Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	June 16, 2024, 9:59 a.m.	June 16, 2024, 10:48 a.m.

Size	5.3MB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`49b56d5b9af9bf4027adf9b2b89971c4`
SHA256	`b392d76bc73486b5a61293cb71d75d79b355682d95a7c2f7aa38716b3b241edd`
CRC32	`F344D034`
ssdeep	`98304:TBvd04TCsRlx5s7KFJJJbfUtY4ENEK2iFjHfMkeLmmzsdvhBu9CxP9F:TBl7TH3fGK7JythvidMmmY9S9kT`
Yara	Malicious_Packer_Zero - Malicious Packer PE_Header_Zero - PE File Signature IsPE32 - (no description)

clips.exe "C:\Users\test22\AppData\Local\Temp\clips.exe"
2552
- attrib.exe attrib +H +S C:\Users\test22\AppData\Roaming\sihost.exe
  2648
- attrib.exe attrib +H C:\Users\test22\AppData\Roaming\sihost.exe
  2684
- schtasks.exe schtasks /f /CREATE /TN "sihost.exe" /TR "C:\Users\test22\AppData\Roaming\sihost.exe" /SC MINUTE
  2748
- powershell.exe powershell ping 127.0.0.1; del clips.exe
  2812
  - PING.EXE "C:\Windows\system32\PING.EXE" 127.0.0.1
    2932

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (7 events)

Time & API	Arguments	Status	Return
GetComputerNameW June 16, 2024, 9:59 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 16, 2024, 9:59 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 16, 2024, 9:59 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 16, 2024, 9:59 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 16, 2024, 9:59 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA June 16, 2024, 9:59 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 16, 2024, 9:59 a.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (1 event)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent June 16, 2024, 9:59 a.m.			0	0

Command line console output was observed (23 events)

Time & API	Arguments	Status	Return
WriteConsoleW June 16, 2024, 9:59 a.m.	buffer: Not resetting system file - C:\Users\tes console_handle: 0x00000013	1	1
WriteConsoleW June 16, 2024, 9:59 a.m.	buffer: t22\AppData\Roaming\sihost.exe console_handle: 0x00000013	1	1
WriteConsoleW June 16, 2024, 9:59 a.m.	buffer: SUCCESS: The scheduled task "sihost.exe" has successfully been created. console_handle: 0x00000007	1	1
WriteConsoleA June 16, 2024, 9:59 a.m.	buffer: Pinging 127.0.0.1 console_handle: 0x00000007	1	1
WriteConsoleA June 16, 2024, 9:59 a.m.	buffer: with 32 bytes of data: console_handle: 0x00000007	1	1
WriteConsoleA June 16, 2024, 9:59 a.m.	buffer: Reply from 127.0.0.1: console_handle: 0x00000007	1	1
WriteConsoleA June 16, 2024, 9:59 a.m.	buffer: bytes=32 console_handle: 0x00000007	1	1
WriteConsoleA June 16, 2024, 9:59 a.m.	buffer: time<1ms console_handle: 0x00000007	1	1
WriteConsoleA June 16, 2024, 9:59 a.m.	buffer: TTL=128 console_handle: 0x00000007	1	1
WriteConsoleA June 16, 2024, 9:59 a.m.	buffer: Reply from 127.0.0.1: console_handle: 0x00000007	1	1
WriteConsoleA June 16, 2024, 9:59 a.m.	buffer: bytes=32 console_handle: 0x00000007	1	1
WriteConsoleA June 16, 2024, 9:59 a.m.	buffer: time<1ms console_handle: 0x00000007	1	1
WriteConsoleA June 16, 2024, 9:59 a.m.	buffer: TTL=128 console_handle: 0x00000007	1	1
WriteConsoleA June 16, 2024, 9:59 a.m.	buffer: Reply from 127.0.0.1: console_handle: 0x00000007	1	1
WriteConsoleA June 16, 2024, 9:59 a.m.	buffer: bytes=32 console_handle: 0x00000007	1	1
WriteConsoleA June 16, 2024, 9:59 a.m.	buffer: time<1ms console_handle: 0x00000007	1	1
WriteConsoleA June 16, 2024, 9:59 a.m.	buffer: TTL=128 console_handle: 0x00000007	1	1
WriteConsoleA June 16, 2024, 9:59 a.m.	buffer: Reply from 127.0.0.1: console_handle: 0x00000007	1	1
WriteConsoleA June 16, 2024, 9:59 a.m.	buffer: bytes=32 console_handle: 0x00000007	1	1
WriteConsoleA June 16, 2024, 9:59 a.m.	buffer: time<1ms console_handle: 0x00000007	1	1
WriteConsoleA June 16, 2024, 9:59 a.m.	buffer: TTL=128 console_handle: 0x00000007	1	1
WriteConsoleA June 16, 2024, 9:59 a.m.	buffer: Ping statistics for 127.0.0.1: Packets: Sent = 4, Received = 4, Lost = 0 (0% loss), console_handle: 0x00000007	1	1
WriteConsoleA June 16, 2024, 9:59 a.m.	buffer: Approximate round trip times in milli-seconds: Minimum = 0ms, Maximum = 0ms, Average = 0ms console_handle: 0x00000007	1	1

Uses Windows APIs to generate a cryptographic key (42 events)

Time & API	Arguments	Status	Return
CryptExportKey June 16, 2024, 9:59 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00620b50 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 16, 2024, 9:59 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006210d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 16, 2024, 9:59 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006210d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 16, 2024, 9:59 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006210d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 16, 2024, 9:59 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00620c50 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 16, 2024, 9:59 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00620c50 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 16, 2024, 9:59 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00620c50 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 16, 2024, 9:59 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00620c50 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 16, 2024, 9:59 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00620c50 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 16, 2024, 9:59 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00620c50 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 16, 2024, 9:59 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00620710 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 16, 2024, 9:59 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00620710 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 16, 2024, 9:59 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00620710 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 16, 2024, 9:59 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006210d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 16, 2024, 9:59 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006210d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 16, 2024, 9:59 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006210d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 16, 2024, 9:59 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00620fd0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 16, 2024, 9:59 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006210d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 16, 2024, 9:59 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006210d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 16, 2024, 9:59 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006210d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 16, 2024, 9:59 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006210d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 16, 2024, 9:59 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006210d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 16, 2024, 9:59 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006210d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 16, 2024, 9:59 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006210d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 16, 2024, 9:59 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00620850 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 16, 2024, 9:59 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00620850 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 16, 2024, 9:59 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00620850 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 16, 2024, 9:59 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00620850 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 16, 2024, 9:59 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00620850 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 16, 2024, 9:59 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00620850 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 16, 2024, 9:59 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00620850 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 16, 2024, 9:59 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00620850 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 16, 2024, 9:59 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00620850 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 16, 2024, 9:59 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00620850 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 16, 2024, 9:59 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00620850 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 16, 2024, 9:59 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00620850 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 16, 2024, 9:59 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00620850 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 16, 2024, 9:59 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00620850 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 16, 2024, 9:59 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006214d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 16, 2024, 9:59 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006214d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 16, 2024, 9:59 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00620a50 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 16, 2024, 9:59 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00620a50 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx June 16, 2024, 9:59 a.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

.vmpa\xc2\xbe\xe2

The file contains an unknown PE resource name possibly indicative of a packer (3 events)

resource name	IBC
resource name	IMAGE
resource name	MUI

Allocates read-write-execute memory (usually to unpack itself) (50 out of 131 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory June 16, 2024, 9:59 a.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00240000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 16, 2024, 9:59 a.m.	process_identifier: 2812 region_size: 851968 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a20000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 16, 2024, 9:59 a.m.	process_identifier: 2812 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02ab0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory June 16, 2024, 9:59 a.m.	process_identifier: 2812 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72891000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 16, 2024, 9:59 a.m.	process_identifier: 2812 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005ca000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory June 16, 2024, 9:59 a.m.	process_identifier: 2812 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72892000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 16, 2024, 9:59 a.m.	process_identifier: 2812 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005c2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 16, 2024, 9:59 a.m.	process_identifier: 2812 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x021a2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 16, 2024, 9:59 a.m.	process_identifier: 2812 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02ab1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 16, 2024, 9:59 a.m.	process_identifier: 2812 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02ab2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 16, 2024, 9:59 a.m.	process_identifier: 2812 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x021ca000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 16, 2024, 9:59 a.m.	process_identifier: 2812 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x021a3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 16, 2024, 9:59 a.m.	process_identifier: 2812 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x021a4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 16, 2024, 9:59 a.m.	process_identifier: 2812 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x021db000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 16, 2024, 9:59 a.m.	process_identifier: 2812 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x021d7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 16, 2024, 9:59 a.m.	process_identifier: 2812 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005cb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 16, 2024, 9:59 a.m.	process_identifier: 2812 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x021c2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 16, 2024, 9:59 a.m.	process_identifier: 2812 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x021d5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 16, 2024, 9:59 a.m.	process_identifier: 2812 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x021a5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 16, 2024, 9:59 a.m.	process_identifier: 2812 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x021cc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 16, 2024, 9:59 a.m.	process_identifier: 2812 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 16, 2024, 9:59 a.m.	process_identifier: 2812 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x021a6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 16, 2024, 9:59 a.m.	process_identifier: 2812 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x021dc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 16, 2024, 9:59 a.m.	process_identifier: 2812 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x021c3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 16, 2024, 9:59 a.m.	process_identifier: 2812 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x021c4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 16, 2024, 9:59 a.m.	process_identifier: 2812 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x021c5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 16, 2024, 9:59 a.m.	process_identifier: 2812 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x021c6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 16, 2024, 9:59 a.m.	process_identifier: 2812 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x021c7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 16, 2024, 9:59 a.m.	process_identifier: 2812 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x021c8000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 16, 2024, 9:59 a.m.	process_identifier: 2812 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x021c9000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 16, 2024, 9:59 a.m.	process_identifier: 2812 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02c80000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 16, 2024, 9:59 a.m.	process_identifier: 2812 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02c81000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 16, 2024, 9:59 a.m.	process_identifier: 2812 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02c82000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 16, 2024, 9:59 a.m.	process_identifier: 2812 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02c83000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 16, 2024, 9:59 a.m.	process_identifier: 2812 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02c84000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 16, 2024, 9:59 a.m.	process_identifier: 2812 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02c85000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 16, 2024, 9:59 a.m.	process_identifier: 2812 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02c86000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 16, 2024, 9:59 a.m.	process_identifier: 2812 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02c87000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 16, 2024, 9:59 a.m.	process_identifier: 2812 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02c88000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 16, 2024, 9:59 a.m.	process_identifier: 2812 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02c89000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 16, 2024, 9:59 a.m.	process_identifier: 2812 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02c8a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 16, 2024, 9:59 a.m.	process_identifier: 2812 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02c8b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 16, 2024, 9:59 a.m.	process_identifier: 2812 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02c8c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 16, 2024, 9:59 a.m.	process_identifier: 2812 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02c8d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 16, 2024, 9:59 a.m.	process_identifier: 2812 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02c8e000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 16, 2024, 9:59 a.m.	process_identifier: 2812 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02c8f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 16, 2024, 9:59 a.m.	process_identifier: 2812 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02c90000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 16, 2024, 9:59 a.m.	process_identifier: 2812 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02c91000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 16, 2024, 9:59 a.m.	process_identifier: 2812 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02c92000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 16, 2024, 9:59 a.m.	process_identifier: 2812 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02c93000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Creates executable files on the filesystem (1 event)

file	C:\Users\test22\AppData\Roaming\sihost.exe

Creates a shortcut to an executable file (1 event)

file	C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk

Creates a suspicious process (2 events)

cmdline	powershell ping 127.0.0.1; del clips.exe
cmdline	schtasks /f /CREATE /TN "sihost.exe" /TR "C:\Users\test22\AppData\Roaming\sihost.exe" /SC MINUTE

Drops an executable to the user AppData folder (1 event)

file	C:\Users\test22\AppData\Local\Temp\clips.exe

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x0051b200', u'virtual_address': u'0x00322000', u'entropy': 7.992983093294697, u'name': u'.vmpa\\xc2\\xbe\\xe2', u'virtual_size': u'0x0051b180'}

entropy

7.99298309329

description

A section with a high entropy has been found

entropy

0.969317760475

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 event)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW June 16, 2024, 9:59 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Uses Windows utilities for basic Windows functionality (5 events)

cmdline	attrib +H C:\Users\test22\AppData\Roaming\sihost.exe
cmdline	powershell ping 127.0.0.1; del clips.exe
cmdline	schtasks /f /CREATE /TN "sihost.exe" /TR "C:\Users\test22\AppData\Roaming\sihost.exe" /SC MINUTE
cmdline	"C:\Windows\system32\PING.EXE" 127.0.0.1
cmdline	attrib +H +S C:\Users\test22\AppData\Roaming\sihost.exe

The executable is likely packed with VMProtect (3 events)

section	.vmpa\xc2\xbe\xe2	description	Section name indicates VMProtect
section	.vmpa\xc2\xbe\xe2	description	Section name indicates VMProtect
section	.vmpa\xc2\xbe\xe2	description	Section name indicates VMProtect

Installs itself for autorun at Windows startup (1 event)

cmdline

schtasks /f /CREATE /TN "sihost.exe" /TR "C:\Users\test22\AppData\Roaming\sihost.exe" /SC MINUTE

One or more non-whitelisted processes were created (1 event)

parent_process

powershell.exe

martian_process

"C:\Windows\system32\PING.EXE" 127.0.0.1

The process powershell.exe wrote an executable file to disk (20 events)

file	C:\Windows\System32\ie4uinit.exe
file	C:\Program Files\Windows Sidebar\sidebar.exe
file	C:\Windows\System32\WindowsAnytimeUpgradeUI.exe
file	C:\Windows\System32\xpsrchvw.exe
file	C:\Windows\System32\displayswitch.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe
file	C:\Windows\System32\mblctr.exe
file	C:\Windows\System32\mstsc.exe
file	C:\Windows\System32\SnippingTool.exe
file	C:\Windows\System32\SoundRecorder.exe
file	C:\Windows\System32\dfrgui.exe
file	C:\Windows\System32\msinfo32.exe
file	C:\Windows\System32\rstrui.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe
file	C:\Program Files\Windows Journal\Journal.exe
file	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
file	C:\Windows\System32\MdSched.exe
file	C:\Windows\System32\msconfig.exe
file	C:\Windows\System32\recdisc.exe
file	C:\Windows\System32\msra.exe

File has been identified by 51 AntiVirus engines on VirusTotal as malicious (50 out of 51 events)

Bkav	W32.AIDetectMalware
Lionic	Trojan.Win32.Tasker.1g!c
Elastic	malicious (high confidence)
Cynet	Malicious (score: 99)
CAT-QuickHeal	Trojan.Tasker
ALYac	Trojan.Generic.36312976
Cylance	Unsafe
VIPRE	Trojan.Generic.36312976
Sangfor	Trojan.Win32.Agent.V7oq
K7AntiVirus	Riskware ( 00584baa1 )
Alibaba	Trojan:Win32/Tasker.b7c344b7
K7GW	Riskware ( 00584baa1 )
BitDefenderTheta	Gen:NN.ZexaF.36806.@J1@aqgpJCii
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/GenCBL.FDB
Paloalto	generic.ml
Kaspersky	Trojan.Win32.Tasker.bdlk
BitDefender	Trojan.Generic.36312976
MicroWorld-eScan	Trojan.Generic.36312976
Rising	Trojan.Generic@AI.100 (RDML:4DtpH/y2/vi73OCqtXRwtA)
Emsisoft	Trojan.Generic.36312976 (B)
F-Secure	Trojan.TR/Tasker.jtvze
DrWeb	Trojan.MulDrop27.50334
TrendMicro	TROJ_GEN.R002C0DFD24
McAfeeD	ti!B392D76BC734
Trapmine	malicious.high.ml.score
FireEye	Trojan.Generic.36312976
Sophos	Mal/EncPk-HM
Ikarus	Trojan.Win32.Tasker
Google	Detected
Avira	TR/Tasker.jtvze
Antiy-AVL	Trojan/Win32.Tasker
Kingsoft	Win32.Troj.Unknown.a
Gridinsoft	Ransom.Win32.STOP.tr!n
Xcitium	Malware@#36a3ofwxiz3a1
Arcabit	Trojan.Generic.D22A1790
ZoneAlarm	Trojan.Win32.Tasker.bdlk
GData	Trojan.Generic.36312976
Varist	W32/ABRisk.HGWU-0376
AhnLab-V3	Trojan/Win.Generic.C5641274
DeepInstinct	MALICIOUS
Malwarebytes	Malware.AI.1516184222
TrendMicro-HouseCall	TROJ_GEN.R002C0DFD24
Tencent	Malware.Win32.Gencirc.140e47c9
Yandex	Trojan.Tasker!LJ/wDSzsRhI
MAX	malware (ai score=85)
MaxSecure	Trojan.Malware.255341686.susgen
Fortinet	W32/PossibleThreat
Panda	Trj/Chgt.AD
CrowdStrike	win/malicious_confidence_100% (W)

clips.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All