Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Nov. 11, 2024, 9:42 a.m.	Nov. 11, 2024, 9:48 a.m.

Size	930.0KB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`de04168171981a90f56a126ec055ba19`
SHA256	`c891493c98f76e82e18c0e57e51b96fe8da86b086d67632e2495a793d3298bf2`
CRC32	`3314052E`
ssdeep	`12288:lS6vgPZN3V4smWPc7H3/BPyf13SFyIz8VOHa8ASSMCFFi0mWWaos2Z8kM+:06vqtcDZPyf13WyODSMyc08aoz8kM`
Yara	Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature Is_DotNET_EXE - (no description) IsPE32 - (no description)

ChromeSetup.exe "C:\Users\test22\AppData\Local\Temp\ChromeSetup.exe"
652

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (47 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Nov. 11, 2024, 9:42 a.m.			0	0
IsDebuggerPresent Nov. 11, 2024, 9:42 a.m.			0	0
IsDebuggerPresent Nov. 11, 2024, 9:42 a.m.			0	0
IsDebuggerPresent Nov. 11, 2024, 9:42 a.m.			0	0
IsDebuggerPresent Nov. 11, 2024, 9:42 a.m.			0	0
IsDebuggerPresent Nov. 11, 2024, 9:42 a.m.			0	0
IsDebuggerPresent Nov. 11, 2024, 9:42 a.m.			0	0
IsDebuggerPresent Nov. 11, 2024, 9:42 a.m.			0	0
IsDebuggerPresent Nov. 11, 2024, 9:42 a.m.			0	0
IsDebuggerPresent Nov. 11, 2024, 9:42 a.m.			0	0
IsDebuggerPresent Nov. 11, 2024, 9:42 a.m.			0	0
IsDebuggerPresent Nov. 11, 2024, 9:42 a.m.			0	0
IsDebuggerPresent Nov. 11, 2024, 9:42 a.m.			0	0
IsDebuggerPresent Nov. 11, 2024, 9:42 a.m.			0	0
IsDebuggerPresent Nov. 11, 2024, 9:42 a.m.			0	0
IsDebuggerPresent Nov. 11, 2024, 9:42 a.m.			0	0
IsDebuggerPresent Nov. 11, 2024, 9:42 a.m.			0	0
IsDebuggerPresent Nov. 11, 2024, 9:42 a.m.			0	0
IsDebuggerPresent Nov. 11, 2024, 9:42 a.m.			0	0
IsDebuggerPresent Nov. 11, 2024, 9:42 a.m.			0	0
IsDebuggerPresent Nov. 11, 2024, 9:42 a.m.			0	0
IsDebuggerPresent Nov. 11, 2024, 9:42 a.m.			0	0
IsDebuggerPresent Nov. 11, 2024, 9:42 a.m.			0	0
IsDebuggerPresent Nov. 11, 2024, 9:42 a.m.			0	0
IsDebuggerPresent Nov. 11, 2024, 9:42 a.m.			0	0
IsDebuggerPresent Nov. 11, 2024, 9:42 a.m.			0	0
IsDebuggerPresent Nov. 11, 2024, 9:42 a.m.			0	0
IsDebuggerPresent Nov. 11, 2024, 9:42 a.m.			0	0
IsDebuggerPresent Nov. 11, 2024, 9:42 a.m.			0	0
IsDebuggerPresent Nov. 11, 2024, 9:42 a.m.			0	0
IsDebuggerPresent Nov. 11, 2024, 9:42 a.m.			0	0
IsDebuggerPresent Nov. 11, 2024, 9:42 a.m.			0	0
IsDebuggerPresent Nov. 11, 2024, 9:42 a.m.			0	0
IsDebuggerPresent Nov. 11, 2024, 9:42 a.m.			0	0
IsDebuggerPresent Nov. 11, 2024, 9:42 a.m.			0	0
IsDebuggerPresent Nov. 11, 2024, 9:42 a.m.			0	0
IsDebuggerPresent Nov. 11, 2024, 9:42 a.m.			0	0
IsDebuggerPresent Nov. 11, 2024, 9:42 a.m.			0	0
IsDebuggerPresent Nov. 11, 2024, 9:42 a.m.			0	0
IsDebuggerPresent Nov. 11, 2024, 9:42 a.m.			0	0
IsDebuggerPresent Nov. 11, 2024, 9:42 a.m.			0	0
IsDebuggerPresent Nov. 11, 2024, 9:42 a.m.			0	0
IsDebuggerPresent Nov. 11, 2024, 9:42 a.m.			0	0
IsDebuggerPresent Nov. 11, 2024, 9:42 a.m.			0	0
IsDebuggerPresent Nov. 11, 2024, 9:42 a.m.			0	0
IsDebuggerPresent Nov. 11, 2024, 9:42 a.m.			0	0
IsDebuggerPresent Nov. 11, 2024, 9:42 a.m.			0	0

Uses Windows APIs to generate a cryptographic key (3 events)

Time & API	Arguments	Status	Return
CryptExportKey Nov. 11, 2024, 9:42 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00901178 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 11, 2024, 9:42 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x009011f8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 11, 2024, 9:42 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x009011f8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Nov. 11, 2024, 9:42 a.m.		1	1	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (50 out of 102 events)

Time & API	Arguments	Status
NtProtectVirtualMemory Nov. 11, 2024, 9:42 a.m.	process_identifier: 652 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74272000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 9:42 a.m.	process_identifier: 652 region_size: 327680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00330000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 9:42 a.m.	process_identifier: 652 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00340000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 11, 2024, 9:42 a.m.	process_identifier: 652 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73522000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 11, 2024, 9:42 a.m.	process_identifier: 652 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x741eb000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 11, 2024, 9:42 a.m.	process_identifier: 652 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72ee1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 11, 2024, 9:42 a.m.	process_identifier: 652 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72ee2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 9:42 a.m.	process_identifier: 652 region_size: 851968 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00bc0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 9:42 a.m.	process_identifier: 652 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00c50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 9:42 a.m.	process_identifier: 652 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00332000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 9:42 a.m.	process_identifier: 652 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0038c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 11, 2024, 9:42 a.m.	process_identifier: 652 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7411a000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 9:42 a.m.	process_identifier: 652 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00880000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 9:42 a.m.	process_identifier: 652 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00495000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 9:42 a.m.	process_identifier: 652 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0049b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 9:42 a.m.	process_identifier: 652 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00497000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 9:42 a.m.	process_identifier: 652 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00396000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 9:42 a.m.	process_identifier: 652 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0033a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 9:42 a.m.	process_identifier: 652 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0039a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 9:42 a.m.	process_identifier: 652 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00397000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 11, 2024, 9:42 a.m.	process_identifier: 652 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73d1f000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 9:42 a.m.	process_identifier: 652 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00881000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 11, 2024, 9:42 a.m.	process_identifier: 652 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73cf1000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 9:42 a.m.	process_identifier: 652 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00882000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 9:42 a.m.	process_identifier: 652 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00883000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 9:42 a.m.	process_identifier: 652 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0033c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 9:42 a.m.	process_identifier: 652 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0038d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 9:42 a.m.	process_identifier: 652 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00884000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 9:42 a.m.	process_identifier: 652 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00885000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 9:42 a.m.	process_identifier: 652 region_size: 12288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00886000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 11, 2024, 9:42 a.m.	process_identifier: 652 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73c21000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 9:42 a.m.	process_identifier: 652 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0038a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 11, 2024, 9:42 a.m.	process_identifier: 652 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x70141000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 9:42 a.m.	process_identifier: 652 region_size: 24576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00889000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 9:42 a.m.	process_identifier: 652 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0088f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 9:42 a.m.	process_identifier: 652 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00ee0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 9:42 a.m.	process_identifier: 652 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00ee1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 11, 2024, 9:42 a.m.	process_identifier: 652 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x70041000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 9:42 a.m.	process_identifier: 652 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00ee2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 9:42 a.m.	process_identifier: 652 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00341000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 9:42 a.m.	process_identifier: 652 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00ee3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 11, 2024, 9:42 a.m.	process_identifier: 652 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73c01000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 9:42 a.m.	process_identifier: 652 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00ee4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 9:42 a.m.	process_identifier: 652 region_size: 24576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00ee5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 9:42 a.m.	process_identifier: 652 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00eeb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 9:42 a.m.	process_identifier: 652 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00eec000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 9:42 a.m.	process_identifier: 652 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00eed000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 9:42 a.m.	process_identifier: 652 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00eee000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 9:42 a.m.	process_identifier: 652 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x045d0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 9:42 a.m.	process_identifier: 652 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x045d1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x000e5600', u'virtual_address': u'0x00002000', u'entropy': 6.9063399968179855, u'name': u'.text', u'virtual_size': u'0x000e55f4'}

entropy

6.90633999682

description

A section with a high entropy has been found

entropy

0.987089833244

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 event)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW Nov. 11, 2024, 9:42 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Looks for the Windows Idle Time to determine the uptime (1 event)

Time & API	Arguments	Status	Return	Repeated
NtQuerySystemInformation Nov. 11, 2024, 9:42 a.m.	information_class: 8 (SystemProcessorPerformanceInformation)	1	0	0

A process attempted to delay the analysis task. (1 event)

description

ChromeSetup.exe tried to sleep 5456396 seconds, actually delayed analysis time by 5456396 seconds

Attempts to remove evidence of file being downloaded from the Internet (1 event)

file	C:\Users\test22\AppData\Local\Temp\ChromeSetup.exe\:Zone.Identifier

File has been identified by 51 AntiVirus engines on VirusTotal as malicious (50 out of 51 events)

Bkav	W32.AIDetectMalware.CS
Lionic	Trojan.Win32.AsyncRAT.4!c
Skyhigh	Artemis!Trojan
ALYac	Trojan.GenericKD.74709190
Cylance	Unsafe
VIPRE	Trojan.GenericKD.74709190
CrowdStrike	win/malicious_confidence_100% (W)
BitDefender	Trojan.GenericKD.74709190
K7GW	Trojan ( 005bcfc81 )
K7AntiVirus	Trojan ( 005bcfc81 )
Arcabit	Trojan.Generic.D473F8C6
VirIT	Trojan.Win32.MSIL.FZH
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	a variant of MSIL/Kryptik.AMQB
APEX	Malicious
Avast	Win32:MalwareX-gen [Trj]
Kaspersky	HEUR:Trojan.MSIL.Crypt.gen
Alibaba	Trojan:MSIL/AsyncRAT.695291fa
NANO-Antivirus	Trojan.Win32.Crypt.kthtrz
MicroWorld-eScan	Trojan.GenericKD.74709190
Rising	Malware.Obfus/MSIL@AI.92 (RDM.MSIL2:YS4V4tMGIwslAyQCuiuI2w)
Emsisoft	Trojan.GenericKD.74709190 (B)
F-Secure	Trojan.TR/Kryptik.bmrnl
McAfeeD	ti!C891493C98F7
Trapmine	malicious.moderate.ml.score
CTX	exe.trojan.msil
Sophos	Mal/Generic-S
SentinelOne	Static AI - Malicious PE
FireEye	Generic.mg.de04168171981a90
Google	Detected
Avira	TR/Kryptik.bmrnl
Antiy-AVL	Trojan/Win32.Agent
Kingsoft	MSIL.Trojan.Crypt.gen
Gridinsoft	Trojan.Win32.AsyncRAT.tr
Microsoft	Trojan:MSIL/AsyncRAT.RDAG!MTB
ViRobot	Trojan.Win.Z.Wacatac.952320
GData	Trojan.GenericKD.74709190
Varist	W32/ABTrojan.XHLK-1272
AhnLab-V3	Trojan/Win.Formbook.X2183
McAfee	Artemis!DE0416817198
DeepInstinct	MALICIOUS
Malwarebytes	Trojan.FakeChrome.MSIL.Generic
Ikarus	Trojan-Spy.AgentTesla
Panda	Trj/Chgt.AD
Tencent	Msil.Trojan.Crypt.Czlw
huorong	Trojan/MSIL.Injector.nj
MaxSecure	Trojan.Malware.11716371.susgen
Fortinet	PossibleThreat
AVG	Win32:MalwareX-gen [Trj]

ChromeSetup.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All