Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	July 31, 2024, 11:02 p.m.	July 31, 2024, 11:04 p.m.

Size	2.5MB
Type	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
MD5	`47781e2f67d75de26c08227ef50a1da5`
SHA256	`499bc6537c074f8e228faa0e1b723726ca1a8e85f817d16c2abf29c1608f60f9`
CRC32	`F8EAC52A`
ssdeep	`49152:bYB+dd0A75bMXCx5LVkRRpN10BbvQDYMP13rl49tDt1G:bnptbICx56cJuYorlwdtQ`
Yara	PE_Header_Zero - PE File Signature IsPE32 - (no description) UPX_Zero - UPX packed file Win32_Trojan_Emotet_2_Zero - Win32 Trojan Emotet mzp_file_format - MZP(Delphi) file format

InstallAAAwave.exe "C:\Users\test22\AppData\Local\Temp\InstallAAAwave.exe"
2540
- AAAwave.exe "C:\Program Files (x86)\Virtual Worlds\AAAwave\AAAwave.exe"
  1560
explorer.exe C:\Windows\Explorer.EXE
1452

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (3 events)

Time & API	Arguments	Status	Return
GetComputerNameW July 31, 2024, 11:03 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 31, 2024, 11:03 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 31, 2024, 11:03 p.m.	computer_name: TEST22-PC	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx July 31, 2024, 11:02 p.m.		1	1	0

One or more processes crashed (14 events)

Time & API	Arguments	Status
__exception__ July 31, 2024, 11:03 p.m.	stacktrace: DllUnregisterServer+0x11f comdlg32+0xc28d @ 0x217ac28d DllRegisterServer+0x5 DllUnregisterServer-0x18 comdlg32+0xc156 @ 0x217ac156 installaaawave+0x1579e @ 0x41579e installaaawave+0x15c6c @ 0x415c6c installaaawave+0x2f16b @ 0x42f16b installaaawave+0x30863 @ 0x430863 installaaawave+0x38c9d @ 0x438c9d installaaawave+0x39618 @ 0x439618 installaaawave+0x3996f @ 0x43996f BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: 8a 08 40 84 c9 75 f9 2b c2 c7 45 fc fe ff ff ff exception.symbol: lstrlen+0x1a lstrcmpW-0x3f kernelbase+0xa34a exception.instruction: mov cl, byte ptr [eax] exception.module: KERNELBASE.dll exception.exception_code: 0xc0000005 exception.offset: 41802 exception.address: 0x7597a34a registers.esp: 1637144 registers.edi: 1968986699 registers.eax: 2 registers.ebp: 1637184 registers.edx: 3 registers.ebx: 0 registers.esi: 561721724 registers.ecx: 2117206016	1
__exception__ July 31, 2024, 11:03 p.m.	stacktrace: DllUnregisterServer+0x11f richtx32+0x1474c @ 0x2001474c DllRegisterServer+0x5 DllUnregisterServer-0x18 richtx32+0x14615 @ 0x20014615 installaaawave+0x1579e @ 0x41579e installaaawave+0x15c6c @ 0x415c6c installaaawave+0x2f16b @ 0x42f16b installaaawave+0x30863 @ 0x430863 installaaawave+0x38c9d @ 0x438c9d installaaawave+0x39618 @ 0x439618 installaaawave+0x3996f @ 0x43996f BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: 8a 08 40 84 c9 75 f9 2b c2 c7 45 fc fe ff ff ff exception.symbol: lstrlen+0x1a lstrcmpW-0x3f kernelbase+0xa34a exception.instruction: mov cl, byte ptr [eax] exception.module: KERNELBASE.dll exception.exception_code: 0xc0000005 exception.offset: 41802 exception.address: 0x7597a34a registers.esp: 1637144 registers.edi: 1968986699 registers.eax: 2 registers.ebp: 1637184 registers.edx: 3 registers.ebx: 0 registers.esi: 536994316 registers.ecx: 2117206016	1
__exception__ July 31, 2024, 11:03 p.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7597b727 registers.esp: 1635176 registers.edi: 6478392 registers.eax: 1635176 registers.ebp: 1635256 registers.edx: 0 registers.ebx: 6478392 registers.esi: 6478392 registers.ecx: 2	1
__exception__ July 31, 2024, 11:03 p.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7597b727 registers.esp: 1629680 registers.edi: 1629868 registers.eax: 1629680 registers.ebp: 1629760 registers.edx: 0 registers.ebx: 6478392 registers.esi: 1629868 registers.ecx: 2	1
__exception__ July 31, 2024, 11:03 p.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7597b727 registers.esp: 1629680 registers.edi: 1629868 registers.eax: 1629680 registers.ebp: 1629760 registers.edx: 0 registers.ebx: 6478392 registers.esi: 1629868 registers.ecx: 2	1
__exception__ July 31, 2024, 11:03 p.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7597b727 registers.esp: 1633028 registers.edi: 1633216 registers.eax: 1633028 registers.ebp: 1633108 registers.edx: 0 registers.ebx: 6478392 registers.esi: 1633216 registers.ecx: 2	1
__exception__ July 31, 2024, 11:03 p.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7597b727 registers.esp: 1633028 registers.edi: 1633216 registers.eax: 1633028 registers.ebp: 1633108 registers.edx: 0 registers.ebx: 6478392 registers.esi: 1633216 registers.ecx: 2	1
__exception__ July 31, 2024, 11:03 p.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7597b727 registers.esp: 1629680 registers.edi: 1629868 registers.eax: 1629680 registers.ebp: 1629760 registers.edx: 0 registers.ebx: 6478392 registers.esi: 1629868 registers.ecx: 2	1
__exception__ July 31, 2024, 11:03 p.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7597b727 registers.esp: 1629680 registers.edi: 1629868 registers.eax: 1629680 registers.ebp: 1629760 registers.edx: 0 registers.ebx: 6478392 registers.esi: 1629868 registers.ecx: 2	1
__exception__ July 31, 2024, 11:03 p.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7597b727 registers.esp: 1633028 registers.edi: 1633216 registers.eax: 1633028 registers.ebp: 1633108 registers.edx: 0 registers.ebx: 6478392 registers.esi: 1633216 registers.ecx: 2	1
__exception__ July 31, 2024, 11:03 p.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7597b727 registers.esp: 1633028 registers.edi: 1633216 registers.eax: 1633028 registers.ebp: 1633108 registers.edx: 0 registers.ebx: 6478392 registers.esi: 1633216 registers.ecx: 2	1
__exception__ July 31, 2024, 11:03 p.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7597b727 registers.esp: 1635260 registers.edi: 1635448 registers.eax: 1635260 registers.ebp: 1635340 registers.edx: 0 registers.ebx: 6478392 registers.esi: 1635448 registers.ecx: 2	1
__exception__ July 31, 2024, 11:03 p.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7597b727 registers.esp: 1635260 registers.edi: 1635448 registers.eax: 1635260 registers.ebp: 1635340 registers.edx: 0 registers.ebx: 6478392 registers.esi: 1635448 registers.ecx: 2	1
__exception__ July 31, 2024, 11:03 p.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7597b727 registers.esp: 1627036 registers.edi: 6478392 registers.eax: 1627036 registers.ebp: 1627116 registers.edx: 0 registers.ebx: 6478392 registers.esi: 6478392 registers.ecx: 2	1

Allocates read-write-execute memory (usually to unpack itself) (40 events)

Time & API	Arguments	Status
NtProtectVirtualMemory July 31, 2024, 11:02 p.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72dd1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 31, 2024, 11:02 p.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x732d4000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 31, 2024, 11:02 p.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72dd2000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 31, 2024, 11:02 p.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6c241000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 31, 2024, 11:02 p.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72a41000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 31, 2024, 11:03 p.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73fa1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 31, 2024, 11:03 p.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02541000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 31, 2024, 11:03 p.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02541000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 31, 2024, 11:03 p.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73921000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 31, 2024, 11:03 p.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73251000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 31, 2024, 11:03 p.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x217a1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 31, 2024, 11:03 p.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75511000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 31, 2024, 11:03 p.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x217a1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 31, 2024, 11:03 p.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75511000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 31, 2024, 11:03 p.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x729e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 31, 2024, 11:03 p.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02541000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 31, 2024, 11:03 p.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02541000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 31, 2024, 11:03 p.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02541000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 31, 2024, 11:03 p.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02541000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 31, 2024, 11:03 p.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02541000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 31, 2024, 11:03 p.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02541000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 31, 2024, 11:03 p.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x20001000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 31, 2024, 11:03 p.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73921000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 31, 2024, 11:03 p.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75511000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 31, 2024, 11:03 p.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x20001000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 31, 2024, 11:03 p.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73251000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 31, 2024, 11:03 p.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75511000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 31, 2024, 11:03 p.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73bb1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 31, 2024, 11:03 p.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72971000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 31, 2024, 11:03 p.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73921000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 31, 2024, 11:03 p.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73251000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 31, 2024, 11:03 p.m.	process_identifier: 1452 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000049d0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 31, 2024, 11:03 p.m.	process_identifier: 1560 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00551000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 31, 2024, 11:03 p.m.	process_identifier: 1560 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72dd1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 31, 2024, 11:03 p.m.	process_identifier: 1560 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a01000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 31, 2024, 11:03 p.m.	process_identifier: 1560 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x732d4000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 31, 2024, 11:03 p.m.	process_identifier: 1560 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72dd2000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 31, 2024, 11:03 p.m.	process_identifier: 1560 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x728b1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 31, 2024, 11:03 p.m.	process_identifier: 1560 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02d51000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 31, 2024, 11:03 p.m.	process_identifier: 1560 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73741000 process_handle: 0xffffffff	1

Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation (2 events)

Time & API	Arguments	Status	Return	Repeated
GetDiskFreeSpaceExW July 31, 2024, 11:02 p.m.	total_number_of_free_bytes: 13321420800 free_bytes_available: 13321420800 root_path: C:\Temp\1KE80Q1B\ total_number_of_bytes: 34252779520	1	1	0
GetDiskFreeSpaceExW July 31, 2024, 11:03 p.m.	total_number_of_free_bytes: 13320925184 free_bytes_available: 13320925184 root_path: C:\Temp\1KE80Q1B\ total_number_of_bytes: 34252779520	1	1	0

Creates executable files on the filesystem (17 events)

file	C:\Windows\System32\dx7vb.dll
file	C:\Program Files (x86)\Virtual Worlds\AAAwave\AAAwave.exe
file	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Virtual Worlds\AAAwave\AAAwave help.lnk
file	C:\Windows\System32\HDK3HTML.DLL
file	C:\Program Files (x86)\Virtual Worlds\AAAwave\Uninstall.exe
file	C:\Windows\System32\HDK3CTNT.DLL
file	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Virtual Worlds\AAAwave\AAAwave.lnk
file	C:\Windows\System32\COMDLG32.OCX
file	C:\Windows\System32\VWcontrols4.ocx
file	C:\Temp\1KE80Q1B\unpack.dll
file	C:\Windows\System32\MSCOMCT2.OCX
file	C:\Temp\1KE80Q1B\Resume.exe
file	C:\Temp\1KE80Q1B\InstallAAAwave\Uninstall.exe
file	C:\Windows\System32\RICHTX32.OCX
file	C:\Users\Public\Desktop\AAA Wave.lnk
file	C:\Windows\System32\VWlicense.dll
file	C:\Temp\1KE80Q1B\InstallAAAwave\plugins\0\StdUI.dll

Creates a shortcut to an executable file (4 events)

file	C:\Users\test22\Desktop\AAA Wave.lnk
file	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Virtual Worlds\AAAwave\AAAwave.lnk
file	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Virtual Worlds\AAAwave\AAAwave help.lnk
file	C:\Users\Public\Desktop\AAA Wave.lnk

Drops a binary and executes it (1 event)

file	C:\Program Files (x86)\Virtual Worlds\AAAwave\AAAwave.exe

File has been identified by one AntiVirus engine on VirusTotal as malicious (1 event)

Cynet

Malicious (score: 100)

Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time) (1 event)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory July 31, 2024, 11:03 p.m.	process_identifier: 1560 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 24576 protection: 32 (PAGE_EXECUTE_READ) base_address: 0x004d0000 process_handle: 0xffffffff	1	0	0

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x0001c800', u'virtual_address': u'0x00037000', u'entropy': 7.918119474221462, u'name': u'UPX1', u'virtual_size': u'0x0001d000'}

entropy

7.91811947422

description

A section with a high entropy has been found

entropy

0.942148760331

description

Overall entropy of this PE file is high

The executable is compressed using UPX (2 events)

section	UPX0				description	Section name indicates UPX
section	UPX1				description	Section name indicates UPX

InstallAAAwave.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All