Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	July 23, 2024, 7:37 a.m.	July 23, 2024, 7:41 a.m.

Size	1.7MB
Type	PE32+ executable (console) x86-64, for MS Windows
MD5	`5cc9482bfa632c0f5bdc71c9e3d9e123`
SHA256	`a51028636c248144ec21dcc056c1bc19bc0ecaf61bdf2a845410e64f7f26803c`
CRC32	`B54CA20E`
ssdeep	`49152:Q2u/BMdg532rpsjCMqigjns2+a95PlpiH9MzMrcgt4hUNyiBaU:nrpEZI6BaU`
Yara	Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature Malicious_Packer_Zero - Malicious Packer IsPE64 - (no description) Antivirus - Contains references to security software UPX_Zero - UPX packed file OS_Processor_Check_Zero - OS Processor Check

file200h.exe "C:\Users\test22\AppData\Local\Temp\file200h.exe"
2572
- powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath $env:UserProfile
  2652
- CasPol.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
  2748

Name	Response	Post-Analysis Lookup
namphuctourist.com	A 103.28.36.182	103.28.36.182
raw.githubusercontent.com	A 185.199.109.133 A 185.199.111.133 A 185.199.110.133 A 185.199.108.133	185.199.110.133
pastebin.com	A 172.67.19.24 A 104.20.4.235 A 104.20.3.235	172.67.19.24
yip.su	A 104.21.79.77 A 172.67.169.89	172.67.169.89

IP Address	Status	Action
103.28.36.182	Active	Moloch
104.20.3.235	Active	Moloch
164.124.101.2	Active	Moloch
172.67.169.89	Active	Moloch
185.199.111.133	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
UDP 192.168.56.101:59002 -> 164.124.101.2:53	2014169	ET DNS Query for .su TLD (Soviet Union) Often Malware Related	Potentially Bad Traffic
TCP 192.168.56.101:49165 -> 104.20.3.235:443	906200022	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49167 -> 185.199.111.133:443	906200022	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49166 -> 172.67.169.89:443	906200022	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49168 -> 103.28.36.182:80	2018581	ET MALWARE Single char EXE direct download likely trojan (multiple families)	A Network Trojan was detected
TCP 192.168.56.101:49168 -> 103.28.36.182:80	2016985	ET INFO Executable Served From /tmp/ Directory - Malware Hosting Behaviour	Potentially Bad Traffic
TCP 103.28.36.182:80 -> 192.168.56.101:49168	2014819	ET INFO Packed Executable Download	Misc activity
TCP 103.28.36.182:80 -> 192.168.56.101:49168	2018959	ET POLICY PE EXE or DLL Windows file download HTTP	Potential Corporate Privacy Violation
TCP 103.28.36.182:80 -> 192.168.56.101:49168	2016538	ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download	Potentially Bad Traffic

Suricata TLS

Flow	Issuer	Subject	Fingerprint
TLS 1.2 192.168.56.101:49165 104.20.3.235:443	C=US, O=Google Trust Services, CN=WE1	CN=pastebin.com	82:49:c5:04:9a:bd:a9:c1:ab:4d:ff:95:b9:94:74:cc:40:bc:09:7f
TLS 1.2 192.168.56.101:49167 185.199.111.133:443	C=US, O=DigiCert Inc, CN=DigiCert Global G2 TLS RSA SHA256 2020 CA1	C=US, ST=California, L=San Francisco, O=GitHub, Inc., CN=*.github.io	97:d8:c5:70:0f:12:24:6c:88:bc:fa:06:7e:8c:a7:4d:a8:62:67:28
TLS 1.2 192.168.56.101:49166 172.67.169.89:443	C=US, O=Google Trust Services, CN=WE1	CN=yip.su	cd:f2:dd:c5:ee:57:d1:5f:01:8c:10:00:ac:b5:85:96:0e:f7:0a:32

Queries for the computername (6 events)

Time & API	Arguments	Status	Return
GetComputerNameW July 23, 2024, 7:30 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 23, 2024, 7:30 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 23, 2024, 7:30 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 23, 2024, 7:30 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA July 23, 2024, 7:31 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 23, 2024, 7:31 a.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (3 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent July 23, 2024, 7:30 a.m.			0	0
IsDebuggerPresent July 23, 2024, 7:37 a.m.			0	0
IsDebuggerPresent July 23, 2024, 7:37 a.m.			0	0

Uses Windows APIs to generate a cryptographic key (46 events)

Time & API	Arguments	Status	Return
CryptExportKey July 23, 2024, 7:31 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000000049cd70 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 23, 2024, 7:31 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b59f240 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 23, 2024, 7:31 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b59f240 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 23, 2024, 7:31 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b59f240 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 23, 2024, 7:31 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b59ec90 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 23, 2024, 7:31 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b59ec90 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 23, 2024, 7:31 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b59f240 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 23, 2024, 7:31 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b59f240 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 23, 2024, 7:31 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b59f240 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 23, 2024, 7:31 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b59f240 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 23, 2024, 7:31 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b59f4e0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 23, 2024, 7:31 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b59f4e0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 23, 2024, 7:31 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b59f4e0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 23, 2024, 7:31 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5e46b0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 23, 2024, 7:31 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5e46b0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 23, 2024, 7:31 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5e46b0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 23, 2024, 7:31 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5e4720 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 23, 2024, 7:31 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5e4720 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 23, 2024, 7:31 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5e4720 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 23, 2024, 7:31 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5e4720 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 23, 2024, 7:31 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5e4720 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 23, 2024, 7:31 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5e4720 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 23, 2024, 7:31 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5e4720 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 23, 2024, 7:31 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5e4720 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 23, 2024, 7:31 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5e46b0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 23, 2024, 7:31 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5e46b0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 23, 2024, 7:31 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5e46b0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 23, 2024, 7:31 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5e4800 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 23, 2024, 7:31 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5e4800 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 23, 2024, 7:31 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b59f4e0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 23, 2024, 7:31 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b59f4e0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 23, 2024, 7:31 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b59f240 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 23, 2024, 7:31 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b59f240 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 23, 2024, 7:31 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b59f240 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 23, 2024, 7:31 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5e48e0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 23, 2024, 7:31 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5e48e0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 23, 2024, 7:31 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5e48e0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 23, 2024, 7:31 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5e48e0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 23, 2024, 7:31 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b615800 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 23, 2024, 7:31 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b615800 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 23, 2024, 7:31 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b615b80 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 23, 2024, 7:31 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b615b80 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 23, 2024, 7:31 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5e4560 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 23, 2024, 7:31 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5e4560 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 23, 2024, 7:31 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5e4560 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 23, 2024, 7:31 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5e4560 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx July 23, 2024, 7:30 a.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (2 events)

section	.managed
section	hydrated

The file contains an unknown PE resource name possibly indicative of a packer (1 event)

resource name

BINARY

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

HTTP traffic contains suspicious features which may be indicative of malware related traffic (3 events)

suspicious_features	GET method with no useragent header	suspicious_request	GET http://namphuctourist.com/tmp/1.exe
suspicious_features	GET method with no useragent header	suspicious_request	GET https://pastebin.com/raw/E0rY26ni
suspicious_features	GET method with no useragent header	suspicious_request	GET https://yip.su/RNWPd.exe

Performs some HTTP requests (3 events)

request	GET http://namphuctourist.com/tmp/1.exe
request	GET https://pastebin.com/raw/E0rY26ni
request	GET https://yip.su/RNWPd.exe

Resolves a suspicious Top Level Domain (TLD) (1 event)

domain

yip.su

description

Soviet Union domain TLD

Allocates read-write-execute memory (usually to unpack itself) (50 out of 194 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory July 23, 2024, 7:30 a.m.	process_identifier: 2652 region_size: 1048576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002940000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 23, 2024, 7:30 a.m.	process_identifier: 2652 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000029c0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 23, 2024, 7:30 a.m.	process_identifier: 2652 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3b61000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 23, 2024, 7:30 a.m.	process_identifier: 2652 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3dde000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 23, 2024, 7:30 a.m.	process_identifier: 2652 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3dde000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 23, 2024, 7:30 a.m.	process_identifier: 2652 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3ddf000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 23, 2024, 7:30 a.m.	process_identifier: 2652 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3ddf000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 23, 2024, 7:30 a.m.	process_identifier: 2652 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3ddf000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 23, 2024, 7:30 a.m.	process_identifier: 2652 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3ddf000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 23, 2024, 7:30 a.m.	process_identifier: 2652 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3ddf000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 23, 2024, 7:30 a.m.	process_identifier: 2652 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3ddf000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 23, 2024, 7:30 a.m.	process_identifier: 2652 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3ddf000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 23, 2024, 7:30 a.m.	process_identifier: 2652 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3ddf000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 23, 2024, 7:30 a.m.	process_identifier: 2652 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3de0000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 23, 2024, 7:30 a.m.	process_identifier: 2652 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3de0000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 23, 2024, 7:30 a.m.	process_identifier: 2652 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3de0000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 23, 2024, 7:30 a.m.	process_identifier: 2652 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3de0000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 23, 2024, 7:30 a.m.	process_identifier: 2652 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3de0000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 23, 2024, 7:30 a.m.	process_identifier: 2652 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3de1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 23, 2024, 7:30 a.m.	process_identifier: 2652 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3de1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 23, 2024, 7:30 a.m.	process_identifier: 2652 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3de1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 23, 2024, 7:30 a.m.	process_identifier: 2652 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3de1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 23, 2024, 7:30 a.m.	process_identifier: 2652 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3dde000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 23, 2024, 7:30 a.m.	process_identifier: 2652 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00052000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 23, 2024, 7:30 a.m.	process_identifier: 2652 region_size: 589824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 23, 2024, 7:30 a.m.	process_identifier: 2652 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 23, 2024, 7:30 a.m.	process_identifier: 2652 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 23, 2024, 7:30 a.m.	process_identifier: 2652 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 23, 2024, 7:30 a.m.	process_identifier: 2652 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 23, 2024, 7:30 a.m.	process_identifier: 2652 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff0010a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 23, 2024, 7:30 a.m.	process_identifier: 2652 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00042000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 23, 2024, 7:30 a.m.	process_identifier: 2652 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000029c2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 23, 2024, 7:31 a.m.	process_identifier: 2652 region_size: 12288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000029c4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 23, 2024, 7:31 a.m.	process_identifier: 2652 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff0011a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 23, 2024, 7:31 a.m.	process_identifier: 2652 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00053000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 23, 2024, 7:31 a.m.	process_identifier: 2652 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00054000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 23, 2024, 7:31 a.m.	process_identifier: 2652 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00142000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 23, 2024, 7:31 a.m.	process_identifier: 2652 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff0011d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 23, 2024, 7:31 a.m.	process_identifier: 2652 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff0010b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 23, 2024, 7:31 a.m.	process_identifier: 2652 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00102000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 23, 2024, 7:31 a.m.	process_identifier: 2652 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00055000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 23, 2024, 7:31 a.m.	process_identifier: 2652 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00190000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 23, 2024, 7:31 a.m.	process_identifier: 2652 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00043000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 23, 2024, 7:31 a.m.	process_identifier: 2652 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00056000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 23, 2024, 7:31 a.m.	process_identifier: 2652 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00143000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 23, 2024, 7:31 a.m.	process_identifier: 2652 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff0010c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 23, 2024, 7:31 a.m.	process_identifier: 2652 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00103000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 23, 2024, 7:31 a.m.	process_identifier: 2652 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff0004a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 23, 2024, 7:31 a.m.	process_identifier: 2652 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00191000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 23, 2024, 7:31 a.m.	process_identifier: 2652 region_size: 16384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000029c7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1

Creates executable files on the filesystem (6 events)

file	C:\Users\test22\Pictures\geSGH76CxrkCsGl1faMAUiHj.exe
file	C:\Users\test22\AppData\Local\qSPlWjbWxPr6Uk2qaGXnjUxw.exe
file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qkTr7ohAdFYNIhscpvOQU59s.bat
file	C:\Users\test22\AppData\Local\qaxQnCxjgCaqGsvPGiImkonF.exe
file	C:\Users\test22\Pictures\QElFn5yWecUvTulFbSuZoPkg.exe
file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\QkPrurxZL45nF4Z70Sqv9rEM.bat

Creates a shortcut to an executable file (1 event)

file	C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk

Creates a suspicious process (1 event)

cmdline

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath $env:UserProfile

Drops an executable to the user AppData folder (1 event)

file	C:\Users\test22\AppData\Local\qSPlWjbWxPr6Uk2qaGXnjUxw.exe

A process created a hidden window (2 events)

Time & API	Arguments	Status	Return	Repeated
ShellExecuteExW July 23, 2024, 7:37 a.m.	show_type: 0 filepath_r: C:\Users\test22\Pictures\QElFn5yWecUvTulFbSuZoPkg.exe parameters: filepath: C:\Users\test22\Pictures\QElFn5yWecUvTulFbSuZoPkg.exe	1	1	0
ShellExecuteExW July 23, 2024, 7:38 a.m.	show_type: 0 filepath_r: C:\Users\test22\Pictures\geSGH76CxrkCsGl1faMAUiHj.exe parameters: filepath: C:\Users\test22\Pictures\geSGH76CxrkCsGl1faMAUiHj.exe		0	0

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses July 23, 2024, 7:37 a.m.	flags: 15 family: 0		111	0

The binary likely contains encrypted or compressed data indicative of a packer (1 event)

section

{u'size_of_data': u'0x00003200', u'virtual_address': u'0x001f7000', u'entropy': 7.818142902846188, u'name': u'.rsrc', u'virtual_size': u'0x000030b4'}

entropy

7.81814290285

description

A section with a high entropy has been found

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 event)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW July 23, 2024, 7:31 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Potentially malicious URLs were found in the process memory dump (1 event)

url	https://docs.microsoft.com/windows/win32/fileio/maximum-file-path-limitation

Yara rule detected in process memory (7 events)

description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Bypass DEP	rule	disable_dep

Allocates execute permission to another process indicative of possible code injection (1 event)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory July 23, 2024, 7:30 a.m.	process_identifier: 2748 region_size: 32768 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000000000000108	1	0	0

Installs itself for autorun at Windows startup (2 events)

file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\QkPrurxZL45nF4Z70Sqv9rEM.bat
file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qkTr7ohAdFYNIhscpvOQU59s.bat

Drops a binary and executes it (1 event)

file	C:\Users\test22\Pictures\geSGH76CxrkCsGl1faMAUiHj.exe

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2572 resumed a thread in remote process 2748
NtResumeThread July 23, 2024, 7:30 a.m.	thread_handle: 0x000000000000010c suspend_count: 1 process_identifier: 2748	1	0	0

The process powershell.exe wrote an executable file to disk (19 events)

file	C:\Windows\System32\ie4uinit.exe
file	C:\Program Files\Windows Sidebar\sidebar.exe
file	C:\Windows\System32\WindowsAnytimeUpgradeUI.exe
file	C:\Windows\System32\xpsrchvw.exe
file	C:\Windows\System32\displayswitch.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe
file	C:\Windows\System32\mblctr.exe
file	C:\Windows\System32\mstsc.exe
file	C:\Windows\System32\SnippingTool.exe
file	C:\Windows\System32\SoundRecorder.exe
file	C:\Windows\System32\dfrgui.exe
file	C:\Windows\System32\msinfo32.exe
file	C:\Windows\System32\rstrui.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe
file	C:\Program Files\Windows Journal\Journal.exe
file	C:\Windows\System32\MdSched.exe
file	C:\Windows\System32\msconfig.exe
file	C:\Windows\System32\recdisc.exe
file	C:\Windows\System32\msra.exe

Executed a process and injected code into it, probably while unpacking (22 events)

Time & API	Arguments	Status	Return
NtResumeThread July 23, 2024, 7:30 a.m.	thread_handle: 0x00000000000000b0 suspend_count: 1 process_identifier: 2572	1	0
NtResumeThread July 23, 2024, 7:30 a.m.	thread_handle: 0x00000000000000e8 suspend_count: 1 process_identifier: 2572	1	0
CreateProcessInternalW July 23, 2024, 7:30 a.m.	thread_identifier: 2656 thread_handle: 0x0000000000000100 process_identifier: 2652 current_directory: filepath: track: 1 command_line: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath $env:UserProfile filepath_r: stack_pivoted: 0 creation_flags: 16 (CREATE_NEW_CONSOLE) inherit_handles: 0 process_handle: 0x0000000000000104	1	1
CreateProcessInternalW July 23, 2024, 7:30 a.m.	thread_identifier: 2752 thread_handle: 0x000000000000010c process_identifier: 2748 current_directory: filepath: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe track: 1 command_line: filepath_r: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x0000000000000108	1	1
NtUnmapViewOfSection July 23, 2024, 7:30 a.m.	base_address: 0x0000000000400000 region_size: 4849664 process_identifier: 2748 process_handle: 0x0000000000000108		-1073741799
NtAllocateVirtualMemory July 23, 2024, 7:30 a.m.	process_identifier: 2748 region_size: 32768 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000000000000108	1	0
NtResumeThread July 23, 2024, 7:30 a.m.	thread_handle: 0x000000000000010c suspend_count: 1 process_identifier: 2748	1	0
NtResumeThread July 23, 2024, 7:30 a.m.	thread_handle: 0x0000000000000284 suspend_count: 1 process_identifier: 2652	1	0
NtResumeThread July 23, 2024, 7:30 a.m.	thread_handle: 0x00000000000002d8 suspend_count: 1 process_identifier: 2652	1	0
NtResumeThread July 23, 2024, 7:31 a.m.	thread_handle: 0x0000000000000368 suspend_count: 1 process_identifier: 2652	1	0
NtResumeThread July 23, 2024, 7:31 a.m.	thread_handle: 0x00000000000003fc suspend_count: 1 process_identifier: 2652	1	0
NtResumeThread July 23, 2024, 7:37 a.m.	thread_handle: 0x000000dc suspend_count: 1 process_identifier: 2748	1	0
NtResumeThread July 23, 2024, 7:37 a.m.	thread_handle: 0x0000018c suspend_count: 1 process_identifier: 2748	1	0
NtResumeThread July 23, 2024, 7:37 a.m.	thread_handle: 0x000001c8 suspend_count: 1 process_identifier: 2748	1	0
NtResumeThread July 23, 2024, 7:37 a.m.	thread_handle: 0x0000029c suspend_count: 1 process_identifier: 2748	1	0
NtResumeThread July 23, 2024, 7:37 a.m.	thread_handle: 0x000003b8 suspend_count: 1 process_identifier: 2748	1	0
NtResumeThread July 23, 2024, 7:37 a.m.	thread_handle: 0x00000610 suspend_count: 1 process_identifier: 2748	1	0
NtResumeThread July 23, 2024, 7:37 a.m.	thread_handle: 0x0000063c suspend_count: 1 process_identifier: 2748	1	0
NtResumeThread July 23, 2024, 7:37 a.m.	thread_handle: 0x0000061c suspend_count: 1 process_identifier: 2748	1	0
CreateProcessInternalW July 23, 2024, 7:37 a.m.	thread_identifier: 2916 thread_handle: 0x0000077c process_identifier: 2912 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Users\test22\Pictures\QElFn5yWecUvTulFbSuZoPkg.exe track: 1 command_line: "C:\Users\test22\Pictures\QElFn5yWecUvTulFbSuZoPkg.exe" filepath_r: C:\Users\test22\Pictures\QElFn5yWecUvTulFbSuZoPkg.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x000007a4	1	1
NtResumeThread July 23, 2024, 7:37 a.m.	thread_handle: 0x00000618 suspend_count: 1 process_identifier: 2748	1	0
CreateProcessInternalW July 23, 2024, 7:38 a.m.	thread_identifier: 0 thread_handle: 0x00000000 process_identifier: 0 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Users\test22\Pictures\geSGH76CxrkCsGl1faMAUiHj.exe track: 0 command_line: "C:\Users\test22\Pictures\geSGH76CxrkCsGl1faMAUiHj.exe" filepath_r: C:\Users\test22\Pictures\geSGH76CxrkCsGl1faMAUiHj.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x00000000		0

file200h.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All