Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	July 15, 2024, 9:27 a.m.	July 15, 2024, 9:29 a.m.

Size	323.2KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`d8bf792f818877bf4848fde9511caeb8`
SHA256	`f5d96127b34730cf3bbbccd1c35098873fc0af897cc5d6dc3dd39a8e64c511d7`
CRC32	`9524EFE7`
ssdeep	`6144:CZABbWqsE/Ao+mv8Qv0LVmwq4FU0fNoy6BLtsorUC7ggXpTILMYSQpIIQENMshQt:kANwRo+mv8QD4+0V161tTNjkIIFN5c`
Yara	DllRegisterServer_Zero - execute regsvr32.exe Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature Antivirus - Contains references to security software IsPE32 - (no description) UPX_Zero - UPX packed file mzp_file_format - MZP(Delphi) file format

1PDF.FaturaDetay_202407.exe "C:\Users\test22\AppData\Local\Temp\1PDF.FaturaDetay_202407.exe"
2628
- cmd.exe "C:\Windows\System32\cmd.exe" /c PowerShell.exe -windowstyle hidden powershell -c C:\TheDream\RootDesign.exe
  2708
  - powershell.exe PowerShell.exe -windowstyle hidden powershell -c C:\TheDream\RootDesign.exe
    2796
    - powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -c C:\TheDream\RootDesign.exe
      2916
      - RootDesign.exe "C:\TheDream\RootDesign.exe"
        2988
        
        RootDesign.exe "C:\TheDream\RootDesign.exe"
        2228
        
        RootDesign.exe "C:\TheDream\RootDesign.exe"
        2464
        
        RootDesign.exe "C:\TheDream\RootDesign.exe"
        2828
        
        RootDesign.exe "C:\TheDream\RootDesign.exe"
        2712
        
        RootDesign.exe "C:\TheDream\RootDesign.exe"
        1528
explorer.exe C:\Windows\Explorer.EXE
1452

Name	Response	Post-Analysis Lookup
smtp.mail.ru	A 94.100.180.160 A 217.69.139.160	217.69.139.160

IP Address	Status	Action
164.124.101.2	Active	Moloch
94.100.180.160	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 94.100.180.160:587 -> 192.168.56.101:49177	2260002	SURICATA Applayer Detect protocol only one direction	Generic Protocol Command Decode
TCP 192.168.56.101:49177 -> 94.100.180.160:587	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 94.100.180.160:587 -> 192.168.56.101:49179	2260002	SURICATA Applayer Detect protocol only one direction	Generic Protocol Command Decode
TCP 192.168.56.101:49179 -> 94.100.180.160:587	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 94.100.180.160:587 -> 192.168.56.101:49181	2260002	SURICATA Applayer Detect protocol only one direction	Generic Protocol Command Decode
TCP 192.168.56.101:49181 -> 94.100.180.160:587	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined

Suricata TLS

Flow	Issuer	Subject	Fingerprint
TLSv1 192.168.56.101:49177 94.100.180.160:587	C=BE, O=GlobalSign nv-sa, CN=GlobalSign RSA OV SSL CA 2018	C=RU, ST=Moscow, L=Moscow, O=VK LLC, CN=*.mail.ru	f5:86:61:b5:b2:6c:9a:dd:9a:ba:a0:24:59:4d:7b:99:e6:72:ea:7e
TLSv1 192.168.56.101:49179 94.100.180.160:587	C=BE, O=GlobalSign nv-sa, CN=GlobalSign RSA OV SSL CA 2018	C=RU, ST=Moscow, L=Moscow, O=VK LLC, CN=*.mail.ru	f5:86:61:b5:b2:6c:9a:dd:9a:ba:a0:24:59:4d:7b:99:e6:72:ea:7e
TLSv1 192.168.56.101:49181 94.100.180.160:587	C=BE, O=GlobalSign nv-sa, CN=GlobalSign RSA OV SSL CA 2018	C=RU, ST=Moscow, L=Moscow, O=VK LLC, CN=*.mail.ru	f5:86:61:b5:b2:6c:9a:dd:9a:ba:a0:24:59:4d:7b:99:e6:72:ea:7e

Queries for the computername (24 events)

Time & API	Arguments	Status	Return
GetComputerNameW July 15, 2024, 9:26 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 15, 2024, 9:26 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 15, 2024, 9:26 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 15, 2024, 9:26 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA July 15, 2024, 9:26 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 15, 2024, 9:26 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 15, 2024, 9:26 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 15, 2024, 9:26 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 15, 2024, 9:26 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 15, 2024, 9:26 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA July 15, 2024, 9:26 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 15, 2024, 9:26 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 15, 2024, 9:26 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 15, 2024, 9:26 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 15, 2024, 9:19 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 15, 2024, 9:19 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 15, 2024, 9:27 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 15, 2024, 9:27 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 15, 2024, 9:27 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 15, 2024, 9:27 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 15, 2024, 9:28 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 15, 2024, 9:28 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 15, 2024, 9:28 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 15, 2024, 9:28 a.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (15 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent July 15, 2024, 9:26 a.m.			0	0
IsDebuggerPresent July 15, 2024, 9:26 a.m.			0	0
IsDebuggerPresent July 15, 2024, 9:26 a.m.			0	0
IsDebuggerPresent July 15, 2024, 9:26 a.m.			0	0
IsDebuggerPresent July 15, 2024, 9:26 a.m.			0	0
IsDebuggerPresent July 15, 2024, 9:27 a.m.			0	0
IsDebuggerPresent July 15, 2024, 9:27 a.m.			0	0
IsDebuggerPresent July 15, 2024, 9:27 a.m.			0	0
IsDebuggerPresent July 15, 2024, 9:27 a.m.			0	0
IsDebuggerPresent July 15, 2024, 9:28 a.m.			0	0
IsDebuggerPresent July 15, 2024, 9:28 a.m.			0	0
IsDebuggerPresent July 15, 2024, 9:28 a.m.			0	0
IsDebuggerPresent July 15, 2024, 9:28 a.m.			0	0
IsDebuggerPresent July 15, 2024, 9:28 a.m.			0	0
IsDebuggerPresent July 15, 2024, 9:28 a.m.			0	0

Uses Windows APIs to generate a cryptographic key (50 out of 80 events)

Time & API	Arguments	Status	Return
CryptExportKey July 15, 2024, 9:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00506870 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 15, 2024, 9:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005070b0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 15, 2024, 9:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005070b0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 15, 2024, 9:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005070b0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 15, 2024, 9:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00507270 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 15, 2024, 9:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00507270 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 15, 2024, 9:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00507270 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 15, 2024, 9:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00507270 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 15, 2024, 9:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00507270 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 15, 2024, 9:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00507270 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 15, 2024, 9:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005066b0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 15, 2024, 9:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005066b0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 15, 2024, 9:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005066b0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 15, 2024, 9:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005070b0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 15, 2024, 9:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005070b0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 15, 2024, 9:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005070b0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 15, 2024, 9:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00506f70 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 15, 2024, 9:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005070b0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 15, 2024, 9:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005070b0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 15, 2024, 9:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005070b0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 15, 2024, 9:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005070b0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 15, 2024, 9:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005070b0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 15, 2024, 9:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005070b0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 15, 2024, 9:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005070b0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 15, 2024, 9:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005073f0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 15, 2024, 9:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005073f0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 15, 2024, 9:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005073f0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 15, 2024, 9:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005073f0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 15, 2024, 9:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005073f0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 15, 2024, 9:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005073f0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 15, 2024, 9:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005073f0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 15, 2024, 9:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005073f0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 15, 2024, 9:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005073f0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 15, 2024, 9:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005073f0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 15, 2024, 9:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005073f0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 15, 2024, 9:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005073f0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 15, 2024, 9:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005073f0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 15, 2024, 9:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005073f0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 15, 2024, 9:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00507330 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 15, 2024, 9:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00507330 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 15, 2024, 9:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003b99d8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 15, 2024, 9:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003ba0d8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 15, 2024, 9:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003ba0d8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 15, 2024, 9:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003ba0d8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 15, 2024, 9:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003ba398 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 15, 2024, 9:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003ba398 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 15, 2024, 9:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003ba398 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 15, 2024, 9:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003ba398 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 15, 2024, 9:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003ba398 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 15, 2024, 9:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003ba398 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Tries to locate where the browsers are installed (2 events)

file	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
file	c:\program files\mozilla firefox\firefox.exe

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx July 15, 2024, 9:26 a.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 events)

section	CODE
section	DATA
section	BSS

The executable uses a known packer (1 event)

packer

BobSoft Mini Delphi -> BoB / BobSoft

One or more processes crashed (1 event)

Time & API	Arguments	Status	Return	Repeated
__exception__ July 15, 2024, 9:27 a.m.	stacktrace: CopyPDBs+0x1b552 DllCanUnloadNowInternal-0x25a85 clr+0x1b1194 @ 0x72751194 LogHelp_TerminateOnAssert+0x14061 GetPrivateContextsPerfCounters-0x53e1 clr+0x82ba1 @ 0x72622ba1 0x2158147 0x215804a 0x215787b 0x215682a 0x2155707 0x215508a 0x215079e DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x725a2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x725b264f CoUninitializeEE+0xa5b4 CreateAssemblyNameObject-0x36a1 clr+0x29df8 @ 0x725c9df8 CoUninitializeEE+0xa5eb CreateAssemblyNameObject-0x366a clr+0x29e2f @ 0x725c9e2f CoUninitializeEE+0xa6b9 CreateAssemblyNameObject-0x359c clr+0x29efd @ 0x725c9efd CoUninitializeEE+0xa75e CreateAssemblyNameObject-0x34f7 clr+0x29fa2 @ 0x725c9fa2 LogHelp_TerminateOnAssert+0x16b0b GetPrivateContextsPerfCounters-0x2937 clr+0x8564b @ 0x7262564b CreateAssemblyNameObject+0x2e9ca GetMetaDataInternalInterface-0x9aa5 clr+0x5be63 @ 0x725fbe63 CreateAssemblyNameObject+0x2e4ff GetMetaDataInternalInterface-0x9f70 clr+0x5b998 @ 0x725fb998 CreateAssemblyNameObject+0x2e28d GetMetaDataInternalInterface-0xa1e2 clr+0x5b726 @ 0x725fb726 CreateAssemblyNameObject+0x2f451 GetMetaDataInternalInterface-0x901e clr+0x5c8ea @ 0x725fc8ea DllGetClassObjectInternal+0x526a2 CorDllMainForThunk-0x39e59 clr+0x11771b @ 0x726b771b CorDllMainForThunk+0x593 _CorExeMain-0x2647 clr+0x151b07 @ 0x726f1b07 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x726f1e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x726f1f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x726f416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x741af5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x72c47f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x72c44de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xe0434f4e exception.offset: 46887 exception.address: 0x7597b727 registers.esp: 4973424 registers.edi: 0 registers.eax: 4973424 registers.ebp: 4973504 registers.edx: 0 registers.ebx: 5913248 registers.esi: 5778264 registers.ecx: 3874990540	1	0	0

Time & API

Arguments

Status

Return

Repeated

__exception__

July 15, 2024, 9:27 a.m.

stacktrace:

CopyPDBs+0x1b552 DllCanUnloadNowInternal-0x25a85 clr+0x1b1194 @ 0x72751194
LogHelp_TerminateOnAssert+0x14061 GetPrivateContextsPerfCounters-0x53e1 clr+0x82ba1 @ 0x72622ba1
0x2158147
0x215804a
0x215787b
0x215682a
0x2155707
0x215508a
0x215079e
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x725a2652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x725b264f
CoUninitializeEE+0xa5b4 CreateAssemblyNameObject-0x36a1 clr+0x29df8 @ 0x725c9df8
CoUninitializeEE+0xa5eb CreateAssemblyNameObject-0x366a clr+0x29e2f @ 0x725c9e2f
CoUninitializeEE+0xa6b9 CreateAssemblyNameObject-0x359c clr+0x29efd @ 0x725c9efd
CoUninitializeEE+0xa75e CreateAssemblyNameObject-0x34f7 clr+0x29fa2 @ 0x725c9fa2
LogHelp_TerminateOnAssert+0x16b0b GetPrivateContextsPerfCounters-0x2937 clr+0x8564b @ 0x7262564b
CreateAssemblyNameObject+0x2e9ca GetMetaDataInternalInterface-0x9aa5 clr+0x5be63 @ 0x725fbe63
CreateAssemblyNameObject+0x2e4ff GetMetaDataInternalInterface-0x9f70 clr+0x5b998 @ 0x725fb998
CreateAssemblyNameObject+0x2e28d GetMetaDataInternalInterface-0xa1e2 clr+0x5b726 @ 0x725fb726
CreateAssemblyNameObject+0x2f451 GetMetaDataInternalInterface-0x901e clr+0x5c8ea @ 0x725fc8ea
DllGetClassObjectInternal+0x526a2 CorDllMainForThunk-0x39e59 clr+0x11771b @ 0x726b771b
CorDllMainForThunk+0x593 _CorExeMain-0x2647 clr+0x151b07 @ 0x726f1b07
CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x726f1e67
CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x726f1f7a
_CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x726f416a
_CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x741af5a3
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x72c47f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x72c44de3
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5

exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0xe0434f4e
exception.offset: 46887
exception.address: 0x7597b727
registers.esp: 4973424
registers.edi: 0
registers.eax: 4973424
registers.ebp: 4973504
registers.edx: 0
registers.ebx: 5913248
registers.esi: 5778264
registers.ecx: 3874990540

Allocates read-write-execute memory (usually to unpack itself) (50 out of 629 events)

Time & API	Arguments	Status
NtProtectVirtualMemory July 15, 2024, 9:26 a.m.	process_identifier: 2628 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73bc2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 15, 2024, 9:26 a.m.	process_identifier: 2796 region_size: 2293760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02910000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 15, 2024, 9:26 a.m.	process_identifier: 2796 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02b00000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory July 15, 2024, 9:26 a.m.	process_identifier: 2796 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x724a1000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 15, 2024, 9:26 a.m.	process_identifier: 2796 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0222a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory July 15, 2024, 9:26 a.m.	process_identifier: 2796 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x724a2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 15, 2024, 9:26 a.m.	process_identifier: 2796 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02222000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 15, 2024, 9:26 a.m.	process_identifier: 2796 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02232000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 15, 2024, 9:26 a.m.	process_identifier: 2796 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02b01000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 15, 2024, 9:26 a.m.	process_identifier: 2796 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02b02000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 15, 2024, 9:26 a.m.	process_identifier: 2796 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0225a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 15, 2024, 9:26 a.m.	process_identifier: 2796 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02233000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 15, 2024, 9:26 a.m.	process_identifier: 2796 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02234000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 15, 2024, 9:26 a.m.	process_identifier: 2796 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0226b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 15, 2024, 9:26 a.m.	process_identifier: 2796 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02267000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 15, 2024, 9:26 a.m.	process_identifier: 2796 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0222b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 15, 2024, 9:26 a.m.	process_identifier: 2796 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02252000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 15, 2024, 9:26 a.m.	process_identifier: 2796 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02265000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 15, 2024, 9:26 a.m.	process_identifier: 2796 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02235000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 15, 2024, 9:26 a.m.	process_identifier: 2796 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0225c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 15, 2024, 9:26 a.m.	process_identifier: 2796 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02860000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 15, 2024, 9:26 a.m.	process_identifier: 2796 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02236000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 15, 2024, 9:26 a.m.	process_identifier: 2796 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0226c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 15, 2024, 9:26 a.m.	process_identifier: 2796 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02253000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 15, 2024, 9:26 a.m.	process_identifier: 2796 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02254000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 15, 2024, 9:26 a.m.	process_identifier: 2796 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02255000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 15, 2024, 9:26 a.m.	process_identifier: 2796 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02256000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 15, 2024, 9:26 a.m.	process_identifier: 2796 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02257000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 15, 2024, 9:26 a.m.	process_identifier: 2796 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02258000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 15, 2024, 9:26 a.m.	process_identifier: 2796 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02259000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 15, 2024, 9:26 a.m.	process_identifier: 2796 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02990000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 15, 2024, 9:26 a.m.	process_identifier: 2796 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02991000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 15, 2024, 9:26 a.m.	process_identifier: 2796 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02992000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 15, 2024, 9:26 a.m.	process_identifier: 2796 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02993000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 15, 2024, 9:26 a.m.	process_identifier: 2796 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02994000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 15, 2024, 9:26 a.m.	process_identifier: 2796 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02995000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 15, 2024, 9:26 a.m.	process_identifier: 2796 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02996000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 15, 2024, 9:26 a.m.	process_identifier: 2796 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02997000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 15, 2024, 9:26 a.m.	process_identifier: 2796 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02998000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 15, 2024, 9:26 a.m.	process_identifier: 2796 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02999000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 15, 2024, 9:26 a.m.	process_identifier: 2796 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0299a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 15, 2024, 9:26 a.m.	process_identifier: 2796 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0299b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 15, 2024, 9:26 a.m.	process_identifier: 2796 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0299c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 15, 2024, 9:26 a.m.	process_identifier: 2796 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0299d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 15, 2024, 9:26 a.m.	process_identifier: 2796 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0299e000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 15, 2024, 9:26 a.m.	process_identifier: 2796 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0299f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 15, 2024, 9:26 a.m.	process_identifier: 2796 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02ad0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 15, 2024, 9:26 a.m.	process_identifier: 2796 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02ad1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 15, 2024, 9:26 a.m.	process_identifier: 2796 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02ad2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 15, 2024, 9:26 a.m.	process_identifier: 2796 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02ad3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation (3 events)

Time & API	Arguments	Status	Return
GetDiskFreeSpaceExW July 15, 2024, 9:19 a.m.	total_number_of_free_bytes: 0 free_bytes_available: 13319532544 root_path: C:\Users\test22\AppData\Local\Microsoft\Windows\Explorer total_number_of_bytes: 0	1	1
GetDiskFreeSpaceExW July 15, 2024, 9:19 a.m.	total_number_of_free_bytes: 0 free_bytes_available: 13319516160 root_path: C:\Users\test22\AppData\Local\Microsoft\Windows\Explorer total_number_of_bytes: 0	1	1
GetDiskFreeSpaceExW July 15, 2024, 9:19 a.m.	total_number_of_free_bytes: 0 free_bytes_available: 13319512064 root_path: C:\Users\test22\AppData\Local\Microsoft\Windows\Explorer total_number_of_bytes: 0	1	1

Creates executable files on the filesystem (2 events)

file	C:\TheDream\Uninstall.exe
file	C:\TheDream\RootDesign.exe

Creates a shortcut to an executable file (14 events)

file	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration.lnk
file	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Snipping Tool.lnk
file	C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk
file	C:\Users\test22\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Windows Explorer.lnk
file	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Welcome Center.lnk
file	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Fax and Scan.lnk
file	C:\Users\test22\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Chrome.lnk
file	C:\Users\test22\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Firefox.lnk
file	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Calculator.lnk
file	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Paint.lnk
file	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\displayswitch.lnk
file	C:\Users\test22\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Internet Explorer.lnk
file	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Sticky Notes.lnk
file	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\XPS Viewer.lnk

Creates a suspicious process (4 events)

cmdline	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -c C:\TheDream\RootDesign.exe
cmdline	PowerShell.exe -windowstyle hidden powershell -c C:\TheDream\RootDesign.exe
cmdline	cmd /c PowerShell.exe -windowstyle hidden powershell -c C:\TheDream\RootDesign.exe
cmdline	"C:\Windows\System32\cmd.exe" /c PowerShell.exe -windowstyle hidden powershell -c C:\TheDream\RootDesign.exe

Drops a binary and executes it (1 event)

file	C:\TheDream\RootDesign.exe

A process created a hidden window (2 events)

Time & API	Arguments	Status	Return	Repeated
CreateProcessInternalW July 15, 2024, 9:26 a.m.	thread_identifier: 2712 thread_handle: 0x000002a8 process_identifier: 2708 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\cmd.exe track: 1 command_line: "C:\Windows\System32\cmd.exe" /c PowerShell.exe -windowstyle hidden powershell -c C:\TheDream\RootDesign.exe filepath_r: C:\Windows\System32\cmd.exe stack_pivoted: 0 creation_flags: 67634196 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_SUSPENDED\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x000002b0	1	1	0
CreateProcessInternalW July 15, 2024, 9:26 a.m.	thread_identifier: 2800 thread_handle: 0x00000084 process_identifier: 2796 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe track: 1 command_line: PowerShell.exe -windowstyle hidden powershell -c C:\TheDream\RootDesign.exe filepath_r: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe stack_pivoted: 0 creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x00000088	1	1	0

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses July 15, 2024, 9:27 a.m.	flags: 1158 family: 0	1	0	0

Checks for the Locally Unique Identifier on the system for a suspicious privilege (10 events)

Time & API	Arguments	Status	Return
LookupPrivilegeValueW July 15, 2024, 9:26 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW July 15, 2024, 9:26 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW July 15, 2024, 9:19 a.m.	system_name: privilege_name: SeShutdownPrivilege	1	1
LookupPrivilegeValueW July 15, 2024, 9:19 a.m.	system_name: privilege_name: SeShutdownPrivilege	1	1
LookupPrivilegeValueW July 15, 2024, 9:19 a.m.	system_name: privilege_name: SeShutdownPrivilege	1	1
LookupPrivilegeValueW July 15, 2024, 9:19 a.m.	system_name: privilege_name: SeShutdownPrivilege	1	1
LookupPrivilegeValueW July 15, 2024, 9:19 a.m.	system_name: privilege_name: SeShutdownPrivilege	1	1
LookupPrivilegeValueW July 15, 2024, 9:19 a.m.	system_name: privilege_name: SeShutdownPrivilege	1	1
LookupPrivilegeValueW July 15, 2024, 9:19 a.m.	system_name: privilege_name: SeShutdownPrivilege	1	1
LookupPrivilegeValueW July 15, 2024, 9:19 a.m.	system_name: privilege_name: SeShutdownPrivilege	1	1

Yara rule detected in process memory (9 events)

description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	DebuggerException__SetConsoleCtrl
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep

Connects to smtp.mail.ru, possibly for spamming or data exfiltration (1 event)

ipaddr

94.100.180.160

Makes SMTP requests, possibly sending spam (3 events)

receiver

[]

sender

[]

server

94.100.180.160

receiver

[]

sender

[]

server

94.100.180.160

receiver

[]

sender

[]

server

94.100.180.160

A process attempted to delay the analysis task. (1 event)

description

RootDesign.exe tried to sleep 8184849 seconds, actually delayed analysis time by 8184849 seconds

Enumerates services, possibly for anti-virtualization (1 event)

Time & API	Arguments	Status	Return	Repeated
EnumServicesStatusW July 15, 2024, 9:26 a.m.	service_handle: 0x0081fae8 service_type: 48 service_status: 3		0	0

Installs itself for autorun at Windows startup (1 event)

reg_key

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\WindowsUqdates

reg_value

C:\TheDream\RootDesign.exe

One or more non-whitelisted processes were created (2 events)

parent_process	powershell.exe				martian_process	"C:\TheDream\RootDesign.exe"
parent_process	powershell.exe				martian_process	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -c C:\TheDream\RootDesign.exe

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2628 resumed a thread in remote process 2708
NtResumeThread July 15, 2024, 9:26 a.m.	thread_handle: 0x000002a8 suspend_count: 1 process_identifier: 2708	1	0	0

Uses suspicious command line tools or Windows utilities (1 event)

cmdline

cmde.exe /c vssadmin delete shadows /all

Creates a suspicious Powershell process (3 events)

option	-windowstyle hidden	value	Attempts to execute command with a hidden window
option	-windowstyle hidden	value	Attempts to execute command with a hidden window
option	-windowstyle hidden	value	Attempts to execute command with a hidden window

The process powershell.exe wrote an executable file to disk (21 events)

file	C:\Windows\System32\ie4uinit.exe
file	C:\Program Files\Windows Sidebar\sidebar.exe
file	C:\Windows\System32\WindowsAnytimeUpgradeUI.exe
file	C:\Windows\System32\xpsrchvw.exe
file	C:\Windows\System32\displayswitch.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe
file	C:\Windows\System32\mblctr.exe
file	C:\Windows\System32\mstsc.exe
file	C:\Windows\System32\SnippingTool.exe
file	C:\Windows\System32\SoundRecorder.exe
file	C:\Windows\System32\dfrgui.exe
file	C:\Windows\System32\msinfo32.exe
file	C:\Windows\System32\rstrui.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe
file	C:\Program Files\Windows Journal\Journal.exe
file	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
file	C:\Windows\System32\MdSched.exe
file	C:\Windows\System32\msconfig.exe
file	C:\Windows\System32\recdisc.exe
file	C:\Windows\System32\msra.exe
file	C:\TheDream\RootDesign.exe

Executed a process and injected code into it, probably while unpacking (50 out of 86 events)

Time & API	Arguments	Status	Return
NtResumeThread July 15, 2024, 9:26 a.m.	thread_handle: 0x00000138 suspend_count: 1 process_identifier: 2628	1	0
CreateProcessInternalW July 15, 2024, 9:26 a.m.	thread_identifier: 2712 thread_handle: 0x000002a8 process_identifier: 2708 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\cmd.exe track: 1 command_line: "C:\Windows\System32\cmd.exe" /c PowerShell.exe -windowstyle hidden powershell -c C:\TheDream\RootDesign.exe filepath_r: C:\Windows\System32\cmd.exe stack_pivoted: 0 creation_flags: 67634196 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_SUSPENDED\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x000002b0	1	1
NtResumeThread July 15, 2024, 9:26 a.m.	thread_handle: 0x000002a8 suspend_count: 1 process_identifier: 2708	1	0
CreateProcessInternalW July 15, 2024, 9:26 a.m.	thread_identifier: 2800 thread_handle: 0x00000084 process_identifier: 2796 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe track: 1 command_line: PowerShell.exe -windowstyle hidden powershell -c C:\TheDream\RootDesign.exe filepath_r: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe stack_pivoted: 0 creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x00000088	1	1
NtResumeThread July 15, 2024, 9:26 a.m.	thread_handle: 0x00000294 suspend_count: 1 process_identifier: 2796	1	0
NtResumeThread July 15, 2024, 9:26 a.m.	thread_handle: 0x000002e8 suspend_count: 1 process_identifier: 2796	1	0
NtResumeThread July 15, 2024, 9:26 a.m.	thread_handle: 0x00000444 suspend_count: 1 process_identifier: 2796	1	0
CreateProcessInternalW July 15, 2024, 9:26 a.m.	thread_identifier: 2920 thread_handle: 0x00000448 process_identifier: 2916 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -c C:\TheDream\RootDesign.exe filepath_r: stack_pivoted: 0 creation_flags: 0 () inherit_handles: 1 process_handle: 0x0000044c	1	1
NtResumeThread July 15, 2024, 9:26 a.m.	thread_handle: 0x00000490 suspend_count: 1 process_identifier: 2796	1	0
NtResumeThread July 15, 2024, 9:26 a.m.	thread_handle: 0x000002a0 suspend_count: 1 process_identifier: 2916	1	0
NtResumeThread July 15, 2024, 9:26 a.m.	thread_handle: 0x000002f4 suspend_count: 1 process_identifier: 2916	1	0
NtResumeThread July 15, 2024, 9:26 a.m.	thread_handle: 0x00000458 suspend_count: 1 process_identifier: 2916	1	0
CreateProcessInternalW July 15, 2024, 9:26 a.m.	thread_identifier: 2992 thread_handle: 0x0000045c process_identifier: 2988 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: "C:\TheDream\RootDesign.exe" filepath_r: stack_pivoted: 0 creation_flags: 0 () inherit_handles: 1 process_handle: 0x00000460	1	1
NtResumeThread July 15, 2024, 9:26 a.m.	thread_handle: 0x000004a4 suspend_count: 1 process_identifier: 2916	1	0
NtResumeThread July 15, 2024, 9:26 a.m.	thread_handle: 0x000000dc suspend_count: 1 process_identifier: 2988	1	0
NtResumeThread July 15, 2024, 9:26 a.m.	thread_handle: 0x0000014c suspend_count: 1 process_identifier: 2988	1	0
NtResumeThread July 15, 2024, 9:26 a.m.	thread_handle: 0x00000190 suspend_count: 1 process_identifier: 2988	1	0
NtResumeThread July 15, 2024, 9:26 a.m.	thread_handle: 0x0000020c suspend_count: 1 process_identifier: 2988	1	0
NtGetContextThread July 15, 2024, 9:26 a.m.	thread_handle: 0x000000e0	1	0
NtGetContextThread July 15, 2024, 9:26 a.m.	thread_handle: 0x000000e0	1	0
NtResumeThread July 15, 2024, 9:26 a.m.	thread_handle: 0x000000e0 suspend_count: 1 process_identifier: 2988	1	0
NtGetContextThread July 15, 2024, 9:26 a.m.	thread_handle: 0x000000e0	1	0
NtGetContextThread July 15, 2024, 9:26 a.m.	thread_handle: 0x000000e0	1	0
NtResumeThread July 15, 2024, 9:26 a.m.	thread_handle: 0x000000e0 suspend_count: 1 process_identifier: 2988	1	0
NtResumeThread July 15, 2024, 9:26 a.m.	thread_handle: 0x00000220 suspend_count: 1 process_identifier: 2988	1	0
NtResumeThread July 15, 2024, 9:26 a.m.	thread_handle: 0x00000240 suspend_count: 1 process_identifier: 2988	1	0
NtResumeThread July 15, 2024, 9:26 a.m.	thread_handle: 0x000002c0 suspend_count: 1 process_identifier: 2988	1	0
NtResumeThread July 15, 2024, 9:26 a.m.	thread_handle: 0x0000031c suspend_count: 1 process_identifier: 2988	1	0
CreateProcessInternalW July 15, 2024, 9:26 a.m.	thread_identifier: 2224 thread_handle: 0x00000474 process_identifier: 2228 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\TheDream\RootDesign.exe track: 1 command_line: "C:\TheDream\RootDesign.exe" filepath_r: C:\TheDream\RootDesign.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x0000047c	1	1
NtResumeThread July 15, 2024, 9:27 a.m.	thread_handle: 0x000000dc suspend_count: 1 process_identifier: 2228	1	0
NtResumeThread July 15, 2024, 9:27 a.m.	thread_handle: 0x0000014c suspend_count: 1 process_identifier: 2228	1	0
NtResumeThread July 15, 2024, 9:27 a.m.	thread_handle: 0x0000017c suspend_count: 1 process_identifier: 2228	1	0
NtResumeThread July 15, 2024, 9:27 a.m.	thread_handle: 0x000001f8 suspend_count: 1 process_identifier: 2228	1	0
NtGetContextThread July 15, 2024, 9:27 a.m.	thread_handle: 0x000000e0	1	0
NtGetContextThread July 15, 2024, 9:27 a.m.	thread_handle: 0x000000e0	1	0
NtGetContextThread July 15, 2024, 9:27 a.m.	thread_handle: 0x000000e0	1	0
NtSetContextThread July 15, 2024, 9:27 a.m.	registers.eip: 1919036292 registers.esp: 4973632 registers.edi: 4973748 registers.eax: 115570788 registers.ebp: 4973656 registers.edx: 0 registers.ebx: 0 registers.esi: 35599108 registers.ecx: 5 thread_handle: 0x000000e0 process_identifier: 2228	1	0
NtResumeThread July 15, 2024, 9:27 a.m.	thread_handle: 0x000000e0 suspend_count: 1 process_identifier: 2228	1	0
NtResumeThread July 15, 2024, 9:27 a.m.	thread_handle: 0x0000020c suspend_count: 1 process_identifier: 2228	1	0
NtResumeThread July 15, 2024, 9:27 a.m.	thread_handle: 0x00000228 suspend_count: 1 process_identifier: 2228	1	0
NtResumeThread July 15, 2024, 9:27 a.m.	thread_handle: 0x000002ac suspend_count: 1 process_identifier: 2228	1	0
NtResumeThread July 15, 2024, 9:27 a.m.	thread_handle: 0x0000030c suspend_count: 1 process_identifier: 2228	1	0
CreateProcessInternalW July 15, 2024, 9:27 a.m.	thread_identifier: 2476 thread_handle: 0x00000434 process_identifier: 2464 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\TheDream\RootDesign.exe track: 1 command_line: "C:\TheDream\RootDesign.exe" filepath_r: C:\TheDream\RootDesign.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x0000043c	1	1
NtResumeThread July 15, 2024, 9:27 a.m.	thread_handle: 0x000000dc suspend_count: 1 process_identifier: 2464	1	0
NtResumeThread July 15, 2024, 9:27 a.m.	thread_handle: 0x00000154 suspend_count: 1 process_identifier: 2464	1	0
NtResumeThread July 15, 2024, 9:27 a.m.	thread_handle: 0x00000198 suspend_count: 1 process_identifier: 2464	1	0
NtResumeThread July 15, 2024, 9:27 a.m.	thread_handle: 0x000001fc suspend_count: 1 process_identifier: 2464	1	0
NtGetContextThread July 15, 2024, 9:27 a.m.	thread_handle: 0x000000e8	1	0
NtGetContextThread July 15, 2024, 9:27 a.m.	thread_handle: 0x000000e8	1	0
NtResumeThread July 15, 2024, 9:27 a.m.	thread_handle: 0x000000e8 suspend_count: 1 process_identifier: 2464	1	0

File has been identified by 44 AntiVirus engines on VirusTotal as malicious (44 events)

Lionic	Trojan.Win32.Donut.4!c
Elastic	malicious (moderate confidence)
Cynet	Malicious (score: 100)
ALYac	Gen:Variant.Tedy.577745
Cylance	Unsafe
VIPRE	Gen:Variant.Tedy.577745
Sangfor	Trojan.Win32.Agent.Vkld
K7AntiVirus	Trojan ( 005b23d21 )
BitDefender	Gen:Variant.Tedy.577745
K7GW	Trojan ( 005b23d21 )
Cybereason	malicious.f81887
Arcabit	Trojan.Tedy.D8D0D1
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
McAfee	Artemis!D8BF792F8188
Avast	Win32:RansomX-gen [Ransom]
Kaspersky	Trojan.MSIL.Donut.asy
MicroWorld-eScan	Gen:Variant.Tedy.577745
Rising	Dropper.Sysn!8.3D8 (CLOUD)
Emsisoft	Gen:Variant.Tedy.577745 (B)
McAfeeD	ti!F5D96127B347
Trapmine	suspicious.low.ml.score
FireEye	Generic.mg.d8bf792f818877bf
Sophos	Mal/Generic-S
Ikarus	Trojan.JS.Kilim
Jiangmin	TrojanDropper.Injector.bekr
Google	Detected
MAX	malware (ai score=80)
Antiy-AVL	Trojan[Dropper]/MSIL.Sysn
Kingsoft	MSIL.Trojan.Donut.a
Gridinsoft	Trojan.Win32.Downloader.sa
Microsoft	Trojan:Win32/Casdet!rfn
ZoneAlarm	Trojan.MSIL.Donut.asy
GData	Gen:Variant.Tedy.577745
Varist	W32/ABRisk.JBLM-3239
AhnLab-V3	Malware/Win32.Generic.C4244351
BitDefenderTheta	Gen:NN.ZemsilF.36808.hu0@ay7e0Pc
DeepInstinct	MALICIOUS
Malwarebytes	Malware.AI.106378209
SentinelOne	Static AI - Suspicious PE
MaxSecure	Trojan-Ransom.Win32.Crypmod.zfq
Fortinet	W32/PossibleThreat
AVG	Win32:RansomX-gen [Ransom]
Paloalto	generic.ml

1PDF.FaturaDetay_202407.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All