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

A process attempted to delay the analysis task. (1 event)

description

ctfmon.exe tried to sleep 156 seconds, actually delayed analysis time by 156 seconds

Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation (1 event)

Time & API	Arguments	Status	Return	Repeated
GetDiskFreeSpaceExW March 28, 2024, 7:50 a.m.	total_number_of_free_bytes: 9923727360 free_bytes_available: 9923727360 root_path: C:\ total_number_of_bytes: 34252779520	1	1	0

Steals private information from local Internet browsers (4 events)

file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\
file	C:\Users\test22\AppData\Local\Chromium\User Data
file	C:\Users\test22\AppData\Local\MapleStudio\ChromePlus\User Data
file	C:\Users\test22\AppData\Local\Yandex\YandexBrowser\User Data

Creates executable files on the filesystem (4 events)

file	C:\Users\test22\AppData\Local\Temp\RarSFX0\setup.exe
file	C:\Users\test22\AppData\Local\Temp\RarSFX0\run.vbs
file	C:\Users\test22\AppData\Local\Temp\sqlite3.dll
file	C:\Users\test22\AppData\Local\Temp\RarSFX0\update.exe

Drops a binary and executes it (3 events)

file	C:\Users\test22\AppData\Local\Temp\RarSFX0\run.vbs
file	C:\Users\test22\AppData\Local\Temp\RarSFX0\update.exe
file	C:\Users\test22\AppData\Local\Temp\RarSFX0\setup.exe

Drops an executable to the user AppData folder (3 events)

file	C:\Users\test22\AppData\Local\Temp\sqlite3.dll
file	C:\Users\test22\AppData\Local\Temp\RarSFX0\setup.exe
file	C:\Users\test22\AppData\Local\Temp\RarSFX0\update.exe

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x00018e00', u'virtual_address': u'0x00068000', u'entropy': 7.191597049127901, u'name': u'.rsrc', u'virtual_size': u'0x00018c3c'}

entropy

7.19159704913

description

A section with a high entropy has been found

entropy

0.325163398693

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (5 events)

Time & API	Arguments	Status	Return
LookupPrivilegeValueW March 28, 2024, 7:50 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW March 28, 2024, 7:50 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW March 28, 2024, 7:50 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW March 28, 2024, 7:50 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW March 28, 2024, 7:50 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1

Yara rule detected in process memory (26 events)

description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerCheck__RemoteAPI
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep
description	Win XWorm V3.1	rule	Win_XWorm_3_M_Zero
description	Remote Administration toolkit using webcam	rule	RAT_WebCam
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Bypass DEP	rule	disable_dep

Communicates with host for which no DNS query was performed (1 event)

host

152.195.38.76

Allocates execute permission to another process indicative of possible code injection (2 events)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory March 28, 2024, 7:50 a.m.	process_identifier: 2340 region_size: 81920 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000260	1	0	0
NtAllocateVirtualMemory March 28, 2024, 7:50 a.m.	process_identifier: 2348 region_size: 270336 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000002c0	1	0	0

Attempts to identify installed AV products by installation directory (2 events)

file	C:\Users\test22\AppData\Local\AVAST Software\Browser\User Data
file	C:\Users\test22\AppData\Local\AVG\Browser\User Data

Potential code injection by writing to the memory of another process (6 events)

Time & API	Arguments	Status	Return
WriteProcessMemory March 28, 2024, 7:50 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL8fàØn÷ @ @@÷OÎ H.textt× Ø `.rsrcÎÚ@@.reloc à@B base_address: 0x00400000 process_identifier: 2340 process_handle: 0x00000260	1	1
WriteProcessMemory March 28, 2024, 7:50 a.m.	buffer: P8h DäêD4VS_VERSION_INFO½ïþ?DVarFileInfo$Translation°¤StringFileInfo000004b0,FileDescription 0FileVersion1.0.0.08InternalNameXClient.exe(LegalCopyright @OriginalFilenameXClient.exe4ProductVersion1.0.0.08Assembly Version1.0.0.0ï»¿<?xml version="1.0" encoding="UTF-8" standalone="yes"?> <assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"> <assemblyIdentity version="1.0.0.0" name="MyApplication.app"/> <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2"> <security> <requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3"> <requestedExecutionLevel level="asInvoker" uiAccess="false"/> </requestedPrivileges> </security> </trustInfo> </assembly> base_address: 0x00410000 process_identifier: 2340 process_handle: 0x00000260	1	1
WriteProcessMemory March 28, 2024, 7:50 a.m.	buffer: ðp7 base_address: 0x00412000 process_identifier: 2340 process_handle: 0x00000260	1	1
WriteProcessMemory March 28, 2024, 7:50 a.m.	buffer: @ base_address: 0xfffde008 process_identifier: 2340 process_handle: 0x00000260	1	1
WriteProcessMemory March 28, 2024, 7:50 a.m.	buffer: MZERèXè ÈÀ<ÁÀ(ÿá¸º´ Í!¸LÍ!This program cannot be run in DOS mode. $y =`gó=`gó=`gó¦¨ó:`gó¦ªó<`gó¦«ó<`góRich=`góPELvÙ-[à P @ @.textD ` base_address: 0x00400000 process_identifier: 2348 process_handle: 0x000002c0	1	1
WriteProcessMemory March 28, 2024, 7:50 a.m.	buffer: @ base_address: 0x7efde008 process_identifier: 2348 process_handle: 0x000002c0	1	1

Code injection by writing an executable or DLL to the memory of another process (2 events)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory March 28, 2024, 7:50 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL8fàØn÷ @ @@÷OÎ H.textt× Ø `.rsrcÎÚ@@.reloc à@B base_address: 0x00400000 process_identifier: 2340 process_handle: 0x00000260	1	1	0
WriteProcessMemory March 28, 2024, 7:50 a.m.	buffer: MZERèXè ÈÀ<ÁÀ(ÿá¸º´ Í!¸LÍ!This program cannot be run in DOS mode. $y =`gó=`gó=`gó¦¨ó:`gó¦ªó<`gó¦«ó<`góRich=`góPELvÙ-[à P @ @.textD ` base_address: 0x00400000 process_identifier: 2348 process_handle: 0x000002c0	1	1	0

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (4 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2176 called NtSetContextThread to modify thread in remote process 2340
Process injection	Process 2244 called NtSetContextThread to modify thread in remote process 2348
NtSetContextThread March 28, 2024, 7:50 a.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4257646 registers.ebp: 0 registers.edx: 0 registers.ebx: -139264 registers.esi: 0 registers.ecx: 0 thread_handle: 0x0000025c process_identifier: 2340	1	0	0
NtSetContextThread March 28, 2024, 7:50 a.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4199760 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x000002bc process_identifier: 2348	1	0	0

One or more non-whitelisted processes were created (4 events)

parent_process	wscript.exe	martian_process	setup.exe
parent_process	wscript.exe	martian_process	"C:\Users\test22\AppData\Local\Temp\RarSFX0\update.exe"
parent_process	wscript.exe	martian_process	"C:\Users\test22\AppData\Local\Temp\RarSFX0\setup.exe"
parent_process	wscript.exe	martian_process	update.exe

A process performed obfuscation on information about the computer or sent it to a remote location indicative of CnC Traffic/Preperations. (1 event)

Time & API	Arguments	Status	Return	Repeated
CryptHashData March 28, 2024, 7:50 a.m.	buffer: 2test22TEST22-PCMicrosoft Windows NT 6.1.7601 Service Pack 134252779520 hash_handle: 0x006b2aa8 flags: 0	1	1	0

Resumed a suspended thread in a remote process potentially indicative of process injection (6 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1460 resumed a thread in remote process 2084
Process injection	Process 2176 resumed a thread in remote process 2340
Process injection	Process 2244 resumed a thread in remote process 2348
NtResumeThread March 28, 2024, 7:50 a.m.	thread_handle: 0x000002f4 suspend_count: 1 process_identifier: 2084	1	0	0
NtResumeThread March 28, 2024, 7:50 a.m.	thread_handle: 0x0000025c suspend_count: 1 process_identifier: 2340	1	0	0
NtResumeThread March 28, 2024, 7:50 a.m.	thread_handle: 0x000002bc suspend_count: 1 process_identifier: 2348	1	0	0

Executed a process and injected code into it, probably while unpacking (41 events)

Time & API	Arguments	Status	Return
NtResumeThread March 28, 2024, 7:50 a.m.	thread_handle: 0x00000180 suspend_count: 1 process_identifier: 1460	1	0
CreateProcessInternalW March 28, 2024, 7:50 a.m.	thread_identifier: 2088 thread_handle: 0x000002f4 process_identifier: 2084 current_directory: C:\Users\test22\AppData\Local\Temp\RarSFX0 filepath: C:\Windows\System32\wscript.exe track: 1 command_line: "C:\Windows\System32\WScript.exe" "C:\Users\test22\AppData\Local\Temp\RarSFX0\run.vbs" filepath_r: C:\Windows\System32\WScript.exe stack_pivoted: 0 creation_flags: 67634196 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_SUSPENDED\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x000002ec	1	1
NtResumeThread March 28, 2024, 7:50 a.m.	thread_handle: 0x000002f4 suspend_count: 1 process_identifier: 2084	1	0
CreateProcessInternalW March 28, 2024, 7:50 a.m.	thread_identifier: 2180 thread_handle: 0x00000350 process_identifier: 2176 current_directory: C:\Users\test22\AppData\Local\Temp\RarSFX0 filepath: C:\Users\test22\AppData\Local\Temp\RarSFX0\update.exe track: 1 command_line: "C:\Users\test22\AppData\Local\Temp\RarSFX0\update.exe" filepath_r: C:\Users\test22\AppData\Local\Temp\RarSFX0\update.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x00000358	1	1
CreateProcessInternalW March 28, 2024, 7:50 a.m.	thread_identifier: 2248 thread_handle: 0x000002fc process_identifier: 2244 current_directory: C:\Users\test22\AppData\Local\Temp\RarSFX0 filepath: C:\Users\test22\AppData\Local\Temp\RarSFX0\setup.exe track: 1 command_line: "C:\Users\test22\AppData\Local\Temp\RarSFX0\setup.exe" filepath_r: C:\Users\test22\AppData\Local\Temp\RarSFX0\setup.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x00000364	1	1
NtResumeThread March 28, 2024, 7:50 a.m.	thread_handle: 0x000000dc suspend_count: 1 process_identifier: 2176	1	0
NtResumeThread March 28, 2024, 7:50 a.m.	thread_handle: 0x00000150 suspend_count: 1 process_identifier: 2176	1	0
NtResumeThread March 28, 2024, 7:50 a.m.	thread_handle: 0x00000190 suspend_count: 1 process_identifier: 2176	1	0
NtResumeThread March 28, 2024, 7:50 a.m.	thread_handle: 0x0000022c suspend_count: 1 process_identifier: 2176	1	0
CreateProcessInternalW March 28, 2024, 7:50 a.m.	thread_identifier: 2344 thread_handle: 0x0000025c process_identifier: 2340 current_directory: C:\Windows\Microsoft.NET\Framework\v4.0.30319 filepath: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe track: 1 command_line: filepath_r: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000260	1	1
NtGetContextThread March 28, 2024, 7:50 a.m.	thread_handle: 0x0000025c	1	0
NtAllocateVirtualMemory March 28, 2024, 7:50 a.m.	process_identifier: 2340 region_size: 81920 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000260	1	0
WriteProcessMemory March 28, 2024, 7:50 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL8fàØn÷ @ @@÷OÎ H.textt× Ø `.rsrcÎÚ@@.reloc à@B base_address: 0x00400000 process_identifier: 2340 process_handle: 0x00000260	1	1
WriteProcessMemory March 28, 2024, 7:50 a.m.	buffer: base_address: 0x00402000 process_identifier: 2340 process_handle: 0x00000260	1	1
WriteProcessMemory March 28, 2024, 7:50 a.m.	buffer: P8h DäêD4VS_VERSION_INFO½ïþ?DVarFileInfo$Translation°¤StringFileInfo000004b0,FileDescription 0FileVersion1.0.0.08InternalNameXClient.exe(LegalCopyright @OriginalFilenameXClient.exe4ProductVersion1.0.0.08Assembly Version1.0.0.0ï»¿<?xml version="1.0" encoding="UTF-8" standalone="yes"?> <assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"> <assemblyIdentity version="1.0.0.0" name="MyApplication.app"/> <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2"> <security> <requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3"> <requestedExecutionLevel level="asInvoker" uiAccess="false"/> </requestedPrivileges> </security> </trustInfo> </assembly> base_address: 0x00410000 process_identifier: 2340 process_handle: 0x00000260	1	1
WriteProcessMemory March 28, 2024, 7:50 a.m.	buffer: ðp7 base_address: 0x00412000 process_identifier: 2340 process_handle: 0x00000260	1	1
WriteProcessMemory March 28, 2024, 7:50 a.m.	buffer: @ base_address: 0xfffde008 process_identifier: 2340 process_handle: 0x00000260	1	1
NtSetContextThread March 28, 2024, 7:50 a.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4257646 registers.ebp: 0 registers.edx: 0 registers.ebx: -139264 registers.esi: 0 registers.ecx: 0 thread_handle: 0x0000025c process_identifier: 2340	1	0
NtResumeThread March 28, 2024, 7:50 a.m.	thread_handle: 0x0000025c suspend_count: 1 process_identifier: 2340	1	0
NtResumeThread March 28, 2024, 7:50 a.m.	thread_handle: 0x0000017c suspend_count: 1 process_identifier: 2244	1	0
NtResumeThread March 28, 2024, 7:50 a.m.	thread_handle: 0x000001ec suspend_count: 1 process_identifier: 2244	1	0
NtResumeThread March 28, 2024, 7:50 a.m.	thread_handle: 0x00000230 suspend_count: 1 process_identifier: 2244	1	0
NtResumeThread March 28, 2024, 7:50 a.m.	thread_handle: 0x0000028c suspend_count: 1 process_identifier: 2244	1	0
NtGetContextThread March 28, 2024, 7:50 a.m.	thread_handle: 0x00000180	1	0
NtGetContextThread March 28, 2024, 7:50 a.m.	thread_handle: 0x00000180	1	0
NtResumeThread March 28, 2024, 7:50 a.m.	thread_handle: 0x00000180 suspend_count: 1 process_identifier: 2244	1	0
CreateProcessInternalW March 28, 2024, 7:50 a.m.	thread_identifier: 2352 thread_handle: 0x000002bc process_identifier: 2348 current_directory: C:\Users\test22\AppData\Local\Temp\RarSFX0 filepath: C:\Users\test22\AppData\Local\Temp\RarSFX0\setup.exe track: 1 command_line: filepath_r: C:\Users\test22\AppData\Local\Temp\RarSFX0\setup.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x000002c0	1	1
NtGetContextThread March 28, 2024, 7:50 a.m.	thread_handle: 0x000002bc	1	0
NtAllocateVirtualMemory March 28, 2024, 7:50 a.m.	process_identifier: 2348 region_size: 270336 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000002c0	1	0
WriteProcessMemory March 28, 2024, 7:50 a.m.	buffer: MZERèXè ÈÀ<ÁÀ(ÿá¸º´ Í!¸LÍ!This program cannot be run in DOS mode. $y =`gó=`gó=`gó¦¨ó:`gó¦ªó<`gó¦«ó<`góRich=`góPELvÙ-[à P @ @.textD ` base_address: 0x00400000 process_identifier: 2348 process_handle: 0x000002c0	1	1
WriteProcessMemory March 28, 2024, 7:50 a.m.	buffer: base_address: 0x00401000 process_identifier: 2348 process_handle: 0x000002c0	1	1
WriteProcessMemory March 28, 2024, 7:50 a.m.	buffer: @ base_address: 0x7efde008 process_identifier: 2348 process_handle: 0x000002c0	1	1
NtSetContextThread March 28, 2024, 7:50 a.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4199760 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x000002bc process_identifier: 2348	1	0
NtResumeThread March 28, 2024, 7:50 a.m.	thread_handle: 0x000002bc suspend_count: 1 process_identifier: 2348	1	0
NtResumeThread March 28, 2024, 7:50 a.m.	thread_handle: 0x000000dc suspend_count: 1 process_identifier: 2340	1	0
NtResumeThread March 28, 2024, 7:50 a.m.	thread_handle: 0x0000014c suspend_count: 1 process_identifier: 2340	1	0
NtResumeThread March 28, 2024, 7:50 a.m.	thread_handle: 0x000001bc suspend_count: 1 process_identifier: 2340	1	0
NtResumeThread March 28, 2024, 7:50 a.m.	thread_handle: 0x00000238 suspend_count: 1 process_identifier: 2340	1	0
NtResumeThread March 28, 2024, 7:50 a.m.	thread_handle: 0x0000029c suspend_count: 1 process_identifier: 2340	1	0
NtResumeThread March 28, 2024, 7:50 a.m.	thread_handle: 0x000001a4 suspend_count: 1 process_identifier: 2836	1	0
CreateProcessInternalW March 28, 2024, 7:50 a.m.	thread_identifier: 2580 thread_handle: 0x00000424 process_identifier: 1156 current_directory: filepath: C:\Program Files\Mozilla Firefox\firefox.exe track: 1 command_line: filepath_r: C:\Program Files\Mozilla Firefox\Firefox.exe stack_pivoted: 0 creation_flags: 12 (CREATE_SUSPENDED\|DETACHED_PROCESS) inherit_handles: 0 process_handle: 0x000003f8	1	1

File has been identified by 50 AntiVirus engines on VirusTotal as malicious (50 events)

Bkav	W32.AIDetectMalware
Lionic	Trojan.Win32.Injuke.16!c
Cynet	Malicious (score: 100)
Skyhigh	BehavesLike.Win32.Generic.rc
ALYac	IL:Trojan.MSILZilla.30422
Cylance	unsafe
Sangfor	Trojan.Msil.Kryptik.Vda2
K7AntiVirus	Trojan ( 005a96641 )
BitDefender	IL:Trojan.MSILZilla.30422
K7GW	Trojan ( 005a96641 )
Cybereason	malicious.7eda45
Arcabit	IL:Trojan.MSILZilla.D76D6 [many]
VirIT	Trojan.Win32.MSIL_Heur.A
Symantec	Trojan.Gen.MBT
Elastic	malicious (high confidence)
ESET-NOD32	a variant of MSIL/Kryptik.AEYN
APEX	Malicious
Avast	Win32:CrypterX-gen [Trj]
Kaspersky	UDS:DangerousObject.Multi.Generic
Alibaba	Trojan:MSIL/Kryptik.fafffe50
MicroWorld-eScan	IL:Trojan.MSILZilla.30422
Rising	Trojan.Injuke!8.10932 (CLOUD)
Emsisoft	IL:Trojan.MSILZilla.30422 (B)
F-Secure	Trojan.TR/Dropper.MSIL.Gen
TrendMicro	Backdoor.Win32.XWORM.YXEC1Z
FireEye	Generic.mg.90489ae7eda45c9a
Sophos	Mal/Generic-S
Ikarus	Trojan.MSIL.Crypt
Google	Detected
Avira	TR/Dropper.MSIL.Gen
MAX	malware (ai score=85)
Kingsoft	Win32.Troj.Unknown.a
Gridinsoft	Trojan.Win32.Kryptik.sa
Xcitium	Malware@#2eivb2fuh9t2v
Microsoft	Trojan:MSIL/Formbook.RDAD!MTB
ZoneAlarm	HEUR:Trojan.MSIL.Injuke.gen
GData	IL:Trojan.MSILZilla.30422 (2x)
Varist	W32/ABRisk.RWIE-8958
McAfee	Artemis!90489AE7EDA4
DeepInstinct	MALICIOUS
VBA32	BScope.Trojan.VBS.Agent
Malwarebytes	Malware.AI.4143616316
Panda	Trj/Genetic.gen
TrendMicro-HouseCall	Backdoor.Win32.XWORM.YXEC1Z
Tencent	Msil.Trojan.Injuke.Vimw
SentinelOne	Static AI - Malicious PE
Fortinet	MSIL/Kryptik.AEYN!tr
AVG	Win32:CrypterX-gen [Trj]
CrowdStrike	win/malicious_confidence_100% (W)
alibabacloud	Trojan[dropper]:MSIL/Injuke.gen

The process wscript.exe wrote an executable file to disk which it then attempted to execute (3 events)

file	C:\Windows\SysWOW64\wscript.exe
file	C:\Users\test22\AppData\Local\Temp\RarSFX0\update.exe
file	C:\Users\test22\AppData\Local\Temp\RarSFX0\setup.exe

file.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All