Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	June 4, 2024, 7:27 a.m.	June 4, 2024, 7:30 a.m.

Size	1.3MB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`439dafb5ed95e1036a120948e7996ea0`
SHA256	`9dd0514aadcdf042d16b61b85b1a345c6216abe92bded39b9ac3908e2ca35726`
CRC32	`279A53B5`
ssdeep	`24576:jNP+6OeKkQOFu97jhh6Z80ws8wB96wYwQXN2K3yWhs0JkKyVZwAWs5X8d:B+6O6Q+u97dhE80wVwB96wYlMahsLzFm`
Yara	PE_Header_Zero - PE File Signature Malicious_Packer_Zero - Malicious Packer anti_vm_detect - Possibly employs anti-virtualization techniques IsPE32 - (no description)

kano.exe "C:\Users\test22\AppData\Local\Temp\kano.exe"
2564
- schtasks.exe schtasks /create /f /RU "test22" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST
  2684
- schtasks.exe schtasks /create /f /RU "test22" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST
  2768

Name	Response	Post-Analysis Lookup
ipinfo.io	A 34.117.186.192	34.117.186.192
db-ip.com	A 104.26.5.15 A 104.26.4.15 A 172.67.75.166	104.26.4.15

IP Address	Status	Action
147.45.47.126	Active	Moloch
164.124.101.2	Active	Moloch
172.67.75.166	Active	Moloch
34.117.186.192	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.101:49166 -> 34.117.186.192:443	2025331	ET POLICY Possible External IP Lookup Domain Observed in SNI (ipinfo. io)	Device Retrieving External IP Address Detected
TCP 192.168.56.101:49166 -> 34.117.186.192:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49166 -> 34.117.186.192:443	2025331	ET POLICY Possible External IP Lookup Domain Observed in SNI (ipinfo. io)	Device Retrieving External IP Address Detected
TCP 192.168.56.101:49168 -> 172.67.75.166:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 147.45.47.126:58709 -> 192.168.56.101:49165	2400022	ET DROP Spamhaus DROP Listed Traffic Inbound group 23	Misc Attack
TCP 192.168.56.101:49165 -> 147.45.47.126:58709	2049060	ET MALWARE RisePro TCP Heartbeat Packet	A Network Trojan was detected
TCP 147.45.47.126:58709 -> 192.168.56.101:49165	2046266	ET MALWARE [ANY.RUN] RisePro TCP (Token)	A Network Trojan was detected
TCP 192.168.56.101:49165 -> 147.45.47.126:58709	2046270	ET MALWARE [ANY.RUN] RisePro TCP (Exfiltration)	A Network Trojan was detected
TCP 192.168.56.101:49165 -> 147.45.47.126:58709	2049661	ET MALWARE RisePro CnC Activity (Inbound)	A Network Trojan was detected
TCP 192.168.56.101:49165 -> 147.45.47.126:58709	2046269	ET MALWARE [ANY.RUN] RisePro TCP (Activity)	A Network Trojan was detected
TCP 192.168.56.101:49165 -> 147.45.47.126:58709	2049661	ET MALWARE RisePro CnC Activity (Inbound)	A Network Trojan was detected
TCP 192.168.56.101:49166 -> 34.117.186.192:443	2025331	ET POLICY Possible External IP Lookup Domain Observed in SNI (ipinfo. io)	Device Retrieving External IP Address Detected

Suricata TLS

Flow	Issuer	Subject	Fingerprint
TLSv1 192.168.56.101:49168 172.67.75.166:443	C=US, O=Google Trust Services LLC, CN=GTS CA 1P5	CN=db-ip.com	1f:af:15:cd:f8:f8:ee:30:f9:6e:6e:54:bc:9a:a7:c7:77:70:6d:25

Queries for the computername (4 events)

Time & API	Arguments	Status	Return
GetComputerNameA June 4, 2024, 7:27 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA June 4, 2024, 7:27 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 4, 2024, 7:27 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 4, 2024, 7:27 a.m.	computer_name: TEST22-PC	1	1

Command line console output was observed (2 events)

Time & API	Arguments	Status	Return	Repeated
WriteConsoleW June 4, 2024, 7:27 a.m.	buffer: SUCCESS: The scheduled task "MPGPH131 HR" has successfully been created. console_handle: 0x00000007	1	1	0
WriteConsoleW June 4, 2024, 7:27 a.m.	buffer: SUCCESS: The scheduled task "MPGPH131 LG" has successfully been created. console_handle: 0x00000007	1	1	0

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

Tries to locate where the browsers are installed (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx June 4, 2024, 7:27 a.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (2 events)

section
section	.data\x00Th

One or more processes crashed (24 events)

Time & API	Arguments	Status
__exception__ June 4, 2024, 7:27 a.m.	stacktrace: kano+0x2e5e08 @ 0x695e08 kano+0x2708dc @ 0x6208dc exception.instruction_r: f7 f0 e8 f8 2f 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: kano+0x24d1d9 exception.instruction: div eax exception.module: kano.exe exception.exception_code: 0xc0000094 exception.offset: 2413017 exception.address: 0x5fd1d9 registers.esp: 3799500 registers.edi: 6869132 registers.eax: 0 registers.ebp: 3799528 registers.edx: 0 registers.ebx: 46543792 registers.esi: 5 registers.ecx: 46543792	1
__exception__ June 4, 2024, 7:27 a.m.	stacktrace: kano+0x2e5e08 @ 0x695e08 kano+0x2708dc @ 0x6208dc exception.instruction_r: f7 f0 e8 f8 2f 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: kano+0x24d1d9 exception.instruction: div eax exception.module: kano.exe exception.exception_code: 0xc0000094 exception.offset: 2413017 exception.address: 0x5fd1d9 registers.esp: 3799500 registers.edi: 3799500 registers.eax: 0 registers.ebp: 3799528 registers.edx: 0 registers.ebx: 6279663 registers.esi: 0 registers.ecx: 3799708	1
__exception__ June 4, 2024, 7:27 a.m.	stacktrace: kano+0x2e5e08 @ 0x695e08 kano+0x2708dc @ 0x6208dc exception.instruction_r: f7 f0 e8 f8 2f 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: kano+0x24d1d9 exception.instruction: div eax exception.module: kano.exe exception.exception_code: 0xc0000094 exception.offset: 2413017 exception.address: 0x5fd1d9 registers.esp: 3799500 registers.edi: 3799500 registers.eax: 0 registers.ebp: 3799528 registers.edx: 0 registers.ebx: 6279663 registers.esi: 0 registers.ecx: 3799708	1
__exception__ June 4, 2024, 7:27 a.m.	stacktrace: kano+0x2e5e08 @ 0x695e08 kano+0x2708dc @ 0x6208dc exception.instruction_r: f7 f0 e8 f8 2f 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: kano+0x24d1d9 exception.instruction: div eax exception.module: kano.exe exception.exception_code: 0xc0000094 exception.offset: 2413017 exception.address: 0x5fd1d9 registers.esp: 3799500 registers.edi: 3799500 registers.eax: 0 registers.ebp: 3799528 registers.edx: 0 registers.ebx: 6279663 registers.esi: 0 registers.ecx: 3799708	1
__exception__ June 4, 2024, 7:27 a.m.	stacktrace: kano+0x2e5e08 @ 0x695e08 kano+0x2708dc @ 0x6208dc exception.instruction_r: f7 f0 e8 f8 2f 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: kano+0x24d1d9 exception.instruction: div eax exception.module: kano.exe exception.exception_code: 0xc0000094 exception.offset: 2413017 exception.address: 0x5fd1d9 registers.esp: 3799500 registers.edi: 3799500 registers.eax: 0 registers.ebp: 3799528 registers.edx: 0 registers.ebx: 6279663 registers.esi: 0 registers.ecx: 3799708	1
__exception__ June 4, 2024, 7:27 a.m.	stacktrace: kano+0x2e5e08 @ 0x695e08 kano+0x2708dc @ 0x6208dc exception.instruction_r: f7 f0 e8 f8 2f 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: kano+0x24d1d9 exception.instruction: div eax exception.module: kano.exe exception.exception_code: 0xc0000094 exception.offset: 2413017 exception.address: 0x5fd1d9 registers.esp: 3799500 registers.edi: 3799500 registers.eax: 0 registers.ebp: 3799528 registers.edx: 0 registers.ebx: 6279663 registers.esi: 0 registers.ecx: 3799708	1
__exception__ June 4, 2024, 7:27 a.m.	stacktrace: kano+0x2e5e08 @ 0x695e08 kano+0x2708dc @ 0x6208dc exception.instruction_r: f7 f0 e8 f8 2f 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: kano+0x24d1d9 exception.instruction: div eax exception.module: kano.exe exception.exception_code: 0xc0000094 exception.offset: 2413017 exception.address: 0x5fd1d9 registers.esp: 3799500 registers.edi: 3799500 registers.eax: 0 registers.ebp: 3799528 registers.edx: 0 registers.ebx: 6279663 registers.esi: 0 registers.ecx: 3799708	1
__exception__ June 4, 2024, 7:27 a.m.	stacktrace: kano+0x2e5e08 @ 0x695e08 kano+0x2708dc @ 0x6208dc exception.instruction_r: f7 f0 e8 f8 2f 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: kano+0x24d1d9 exception.instruction: div eax exception.module: kano.exe exception.exception_code: 0xc0000094 exception.offset: 2413017 exception.address: 0x5fd1d9 registers.esp: 3799500 registers.edi: 3799500 registers.eax: 0 registers.ebp: 3799528 registers.edx: 0 registers.ebx: 6279663 registers.esi: 0 registers.ecx: 3799708	1
__exception__ June 4, 2024, 7:27 a.m.	stacktrace: kano+0x2e5e08 @ 0x695e08 kano+0x2708dc @ 0x6208dc exception.instruction_r: f7 f0 e8 f8 2f 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: kano+0x24d1d9 exception.instruction: div eax exception.module: kano.exe exception.exception_code: 0xc0000094 exception.offset: 2413017 exception.address: 0x5fd1d9 registers.esp: 3799500 registers.edi: 3799500 registers.eax: 0 registers.ebp: 3799528 registers.edx: 0 registers.ebx: 6279663 registers.esi: 0 registers.ecx: 3799708	1
__exception__ June 4, 2024, 7:27 a.m.	stacktrace: kano+0x2e5e08 @ 0x695e08 kano+0x2708dc @ 0x6208dc exception.instruction_r: 0f 0b e8 cd 2f 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: kano+0x24d204 exception.instruction: ud2 exception.module: kano.exe exception.exception_code: 0xc000001d exception.offset: 2413060 exception.address: 0x5fd204 registers.esp: 3799500 registers.edi: 3799500 registers.eax: 0 registers.ebp: 3799528 registers.edx: 2 registers.ebx: 6279663 registers.esi: 0 registers.ecx: 3799708	1
__exception__ June 4, 2024, 7:27 a.m.	stacktrace: kano+0x2e47d7 @ 0x6947d7 kano+0x2e4dca @ 0x694dca kano+0x2708dc @ 0x6208dc exception.instruction_r: 0f 0b e8 cd 2f 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: kano+0x24d204 exception.instruction: ud2 exception.module: kano.exe exception.exception_code: 0xc000001d exception.offset: 2413060 exception.address: 0x5fd204 registers.esp: 3799452 registers.edi: 6869132 registers.eax: 0 registers.ebp: 3799480 registers.edx: 2 registers.ebx: 1339392 registers.esi: 5533696 registers.ecx: 5533696	1
__exception__ June 4, 2024, 7:27 a.m.	stacktrace: kano+0x2e47d7 @ 0x6947d7 kano+0x2e4dca @ 0x694dca kano+0x2708dc @ 0x6208dc exception.instruction_r: 0f 0b e8 cd 2f 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: kano+0x24d204 exception.instruction: ud2 exception.module: kano.exe exception.exception_code: 0xc000001d exception.offset: 2413060 exception.address: 0x5fd204 registers.esp: 3799452 registers.edi: 3799452 registers.eax: 0 registers.ebp: 3799480 registers.edx: 2 registers.ebx: 6279706 registers.esi: 0 registers.ecx: 3799488	1
__exception__ June 4, 2024, 7:27 a.m.	stacktrace: kano+0x2e47d7 @ 0x6947d7 kano+0x2e4dca @ 0x694dca kano+0x2708dc @ 0x6208dc exception.instruction_r: f7 f0 e8 f8 2f 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: kano+0x24d1d9 exception.instruction: div eax exception.module: kano.exe exception.exception_code: 0xc0000094 exception.offset: 2413017 exception.address: 0x5fd1d9 registers.esp: 3799452 registers.edi: 3799452 registers.eax: 0 registers.ebp: 3799480 registers.edx: 0 registers.ebx: 6279706 registers.esi: 0 registers.ecx: 3799488	1
__exception__ June 4, 2024, 7:27 a.m.	stacktrace: kano+0x2e48b3 @ 0x6948b3 kano+0x2e4dca @ 0x694dca kano+0x2708dc @ 0x6208dc exception.instruction_r: 0f 0b e8 cd 2f 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: kano+0x24d204 exception.instruction: ud2 exception.module: kano.exe exception.exception_code: 0xc000001d exception.offset: 2413060 exception.address: 0x5fd204 registers.esp: 3799452 registers.edi: 6869132 registers.eax: 0 registers.ebp: 3799480 registers.edx: 2 registers.ebx: 1339392 registers.esi: 5533696 registers.ecx: 0	1
__exception__ June 4, 2024, 7:27 a.m.	stacktrace: kano+0x2e48b3 @ 0x6948b3 kano+0x2e4dca @ 0x694dca kano+0x2708dc @ 0x6208dc exception.instruction_r: f7 f0 e8 f8 2f 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: kano+0x24d1d9 exception.instruction: div eax exception.module: kano.exe exception.exception_code: 0xc0000094 exception.offset: 2413017 exception.address: 0x5fd1d9 registers.esp: 3799452 registers.edi: 3799452 registers.eax: 0 registers.ebp: 3799480 registers.edx: 0 registers.ebx: 6279706 registers.esi: 0 registers.ecx: 3799488	1
__exception__ June 4, 2024, 7:27 a.m.	stacktrace: kano+0x2e48b3 @ 0x6948b3 kano+0x2e4dca @ 0x694dca kano+0x2708dc @ 0x6208dc exception.instruction_r: 0f 0b e8 cd 2f 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: kano+0x24d204 exception.instruction: ud2 exception.module: kano.exe exception.exception_code: 0xc000001d exception.offset: 2413060 exception.address: 0x5fd204 registers.esp: 3799452 registers.edi: 3799452 registers.eax: 0 registers.ebp: 3799480 registers.edx: 2 registers.ebx: 6279663 registers.esi: 0 registers.ecx: 3799488	1
__exception__ June 4, 2024, 7:27 a.m.	stacktrace: kano+0x2e4985 @ 0x694985 kano+0x2e4dca @ 0x694dca kano+0x2708dc @ 0x6208dc exception.instruction_r: f7 f0 e8 f8 2f 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: kano+0x24d1d9 exception.instruction: div eax exception.module: kano.exe exception.exception_code: 0xc0000094 exception.offset: 2413017 exception.address: 0x5fd1d9 registers.esp: 3799452 registers.edi: 6869132 registers.eax: 0 registers.ebp: 3799480 registers.edx: 0 registers.ebx: 1339392 registers.esi: 5533696 registers.ecx: 3799480	1
__exception__ June 4, 2024, 7:27 a.m.	stacktrace: kano+0x2e4985 @ 0x694985 kano+0x2e4dca @ 0x694dca kano+0x2708dc @ 0x6208dc exception.instruction_r: 0f 0b e8 cd 2f 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: kano+0x24d204 exception.instruction: ud2 exception.module: kano.exe exception.exception_code: 0xc000001d exception.offset: 2413060 exception.address: 0x5fd204 registers.esp: 3799452 registers.edi: 3799452 registers.eax: 0 registers.ebp: 3799480 registers.edx: 2 registers.ebx: 6279663 registers.esi: 0 registers.ecx: 3799488	1
__exception__ June 4, 2024, 7:27 a.m.	stacktrace: kano+0x2e4a7f @ 0x694a7f kano+0x2e4dca @ 0x694dca kano+0x2708dc @ 0x6208dc exception.instruction_r: 0f 0b e8 cd 2f 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: kano+0x24d204 exception.instruction: ud2 exception.module: kano.exe exception.exception_code: 0xc000001d exception.offset: 2413060 exception.address: 0x5fd204 registers.esp: 3799452 registers.edi: 6869132 registers.eax: 0 registers.ebp: 3799480 registers.edx: 2 registers.ebx: 1339392 registers.esi: 5533696 registers.ecx: 0	1
__exception__ June 4, 2024, 7:27 a.m.	stacktrace: kano+0x2e4b15 @ 0x694b15 kano+0x2e4dca @ 0x694dca kano+0x2708dc @ 0x6208dc exception.instruction_r: f7 f0 e8 f8 2f 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: kano+0x24d1d9 exception.instruction: div eax exception.module: kano.exe exception.exception_code: 0xc0000094 exception.offset: 2413017 exception.address: 0x5fd1d9 registers.esp: 3799452 registers.edi: 6869132 registers.eax: 0 registers.ebp: 3799480 registers.edx: 0 registers.ebx: 1339392 registers.esi: 5533696 registers.ecx: 5462824	1
__exception__ June 4, 2024, 7:27 a.m.	stacktrace: kano+0x2e4b15 @ 0x694b15 kano+0x2e4dca @ 0x694dca kano+0x2708dc @ 0x6208dc exception.instruction_r: 0f 0b e8 cd 2f 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: kano+0x24d204 exception.instruction: ud2 exception.module: kano.exe exception.exception_code: 0xc000001d exception.offset: 2413060 exception.address: 0x5fd204 registers.esp: 3799452 registers.edi: 3799452 registers.eax: 0 registers.ebp: 3799480 registers.edx: 2 registers.ebx: 6279663 registers.esi: 0 registers.ecx: 3799488	1
__exception__ June 4, 2024, 7:27 a.m.	stacktrace: kano+0x2e4b15 @ 0x694b15 kano+0x2e4dca @ 0x694dca kano+0x2708dc @ 0x6208dc exception.instruction_r: f7 f0 e8 f8 2f 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: kano+0x24d1d9 exception.instruction: div eax exception.module: kano.exe exception.exception_code: 0xc0000094 exception.offset: 2413017 exception.address: 0x5fd1d9 registers.esp: 3799452 registers.edi: 3799452 registers.eax: 0 registers.ebp: 3799480 registers.edx: 0 registers.ebx: 6279706 registers.esi: 0 registers.ecx: 3799488	1
__exception__ June 4, 2024, 7:27 a.m.	stacktrace: kano+0x2e4b15 @ 0x694b15 kano+0x2e4dca @ 0x694dca kano+0x2708dc @ 0x6208dc exception.instruction_r: 0f 0b e8 cd 2f 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: kano+0x24d204 exception.instruction: ud2 exception.module: kano.exe exception.exception_code: 0xc000001d exception.offset: 2413060 exception.address: 0x5fd204 registers.esp: 3799452 registers.edi: 3799452 registers.eax: 0 registers.ebp: 3799480 registers.edx: 2 registers.ebx: 6279663 registers.esi: 0 registers.ecx: 3799488	1
__exception__ June 4, 2024, 7:28 a.m.	stacktrace: RtlpNtEnumerateSubKey+0x2a2b isupper-0x4e2b ntdll+0xcf559 @ 0x76fdf559 RtlpNtEnumerateSubKey+0x2b0b isupper-0x4d4b ntdll+0xcf639 @ 0x76fdf639 RtlUlonglongByteSwap+0xba5 RtlFreeOemString-0x20d35 ntdll+0x7df95 @ 0x76f8df95 HeapFree+0x14 GetProcessHeap-0xc kernel32+0x114dd @ 0x755c14dd kano+0x4b036 @ 0x3fb036 kano+0x41cae @ 0x3f1cae kano+0x338fe @ 0x3e38fe kano+0x2e37 @ 0x3b2e37 kano+0x4665c @ 0x3f665c kano+0x46454 @ 0x3f6454 kano+0x46708 @ 0x3f6708 kano+0x434da @ 0x3f34da kano+0x43406 @ 0x3f3406 kano+0x435c8 @ 0x3f35c8 kano+0x4372f @ 0x3f372f kano+0x33d64 @ 0x3e3d64 0x39f9b0 kano+0x2e4be7 @ 0x694be7 kano+0x2e4dca @ 0x694dca kano+0x2708dc @ 0x6208dc exception.instruction_r: eb 12 8b 45 ec 8b 08 8b 09 50 51 e8 6f ff ff ff exception.symbol: RtlpNtEnumerateSubKey+0x1b25 isupper-0x5d31 ntdll+0xce653 exception.instruction: jmp 0x76fde667 exception.module: ntdll.dll exception.exception_code: 0xc0000374 exception.offset: 845395 exception.address: 0x76fde653 registers.esp: 3798696 registers.edi: 12174928 registers.eax: 3798712 registers.ebp: 3798816 registers.edx: 0 registers.ebx: 0 registers.esi: 11993088 registers.ecx: 2147483647	1

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Performs some HTTP requests (1 event)

request

GET https://db-ip.com/demo/home.php?s=175.208.134.152

Allocates read-write-execute memory (usually to unpack itself) (15 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory June 4, 2024, 7:27 a.m.	process_identifier: 2564 region_size: 2936832 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02830000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 4, 2024, 7:27 a.m.	process_identifier: 2564 region_size: 16384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02c40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 4, 2024, 7:27 a.m.	process_identifier: 2564 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00ab0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 4, 2024, 7:27 a.m.	process_identifier: 2564 region_size: 81920 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02c44000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 4, 2024, 7:27 a.m.	process_identifier: 2564 region_size: 147456 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02c44000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 4, 2024, 7:27 a.m.	process_identifier: 2564 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02c64000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 4, 2024, 7:27 a.m.	process_identifier: 2564 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02c74000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 4, 2024, 7:27 a.m.	process_identifier: 2564 region_size: 81920 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02c74000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 4, 2024, 7:27 a.m.	process_identifier: 2564 region_size: 16384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02c84000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 4, 2024, 7:27 a.m.	process_identifier: 2564 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02c88000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 4, 2024, 7:27 a.m.	process_identifier: 2564 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02c88000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 4, 2024, 7:27 a.m.	process_identifier: 2564 region_size: 606208 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02c88000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 4, 2024, 7:27 a.m.	process_identifier: 2564 region_size: 81920 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02c88000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 4, 2024, 7:27 a.m.	process_identifier: 2564 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02c88000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 4, 2024, 7:27 a.m.	process_identifier: 2564 region_size: 114688 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02c88000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation (13 events)

Time & API	Arguments	Status	Return
GetDiskFreeSpaceW June 4, 2024, 7:27 a.m.	number_of_free_clusters: 8362495 sectors_per_cluster: 8362495 bytes_per_sector: 512 root_path: C: total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceW June 4, 2024, 7:27 a.m.	number_of_free_clusters: 8362495 sectors_per_cluster: 8362495 bytes_per_sector: 512 root_path: C: total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceW June 4, 2024, 7:27 a.m.	number_of_free_clusters: 8362495 sectors_per_cluster: 8362495 bytes_per_sector: 512 root_path: C: total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceW June 4, 2024, 7:27 a.m.	number_of_free_clusters: 8362495 sectors_per_cluster: 8362495 bytes_per_sector: 512 root_path: C: total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceW June 4, 2024, 7:27 a.m.	number_of_free_clusters: 8362495 sectors_per_cluster: 8362495 bytes_per_sector: 512 root_path: C: total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceW June 4, 2024, 7:27 a.m.	number_of_free_clusters: 8362495 sectors_per_cluster: 8362495 bytes_per_sector: 512 root_path: C: total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceW June 4, 2024, 7:27 a.m.	number_of_free_clusters: 8362495 sectors_per_cluster: 8362495 bytes_per_sector: 512 root_path: C: total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceW June 4, 2024, 7:27 a.m.	number_of_free_clusters: 8362495 sectors_per_cluster: 8362495 bytes_per_sector: 512 root_path: C: total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceW June 4, 2024, 7:27 a.m.	number_of_free_clusters: 8362495 sectors_per_cluster: 8362495 bytes_per_sector: 512 root_path: C: total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceW June 4, 2024, 7:27 a.m.	number_of_free_clusters: 8362495 sectors_per_cluster: 8362495 bytes_per_sector: 512 root_path: C: total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceW June 4, 2024, 7:27 a.m.	number_of_free_clusters: 8362495 sectors_per_cluster: 8362495 bytes_per_sector: 512 root_path: C: total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceW June 4, 2024, 7:27 a.m.	number_of_free_clusters: 8362495 sectors_per_cluster: 8362495 bytes_per_sector: 512 root_path: C: total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceW June 4, 2024, 7:27 a.m.	number_of_free_clusters: 8362495 sectors_per_cluster: 8362495 bytes_per_sector: 512 root_path: C: total_number_of_clusters: 8362495	1	1

Steals private information from local Internet browsers (50 out of 3360 events)

file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\PepperFlash\Sync Extension Settings\kncchdigobghenbbaddojjnnaogfppfj\CURRENT
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\OriginTrials\Local Extension Settings\lpilbniiabackdjcionkobglmddfbcjo\CURRENT
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\ShaderCache\Sync Extension Settings\jgaaimajipbpdogpdglhaphldakikgef\CURRENT
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\BrowserMetrics\Local Extension Settings\agoakfejjabomempkjlepdflaleeobhb\CURRENT
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\ShaderCache\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa\CURRENT
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\SSLErrorAssistant\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn\CURRENT
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\BrowserMetrics\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk\CURRENT
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp\CURRENT
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\WidevineCdm\Local Extension Settings\jhfjfclepacoldmjmkmdlmganfaalklb\CURRENT
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\ShaderCache\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao\CURRENT
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil\CURRENT
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn\CURRENT
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\SSLErrorAssistant\Sync Extension Settings\ebfidpplhabeedpnhjnobghokpiioolj\CURRENT
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Safe Browsing\Sync Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno\CURRENT
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm\CURRENT
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\BrowserMetrics\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf\CURRENT
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Crashpad\Sync Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil\CURRENT
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\ShaderCache\Sync Extension Settings\mgffkfbidihjpoaomajlbgchddlicgpn\CURRENT
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\CertificateRevocation\Sync Extension Settings\lpilbniiabackdjcionkobglmddfbcjo\CURRENT
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\OriginTrials\Sync Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh\CURRENT
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Safe Browsing\Sync Extension Settings\igkpcodhieompeloncfnbekccinhapdb\CURRENT
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\CertificateRevocation\Sync Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma\CURRENT
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\WidevineCdm\Sync Extension Settings\jnkelfanjkeadonecabehalmbgpfodjm\CURRENT
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\WidevineCdm\Sync Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg\CURRENT
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Crashpad\Sync Extension Settings\jnkelfanjkeadonecabehalmbgpfodjm\CURRENT
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\SSLErrorAssistant\Local Extension Settings\gjagmgiddbbciopjhllkdnddhcglnemk\CURRENT
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\CertificateRevocation\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj\CURRENT
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\FileTypePolicies\Sync Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad\CURRENT
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\SwReporter\Sync Extension Settings\anokgmphncpekkhclmingpimjmcooifb\CURRENT
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\BrowserMetrics\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg\CURRENT
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\SwReporter\Sync Extension Settings\agoakfejjabomempkjlepdflaleeobhb\CURRENT
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil\CURRENT
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\PepperFlash\Local Extension Settings\lpilbniiabackdjcionkobglmddfbcjo\CURRENT
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\CertificateRevocation\Sync Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec\CURRENT
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\PepperFlash\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd\CURRENT
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\pnacl\Sync Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb\CURRENT
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\SwReporter\Sync Extension Settings\cjmkndjhnagcfbpiemnkdpomccnjblmj\CURRENT
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\FileTypePolicies\Sync Extension Settings\jnkelfanjkeadonecabehalmbgpfodjm\CURRENT
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\CertificateTransparency\Sync Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm\CURRENT
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Subresource Filter\Sync Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm\CURRENT
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\ookjlbkiijinhpmnjffcofjonbfbgaoc\CURRENT
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\PnaclTranslationCache\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg\CURRENT
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\CertificateTransparency\Sync Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn\CURRENT
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\PepperFlash\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn\CURRENT
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\pnacl\Sync Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh\CURRENT
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\WidevineCdm\Sync Extension Settings\flpiciilemghbmfalicajoolhkkenfel\CURRENT
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\CertificateTransparency\Local Extension Settings\aodkkagnadcbobfpggfnjeongemjbjca\CURRENT
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\SwReporter\Local Extension Settings\aijcbedoijmgnlmjeegjaglmepbmpkpi\CURRENT
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.ldb
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\pnacl\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj\CURRENT

Looks up the external IP address (1 event)

domain

ipinfo.io

Creates a suspicious process (2 events)

cmdline	schtasks /create /f /RU "test22" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST
cmdline	schtasks /create /f /RU "test22" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST

A process created a hidden window (2 events)

Time & API	Arguments	Status	Return	Repeated
CreateProcessInternalW June 4, 2024, 7:27 a.m.	thread_identifier: 2688 thread_handle: 0x00000158 process_identifier: 2684 current_directory: filepath: track: 1 command_line: schtasks /create /f /RU "test22" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 0 process_handle: 0x0000015c	1	1	0
CreateProcessInternalW June 4, 2024, 7:27 a.m.	thread_identifier: 2772 thread_handle: 0x00000164 process_identifier: 2768 current_directory: filepath: track: 1 command_line: schtasks /create /f /RU "test22" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 0 process_handle: 0x00000160	1	1	0

Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (26 events)

Time & API	Arguments	Status	Return
Process32NextW June 4, 2024, 7:27 a.m.	snapshot_handle: 0x0000046c process_name: smss.exe process_identifier: 224	1	1
Process32NextW June 4, 2024, 7:27 a.m.	snapshot_handle: 0x0000046c process_name: csrss.exe process_identifier: 360	1	1
Process32NextW June 4, 2024, 7:27 a.m.	snapshot_handle: 0x0000046c process_name: svchost.exe process_identifier: 572	1	1
Process32NextW June 4, 2024, 7:27 a.m.	snapshot_handle: 0x0000046c process_name: svchost.exe process_identifier: 652	1	1
Process32NextW June 4, 2024, 7:27 a.m.	snapshot_handle: 0x0000046c process_name: svchost.exe process_identifier: 724	1	1
Process32NextW June 4, 2024, 7:27 a.m.	snapshot_handle: 0x0000046c process_name: svchost.exe process_identifier: 784	1	1
Process32NextW June 4, 2024, 7:27 a.m.	snapshot_handle: 0x0000046c process_name: svchost.exe process_identifier: 832	1	1
Process32NextW June 4, 2024, 7:27 a.m.	snapshot_handle: 0x0000046c process_name: audiodg.exe process_identifier: 900	1	1
Process32NextW June 4, 2024, 7:27 a.m.	snapshot_handle: 0x0000046c process_name: svchost.exe process_identifier: 992	1	1
Process32NextW June 4, 2024, 7:27 a.m.	snapshot_handle: 0x0000046c process_name: svchost.exe process_identifier: 292	1	1
Process32NextW June 4, 2024, 7:27 a.m.	snapshot_handle: 0x0000046c process_name: spoolsv.exe process_identifier: 324	1	1
Process32NextW June 4, 2024, 7:27 a.m.	snapshot_handle: 0x0000046c process_name: svchost.exe process_identifier: 1048	1	1
Process32NextW June 4, 2024, 7:27 a.m.	snapshot_handle: 0x0000046c process_name: srvany.exe process_identifier: 1284	1	1
Process32NextW June 4, 2024, 7:27 a.m.	snapshot_handle: 0x0000046c process_name: KMService.exe process_identifier: 1436	1	1
Process32NextW June 4, 2024, 7:27 a.m.	snapshot_handle: 0x0000046c process_name: conhost.exe process_identifier: 1448	1	1
Process32NextW June 4, 2024, 7:27 a.m.	snapshot_handle: 0x0000046c process_name: taskhost.exe process_identifier: 1600	1	1
Process32NextW June 4, 2024, 7:27 a.m.	snapshot_handle: 0x0000046c process_name: sppsvc.exe process_identifier: 1820	1	1
Process32NextW June 4, 2024, 7:27 a.m.	snapshot_handle: 0x0000046c process_name: svchost.exe process_identifier: 1896	1	1
Process32NextW June 4, 2024, 7:27 a.m.	snapshot_handle: 0x0000046c process_name: dwm.exe process_identifier: 1260	1	1
Process32NextW June 4, 2024, 7:27 a.m.	snapshot_handle: 0x0000046c process_name: explorer.exe process_identifier: 1452	1	1
Process32NextW June 4, 2024, 7:27 a.m.	snapshot_handle: 0x0000046c process_name: pw.exe process_identifier: 988	1	1
Process32NextW June 4, 2024, 7:27 a.m.	snapshot_handle: 0x0000046c process_name: SearchIndexer.exe process_identifier: 1160	1	1
Process32NextW June 4, 2024, 7:27 a.m.	snapshot_handle: 0x0000046c process_name: SearchProtocolHost.exe process_identifier: 936	1	1
Process32NextW June 4, 2024, 7:27 a.m.	snapshot_handle: 0x0000046c process_name: SearchFilterHost.exe process_identifier: 2000	1	1
Process32NextW June 4, 2024, 7:27 a.m.	snapshot_handle: 0x0000046c process_name: taskhost.exe process_identifier: 2380	1	1
Process32NextW June 4, 2024, 7:27 a.m.	snapshot_handle: 0x0000046c process_name: kano.exe process_identifier: 2564	1	1

The binary likely contains encrypted or compressed data indicative of a packer (6 events)

section

{u'size_of_data': u'0x00093c00', u'virtual_address': u'0x00001000', u'entropy': 7.999592987200359, u'name': u'', u'virtual_size': u'0x0015c000'}

entropy

7.9995929872

description