Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Nov. 7, 2024, 1:48 p.m.	Nov. 7, 2024, 1:57 p.m.

Size	96.0KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`930c41bc0c20865af61a95bcf0c3b289`
SHA256	`1f2e9724dfb091059ae16c305601e21d64b5308df76ddef6b394573e576ef1ff`
CRC32	`36E746F6`
ssdeep	`1536:y7zFjdFmav82XA3I9XRH5McIu9Xh0TRvfQaQG9MF7vnn:uRyOPA3MfCwR0toZF7vn`
Yara	Malicious_Library_Zero - Malicious_Library Network_Downloader - File Downloader Admin_Tool_IN_Zero - Admin Tool Sysinternals PE_Header_Zero - PE File Signature Malicious_Packer_Zero - Malicious Packer IsPE32 - (no description) Generic_Malware_Zero - Generic Malware UPX_Zero - UPX packed file

r.exe "C:\Users\test22\AppData\Local\Temp\r.exe"
1680
- sysvplervcs.exe C:\Windows\sysvplervcs.exe
  1684
  - cmd.exe "C:\Windows\System32\cmd.exe" /c powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
    2160
    - powershell.exe powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
      2280
  - cmd.exe "C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop DoSvc & sc stop BITS /wait
    2204
    - sc.exe sc stop UsoSvc
      2316
    - sc.exe sc stop WaaSMedicSvc
      2380
    - sc.exe sc stop wuauserv
      2448
    - sc.exe sc stop DoSvc
      2496
    - sc.exe sc stop BITS /wait
      2544

Name	Response	Post-Analysis Lookup
www.update.microsoft.com		20.72.235.82

IP Address	Status	Action
125.74.99.73	Active	Moloch
164.124.101.2	Active	Moloch
185.215.113.66	Active	Moloch
213.230.111.168	Active	Moloch
37.255.202.28	Active	Moloch
5.219.163.120	Active	Moloch
5.234.21.11	Active	Moloch
5.53.62.35	Active	Moloch
5.75.53.107	Active	Moloch
78.36.17.105	Active	Moloch
82.151.120.74	Active	Moloch
89.249.62.238	Active	Moloch
90.156.163.31	Active	Moloch
94.252.244.21	Active	Moloch
95.159.149.185	Active	Moloch
95.72.81.43	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
UDP 192.168.56.103:50801 -> 5.75.53.107:40500	2044077	ET MALWARE Win32/Phorpiex UDP Peer-to-Peer CnC	A Network Trojan was detected
UDP 192.168.56.103:50801 -> 5.53.62.35:40500	2044077	ET MALWARE Win32/Phorpiex UDP Peer-to-Peer CnC	A Network Trojan was detected
UDP 192.168.56.103:50801 -> 5.234.21.11:40500	2044077	ET MALWARE Win32/Phorpiex UDP Peer-to-Peer CnC	A Network Trojan was detected
UDP 192.168.56.103:50801 -> 95.72.81.43:40500	2044077	ET MALWARE Win32/Phorpiex UDP Peer-to-Peer CnC	A Network Trojan was detected
UDP 192.168.56.103:50801 -> 89.249.62.238:40500	2044077	ET MALWARE Win32/Phorpiex UDP Peer-to-Peer CnC	A Network Trojan was detected
UDP 192.168.56.103:50801 -> 78.36.17.105:40500	2044077	ET MALWARE Win32/Phorpiex UDP Peer-to-Peer CnC	A Network Trojan was detected
UDP 192.168.56.103:50801 -> 37.255.202.28:40500	2044077	ET MALWARE Win32/Phorpiex UDP Peer-to-Peer CnC	A Network Trojan was detected
UDP 192.168.56.103:50801 -> 125.74.99.73:40500	2044077	ET MALWARE Win32/Phorpiex UDP Peer-to-Peer CnC	A Network Trojan was detected

Suricata TLS

No Suricata TLS

Queries for the computername (6 events)

Time & API	Arguments	Status	Return
GetComputerNameW Nov. 7, 2024, 1:48 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 7, 2024, 1:48 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 7, 2024, 1:48 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 7, 2024, 1:48 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Nov. 7, 2024, 1:48 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 7, 2024, 1:48 p.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (1 event)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Nov. 7, 2024, 1:48 p.m.			0	0

Command line console output was observed (32 events)

Time & API	Arguments	Status	Return
WriteConsoleW Nov. 7, 2024, 1:48 p.m.	buffer: The term 'Add-MpPreference' is not recognized as the name of a cmdlet, function console_handle: 0x00000023	1	1
WriteConsoleW Nov. 7, 2024, 1:48 p.m.	buffer: , script file, or operable program. Check the spelling of the name, or if a pat console_handle: 0x0000002f	1	1
WriteConsoleW Nov. 7, 2024, 1:48 p.m.	buffer: h was included, verify that the path is correct and try again. console_handle: 0x0000003b	1	1
WriteConsoleW Nov. 7, 2024, 1:48 p.m.	buffer: At line:1 char:17 console_handle: 0x00000047	1	1
WriteConsoleW Nov. 7, 2024, 1:48 p.m.	buffer: + Add-MpPreference <<<< -ExclusionPath $env:windir; Add-MpPreference -Exclusio console_handle: 0x00000053	1	1
WriteConsoleW Nov. 7, 2024, 1:48 p.m.	buffer: nPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE console_handle: 0x0000005f	1	1
WriteConsoleW Nov. 7, 2024, 1:48 p.m.	buffer: + CategoryInfo : ObjectNotFound: (Add-MpPreference:String) [], Co console_handle: 0x0000006b	1	1
WriteConsoleW Nov. 7, 2024, 1:48 p.m.	buffer: mmandNotFoundException console_handle: 0x00000077	1	1
WriteConsoleW Nov. 7, 2024, 1:48 p.m.	buffer: + FullyQualifiedErrorId : CommandNotFoundException console_handle: 0x00000083	1	1
WriteConsoleW Nov. 7, 2024, 1:48 p.m.	buffer: The term 'Add-MpPreference' is not recognized as the name of a cmdlet, function console_handle: 0x000000a3	1	1
WriteConsoleW Nov. 7, 2024, 1:48 p.m.	buffer: , script file, or operable program. Check the spelling of the name, or if a pat console_handle: 0x000000af	1	1
WriteConsoleW Nov. 7, 2024, 1:48 p.m.	buffer: h was included, verify that the path is correct and try again. console_handle: 0x000000bb	1	1
WriteConsoleW Nov. 7, 2024, 1:48 p.m.	buffer: At line:1 char:62 console_handle: 0x000000c7	1	1
WriteConsoleW Nov. 7, 2024, 1:48 p.m.	buffer: + Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference <<<< -Exclusio console_handle: 0x000000d3	1	1
WriteConsoleW Nov. 7, 2024, 1:48 p.m.	buffer: nPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE console_handle: 0x000000df	1	1
WriteConsoleW Nov. 7, 2024, 1:48 p.m.	buffer: + CategoryInfo : ObjectNotFound: (Add-MpPreference:String) [], Co console_handle: 0x000000eb	1	1
WriteConsoleW Nov. 7, 2024, 1:48 p.m.	buffer: mmandNotFoundException console_handle: 0x000000f7	1	1
WriteConsoleW Nov. 7, 2024, 1:48 p.m.	buffer: + FullyQualifiedErrorId : CommandNotFoundException console_handle: 0x00000103	1	1
WriteConsoleW Nov. 7, 2024, 1:48 p.m.	buffer: The term 'Add-MpPreference' is not recognized as the name of a cmdlet, function console_handle: 0x00000123	1	1
WriteConsoleW Nov. 7, 2024, 1:48 p.m.	buffer: , script file, or operable program. Check the spelling of the name, or if a pat console_handle: 0x0000012f	1	1
WriteConsoleW Nov. 7, 2024, 1:48 p.m.	buffer: h was included, verify that the path is correct and try again. console_handle: 0x0000013b	1	1
WriteConsoleW Nov. 7, 2024, 1:48 p.m.	buffer: At line:1 char:105 console_handle: 0x00000147	1	1
WriteConsoleW Nov. 7, 2024, 1:48 p.m.	buffer: + Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath console_handle: 0x00000153	1	1
WriteConsoleW Nov. 7, 2024, 1:48 p.m.	buffer: $env:TEMP; Add-MpPreference <<<< -ExclusionPath $env:USERPROFILE console_handle: 0x0000015f	1	1
WriteConsoleW Nov. 7, 2024, 1:48 p.m.	buffer: + CategoryInfo : ObjectNotFound: (Add-MpPreference:String) [], Co console_handle: 0x0000016b	1	1
WriteConsoleW Nov. 7, 2024, 1:48 p.m.	buffer: mmandNotFoundException console_handle: 0x00000177	1	1
WriteConsoleW Nov. 7, 2024, 1:48 p.m.	buffer: + FullyQualifiedErrorId : CommandNotFoundException console_handle: 0x00000183	1	1
WriteConsoleW Nov. 7, 2024, 1:48 p.m.	buffer: [SC] OpenService FAILED 1060: The specified service does not exist as an installed service. console_handle: 0x00000007	1	1
WriteConsoleW Nov. 7, 2024, 1:48 p.m.	buffer: [SC] OpenService FAILED 1060: The specified service does not exist as an installed service. console_handle: 0x00000007	1	1
WriteConsoleW Nov. 7, 2024, 1:48 p.m.	buffer: [SC] ControlService FAILED 1062: The service has not been started. console_handle: 0x00000007	1	1
WriteConsoleW Nov. 7, 2024, 1:48 p.m.	buffer: [SC] OpenService FAILED 1060: The specified service does not exist as an installed service. console_handle: 0x00000007	1	1
WriteConsoleW Nov. 7, 2024, 1:48 p.m.	buffer: [SC] ControlServiceEx FAILED 87: The parameter is incorrect. console_handle: 0x00000007	1	1

Uses Windows APIs to generate a cryptographic key (46 events)

Time & API	Arguments	Status	Return
CryptExportKey Nov. 7, 2024, 1:48 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006ee7a0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 7, 2024, 1:48 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006ee8e0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 7, 2024, 1:48 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006ee8e0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 7, 2024, 1:48 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006ee8e0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 7, 2024, 1:48 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006ee0e0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 7, 2024, 1:48 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006ee0e0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 7, 2024, 1:48 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006ee0e0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 7, 2024, 1:48 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006ee0e0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 7, 2024, 1:48 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006ee0e0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 7, 2024, 1:48 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006ee0e0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 7, 2024, 1:48 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006ee8e0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 7, 2024, 1:48 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006ee8e0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 7, 2024, 1:48 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006ee8e0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 7, 2024, 1:48 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006eee60 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 7, 2024, 1:48 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006eee60 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 7, 2024, 1:48 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006eee60 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 7, 2024, 1:48 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006eeb60 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 7, 2024, 1:48 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006eee60 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 7, 2024, 1:48 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006eee60 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 7, 2024, 1:48 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006eee60 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 7, 2024, 1:48 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006eee60 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 7, 2024, 1:48 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006eee60 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 7, 2024, 1:48 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006eee60 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 7, 2024, 1:48 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006eee60 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 7, 2024, 1:48 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006eec20 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 7, 2024, 1:48 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006eec20 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 7, 2024, 1:48 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006eec20 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 7, 2024, 1:48 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006eec20 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 7, 2024, 1:48 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006eec20 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 7, 2024, 1:48 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006eec20 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 7, 2024, 1:48 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006eec20 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 7, 2024, 1:48 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006eec20 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 7, 2024, 1:48 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006eec20 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 7, 2024, 1:48 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006eec20 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 7, 2024, 1:48 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006eec20 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 7, 2024, 1:48 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006eec20 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 7, 2024, 1:48 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006eec20 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 7, 2024, 1:48 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006eec20 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 7, 2024, 1:48 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006eeca0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 7, 2024, 1:48 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006eeca0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 7, 2024, 1:48 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006eeca0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 7, 2024, 1:48 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006eeca0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 7, 2024, 1:48 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006eeca0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 7, 2024, 1:48 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006eeca0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 7, 2024, 1:48 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006eeca0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 7, 2024, 1:48 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006eeca0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Nov. 7, 2024, 1:48 p.m.		1	1	0

Communication to multiple IPs on high port numbers possibly indicative of a peer-to-peer (P2P) or non-standard command and control protocol (12 events)

ip	100.73.146.197
ip	125.74.99.73
ip	213.230.111.168
ip	37.255.202.28
ip	5.219.163.120
ip	5.234.21.11
ip	5.53.62.35
ip	5.75.53.107
ip	78.36.17.105
ip	82.151.120.74
ip	89.249.62.238
ip	95.72.81.43

Allocates read-write-execute memory (usually to unpack itself) (50 out of 137 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Nov. 7, 2024, 1:48 p.m.	process_identifier: 2280 region_size: 524288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02660000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 7, 2024, 1:48 p.m.	process_identifier: 2280 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026a0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 7, 2024, 1:48 p.m.	process_identifier: 2280 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72fd1000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 7, 2024, 1:48 p.m.	process_identifier: 2280 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x023aa000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 7, 2024, 1:48 p.m.	process_identifier: 2280 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72fd2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 7, 2024, 1:48 p.m.	process_identifier: 2280 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x023a2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 7, 2024, 1:48 p.m.	process_identifier: 2280 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02462000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 7, 2024, 1:48 p.m.	process_identifier: 2280 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026a1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 7, 2024, 1:48 p.m.	process_identifier: 2280 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026a2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 7, 2024, 1:48 p.m.	process_identifier: 2280 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0248a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 7, 2024, 1:48 p.m.	process_identifier: 2280 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02463000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 7, 2024, 1:48 p.m.	process_identifier: 2280 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02464000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 7, 2024, 1:48 p.m.	process_identifier: 2280 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0249b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 7, 2024, 1:48 p.m.	process_identifier: 2280 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02497000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 7, 2024, 1:48 p.m.	process_identifier: 2280 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x023ab000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 7, 2024, 1:48 p.m.	process_identifier: 2280 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02482000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 7, 2024, 1:48 p.m.	process_identifier: 2280 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02495000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 7, 2024, 1:48 p.m.	process_identifier: 2280 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02465000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 7, 2024, 1:48 p.m.	process_identifier: 2280 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0248c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 7, 2024, 1:48 p.m.	process_identifier: 2280 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02690000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 7, 2024, 1:48 p.m.	process_identifier: 2280 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02466000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 7, 2024, 1:48 p.m.	process_identifier: 2280 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0249c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 7, 2024, 1:48 p.m.	process_identifier: 2280 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02483000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 7, 2024, 1:48 p.m.	process_identifier: 2280 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02484000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 7, 2024, 1:48 p.m.	process_identifier: 2280 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02485000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 7, 2024, 1:48 p.m.	process_identifier: 2280 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02486000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 7, 2024, 1:48 p.m.	process_identifier: 2280 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02487000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 7, 2024, 1:48 p.m.	process_identifier: 2280 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02488000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 7, 2024, 1:48 p.m.	process_identifier: 2280 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02489000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 7, 2024, 1:48 p.m.	process_identifier: 2280 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x027b0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 7, 2024, 1:48 p.m.	process_identifier: 2280 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x027b1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 7, 2024, 1:48 p.m.	process_identifier: 2280 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x027b2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 7, 2024, 1:48 p.m.	process_identifier: 2280 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x027b3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 7, 2024, 1:48 p.m.	process_identifier: 2280 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x027b4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 7, 2024, 1:48 p.m.	process_identifier: 2280 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x027b5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 7, 2024, 1:48 p.m.	process_identifier: 2280 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x027b6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 7, 2024, 1:48 p.m.	process_identifier: 2280 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x027b7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 7, 2024, 1:48 p.m.	process_identifier: 2280 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x027b8000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 7, 2024, 1:48 p.m.	process_identifier: 2280 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x027b9000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 7, 2024, 1:48 p.m.	process_identifier: 2280 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x027ba000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 7, 2024, 1:48 p.m.	process_identifier: 2280 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x027bb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 7, 2024, 1:48 p.m.	process_identifier: 2280 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x027bc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 7, 2024, 1:48 p.m.	process_identifier: 2280 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x027bd000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 7, 2024, 1:48 p.m.	process_identifier: 2280 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x027be000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 7, 2024, 1:48 p.m.	process_identifier: 2280 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x027bf000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 7, 2024, 1:48 p.m.	process_identifier: 2280 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x028f0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 7, 2024, 1:48 p.m.	process_identifier: 2280 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x028f1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 7, 2024, 1:48 p.m.	process_identifier: 2280 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x028f2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 7, 2024, 1:48 p.m.	process_identifier: 2280 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x028f3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 7, 2024, 1:48 p.m.	process_identifier: 2280 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x028f4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

A process attempted to delay the analysis task. (1 event)

description

sysvplervcs.exe tried to sleep 133 seconds, actually delayed analysis time by 133 seconds

Creates hidden or system file (1 event)

Time & API	Arguments	Status	Return	Repeated
NtCreateFile Nov. 7, 2024, 1:49 p.m.	create_disposition: 5 (FILE_OVERWRITE_IF) file_handle: 0x000003cc filepath: C:\Users\test22\tbtnds.dat desired_access: 0x40100080 (FILE_READ_ATTRIBUTES\|SYNCHRONIZE\|GENERIC_WRITE) file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN) filepath_r: \??\C:\Users\test22\tbtnds.dat create_options: 96 (FILE_NON_DIRECTORY_FILE\|FILE_SYNCHRONOUS_IO_NONALERT) status_info: 2 (FILE_CREATED) share_access: 0 ()	1	0	0

Creates a shortcut to an executable file (1 event)

file	C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk

Creates a suspicious process (5 events)

cmdline	"C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop DoSvc & sc stop BITS /wait
cmdline	powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
cmdline	"C:\Windows\System32\cmd.exe" /c powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
cmdline	cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop DoSvc & sc stop BITS /wait
cmdline	cmd.exe /c powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"

A process created a hidden window (2 events)

Time & API	Arguments	Status	Return	Repeated
ShellExecuteExW Nov. 7, 2024, 1:48 p.m.	show_type: 0 filepath_r: cmd.exe parameters: /c powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE" filepath: cmd.exe	1	1	0
ShellExecuteExW Nov. 7, 2024, 1:48 p.m.	show_type: 0 filepath_r: cmd.exe parameters: /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop DoSvc & sc stop BITS /wait filepath: cmd.exe	1	1	0

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 event)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW Nov. 7, 2024, 1:48 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Uses Windows utilities for basic Windows functionality (7 events)

cmdline	sc stop UsoSvc
cmdline	sc stop DoSvc
cmdline	"C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop DoSvc & sc stop BITS /wait
cmdline	sc stop WaaSMedicSvc
cmdline	sc stop wuauserv
cmdline	cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop DoSvc & sc stop BITS /wait
cmdline	sc stop BITS /wait

Communicates with host for which no DNS query was performed (15 events)

host	125.74.99.73
host	185.215.113.66
host	213.230.111.168
host	37.255.202.28
host	5.219.163.120
host	5.234.21.11
host	5.53.62.35
host	5.75.53.107
host	78.36.17.105
host	82.151.120.74
host	89.249.62.238
host	90.156.163.31
host	94.252.244.21
host	95.159.149.185
host	95.72.81.43

Attempts to stop active services (1 event)

Time & API	Arguments	Status	Return	Repeated
ControlService Nov. 7, 2024, 1:48 p.m.	service_handle: 0x003fb8a0 service_name: wuauserv control_code: 1		0	0

Installs itself for autorun at Windows startup (1 event)

reg_key

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Settings

reg_value

C:\Windows\sysvplervcs.exe

Modifies security center warnings (7 events)

registry	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesOverride
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiSpywareOverride
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride

Attempts to remove evidence of file being downloaded from the Internet (2 events)

file	C:\Windows\sysvplervcs.exe:Zone.Identifier
file	C:\Users\test22\AppData\Local\Temp\r.exe:Zone.Identifier

Disables Windows Security features (5 events)

description	attempts to disable antivirus notifications	registry	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride
description	attempts to disable antivirus notifications	registry	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify
description	attempts to disable firewall notifications	registry	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify
description	attempts to disable firewall notifications	registry	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride
description	attempts to disable windows update notifications	registry	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify

Stops Windows services (2 events)

service	wuauserv (regkey HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\wuauserv\Start)
service	BITS (regkey HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BITS\Start)

File has been identified by 55 AntiVirus engines on VirusTotal as malicious (50 out of 55 events)

Bkav	W32.AIDetectMalware
Lionic	Trojan.Win32.Phorpiex.7!c
Cynet	Malicious (score: 100)
CAT-QuickHeal	Worm.Generic
Skyhigh	BehavesLike.Win32.Dropper.nh
Cylance	Unsafe
VIPRE	Gen:Heur.Mint.Zard.39
CrowdStrike	win/malicious_confidence_100% (D)
BitDefender	Gen:Heur.Mint.Zard.39
K7GW	Trojan ( 005533551 )
K7AntiVirus	Trojan ( 005533551 )
Arcabit	Trojan.Mint.Zard.39
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	a variant of Win32/Phorpiex.V
APEX	Malicious
Avast	Win32:KadrBot [Trj]
Kaspersky	Trojan-Banker.Win32.ClipBanker.acoy
Alibaba	Worm:Win32/Phorpiex.e1e1c58c
NANO-Antivirus	Trojan.Win32.Phorpiex.ksluau
MicroWorld-eScan	Gen:Heur.Mint.Zard.39
Rising	Worm.Phorpiex!1.DF9C (CLASSIC)
Emsisoft	Gen:Heur.Mint.Zard.39 (B)
F-Secure	Trojan.TR/AD.Hvnc.caaju
DrWeb	Trojan.Siggen29.48364
Zillya	Worm.Phorpiex.Win32.3201
TrendMicro	TROJ_GEN.R002C0DJ524
McAfeeD	Real Protect-LS!930C41BC0C20
Trapmine	malicious.high.ml.score
CTX	exe.trojan.phorpiex
Sophos	Mal/Generic-S
Ikarus	Trojan.Win32.Phorpiex
FireEye	Generic.mg.930c41bc0c20865a
Google	Detected
Avira	TR/AD.Hvnc.caaju
Kingsoft	Win32.HeurC.KVMH012.a
Gridinsoft	Trojan.Win32.Phorpiex.sa
Xcitium	Malware@#3cxekyg5gwern
Microsoft	Trojan:Win32/Phorpiex.RA!MTB
ZoneAlarm	HEUR:Worm.Win32.Generic
GData	Win32.Trojan.Phorpiex.D
AhnLab-V3	Trojan/Win.Generic.C4630408
McAfee	Artemis!930C41BC0C20
DeepInstinct	MALICIOUS
VBA32	BScope.Worm.Propriex
Malwarebytes	Phorpiex.Trojan.Bot.DDS
Panda	Adware/SecurityProtection
TrendMicro-HouseCall	TROJ_GEN.R002C0DJ524
Tencent	Malware.Win32.Gencirc.11c90f67
huorong	TrojanSpy/Stealer.it

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (3 events)

dead_host	185.215.113.66:80
dead_host	95.159.149.185:40500
dead_host	94.252.244.21:40500

r.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All